feat: support upstream token refresh

backend/test_auth_capture.py

@@ -218,6 +218,39 @@ def test_new_api_user_propagated_to_bundle():
     assert bundle.get("new_api_user") == "42"
 
 
+def test_storage_access_and_refresh_token_build_sub2api_bearer_candidate():
+    candidates = _curate_candidates(
+        cookies=[],
+        local_storage={"auth_token": "access-token", "refresh_token": "refresh-token"},
+        session_storage={},
+        auth_headers=[],
+        page_url="https://sub2api.example.com/",
+    )
+
+    assert candidates[0]["type"] == "bearer_token"
+    assert candidates[0]["value"] == "access-token"
+    assert candidates[0]["refresh_token"] == "refresh-token"
+    assert candidates[0]["label"] == "Sub2API Bearer + Refresh Token"
+    assert not any(
+        c["type"] == "bearer_token" and c.get("value") == "refresh-token"
+        for c in candidates
+    )
+
+
+def test_storage_access_token_without_refresh_keeps_bearer_candidate():
+    candidates = _curate_candidates(
+        cookies=[],
+        local_storage={"auth_token": "access-token"},
+        session_storage={},
+        auth_headers=[],
+        page_url="https://sub2api.example.com/",
+    )
+
+    assert candidates[0]["type"] == "bearer_token"
+    assert candidates[0]["value"] == "access-token"
+    assert "refresh_token" not in candidates[0]
+
+
 def test_browser_import_payload_builds_cookie_bundle_with_new_api_user():
     from app.services.browser_import_service import build_import_result