Invalid access token UX could maybe be improved

[Newbytee]

Describe the bug

When Tuba isn't opened for a while, the instance I use (https://mastodon.nu) seems to invalidate the access token (I don't know if all instances do this, not familiar with the inner workings of Mastodon). This makes sense for security reasons, but it seems like Tuba doesn't handle this happening very well and treats it as an error when I think better UX would be prompting the user to enter their password again with a message explaining that this is done for security reasons and then logging in again.

Steps To Reproduce

1. Log in to Mastodon.nu via Tuba
2. Don't open Tuba for a long time (I'm not sure how long but in this case it was slightly less than a month since I last used this PC, exactly 4 weeks)
3. Observe that Tuba says "An Error Occurred" along with the error message "The access token is ogiltig" (for some reason the error message mixes English and Swedish)

Logs and/or Screenshots

(dev.geopjr.Tuba:2): Tuba-WARNING **: 23:45:25.438: Streams.vala:86: Error opening stream: The server did not accept the WebSocket handshake.

(dev.geopjr.Tuba:2): Tuba-CRITICAL **: 23:45:25.460: Network.vala:83: Request "https://mastodon.nu/api/v1/announcements" failed: 422 Unprocessable Entity

(dev.geopjr.Tuba:2): Tuba-WARNING **: 23:45:25.460: AccountStore.vala:103: Couldn't activate account @newbyte@mastodon.nu:

(dev.geopjr.Tuba:2): Tuba-WARNING **: 23:45:25.460: AccountStore.vala:104: The access token är ogiltig

(dev.geopjr.Tuba:2): Tuba-CRITICAL **: 23:45:25.461: Network.vala:83: Request "https://mastodon.nu/api/v1/markers?timeline[]=notifications" failed: 401 Unauthorized

(dev.geopjr.Tuba:2): Tuba-WARNING **: 23:45:25.462: Streams.vala:86: Error opening stream: The server did not accept the WebSocket handshake.

(dev.geopjr.Tuba:2): Tuba-WARNING **: 23:45:25.464: Streams.vala:86: Error opening stream: The server did not accept the WebSocket handshake.

(dev.geopjr.Tuba:2): Tuba-WARNING **: 23:45:25.470: Streams.vala:86: Error opening stream: The server did not accept the WebSocket handshake.

(dev.geopjr.Tuba:2): Tuba-WARNING **: 23:45:25.483: Streams.vala:86: Error opening stream: The server did not accept the WebSocket handshake.

(dev.geopjr.Tuba:2): Tuba-CRITICAL **: 23:45:25.545: Network.vala:83: Request "https://mastodon.nu/api/v1/annual_reports/2025" failed: 401 Unauthorized

Instance Backend

Mastodon

Operating System

Fedora

Package

Flatpak

Troubleshooting information

os: GNOME 49 (Flatpak runtime)
prefix: /app
flatpak: true
version: 0.10.3 (production)
gtk: 4.20.3 (4.20.1)
libadwaita: 1.8.2 (1.8.0)
libsoup: 3.6.5 (3.6.5)
libgtksourceview: 5.18.0 (5.18.0)
libspelling: true
Clapper: 0.8.0 (0.8.0)
GStreamer: GStreamer 1.26.8 (1.6.26.0)
GExiv2: 1600 (0.16.0)

Additional Context

Feel free to close this if implementing it isn't feasible, I'm not sure how trivial it is to detect whether this happens on the client side. I am also deliberately keeping my client in this state for now in case it is helpful for providing further debug information.

Somewhat related: #1450

[GeopJr]

I think it's possible to handle this more gracefully - and on that note, maybe also revoke the tokens when an account is manually removed for security reasons - but I also believe this is something you should contact your admin about. Tokens shouldn't be automatically removed, if this is the first time it happened to you in your instance then the admin might have accidentally removed all of them or not migrate them correctly if the server was updated recently.

Tokens are not just for clients, if an instance just periodically revokes all tokens, it could render third-party services unusable, the docs even mention

Tokens will not expire automatically. They will become invalid only when deleted by a user or revoked by the app.
https://docs.joinmastodon.org/api/oauth-tokens/

[Newbytee]

Very interesting. This happened to me before in similar circumstances before, which gave me the impression that it was revoked due to inactivity. I sent an email to the Mastodon.nu admins, will see what happens.

[Newbytee]

I received a reply that Mastodon.nu indeed does not automatically invalidate tokens and that it may have had something to do with a recent database migration that required rotating access tokens, so based on that I'm not sure how to best explain this in a prompt to users.

[GeopJr]

Probably something along the lines of

Credentials Expired
Forget Account | Refresh Credentials

I'll have to check out how Fractal & similar services handle revoked tokens