fix: guard against non-dict JSON in token refresh response

resp.json() could return non-dict values (null, string, list) which would cause AttributeError on data.get("access_token"). Now checks isinstance(data, dict) first, returning (False, None) for malformed responses. Applied to both sync and async refresh helpers.
stack-auth · ejirocodes · Mar 24, 2026 · Mar 24, 2026 · Mar 24, 2026 · Mar 24, 2026
commit 6aaa4b3b4b4c85f8447615ea24c7d14be12dec85
diff --git a/sdks/implementations/python/src/stack_auth/_token_store.py b/sdks/implementations/python/src/stack_auth/_token_store.py
@@ -390,6 +390,8 @@ def _refresh_access_token_sync(
         )
         if resp.status_code == 200:
             data = resp.json()
+            if not isinstance(data, dict):
+                return (False, None)
             return (True, data.get("access_token"))
         return (False, None)
     except (httpx.HTTPError, ValueError, KeyError) as exc:
@@ -421,6 +423,8 @@ async def _refresh_access_token_async(
         )
         if resp.status_code == 200:
             data = resp.json()
+            if not isinstance(data, dict):
+                return (False, None)
             return (True, data.get("access_token"))
         return (False, None)
     except (httpx.HTTPError, ValueError, KeyError) as exc: