A leftover of what I assume was the v1 API behaviour handling manually
multiplied the `expires` values by 1,000, supposedly to make it a
millisecond value. However, AL tokens have been saved as milliseconds
since at least the v2 API implementation in 2018, so this has made
every expiry comparison ludicrously impossible.
Example:
millisecond timestamp:
1788529931115 (2026-09-04T13:52:11.115Z)
*1,000
1788529931115000 (+58646-04-04T21:45:15Z)
So any expiry comparisons would say "yes this token is still totally
valid", causing Mihon to send expired credentials and AL to respond
with a 401.
With these changes (which include some loosely associated clean-up),
we now correctly identify expired credentials before we attempt any AL
requests & actually show a toast with the "Token expired." error
message for the first time in 8 years or so?
I was able to keep the new ALOAuth shape compatible with
already-serialized data, though whenever a user (re-)links AL from now
on, both the `token_type` and `expiresIn` fields won't exist any more.
Since they had no use in the current code anyway, I don't consider
this a problem.
I took the liberty of adding basic instructions to the error message
but these can't be i18n'd properly so I kept it short and sweet.
---
Side effect of expired credentials is Mihon erasing the token in
storage, meaning AL disappears from the tracker sheet until re-linked.
I would say this is acceptable, but we might see panicked users in
support saying "Mihon deleted my AL links" or something.
MajorTanya
21af65b100