[Bug]: Token Expiration Bypass in @segment/analytics-node 2.3.0

Start in src/lib/token-manager.ts at isValidToken around lines 320-326, then read the OAuth token handling around line 137 where expires_at is calculated. Reproduce the OAuth flow with an expired token and verify that expiration validation rejects it and triggers refresh rather than reusing the cached token.

Summary

The isValidToken method in the TokenManager class contains a logic error that causes token expiration checks to always pass, effectively disabling token expiration validation entirely.

Vulnerable Code

// src/lib/token-manager.ts, lines 320-326
isValidToken(token?: AccessToken): token is AccessToken {
  return (
    typeof token !== 'undefined' &&
    token !== null &&
    token.expires_in < Date.now() / 1000  // BUG: Wrong field and wrong comparison
  )
}

Root Cause

The validation logic has two compounding errors:

1. Wrong field: The code checks expires_in (a duration in seconds, e.g., 3600) instead of expires_at (the actual expiration timestamp).

2. Wrong comparison operator: Even if the correct field were used, the comparison should check if the expiration time is greater than the current time, not less than.

How tokens are structured

When a token is received (line 137), the code correctly calculates expires_at:

token.expires_at = Math.round(Date.now() / 1000) + token.expires_in

For a token with expires_in: 3600 (1 hour):

• expires_at = current timestamp + 3600 ≈ 1707004600
• expires_in = 3600

Why the bug occurs

The current check token.expires_in < Date.now() / 1000 evaluates:

3600 < 1707000000  →  true (always)

This condition is always true for any realistic token, meaning:

• Expired tokens are incorrectly considered valid
• Token refresh is never triggered based on expiration
• The SDK continues using stale/expired tokens

Impact

• Expired tokens remain in use: The SDK will continue sending requests with expired OAuth tokens until an external failure occurs.
• Authentication failures: Requests made with expired tokens will fail at the Segment API, causing data loss or delivery failures.
• Silent failures: Depending on error handling, these failures may go unnoticed.

Suggested Fix

isValidToken(token?: AccessToken): token is AccessToken {
  return (
    typeof token !== 'undefined' &&
    token !== null &&
    typeof token.expires_at === 'number' &&
    token.expires_at > Date.now() / 1000  // Use expires_at with correct comparison
  )
}

Reproduction

Any usage of the OAuth flow in @segment/analytics-node is affected. The bug can be confirmed by:

1. Obtaining a valid OAuth token
2. Waiting for the token to expire
3. Observing that isValidToken() still returns true
4. Observing that the cached expired token continues to be used