chore: prepare new release(s)

Author: jselig-rigetti

Cargo.lock

@@ -93,25 +93,25 @@ version = '0.27.0'
 
 [workspace.dependencies.qcs-api-client-common]
 path = 'qcs-api-client-common'
-version = '0.18.2'
+version = '0.18.3'
 
 [workspace.dependencies.qcs-api-client-grpc]
 path = 'qcs-api-client-grpc'
-version = '0.18.2'
+version = '0.18.3'
 
 [workspace.dependencies.qcs-api-client-grpc-internal]
 path = 'qcs-api-client-grpc-internal'
 registry = 'rigetti-cargo'
-version = '0.19.2'
+version = '0.19.3'
 
 [workspace.dependencies.qcs-api-client-openapi]
 path = 'qcs-api-client-openapi/public'
-version = '0.19.2'
+version = '0.19.3'
 
 [workspace.dependencies.qcs-api-client-openapi-internal]
 path = 'qcs-api-client-openapi/internal'
 registry = 'rigetti-cargo'
-version = '0.19.2'
+version = '0.19.3'
 
 [workspace.dependencies.qcs-dependencies-client]
 version = '0.3.1'

Cargo.toml

@@ -1,3 +1,9 @@
+## 0.18.3 (2026-06-30)
+
+### Fixes
+
+- persist refresh token changes
+
 ## 0.18.2 (2026-06-01)
 
 ### Fixes

qcs-api-client-common/CHANGELOG.md

@@ -8,7 +8,7 @@ name = 'qcs-api-client-common'
 publish = true
 readme = 'README.md'
 repository = 'https://github.com/rigetti/qcs-api-client-rust'
-version = '0.18.2'
+version = '0.18.3'
 
 [package.authors]
 workspace = true

qcs-api-client-common/Cargo.toml

@@ -1,7 +1,7 @@
 [project]
 name = "qcs-api-client-common"
 requires-python = ">=3.10,<4"
-version = "0.18.2"
+version = "0.18.3"
 description = "Contains core QCS client functionality and middleware implementations."
 readme = "README-py.md"
 license = { text = "Apache-2.0" }
@@ -144,6 +144,7 @@ disable_error_code = [
 ]
 
 [tool.pytest.ini_options]
+asyncio_mode = "auto"
 markers = [
     "integration: mark a test as an integration test.",
 ]

qcs-api-client-common/pyproject.toml

@@ -604,12 +604,15 @@ impl TokenDispatcher {
             match Secrets::is_read_only(secrets_path).await {
                 Ok(true) => Ok(()),
                 Ok(false) => {
-                    // If the payload is a PkceFlow, write the fresh refresh token if available.
+                    // Persist the fresh refresh token if the grant carries one, so that a rotated
+                    // refresh token isn't lost on the next load. Both the PKCE and refresh-token
+                    // grants can hold a refresh token that the auth server may have rotated.
                     let refresh_token = match &oauth_session.payload {
                         OAuthGrant::PkceFlow(payload) => {
                             payload.refresh_token.as_ref().map(|rt| &rt.refresh_token)
                         }
-                        _ => None,
+                        OAuthGrant::RefreshToken(payload) => Some(&payload.refresh_token),
+                        OAuthGrant::ExternallyManaged(_) | OAuthGrant::ClientCredentials(_) => None,
                     };
 
                     let now = OffsetDateTime::now_utc();
@@ -1217,6 +1220,102 @@ updated_at = "2024-01-01T00:00:00Z"
         });
     }
 
+    /// When the auth server rotates the refresh token, a [`OAuthGrant::RefreshToken`] grant should
+    /// persist the new refresh token to the secrets file (not just the access token).
+    #[test]
+    fn test_refresh_token_grant_persists_rotated_refresh_token() {
+        let initial_refresh_token = "initial_refresh_token";
+        let rotated_refresh_token = "rotated_refresh_token";
+        let new_access_token = "new_access_token";
+
+        figment::Jail::expect_with(|jail| {
+            jail.clear_env();
+
+            let secrets_path = "secrets.toml";
+            let initial_secrets_file_contents = format!(
+                r#"
+[credentials]
+[credentials.test]
+[credentials.test.token_payload]
+access_token = "initial_access_token"
+refresh_token = "{initial_refresh_token}"
+updated_at = "2024-01-01T00:00:00Z"
+"#
+            );
+            jail.create_file(secrets_path, &initial_secrets_file_contents)
+                .expect("should create test secrets.toml");
+
+            let rt = tokio::runtime::Runtime::new().unwrap();
+            rt.block_on(async {
+                let mock_server = MockServer::start_async().await;
+                let oidc_mock = mock_server
+                    .mock_async(|when, then| {
+                        when.method(GET).path("/.well-known/openid-configuration");
+                        then.status(200)
+                            .json_body_obj(&oidc::Discovery::new_for_test(
+                                mock_server.base_url().parse().unwrap(),
+                            ));
+                    })
+                    .await;
+                let issuer_mock = mock_server
+                    .mock_async(|when, then| {
+                        when.method(POST).path("/v1/token");
+                        then.status(200).json_body_obj(&RefreshTokenResponse {
+                            access_token: SecretAccessToken::from(new_access_token),
+                            refresh_token: Some(SecretRefreshToken::from(rotated_refresh_token)),
+                        });
+                    })
+                    .await;
+
+                let dispatcher: TokenDispatcher = OAuthSession::from_refresh_token(
+                    RefreshToken::new(SecretRefreshToken::from(initial_refresh_token)),
+                    AuthServer {
+                        client_id: "client_id".to_string(),
+                        issuer: mock_server.base_url(),
+                        scopes: None,
+                    },
+                    Some(SecretAccessToken::from("initial_access_token")),
+                )
+                .into();
+
+                dispatcher
+                    .refresh(
+                        &ConfigSource::File {
+                            settings_path: "".into(),
+                            secrets_path: secrets_path.into(),
+                        },
+                        "test",
+                    )
+                    .await
+                    .expect("refresh should succeed");
+
+                oidc_mock.assert_async().await;
+                issuer_mock.assert_async().await;
+            });
+
+            // The rotated refresh token (and the new access token) should be persisted.
+            let payload = Secrets::load_from_path(&secrets_path.into())
+                .expect("should load secrets")
+                .credentials
+                .remove("test")
+                .expect("should have test credentials")
+                .token_payload
+                .expect("should have token payload");
+            assert_eq!(
+                payload.refresh_token.unwrap(),
+                SecretRefreshToken::from(rotated_refresh_token),
+                "rotated refresh token should be persisted to the secrets file"
+            );
+            assert_eq!(
+                payload.access_token.unwrap(),
+                SecretAccessToken::from(new_access_token),
+                "new access token should be persisted to the secrets file"
+            );
+
+            Ok(())
+        });
+    }
+
     #[test]
     fn test_auth_session_debug_fmt() {
         let session = OAuthSession {

qcs-api-client-common/src/configuration/tokens.rs

@@ -1,5 +1,4 @@
-import asyncio
-from unittest.mock import MagicMock
+from unittest.mock import AsyncMock
 
 import grpc
 import pytest
@@ -30,11 +29,8 @@ def make_request() -> Any:
 
 @pytest.fixture
 def mock_config(mocker):
-    mock = mocker.patch.object(ClientConfiguration, "get_bearer_access_token_async", new_callable=MagicMock)
-    future = asyncio.Future()
-    future.set_result("mock_config_fixture_token")
-    mock.return_value = future
-
+    mock = mocker.patch.object(ClientConfiguration, "get_bearer_access_token_async", new_callable=AsyncMock)
+    mock.return_value = "mock_config_fixture_token"
     return mock
 
 

qcs-api-client-common/tests_py/test_grpc.py

@@ -1,3 +1,9 @@
+## 0.18.3 (2026-06-30)
+
+### Fixes
+
+- persist refresh token changes
+
 ## 0.18.2 (2026-06-01)
 
 ### Fixes

qcs-api-client-grpc/CHANGELOG.md

@@ -8,7 +8,7 @@ name = 'qcs-api-client-grpc'
 publish = true
 readme = 'README.md'
 repository = 'https://github.com/rigetti/qcs-api-client-rust'
-version = '0.18.2'
+version = '0.18.3'
 
 [package.authors]
 workspace = true

qcs-api-client-grpc/Cargo.toml

@@ -1,3 +1,9 @@
+## 0.19.3 (2026-06-30)
+
+### Fixes
+
+- persist refresh token changes
+
 ## 0.19.2 (2026-06-01)
 
 ### Fixes