🔧 fix(x-bot): persist OAuth 2.0 refresh token in database to survive rotation

Twitter OAuth 2.0 rotates refresh tokens on each use, invalidating the previous
one. Storing the token only in an env var meant the second poll call always
failed. Now the refresh token is read from/written to the xBotState DB table,
with the env var as initial seed fallback.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: bidah

apps/web/app/(app)/api/x-bot/auth/callback/route.ts

@@ -1,6 +1,9 @@
 // app/api/auth/callback/route.ts
 import { NextResponse } from 'next/server';
 import { cookies } from 'next/headers';
+import { db } from '@/lib/db';
+import { xBotState } from '@react-native-vibe-code/database';
+import { eq } from 'drizzle-orm';
 
 export async function GET(request: Request) {
   const url = new URL(request.url);
@@ -62,8 +65,29 @@ export async function GET(request: Request) {
     const data = await response.json();
     const refreshToken = data.refresh_token;
 
-    // Return the refresh token (and optionally other data)
-    return NextResponse.json({ refresh_token: refreshToken });
+    // Store refresh token in database so it survives rotation
+    if (refreshToken) {
+      const existing = await db
+        .select()
+        .from(xBotState)
+        .where(eq(xBotState.id, 'default'))
+        .limit(1);
+
+      if (existing.length === 0) {
+        await db.insert(xBotState).values({
+          id: 'default',
+          refreshToken,
+          updatedAt: new Date(),
+        });
+      } else {
+        await db
+          .update(xBotState)
+          .set({ refreshToken, updatedAt: new Date() })
+          .where(eq(xBotState.id, 'default'));
+      }
+    }
+
+    return NextResponse.json({ refresh_token: refreshToken, saved_to_db: true });
   } catch (error) {
     return NextResponse.json({ error: (error as Error).message }, { status: 500 });
   }

apps/web/lib/x-bot/process-mention.ts

@@ -1,6 +1,6 @@
 import { Client, auth } from 'twitter-api-sdk'
 import { db } from '@/lib/db'
-import { xBotReplies, twitterLinks } from '@react-native-vibe-code/database'
+import { xBotReplies, xBotState, twitterLinks } from '@react-native-vibe-code/database'
 import { eq } from 'drizzle-orm'
 import { classifyTweet, quickAppRequestCheck } from '@/lib/x-bot/classify-tweet'
 import { downloadAndStoreTweetImages } from '@/lib/x-bot/extract-images'
@@ -80,12 +80,48 @@ async function updateTweet(
   await db.update(xBotReplies).set(data).where(eq(xBotReplies.tweetId, tweetId))
 }
 
+// Get the current refresh token — prefer DB (survives rotation), fall back to env var
+async function getStoredRefreshToken(): Promise<string> {
+  const rows = await db
+    .select()
+    .from(xBotState)
+    .where(eq(xBotState.id, 'default'))
+    .limit(1)
+
+  const dbToken = rows[0]?.refreshToken
+  if (dbToken) return dbToken
+
+  const envToken = process.env.TWITTER_REFRESH_TOKEN
+  if (envToken) return envToken
+
+  throw new Error('No refresh token found in database or TWITTER_REFRESH_TOKEN env var')
+}
+
+// Persist the rotated refresh token to the database
+async function saveRefreshToken(token: string): Promise<void> {
+  const existing = await db
+    .select()
+    .from(xBotState)
+    .where(eq(xBotState.id, 'default'))
+    .limit(1)
+
+  if (existing.length === 0) {
+    await db.insert(xBotState).values({
+      id: 'default',
+      refreshToken: token,
+      updatedAt: new Date(),
+    })
+  } else {
+    await db
+      .update(xBotState)
+      .set({ refreshToken: token, updatedAt: new Date() })
+      .where(eq(xBotState.id, 'default'))
+  }
+}
+
 // Get authenticated Twitter client
 export async function getAuthClient(): Promise<Client> {
-  const refreshToken = process.env.TWITTER_REFRESH_TOKEN
-  if (!refreshToken) {
-    throw new Error('TWITTER_REFRESH_TOKEN environment variable is required')
-  }
+  const refreshToken = await getStoredRefreshToken()
 
   const oauth2Client = new auth.OAuth2User({
     client_id: process.env.TWITTER_CLIENT_ID as string,
@@ -97,14 +133,11 @@ export async function getAuthClient(): Promise<Client> {
   oauth2Client.token = { refresh_token: refreshToken }
   await oauth2Client.refreshAccessToken()
 
-  if (
-    oauth2Client.token?.refresh_token &&
-    oauth2Client.token.refresh_token !== refreshToken
-  ) {
-    console.log(
-      'WARNING: Refresh token rotated. Update TWITTER_REFRESH_TOKEN:',
-      oauth2Client.token.refresh_token
-    )
+  // Persist rotated refresh token to survive across invocations
+  const newRefreshToken = oauth2Client.token?.refresh_token
+  if (newRefreshToken && newRefreshToken !== refreshToken) {
+    console.log('[X-Bot] Refresh token rotated — saving to database')
+    await saveRefreshToken(newRefreshToken)
   }
 
   return new Client(oauth2Client)

packages/database/src/schema.ts

@@ -443,6 +443,7 @@ export const xBotReplies = pgTable('x_bot_replies', {
 export const xBotState = pgTable('x_bot_state', {
   id: text('id').primaryKey().default('default'), // Single row with id='default'
   lastTweetId: text('last_tweet_id'), // Last processed tweet ID for since_id
+  refreshToken: text('refresh_token'), // OAuth 2.0 refresh token (rotates on each use)
   updatedAt: timestamp('updated_at').defaultNow(),
 })