Update src/nwp500/auth.py

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Author: eman

src/nwp500/auth.py

@@ -401,28 +401,62 @@ async def refresh_token(self, refresh_token: str) -> AuthTokens:
                 new_tokens = AuthTokens.from_dict(data)
 
                 # Preserve AWS credentials from old tokens if not in refresh
-                # response
+                # response, but only if they are still valid (not expired).
+                # If credentials are expired, do not preserve them.
+                # If you are relying on credentials being valid after token refresh,
+                # ensure this is documented and validated here.
                 if self._auth_response and self._auth_response.tokens:
                     old_tokens = self._auth_response.tokens
-                    if (
-                        not new_tokens.access_key_id
-                        and old_tokens.access_key_id
-                    ):
-                        new_tokens.access_key_id = old_tokens.access_key_id
-                    if not new_tokens.secret_key and old_tokens.secret_key:
-                        new_tokens.secret_key = old_tokens.secret_key
-                    if (
-                        not new_tokens.session_token
-                        and old_tokens.session_token
-                    ):
-                        new_tokens.session_token = old_tokens.session_token
-                    if (
-                        not new_tokens.authorization_expires_in
-                        and old_tokens.authorization_expires_in
-                    ):
-                        new_tokens.authorization_expires_in = (
-                            old_tokens.authorization_expires_in
+                    # Check if AWS credentials are still valid
+                    expires = getattr(old_tokens, "authorization_expires_in", None)
+                    if expires and isinstance(expires, datetime):
+                        if expires > datetime.utcnow():
+                            # Credentials are still valid, preserve them
+                            if (
+                                not new_tokens.access_key_id
+                                and old_tokens.access_key_id
+                            ):
+                                new_tokens.access_key_id = old_tokens.access_key_id
+                            if not new_tokens.secret_key and old_tokens.secret_key:
+                                new_tokens.secret_key = old_tokens.secret_key
+                            if (
+                                not new_tokens.session_token
+                                and old_tokens.session_token
+                            ):
+                                new_tokens.session_token = old_tokens.session_token
+                            if (
+                                not new_tokens.authorization_expires_in
+                                and old_tokens.authorization_expires_in
+                            ):
+                                new_tokens.authorization_expires_in = (
+                                    old_tokens.authorization_expires_in
+                                )
+                        else:
+                            _logger.warning("Old AWS credentials have expired and will not be preserved.")
+                    else:
+                        # If expiration is not available, preserve credentials but log a warning.
+                        _logger.warning(
+                            "AWS credentials expiration not available; preserving old credentials by assumption."
                         )
+                        if (
+                            not new_tokens.access_key_id
+                            and old_tokens.access_key_id
+                        ):
+                            new_tokens.access_key_id = old_tokens.access_key_id
+                        if not new_tokens.secret_key and old_tokens.secret_key:
+                            new_tokens.secret_key = old_tokens.secret_key
+                        if (
+                            not new_tokens.session_token
+                            and old_tokens.session_token
+                        ):
+                            new_tokens.session_token = old_tokens.session_token
+                        if (
+                            not new_tokens.authorization_expires_in
+                            and old_tokens.authorization_expires_in
+                        ):
+                            new_tokens.authorization_expires_in = (
+                                old_tokens.authorization_expires_in
+                            )
 
                 # Update stored auth response if we have one
                 if self._auth_response: