Dashboard › cli › Distillation
09d02efd-1354-4dac-bd90-e39bb22f9b46["lore_tm_v1_rhIRe2IxIwL9bNbK5F2POexP7N0Ni7mIou2nEUNhpJA","lore_tm_v1_Gwode9pS1hPF_wCR0SPwJydMz6TzCaaIu5ZnOAaDbwk"]
auth table (id = 1), with AuthRow fields token, refresh_token, expires_at, issued_at, updated_at, and host; host is nullable for rows written before schema v16.REFRESH_THRESHOLD = 0.1, meaning refresh occurs when less than 10% of token lifetime remains, and DEFAULT_TOKEN_LIFETIME_MS = 3600 * 1000 (1 hour) for tokens without issuedAt.migrateNullHost(row) lazily migrates pre-schema-v16 rows with host = NULL using the boot-time environment snapshot from getEnvTokenHost(), captured before the .sentryclirc shim can mutate the environment; reading current env could incorrectly default self-hosted users to SaaS or use a poisoned rc URL.migrateNullHost(row) applies normalizeOrigin(bootHost), falls back to DEFAULT_SENTRY_URL, writes via withDbSpan("migrateAuthHost", ...) and UPDATE auth SET host = ? WHERE id = 1, treats write failure as non-fatal and retries on next access, updates row.host, and returns a migrated host that is never NULL.sentry auth logout && sentry auth login.getRawEnvToken() always returns the environment token if set, regardless of whether stored OAuth credentials normally take priority; it trims values, prefers SENTRY_AUTH_TOKEN over SENTRY_TOKEN, treats empty/whitespace-only values as unset, and supports HTTP-layer detection of whether an env token was provided plus the per-endpoint permission cache.getEnvToken() is intentionally pure with no database access; stored-OAuth-over-env precedence is implemented in getAuthToken and getAuthConfig, which check the DB first unless SENTRY_FORCE_ENV_TOKEN is set.options.host for login/tests; 2. existing row host, preserving original scope during refresh; 3. getConfiguredSentryUrl(); 4. DEFAULT_SENTRY_URL. The result is always normalized to scheme+host[+port] through normalizeOrigin, with DEFAULT_SENTRY_URL as fallback.getIdentityFingerprint() provides an opaque fingerprint of the active bearer identity to namespace response-cache keys so entries never leak across accounts.getAuthConfig: forced env token > stored OAuth, preferring refresh_token for stability across access-token rotation and falling through expired access-only rows > env token > anonymous.setAuthToken and clearAuth; stable refresh tokens ordinarily retain the same fingerprint, while server-rotated refresh tokens change it and naturally repopulate the cache under the new identity. Tests that mutate auth state call resetIdentityFingerprintCache.RefreshTokenOptions with optional force?: boolean, documented as bypassing the threshold check to always refresh; implementation defaults with const { force = false } = options.host = NULL, adds an unforced forged environment claim, invokes a control-silo request, and asserts the stored bearer token is sent only to the safely migrated host. The expected pre-fix failure is that the request targets the inactive claim host.