Describe the bug
When running inside Thunderbird with the Thunderbird Pro add-on signed in, clicking a link to send.tb.pro from the accounts.tb.pro/dashboard closes the newly-opened Send tab instead of showing the Send dashboard.
This happens once the add-on's stored OIDC access token has passed its short-lived expires_at, even though the session itself is still valid (the refresh token is good and the menu still shows you as signed in).
To Reproduce
Steps to reproduce the behavior:
- Install/enable the Thunderbird Pro add-on and sign in.
- Let the OIDC access-token TTL lapse (a few minutes). The add-on menu still shows you as signed in.
- Inside Thunderbird, open
accounts.tb.pro/dashboard and click a link to send.tb.pro (e.g. /send/profile).
- The Send tab opens briefly, then closes.
Expected behavior
The Send dashboard renders and stays open. The Send web app silently refreshes the access token using the refresh token (userManager.signinSilent()).
Actual behavior
The add-on's getLoginState() (packages/addon/src/menu.ts) treats the expired access token as logged-out and calls closeAllTbProTabs(), which removes every send.tb.pro tab — including the one just opened. A 60s timer (checkLoginStateOnInterval) runs the same check, so Send tabs can also be closed out from under the user mid-session.
Screenshots
N/A
System
- OS: platform-independent (observed on macOS, Darwin 25.5.0)
- Browser Version: Thunderbird Daily (built-in / system add-on build)
Additional context
Root cause is a category error: expires_at is the short-lived OIDC access-token expiry, not the session lifetime. Login state should be driven by the presence of a refresh_token, and a read-only login-state probe should not have destructive side effects (closing tabs / wiping storage). This is distinct from #945 (the ProfileView self-close), which is working correctly.
Describe the bug
When running inside Thunderbird with the Thunderbird Pro add-on signed in, clicking a link to
send.tb.profrom theaccounts.tb.pro/dashboardcloses the newly-opened Send tab instead of showing the Send dashboard.This happens once the add-on's stored OIDC access token has passed its short-lived
expires_at, even though the session itself is still valid (the refresh token is good and the menu still shows you as signed in).To Reproduce
Steps to reproduce the behavior:
accounts.tb.pro/dashboardand click a link tosend.tb.pro(e.g./send/profile).Expected behavior
The Send dashboard renders and stays open. The Send web app silently refreshes the access token using the refresh token (
userManager.signinSilent()).Actual behavior
The add-on's
getLoginState()(packages/addon/src/menu.ts) treats the expired access token as logged-out and callscloseAllTbProTabs(), which removes everysend.tb.protab — including the one just opened. A 60s timer (checkLoginStateOnInterval) runs the same check, so Send tabs can also be closed out from under the user mid-session.Screenshots
N/A
System
Additional context
Root cause is a category error:
expires_atis the short-lived OIDC access-token expiry, not the session lifetime. Login state should be driven by the presence of arefresh_token, and a read-only login-state probe should not have destructive side effects (closing tabs / wiping storage). This is distinct from #945 (theProfileViewself-close), which is working correctly.