Clear the session cookie when a token refresh fails so sign-in doesn't loop

[juancobo]

When a GitHub token refresh fails or the refresh token has expired, maybeRefreshToken redirects to /signin?reason=session_expired. The auth middleware was letting that redirect through without clearing the session cookie. Because the cookie stayed valid, the sign-in loader bounced the user straight back to /dashboard, which failed the refresh again — producing an ERR_TOO_MANY_REDIRECTS loop for any signed-in user whose refresh token expired.

The middleware now re-throws that redirect with destroySession, turning an expired session into a clean logout — consistent with the middleware's other two exits. The user lands on the sign-in page and can re-authenticate.

Adds a regression test covering both the cookie-clearing redirect and that non-redirect refresh errors still propagate.

[Copilot]

Pull request overview

This PR fixes an auth redirect loop that occurred when a GitHub token refresh fails (e.g., expired refresh token) by ensuring the auth middleware clears the session cookie before re-throwing the /signin?reason=session_expired redirect. This turns the expired session into a clean logout, preventing ERR_TOO_MANY_REDIRECTS.

Changes:

• Update authMiddleware to catch token-refresh redirects and re-throw them with destroySession applied via Set-Cookie.
• Add a regression test to verify the session cookie is cleared on session_expired redirects and that non-redirect refresh errors still propagate.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
app/middleware/auth.server.ts	Wraps maybeRefreshToken to re-throw redirect responses with a destroyed session cookie to avoid redirect loops.
tests/auth-middleware-session-expired.test.ts	Adds regression coverage for cookie-clearing behavior on refresh redirect and error propagation on non-redirect failures.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.