[Bug]: AutoRefresh running even if the app is in the BG

[jozefv-git]

General Info

• I checked for similar bug report
• I am using the latest version
• I checked the troubleshooting page for similar problems

Version(s)

v3.0

Kotlin Target(s) and their respective versions

Android 15,16

What happened? (include your code)

Current behavior
If the user session expired while the app is offline, the refresh token flow keeps going as long as the app is alive. If the app is opened multiple times from the BG (while still offline), multiple concurrent "refresh" flows will launch.
Expected behavior

• If the session is expired and the application (device) has no internet connection, don't try to refresh the session token as we cannot reach the cloud anyway. Doesn't matter if the app is in the foreground or BG.
• If the session expired while app in the BG and online - the flow may continue to run in the BG (as long as the app is alive) until successful refresh.
  Possible cause
  Auto-refresh is not cancelled when the app is offline or in the BG.

Steps To Reproduce (optional)

Steps to reproduce

1. Initialize supabase client supabase-kt v3.0 together with the auth plugin and enabled client debug logs (defaultLogLevel = LogLevel.DEBUG)
2. Make sure your IDE logs are enabled.
3. Start application with the running supabase client.
4. Login into your app.
5. Put device offline.
6. Wait 1h (or your session expiration time) or set your device time into "future" accordingly.
7. Multiple supabase logs should be visible and periodically updated ex. Supabase-Auth trying to re-load session from storage...
8. Put application into BG - you should be able to still see periodical log refreshs.
9. Put application back into FG - the concurrent "refresh" flow should appear.
10. With every BG/FG app switch - another concurrent flow should starts.
    Replicated and tested on

• Samsung Galaxy S22 Ultra Android 15 (Real device).
• Pixel Android 16 (Emulator).

Relevant log output (optional)

// App starts
2025-09-28 12:57:34.137 12327-12327 Supabase-Core SupabaseClient created! Please report any bugs you find.
2025-09-28 12:57:34.553 12327-12327 Supabase-Auth Initializing Auth plugin...
2025-09-28 12:57:34.554 12327-12527 Supabase-Auth Loading session from storage...
2025-09-28 12:57:34.554 12327-12327 Supabase-Auth nitialized Auth plugin
2025-09-28 12:57:34.554 12327-12527 Supabase-Auth No session found in storage.
2025-09-28 12:57:34.554 12327-12527 Supabase-Auth Setting session status to NotAuthenticated(isSignOut=false)
2025-09-28 12:57:34.801 12327-12327 Supabase-Auth Trying to re-load session from storage...
2025-09-28 12:57:34.801 12327-12527 Supabase-Auth No session found, not starting auto refresh
// User login
2025-09-28 13:02:59.634 12327-12327 Supabase-Auth Importing session UserSession(accessToken=eyJ...)
2025-09-28 13:02:59.642 12327-12327 Supabase-Auth Session saved to storage (auto refresh enabled)
2025-09-28 13:02:59.643 12327-12327 Supabase-Auth Setting session status to Authenticated(…)
2025-09-28 13:02:59.643 12327-12327 Supabase-Auth Session imported successfully. Starting auto refresh...
2025-09-28 13:02:59.644 12327-12327 Supabase-Auth Auto refresh started.
2025-09-28 13:02:59.644 12327-12527 Supabase-Auth  Refreshing session in 47m 59.988586s.
// Internet connection off
// App going to the BG
2025-09-28 13:07:08.166 12327-12327 Supabase-Auth Cancelling auto refresh because app is switching to the background
2025-09-28 13:07:08.167 12327-12527 Supabase-Auth Stopping auto refresh for current session
2025-09-28 13:07:08.168 12327-12527 Supabase-Auth Setting session status to Initializing
// Time changed +1day
// App coming from the BG
2025-09-29 13:09:03.775 12327-12327 Supabase-Auth trying to re-load session from storage...
2025-09-29 13:09:03.804 12327-12526 Supabase-Auth Importing session UserSession(accessToken=eyJ…)
2025-09-29 13:09:03.804 12327-12526 Supabase-Auth Session is under the threshold date. Refreshing session...
2025-09-29 13:09:03.804 12327-12526 Supabase-Auth Session expired. Refreshing session...
2025-09-29 13:09:03.805 12327-12526 Supabase-Auth Refreshing session
2025-09-29 13:09:03.844 12327-12527 Supabase-Core POST request to endpoint /auth/v1/token failed with exception Unable to resolve host..
2025-09-29 13:09:03.844 12327-12527 Supabase-Auth Couldn't reach Supabase. Either the address doesn't exist or the network might not be on. Retrying in 10s...
2025-09-29 13:09:03.846 12327-12527 Supabase-Auth Session expired while trying to refresh the session. Updating status...
2025-09-29 13:09:03.846 12327-12527 Supabase-Auth Setting session status to RefreshFailure(cause=NetworkError..)
2025-09-29 13:09:03.846 12327-12527 Supabase-Auth Emitting event RefreshFailure(cause=NetworkError(…)
// App going to the BG
 - emissions ongoing
// App comming from the BG
2025-09-29 13:17:39.188 12327-12327 Supabase-Auth Trying to re-load session from storage...

2025-09-29 13:17:39.192 12327-16674 Supabase-Auth Importing session UserSession(accessToken=eyJ…)
2025-09-29 13:17:39.193 12327-16674  Supabase-Auth Session is under the threshold date. Refreshing session...
2025-09-29 13:17:39.193 12327-16674  Supabase-Auth Session expired. Refreshing session...
2025-09-29 13:17:39.193 12327-16674  Supabase-Auth Refreshing session 
2025-09-29 13:17:39.209 12327-16675 Supabase-Core POST request to endpoint /auth/v1/token failed with exception Unable to resolve host..

2025-09-29 13:17:39.209 12327-12527 Supabase-Auth Couldn't reach Supabase. Either the address doesn't exist or the network might not be on. Retrying in 10s...

2025-09-29 13:17:39.209 12327-16675 Supabase-Auth Session expired while trying to refresh the session. Updating status...
2025-09-29 13:17:39.209 12327-16675 Supabase-Auth Setting session status to RefreshFailure(cause=NetworkError..)
2025-09-29 13:17:39.209 12327-16675 Supabase-Auth Emitting event RefreshFailure(cause=NetworkError(…)
2025-09-29 13:17:46.984 12327-16674 Supabase-Auth Importing session UserSession(accessToken=eyJ…)
2025-09-29 13:17:46.985 12327-16674  Supabase-Auth Session is under the threshold date. Refreshing session...
2025-09-29 13:17:46.985 12327-16674  Supabase-Auth Session expired. Refreshing session...
2025-09-29 13:17:46.985 12327-16674  Supabase-Auth Refreshing session 
2025-09-29 13:17:47.018 12327-16674 Supabase-Core POST request to endpoint /auth/v1/token failed with exception Unable to resolve host..

2025-09-29 13:17:47.020 12327-12527 Supabase-Auth Couldn't reach Supabase. Either the address doesn't exist or the network might not be on. Retrying in 10s...

2025-09-29 13:17:47.020 12327-16674 Supabase-Auth Session expired while trying to refresh the session. Updating status...
2025-09-29 13:17:47.020 12327-16674 Supabase-Auth Setting session status to RefreshFailure(cause=NetworkError..)
2025-09-29 13:17:47.022 12327-16674 Supabase-Auth Emitting event RefreshFailure(cause=NetworkError(…)
 - emissions ongoing

[jan-tennert]

@jozefv-git Hmm, so when I switch to BG after a few retry fails, it correctly stops the auto refresh and upon opening the app again, it correctly restarts. I ran the chat demo sample and set the access token lifespan to 10s for testing

[jozefv-git]

@jan-tennert It seems like isAutorefreshingRunning doesn't update properly, which is causing the mentioned bug.
kotlin/io/github/jan/supabase/auth/setupPlatform.kt

                override fun onStop(owner: LifecycleOwner) {
                    if(gotrue.isAutoRefreshRunning) {
                        Auth.logger.d { "Cancelling auto refresh because app is switching to the background" }
                        scope.launch {
                            gotrue.stopAutoRefreshForCurrentSession()
                            gotrue.setSessionStatus(SessionStatus.Initializing)
                        }
                    }
                }

The reason for that is because the sessionJob inside the AuthImpl.kt isn't properly recreated in the case when the session is already expired. This results in isAutoRefreshRunning being false, thus there is no option how would be the importSession(...) recursive call together with flow emission cancelled.

To possibly fix this (hopefully I haven't miss anything), we need to re-create the sessionJob for the importSession(...).

Current solution which is causing the bug:
kotlin/io/github/jan/supabase/auth/AuthImpl.kt

override suspend fun importSession(
        session: UserSession,
        autoRefresh: Boolean,
        source: SessionSource
    ) {
        Auth.logger.d { "Importing session $session from $source, auto refresh is set to $autoRefresh." }
        if (!autoRefresh) {
            if (session.refreshToken.isNotBlank() && session.expiresIn != 0L && config.autoSaveToStorage) {
                sessionManager.saveSession(session)
                Auth.logger.d { "Session saved to storage (no auto refresh)" }
            }
            setSessionStatus(SessionStatus.Authenticated(session, source))
            Auth.logger.d { "Session imported successfully." }
            return
        }
        val thresholdDate = session.expiresAt - session.expiresIn.seconds * (1 - SESSION_REFRESH_THRESHOLD)
        if (thresholdDate <= Clock.System.now()) {
            Auth.logger.d { "Session is under the threshold date. Refreshing session..." }
            tryImportingSession(
                { handleExpiredSession(session, config.alwaysAutoRefresh) },
                { importSession(session) },
                { updateStatusIfExpired(session, it) }
            )
        } else {
            if (config.autoSaveToStorage) {
                sessionManager.saveSession(session)
                Auth.logger.d { "Session saved to storage (auto refresh enabled)" }
            }
            setSessionStatus(SessionStatus.Authenticated(session, source))
            Auth.logger.d { "Session imported successfully. Starting auto refresh..." }
            sessionJob?.cancel()
            sessionJob = authScope.launch {
                delayBeforeExpiry(session)
                launch {
                    tryImportingSession(
                        { handleExpiredSession(session) },
                        { importSession(session, source = source) },
                        { updateStatusIfExpired(session, it) }
                    )
                }
            }
            Auth.logger.d { "Auto refresh started." }
        }
    }

Possible fix:
kotlin/io/github/jan/supabase/auth/AuthImpl.kt

override suspend fun importSession(
        session: UserSession,
        autoRefresh: Boolean,
        source: SessionSource
    ) {
        Auth.logger.d { "Importing session $session from $source, auto refresh is set to $autoRefresh." }
        if (!autoRefresh) {
            if (session.refreshToken.isNotBlank() && session.expiresIn != 0L && config.autoSaveToStorage) {
                sessionManager.saveSession(session)
                Auth.logger.d { "Session saved to storage (no auto refresh)" }
            }
            setSessionStatus(SessionStatus.Authenticated(session, source))
            Auth.logger.d { "Session imported successfully." }
            return
        }
        val thresholdDate = session.expiresAt - session.expiresIn.seconds * (1 - SESSION_REFRESH_THRESHOLD)
        if (thresholdDate <= Clock.System.now()) {
            Auth.logger.d { "Session is under the threshold date. Refreshing session..." }
            sessionJob?.cancel()
            sessionJob = authScope.launch {  
            tryImportingSession(
                { handleExpiredSession(session, config.alwaysAutoRefresh) },
                { importSession(session) },
                { updateStatusIfExpired(session, it) }
            )
                }
        } else {
            if (config.autoSaveToStorage) {
                sessionManager.saveSession(session)
                Auth.logger.d { "Session saved to storage (auto refresh enabled)" }
            }
            setSessionStatus(SessionStatus.Authenticated(session, source))
            Auth.logger.d { "Session imported successfully. Starting auto refresh..." }
            sessionJob?.cancel()
            sessionJob = authScope.launch {
                delayBeforeExpiry(session)
                launch {
                    tryImportingSession(
                        { handleExpiredSession(session) },
                        { importSession(session, source = source) },
                        { updateStatusIfExpired(session, it) }
                    )
                }
            }
            Auth.logger.d { "Auto refresh started." }
        }
    }

[jan-tennert]

Alright, can you create a PR? Easier to see the differences that way, will look at it later