Repository navigation
Return Error from consumer authenticateJwt when the API rejects the JWT - #156
Merged
Merged
Conversation
When local JWT validation failed and the remote /sessions/authenticate call returned an error, consumer authenticateJwt wrapped that error as StytchResult.Success(JWTErrorResponse) or StytchResult.Success(JWTNullResponse). Callers branching on Success vs Error would treat a rejected JWT as authenticated. Pass the StytchResult.Error through unchanged, matching the B2B implementation. JWTErrorResponse and JWTNullResponse are no longer returned and are deprecated.
logan-twilio
marked this pull request as ready for review
October 19, 2026 17:58
logan-twilio
requested review from
evan-twilio
and removed request for
a team
October 19, 2026 17:58
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
When local validation fails, consumer
authenticateJwtfalls back to/v1/sessions/authenticate. If that call returned an error, the method wrapped it asStytchResult.Success:StytchException.ResponsebecameSuccess(JWTErrorResponse(...))Success(JWTNullResponse)So callers branching on
SuccessvsErrorwould treat a rejected JWT as authenticated. This now returns theStytchResult.Errorunchanged, which is what the B2BauthenticateJwtalready does.Changes
consumer/api/sessions/Sessions.kt—is StytchResult.Error -> netResult; dropped the now-unused importscommon/JWTResponse.kt— deprecatedJWTErrorResponseandJWTNullResponse, since nothing returns them anymore. Kept rather than removed so existing code still compiles.consumer/api/sessions/SessionsTest.kt—authenticateJwttests against a MockWebServer-backedHttpClient: a 401 returnsError(StytchException.Response), and a 500 with an unparseable body returnsError(StytchException.Critical). Both fail onmain.Behavior change
Callers that inspected
Success.value is JWTErrorResponse/JWTNullResponsewill now getStytchResult.Errorinstead, and those branches become dead code (flagged by the deprecation warning).Testing
./gradlew :stytch:testpasses (JDK 17).Open question
This method sits in a
MANUAL(authenticateJWT_impl)block, and the interface hasADDIMPORThints for the deprecated types. Does sdk-codegen also hold this manual block, or need the ADDIMPORT hints updated, so the next regeneration doesn't revert it?