GODT-2131: if refresh token is revoked, user gets signed out.

internal/bridge/user.go

@@ -19,6 +19,7 @@ package bridge
 
 import (
 	"context"
+	"errors"
 	"fmt"
 	"runtime"
 
@@ -358,6 +359,12 @@ func (bridge *Bridge) loadUsers(ctx context.Context) error {
 func (bridge *Bridge) loadUser(ctx context.Context, user *vault.User) error {
 	client, auth, err := bridge.api.NewClientWithRefresh(ctx, user.AuthUID(), user.AuthRef())
 	if err != nil {
+		if apiErr := new(liteapi.Error); errors.As(err, &apiErr) && (apiErr.Code == liteapi.AuthRefreshTokenInvalid) {
+			// The session cannot be refreshed, we sign out the user by clearing his auth secrets.
+			if err := user.Clear(); err != nil {
+				logrus.WithError(err).Warn("Failed to clear user secrets")
+			}
+		}
 		return fmt.Errorf("failed to create API client: %w", err)
 	}