From 2a023b59a2f9cf10cb70f4033ca05e070febc0b5 Mon Sep 17 00:00:00 2001
From: xargs <51077147+XargsUK@users.noreply.github.com>
Date: Tue, 3 Mar 2026 10:12:18 +0000
Subject: [PATCH] fix: keep expired credentials for AWS rejection

---
 src/library/__tests__/credentials.test.ts | 6 +++---
 src/library/credentials.ts                | 8 +-------
 src/options.ts                            | 2 +-
 src/popup.ts                              | 2 +-
 4 files changed, 6 insertions(+), 12 deletions(-)

diff --git a/src/library/__tests__/credentials.test.ts b/src/library/__tests__/credentials.test.ts
index 125b045..ee858aa 100644
--- a/src/library/__tests__/credentials.test.ts
+++ b/src/library/__tests__/credentials.test.ts
@@ -68,13 +68,13 @@ describe('credentials', () => {
       expect(result).toBeNull();
     });
 
-    it('should return null and clear storage when credentials are expired', async () => {
+    it('should return expired credentials to let AWS reject them', async () => {
       const getSpy = chrome.storage.local.get as jest.Mock;
       getSpy.mockImplementationOnce(() => Promise.resolve({ awsCredentials: expiredCredentials }));
 
       const result = await getValidCredentials();
-      expect(result).toBeNull();
-      expect(chrome.storage.local.remove).toHaveBeenCalledWith('awsCredentials');
+      expect(result).toEqual(expiredCredentials);
+      expect(chrome.storage.local.remove).not.toHaveBeenCalled();
     });
 
     it('should return null when credentials are incomplete', async () => {
diff --git a/src/library/credentials.ts b/src/library/credentials.ts
index 937d08c..7aff4d6 100644
--- a/src/library/credentials.ts
+++ b/src/library/credentials.ts
@@ -24,17 +24,11 @@ export async function getValidCredentials(): Promise<AWSCredentials | null> {
   if (
     !credentials.accessKeyId ||
     !credentials.secretAccessKey ||
-    !credentials.sessionToken ||
-    !credentials.expiration
+    !credentials.sessionToken
   ) {
     return null;
   }
 
-  if (areCredentialsExpired(credentials.expiration)) {
-    await chrome.storage.local.remove('awsCredentials');
-    return null;
-  }
-
   return credentials;
 }
 
diff --git a/src/options.ts b/src/options.ts
index a750d12..e2eb011 100644
--- a/src/options.ts
+++ b/src/options.ts
@@ -333,7 +333,7 @@ document.addEventListener('DOMContentLoaded', async () => {
 
       const awsCredentials = await getValidCredentials();
       if (!awsCredentials) {
-        showToastMessage('warning', 'Session expired — please sign in to AWS again.');
+        showToastMessage('warning', 'No AWS credentials found. Please sign in to AWS first.');
         return;
       }
 
diff --git a/src/popup.ts b/src/popup.ts
index dfc91f0..916a258 100644
--- a/src/popup.ts
+++ b/src/popup.ts
@@ -140,7 +140,7 @@ function setupEventListeners(): void {
         const awsCredentials = await getValidCredentials();
 
         if (!awsCredentials) {
-          showToastMessage('warning', 'Session expired — please sign in to AWS again.');
+          showToastMessage('warning', 'No AWS credentials found. Please sign in to AWS first.');
           return;
         }