svc-infra 0.1.595__py3-none-any.whl → 1.1.0__py3-none-any.whl

svc_infra/api/fastapi/auth/mfa/models.py

@@ -1,5 +1,4 @@
 from datetime import datetime
-from typing import Optional
 
 from pydantic import BaseModel
 
@@ -54,9 +53,9 @@ class MFAProof(BaseModel):
 
 
 class DisableAccountIn(BaseModel):
-    reason: Optional[str] = None
-    mfa: Optional[MFAProof] = None
+    reason: str | None = None
+    mfa: MFAProof | None = None
 
 
 class DeleteAccountIn(BaseModel):
-    mfa: Optional[MFAProof] = None
+    mfa: MFAProof | None = None

svc_infra/api/fastapi/auth/mfa/pre_auth.py

@@ -1,18 +1,22 @@
-from datetime import datetime, timezone
+from datetime import UTC, datetime
 
 from svc_infra.api.fastapi.auth.settings import get_auth_settings
+from svc_infra.app.env import require_secret
 
 
 def get_mfa_pre_jwt_writer():
     st = get_auth_settings()
     jwt_block = getattr(st, "jwt", None)
 
-    # Force to plain string
-    secret = (
-        jwt_block.secret.get_secret_value()
-        if jwt_block and getattr(jwt_block, "secret", None)
-        else "svc-dev-secret-change-me"
-    )
+    # Force to plain string - use require_secret to ensure it's set in production
+    if jwt_block and getattr(jwt_block, "secret", None):
+        secret = jwt_block.secret.get_secret_value()
+    else:
+        secret = require_secret(
+            None,
+            "JWT_SECRET (via auth settings jwt.secret for MFA)",
+            dev_default="dev-only-mfa-jwt-secret-not-for-production",
+        )
     secret = str(secret)
 
     lifetime = int(getattr(st, "mfa_pre_token_lifetime_seconds", 300))
@@ -25,9 +29,9 @@ def get_mfa_pre_jwt_writer():
         async def write(self, user):
             from fastapi_users.jwt import generate_jwt
 
-            now = datetime.now(timezone.utc)
+            now = datetime.now(UTC)
             payload = {
-                "sub": str(getattr(user, "id")),
+                "sub": str(user.id),
                 "aud": ["fastapi-users:mfa"],
                 "iat": int(now.timestamp()),
                 "exp": int(now.timestamp()) + self.lifetime,

svc_infra/api/fastapi/auth/mfa/router.py

@@ -1,6 +1,7 @@
 from __future__ import annotations
 
-from datetime import datetime, timezone
+from datetime import UTC, datetime
+from typing import Any, cast
 
 import pyotp
 from fastapi import APIRouter, Body, Depends, HTTPException, Request, status
@@ -79,7 +80,7 @@ def mfa_router(
             raise HTTPException(401, "Invalid token")
 
         # IMPORTANT: rehydrate into *your* session
-        db_user = await session.get(user_model, user.id)
+        db_user = await cast("Any", session).get(user_model, user.id)
         if not db_user:
             raise HTTPException(401, "Invalid token")
 
@@ -126,7 +127,7 @@ def mfa_router(
 
         # RELOAD from DB to avoid stale state
         user = (
-            await session.execute(select(user_model).where(user_model.id == user.id))
+            await session.execute(select(user_model).where(user_model.id == user.id))  # type: ignore[attr-defined]
         ).scalar_one()
 
         if not getattr(user, "mfa_secret", None):
@@ -141,7 +142,7 @@ def mfa_router(
 
         user.mfa_recovery = [_hash(c) for c in codes]
         user.mfa_enabled = True
-        user.mfa_confirmed_at = datetime.now(timezone.utc)
+        user.mfa_confirmed_at = datetime.now(UTC)
         await session.commit()
 
         return RecoveryCodesOut(codes=codes)
@@ -198,7 +199,7 @@ def mfa_router(
             raise HTTPException(401, "Invalid pre-auth token")
 
         # 2) load user
-        user = await session.get(user_model, uid)
+        user = await cast("Any", session).get(user_model, uid)
         if not user:
             raise HTTPException(401, "Invalid pre-auth token")
 
@@ -242,7 +243,7 @@ def mfa_router(
             raise HTTPException(400, "Invalid code")
 
         # NEW: set last_login on successful MFA
-        user.last_login = datetime.now(timezone.utc)
+        user.last_login = datetime.now(UTC)
         await session.commit()
 
         # 4) mint normal JWT and set cookie
@@ -271,7 +272,7 @@ def mfa_router(
             raise HTTPException(401, "Invalid pre-auth token")
 
         # 1b) Load user to get their email
-        user = await session.get(user_model, uid)
+        user = await cast("Any", session).get(user_model, uid)
         if not user or not getattr(user, "email", None):
             # (optionally also check user.mfa_enabled here)
             raise HTTPException(401, "Invalid pre-auth token")
@@ -326,7 +327,7 @@ def mfa_router(
         # Email OTP is always offered in your flow at verify-time
         methods.append("email")
 
-        def _mask(email: str) -> str:
+        def _mask(email: str) -> str | None:
             if not email or "@" not in email:
                 return None
             name, domain = email.split("@", 1)

svc_infra/api/fastapi/auth/mfa/security.py

@@ -1,21 +1,18 @@
-from typing import Optional
-
 from fastapi import Body, Depends, HTTPException, Query
 
 from svc_infra.api.fastapi.auth.security import Identity
 from svc_infra.api.fastapi.db.sql.session import SqlSessionDep
 
-from .models import MFAProof
-from .verify import verify_mfa_for_user
+from .verify import MFAProof, verify_mfa_for_user
 
 
 def RequireMFAIfEnabled(body_field: str = "mfa"):
     async def _dep(
         p: Identity,
         sess: SqlSessionDep,
-        mfa: Optional[MFAProof] = Body(None, embed=True, alias=body_field),
-        mfa_code: Optional[str] = Query(None, alias="mfa_code"),
-        mfa_pre_token: Optional[str] = Query(None, alias="mfa_pre_token"),
+        mfa: MFAProof | None = Body(None, embed=True, alias=body_field),
+        mfa_code: str | None = Query(None, alias="mfa_code"),
+        mfa_pre_token: str | None = Query(None, alias="mfa_pre_token"),
     ):
         proof = mfa or (
             MFAProof(code=mfa_code, pre_token=mfa_pre_token)

svc_infra/api/fastapi/auth/mfa/utils.py

@@ -1,6 +1,7 @@
 import base64
 import hashlib
 import os
+from datetime import UTC
 
 import pyotp
 
@@ -29,7 +30,8 @@ def _gen_recovery_codes(n: int, length: int) -> list[str]:
 def _gen_numeric_code(n: int = 6) -> str:
     import random
 
-    return "".join(str(random.randrange(10)) for _ in range(n))
+    code = "".join(str(random.randrange(10)) for _ in range(n))
+    return code
 
 
 def _hash(s: str) -> str:
@@ -37,6 +39,6 @@ def _hash(s: str) -> str:
 
 
 def _now_utc_ts() -> int:
-    from datetime import datetime, timezone
+    from datetime import datetime
 
-    return int(datetime.now(timezone.utc).timestamp())
+    return int(datetime.now(UTC).timestamp())

svc_infra/api/fastapi/auth/policy.py

@@ -4,7 +4,6 @@ from typing import Any, Protocol
 
 
 class AuthPolicy(Protocol):
-
     async def should_require_mfa(self, user: Any) -> bool:
         pass
 

svc_infra/api/fastapi/auth/providers.py

@@ -1,7 +1,7 @@
-from typing import Any, Dict
+from typing import Any
 
 
-def providers_from_settings(settings: Any) -> Dict[str, Dict[str, Any]]:
+def providers_from_settings(settings: Any) -> dict[str, dict[str, Any]]:
     """
     Returns a registry of providers:
       {
@@ -20,7 +20,7 @@ def providers_from_settings(settings: Any) -> Dict[str, Dict[str, Any]]:
         }
       }
     """
-    reg: Dict[str, Dict[str, Any]] = {}
+    reg: dict[str, dict[str, Any]] = {}
 
     # Google (OIDC)
     if getattr(settings, "google_client_id", None) and getattr(

svc_infra/api/fastapi/auth/routers/apikey_router.py

@@ -1,7 +1,7 @@
 from __future__ import annotations
 
-from datetime import datetime, timedelta, timezone
-from typing import List, Optional
+from datetime import UTC, datetime, timedelta
+from typing import Any, cast
 from uuid import UUID
 
 from fastapi import HTTPException, Query
@@ -23,21 +23,21 @@ from svc_infra.db.sql.apikey import get_apikey_model
 
 class ApiKeyCreateIn(BaseModel):
     name: str
-    user_id: Optional[str] = None
-    scopes: List[str] = Field(default_factory=list)
-    ttl_hours: Optional[int] = 24 * 365  # default 1y
+    user_id: str | None = None
+    scopes: list[str] = Field(default_factory=list)
+    ttl_hours: int | None = 24 * 365  # default 1y
 
 
 class ApiKeyOut(BaseModel):
     id: str
     name: str
-    user_id: Optional[str]
-    key: Optional[str] = None
+    user_id: str | None
+    key: str | None = None
     key_prefix: str
-    scopes: List[str]
+    scopes: list[str]
     active: bool
-    expires_at: Optional[datetime]
-    last_used_at: Optional[datetime]
+    expires_at: datetime | None
+    last_used_at: datetime | None
 
 
 def _to_uuid(val):
@@ -56,17 +56,15 @@ def apikey_router():
         description="Create a new API key. The plaintext key is shown only once, at creation time.",
     )
     async def create_key(sess: SqlSessionDep, payload: ApiKeyCreateIn, p: Identity):
-        caller_id: UUID = getattr(p.user, "id")
+        caller_id: UUID = p.user.id
         owner_id: UUID = _to_uuid(payload.user_id) if payload.user_id else caller_id
 
         if owner_id != caller_id and not getattr(p.user, "is_superuser", False):
             raise HTTPException(403, "forbidden")
 
-        plaintext, prefix, hashed = ApiKey.make_secret()
+        plaintext, prefix, hashed = ApiKey.make_secret()  # type: ignore[attr-defined]
         expires = (
-            (datetime.now(timezone.utc) + timedelta(hours=payload.ttl_hours))
-            if payload.ttl_hours
-            else None
+            (datetime.now(UTC) + timedelta(hours=payload.ttl_hours)) if payload.ttl_hours else None
         )
 
         row = ApiKey(
@@ -98,9 +96,9 @@ def apikey_router():
         description="List API keys. Non-superusers see only their own keys.",
     )
     async def list_keys(sess: SqlSessionDep, p: Identity):
-        q = select(ApiKey)
+        q: Any = select(ApiKey)
         if not getattr(p.user, "is_superuser", False):
-            q = q.where(ApiKey.user_id == p.user.id)
+            q = q.where(ApiKey.user_id == p.user.id)  # type: ignore[attr-defined]
         rows = (await sess.execute(q)).scalars().all()
         return [
             ApiKeyOut(
@@ -124,11 +122,11 @@ def apikey_router():
         description="Revoke an API key",
     )
     async def revoke_key(key_id: str, sess: SqlSessionDep, p: Identity):
-        row = await sess.get(ApiKey, key_id)
+        row = await cast("Any", sess).get(ApiKey, key_id)
         if not row:
             raise HTTPException(404, "not_found")
 
-        caller_id: UUID = getattr(p.user, "id")
+        caller_id: UUID = p.user.id
         if not (getattr(p.user, "is_superuser", False) or row.user_id == caller_id):
             raise HTTPException(403, "forbidden")
 
@@ -148,11 +146,11 @@ def apikey_router():
         p: Identity,
         force: bool = Query(False, description="Allow deleting an active key if True"),
     ):
-        row = await sess.get(ApiKey, key_id)
+        row = await cast("Any", sess).get(ApiKey, key_id)
         if not row:
             return  # 204
 
-        caller_id: UUID = getattr(p.user, "id")
+        caller_id: UUID = p.user.id
         if not (getattr(p.user, "is_superuser", False) or row.user_id == caller_id):
             raise HTTPException(403, "forbidden")
 

svc_infra/api/fastapi/auth/routers/oauth_router.py

@@ -3,16 +3,16 @@ from __future__ import annotations
 import base64
 import hashlib
 import secrets
-from datetime import datetime, timedelta, timezone
-from typing import Any, Dict, Literal, cast
+from datetime import UTC, datetime, timedelta
+from typing import Any, Literal, cast
 from urllib.parse import urlencode, urlparse
 
 import jwt
 from authlib.integrations.base_client.errors import OAuthError
 from authlib.integrations.starlette_client import OAuth
-from fastapi import APIRouter, HTTPException, Request
+from fastapi import APIRouter, Depends, HTTPException, Request
 from fastapi.responses import RedirectResponse
-from fastapi_users.authentication import AuthenticationBackend
+from fastapi_users.authentication import AuthenticationBackend, Strategy
 from fastapi_users.password import PasswordHelper
 from sqlalchemy import select
 from starlette import status
@@ -20,7 +20,10 @@ from starlette.responses import Response
 
 from svc_infra.api.fastapi.auth.mfa.pre_auth import get_mfa_pre_jwt_writer
 from svc_infra.api.fastapi.auth.policy import AuthPolicy, DefaultAuthPolicy
-from svc_infra.api.fastapi.auth.settings import get_auth_settings, parse_redirect_allow_hosts
+from svc_infra.api.fastapi.auth.settings import (
+    get_auth_settings,
+    parse_redirect_allow_hosts,
+)
 from svc_infra.api.fastapi.db.sql.session import SqlSessionDep
 from svc_infra.api.fastapi.dual.public import public_router
 from svc_infra.api.fastapi.paths.auth import (
@@ -28,6 +31,7 @@ from svc_infra.api.fastapi.paths.auth import (
     OAUTH_LOGIN_PATH,
     OAUTH_REFRESH_PATH,
 )
+from svc_infra.app.env import require_secret
 from svc_infra.security.models import RefreshToken
 from svc_infra.security.session import issue_session_and_refresh, rotate_session_refresh
 
@@ -45,9 +49,12 @@ def _validate_redirect(url: str, allow_hosts: list[str], *, require_https: bool)
     p = urlparse(url)
     if not p.netloc:
         return
-    host_port = p.hostname.lower() + (f":{p.port}" if p.port else "")
+    if not p.hostname:
+        raise HTTPException(400, "redirect_not_allowed")
+    hostname = p.hostname
+    host_port = hostname.lower() + (f":{p.port}" if p.port else "")
     allowed = {h.lower() for h in allow_hosts}
-    if host_port not in allowed and p.hostname.lower() not in allowed:
+    if host_port not in allowed and hostname.lower() not in allowed:
         raise HTTPException(400, "redirect_not_allowed")
     if require_https and p.scheme != "https":
         raise HTTPException(400, "https_required")
@@ -62,13 +69,13 @@ def _coerce_expires_at(token: dict | None) -> datetime | None:
             v = float(token["expires_at"])
             if v > 1e12:  # ms -> s
                 v /= 1000.0
-            return datetime.fromtimestamp(v, tz=timezone.utc)
+            return datetime.fromtimestamp(v, tz=UTC)
         except Exception:
             pass
     if token.get("expires_in") is not None:
         try:
             secs = int(token["expires_in"])
-            return datetime.now(timezone.utc) + timedelta(seconds=secs)
+            return datetime.now(UTC) + timedelta(seconds=secs)
         except Exception:
             pass
     return None
@@ -88,7 +95,7 @@ def _cookie_domain(st):
     return d or None
 
 
-def _register_oauth_providers(oauth: OAuth, providers: Dict[str, Dict[str, Any]]) -> None:
+def _register_oauth_providers(oauth: OAuth, providers: dict[str, dict[str, Any]]) -> None:
     """Register all OAuth providers with the OAuth client."""
     for name, cfg in providers.items():
         kind = cfg.get("kind")
@@ -263,14 +270,17 @@ async def _find_or_create_user(session, user_model, email: str, full_name: str |
         is_verified=True,
     )
 
-    # Set hashed password for OAuth users
+    # Set hashed password for OAuth users - use cryptographically random password
+    # OAuth users authenticate via provider, not password, so this is never used
+    # but must be unpredictable to prevent password-based login attacks
+    random_password = secrets.token_urlsafe(32)
     if hasattr(user, "hashed_password"):
-        user.hashed_password = PasswordHelper().hash("!oauth!")
+        user.hashed_password = PasswordHelper().hash(random_password)
     elif hasattr(user, "password_hash"):
-        user.password_hash = PasswordHelper().hash("!oauth!")
+        user.password_hash = PasswordHelper().hash(random_password)
 
     if full_name and hasattr(user, "full_name"):
-        setattr(user, "full_name", full_name)
+        user.full_name = full_name
 
     session.add(user)
     await session.flush()  # ensure user.id exists
@@ -335,11 +345,11 @@ async def _update_provider_account(
     expires_at = _coerce_expires_at(tok)
 
     if not link:
-        values = dict(
-            user_id=user.id,
-            provider=provider,
-            provider_account_id=provider_user_id,
-        )
+        values = {
+            "user_id": user.id,
+            "provider": provider,
+            "provider_account_id": provider_user_id,
+        }
         if hasattr(provider_account_model, "access_token"):
             values["access_token"] = access_token
         if hasattr(provider_account_model, "refresh_token"):
@@ -373,9 +383,8 @@ async def _update_provider_account(
 def _determine_final_redirect_url(request: Request, provider: str, post_login_redirect: str) -> str:
     """Determine the final redirect URL after successful authentication."""
     st = get_auth_settings()
-    redirect_url = str(
-        getattr(st, "post_login_redirect", post_login_redirect) or post_login_redirect
-    )
+    # Prioritize the parameter passed to the router over settings
+    redirect_url = str(post_login_redirect or getattr(st, "post_login_redirect", "/"))
     allow_hosts = parse_redirect_allow_hosts(getattr(st, "redirect_allow_hosts_raw", None))
     require_https = bool(getattr(st, "session_cookie_secure", False))
 
@@ -437,7 +446,13 @@ async def _process_user_authentication(
 
     # Ensure provider link exists
     await _update_provider_account(
-        session, provider_account_model, user, provider, provider_user_id, token, raw_claims
+        session,
+        provider_account_model,
+        user,
+        provider,
+        provider_user_id,
+        token,
+        raw_claims,
     )
 
     return user
@@ -446,11 +461,16 @@ async def _process_user_authentication(
 async def _validate_and_decode_jwt_token(raw_token: str) -> str:
     """Validate and decode JWT token to extract user ID."""
     st = get_auth_settings()
-    secret = (
-        st.jwt.secret.get_secret_value()
-        if getattr(st, "jwt", None) and getattr(st.jwt, "secret", None)
-        else "dev-change-me"
-    )
+    jwt_settings = getattr(st, "jwt", None)
+    jwt_secret = getattr(jwt_settings, "secret", None) if jwt_settings is not None else None
+    if jwt_secret:
+        secret = jwt_secret.get_secret_value()
+    else:
+        secret = require_secret(
+            None,
+            "JWT_SECRET (via auth settings jwt.secret for token validation)",
+            dev_default="dev-only-jwt-validation-secret-not-for-production",
+        )
 
     try:
         payload = jwt.decode(
@@ -462,24 +482,25 @@ async def _validate_and_decode_jwt_token(raw_token: str) -> str:
         user_id = payload.get("sub")
         if not user_id:
             raise HTTPException(401, "invalid_token")
-        return user_id
+        return cast("str", user_id)
     except Exception:
         raise HTTPException(401, "invalid_token")
 
 
 async def _set_cookie_on_response(
     resp: Response,
-    auth_backend: AuthenticationBackend,
+    strategy: Strategy[Any, Any],
     user: Any,
     *,
     refresh_raw: str,
 ) -> None:
     """Set authentication (JWT) and refresh cookies on response."""
     st = get_auth_settings()
-    strategy = auth_backend.get_strategy()
     jwt_token = await strategy.write_token(user)
 
-    same_site_lit = cast(Literal["lax", "strict", "none"], str(st.session_cookie_samesite).lower())
+    same_site_lit = cast(
+        "Literal['lax', 'strict', 'none']", str(st.session_cookie_samesite).lower()
+    )
     if same_site_lit == "none" and not bool(st.session_cookie_secure):
         raise HTTPException(500, "session_cookie_samesite=None requires session_cookie_secure=True")
 
@@ -529,7 +550,7 @@ async def _handle_mfa_redirect(
 def oauth_router_with_backend(
     user_model: type,
     auth_backend: AuthenticationBackend,
-    providers: Dict[str, Dict[str, Any]],
+    providers: dict[str, dict[str, Any]],
     post_login_redirect: str = "/",
     provider_account_model: type | None = None,
     auth_policy: AuthPolicy | None = None,
@@ -547,7 +568,7 @@ def oauth_router_with_backend(
 def _create_oauth_router(
     user_model: type,
     auth_backend: AuthenticationBackend,
-    providers: Dict[str, Dict[str, Any]],
+    providers: dict[str, dict[str, Any]],
     post_login_redirect: str = "/",
     provider_account_model: type | None = None,
     auth_policy: AuthPolicy | None = None,
@@ -600,7 +621,12 @@ def _create_oauth_router(
         responses={302: {"description": "Redirect to app (or MFA redirect)."}},
         description="OAuth callback endpoint.",
     )
-    async def oauth_callback(request: Request, provider: str, session: SqlSessionDep):
+    async def oauth_callback(
+        request: Request,
+        provider: str,
+        session: SqlSessionDep,
+        strategy: Strategy[Any, Any] = Depends(auth_backend.get_strategy),
+    ):
         """Handle OAuth callback and complete authentication."""
         # Handle provider-side errors up front
         if err := request.query_params.get("error"):
@@ -621,14 +647,20 @@ def _create_oauth_router(
 
         # Extract user information from provider
         cfg = providers.get(provider, {})
-        email, full_name, provider_user_id, email_verified, raw_claims = (
-            await _extract_user_info_from_provider(request, client, token, provider, cfg, nonce)
-        )
+        (
+            email,
+            full_name,
+            provider_user_id,
+            email_verified,
+            raw_claims,
+        ) = await _extract_user_info_from_provider(request, client, token, provider, cfg, nonce)
 
         if email_verified is False:
             raise HTTPException(400, "unverified_email")
         if not email:
             raise HTTPException(400, "No email from provider")
+        if not provider_user_id:
+            raise HTTPException(400, "No user ID from provider")
 
         # Process user authentication
         user = await _process_user_authentication(
@@ -657,7 +689,7 @@ def _create_oauth_router(
             return mfa_response
 
         # NEW: set last_login only when we are actually logging in now
-        user.last_login = datetime.now(timezone.utc)
+        user.last_login = datetime.now(UTC)
         await session.commit()
 
         # Create session + initial refresh token
@@ -669,9 +701,24 @@ def _create_oauth_router(
             ip_hash=None,
         )
 
-        # Create response with auth + refresh cookies
+        # Generate JWT token for the response
+        jwt_token = await strategy.write_token(user)
+
+        # If redirecting to a different origin, append token as URL fragment for frontend to extract
+        # This handles cross-port scenarios like localhost:8000 -> localhost:3000
+        parsed_redirect = urlparse(redirect_url)
+        request_origin = f"{request.url.scheme}://{request.url.netloc}"
+        redirect_origin = f"{parsed_redirect.scheme}://{parsed_redirect.netloc}"
+
+        if redirect_origin and redirect_origin != request_origin:
+            # Cross-origin redirect: append token as URL fragment
+            # Fragment is not sent to server, only accessible to client-side JS
+            separator = "#" if not parsed_redirect.fragment else "&"
+            redirect_url = f"{redirect_url}{separator}access_token={jwt_token}"
+
+        # Create response with auth + refresh cookies (for same-origin requests)
         resp = RedirectResponse(url=redirect_url, status_code=status.HTTP_302_FOUND)
-        await _set_cookie_on_response(resp, auth_backend, user, refresh_raw=raw_refresh)
+        await _set_cookie_on_response(resp, strategy, user, refresh_raw=raw_refresh)
 
         # Clean up session state
         _clean_oauth_session_state(request, provider)
@@ -691,7 +738,11 @@ def _create_oauth_router(
         responses={204: {"description": "Cookie refreshed"}},
         description="Refresh authentication token.",
     )
-    async def refresh(request: Request, session: SqlSessionDep):
+    async def refresh(
+        request: Request,
+        session: SqlSessionDep,
+        strategy: Strategy[Any, Any] = Depends(auth_backend.get_strategy),
+    ):
         """Refresh authentication token."""
         st = get_auth_settings()
 
@@ -705,7 +756,7 @@ def _create_oauth_router(
         user_id = await _validate_and_decode_jwt_token(raw_auth)
 
         # Load user
-        user = await session.get(user_model, user_id)
+        user = await cast("Any", session).get(user_model, user_id)
         if not user:
             raise HTTPException(401, "invalid_token")
 
@@ -733,22 +784,17 @@ def _create_oauth_router(
         if (
             not found
             or found.revoked_at
-            or (found.expires_at and found.expires_at < datetime.now(timezone.utc))
+            or (found.expires_at and found.expires_at < datetime.now(UTC))
         ):
             raise HTTPException(401, "invalid_refresh_token")
 
         # Rotate refresh token
-        try:
-            new_raw, _new_rt = await rotate_session_refresh(session, current=found)
-        except ValueError:
-            # Token expired between validation and rotation; treat as invalid
-            raise HTTPException(401, "invalid_refresh_token") from None
+        new_raw, _new_rt = await rotate_session_refresh(session, current=found)
 
         # Write response (204) with new cookies
         resp = Response(status_code=status.HTTP_204_NO_CONTENT)
-        await _set_cookie_on_response(resp, auth_backend, user, refresh_raw=new_raw)
-
-        # Dead code removed: MFA branch handled earlier in login flow, refresh returns 204 above.
+        await _set_cookie_on_response(resp, strategy, user, refresh_raw=new_raw)
+        # Policy hook: trigger after successful rotation; suppress hook errors
         if hasattr(policy, "on_token_refresh"):
             try:
                 await policy.on_token_refresh(user)