[BUG] GitHub OAuth access token expiry is not checked before API calls, causing silent 401 failures after token refresh

[anshul23102]

Problem

The dashboard uses a GitHub OAuth access token stored in the user session. GitHub access tokens for OAuth apps do not expire by default, but fine-grained personal access tokens and GitHub Apps tokens do expire. Additionally, users can revoke authorization at any time in their GitHub settings. When an expired or revoked token is used to call the API, GitHub returns HTTP 401, but the dashboard does not distinguish this from a network error: it either shows stale data or a generic error message, leaving users confused about why their stats are missing.

Steps to Reproduce

1. Authenticate with GitHub OAuth
2. Manually revoke the application's access in GitHub Settings > Applications
3. Reload the dashboard
4. Observe the generic error state rather than a "reconnect GitHub" prompt

Proposed Fix

Inspect the HTTP status and X-OAuth-Scopes header on every GitHub API response:

if (response.status === 401) {
  await invalidateSession(userId);
  redirect("/auth/github"); // prompt re-authentication
}

Show a clear "Your GitHub connection has expired. Reconnect to refresh your stats." banner when this condition is detected.

Complexity: Level 2 | Program: GSSOC '26

[Tanisha-sharma7302]

Hi @Priyanshu-byte-coder , I'd like to work on this issue as part of GSSoC '26.

I reviewed the issue and understand that expired or revoked GitHub tokens should be handled separately from generic network failures. I plan to implement proper handling for HTTP 401 responses by invalidating the affected session, redirecting users to re-authenticate, and displaying a clear banner prompting them to reconnect their GitHub account. I'll also ensure the dashboard avoids showing stale data and provides a better user experience when authentication expires.

Could you please assign this issue to me? Thank you!

[github-actions]

Assigned to @Tanisha-sharma7302! You have 7 days to open a PR. No PR after 7 days = auto-unassigned so others can pick it up. Good luck!

[anshul23102]

/assign

Claiming this issue for GSSoC '26. Please assign it to me, I'll start working on it right away.