Trusting the client to be permitted to reauth is a guaranteed failure scenario, because then they can just put their phone in airplane mode and disable backgrou

Trusting the client to be permitted to reauth is a guaranteed failure scenario, because then they can just put their phone in airplane mode and disable background updates. Issuing time-restricted certificates to the client that expire after an interval is the only way to be certain, other than the property manager simply walking to the lock in question and using the lock app on it to force out your client. Interpreting “No route to host, as various mobile networks do when your only cellular connection is Emergency Only, as “Purge the current session” is not beneficial to anyone’s security, and results in angry tenants trapped without cellular service in your parking garage, that then call emergency services via the elevator to get out. (This is not a theoretical example.) I assume the core problem is that they only refresh their session once a month when the previous session expires, and if that refresh fails, you’re locked out — because they didn’t code it to update the session expiration each time it successfully phones home your lock’s status when used, and so when the monthly interval is up, it logs out because it incompetently manages the OAuth session.