The managed Admin middleware returns anonymous immediately when the short-lived access-token cookie has expired and disappeared, even when the rotating HttpOnly refresh cookie is still valid. Long-running Reviewer campaigns therefore fall back to sign-in instead of refreshing.
Acceptance:
- missing access + valid refresh rotates credentials once and reloads
/v1/me;
- invalid/replayed refresh clears both cookies;
- active account/team browser campaign remains authenticated beyond the access-token lifetime;
- tokens remain HttpOnly and redacted.
Discovered through the exact generation 75 Reviewer campaign for Platform #161.
The managed Admin middleware returns anonymous immediately when the short-lived access-token cookie has expired and disappeared, even when the rotating HttpOnly refresh cookie is still valid. Long-running Reviewer campaigns therefore fall back to sign-in instead of refreshing.
Acceptance:
/v1/me;Discovered through the exact generation 75 Reviewer campaign for Platform #161.