From 8030cae47498ec3e135bbc003d192fe11f0d3c50 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Danny=20B=C3=A9dard?= <dbedard@devolutions.net>
Date: Mon, 28 Sep 2026 14:37:42 -0400
Subject: [PATCH 1/2] [DEVOPS-4768] fix(auth): do not send stale tokenId on
 login

---
 authentication.go |  4 ++--
 dvls.go           |  8 ++++----
 dvls_unit_test.go | 32 ++++++++++++++++++++++++++++++++
 3 files changed, 38 insertions(+), 6 deletions(-)

diff --git a/authentication.go b/authentication.go
index a4cf5a3..91ee8ab 100644
--- a/authentication.go
+++ b/authentication.go
@@ -122,7 +122,7 @@ func (c *Client) loginWithContext(ctx context.Context) error {
 		return fmt.Errorf("failed to build login url: %w", err)
 	}
 
-	resp, err := c.rawRequestWithContext(ctx, reqUrl, http.MethodPost, loginContentType, bytes.NewBufferString(loginBody))
+	resp, err := c.rawRequestWithContext(ctx, reqUrl, http.MethodPost, loginContentType, "", bytes.NewBufferString(loginBody))
 	if err != nil {
 		return fmt.Errorf("error while submitting login request: %w", err)
 	}
@@ -148,7 +148,7 @@ func (c *Client) isLoggedWithContext(ctx context.Context) (bool, error) {
 		return false, fmt.Errorf("failed to build isLogged url: %w", err)
 	}
 
-	resp, err := c.rawRequestWithContext(ctx, reqUrl, http.MethodGet, defaultContentType, nil)
+	resp, err := c.rawRequestWithContext(ctx, reqUrl, http.MethodGet, defaultContentType, c.credential.token, nil)
 	if err != nil && !strings.Contains(err.Error(), "json: cannot unmarshal bool into Go value") {
 		return false, fmt.Errorf("error while submitting isLogged request: %w", err)
 	}
diff --git a/dvls.go b/dvls.go
index 2d8f968..1e7dc4a 100644
--- a/dvls.go
+++ b/dvls.go
@@ -76,14 +76,14 @@ func (c *Client) RequestWithContext(ctx context.Context, url string, reqMethod s
 		opts = options[0]
 	}
 
-	resp, err := c.rawRequestWithContext(ctx, url, reqMethod, defaultContentType, reqBody, opts)
+	resp, err := c.rawRequestWithContext(ctx, url, reqMethod, defaultContentType, c.credential.token, reqBody, opts)
 	if err != nil {
 		return Response{}, err
 	}
 	return resp, nil
 }
 
-func (c *Client) rawRequestWithContext(ctx context.Context, url string, reqMethod string, contentType string, reqBody io.Reader, options ...RequestOptions) (Response, error) {
+func (c *Client) rawRequestWithContext(ctx context.Context, url string, reqMethod string, contentType string, token string, reqBody io.Reader, options ...RequestOptions) (Response, error) {
 	var opts RequestOptions
 	if len(options) > 0 {
 		opts = options[0]
@@ -97,8 +97,8 @@ func (c *Client) rawRequestWithContext(ctx context.Context, url string, reqMetho
 	req.Header.Add("Content-Type", contentType)
 	if c.credential.useApiKey() {
 		req.Header.Add("Authorization", "Bearer "+c.credential.apiKey)
-	} else {
-		req.Header.Add("tokenId", c.credential.token)
+	} else if token != "" {
+		req.Header.Add("tokenId", token)
 	}
 
 	resp, err := c.client.Do(req)
diff --git a/dvls_unit_test.go b/dvls_unit_test.go
index 5f84f80..b47af5d 100644
--- a/dvls_unit_test.go
+++ b/dvls_unit_test.go
@@ -30,6 +30,38 @@ func TestNewClient_Login(t *testing.T) {
 	assert.NotNil(t, client.Vaults)
 }
 
+func TestRequest_ReloginAfterTokenExpiry(t *testing.T) {
+	mux := http.NewServeMux()
+	mux.HandleFunc("/api/v1/login", func(w http.ResponseWriter, r *http.Request) {
+		assert.Empty(t, r.Header.Get("tokenId"), "login must not send the expired token")
+		w.Write([]byte(`{"tokenId":"new-token"}`))
+	})
+	mux.HandleFunc("/api/is-logged", func(w http.ResponseWriter, r *http.Request) {
+		if r.Header.Get("tokenId") == "new-token" {
+			w.Write([]byte("true"))
+			return
+		}
+		w.Write([]byte("false"))
+	})
+	mux.HandleFunc("/api/v1/vault", func(w http.ResponseWriter, r *http.Request) {
+		assert.Equal(t, "new-token", r.Header.Get("tokenId"))
+		w.Write([]byte(`{"result":1}`))
+	})
+
+	server := httptest.NewServer(mux)
+	defer server.Close()
+
+	client := &Client{
+		baseUri:    server.URL,
+		client:     server.Client(),
+		credential: credentials{appKey: "test-key", appSecret: "test-secret", token: "expired-token"},
+	}
+
+	_, err := client.Request(server.URL+"/api/v1/vault", http.MethodGet, nil)
+	require.NoError(t, err)
+	assert.Equal(t, "new-token", client.credential.token)
+}
+
 func TestNewClientWithApiKey(t *testing.T) {
 	mux := http.NewServeMux()
 	loginCalled := false

From f74f2255beebbba9f3960453b31a0646c211efa4 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Danny=20B=C3=A9dard?= <dbedard@devolutions.net>
Date: Mon, 28 Sep 2026 14:52:14 -0400
Subject: [PATCH 2/2] [DEVOPS-4768] build: bump version to 0.21.1

---
 VERSION | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/VERSION b/VERSION
index 8854156..a67ceba 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-0.21.0
+0.21.1