Skip to content

Conversation

rli
Copy link
Contributor

@rli rli commented Jul 3, 2025

…/ clear tokens on InvalidGrantException

when a user reauthenticates while reusing a connection, the cached supplier can incorrectly retain the last token instead of immediately returning the new one

additionally, the cached supplier can infinitely attempt token refresh since we are retaining invalid tokens instead of destroying them

Types of changes

  • Bug fix (non-breaking change which fixes an issue)
  • New feature (non-breaking change which adds functionality)

Description

Checklist

  • My code follows the code style of this project
  • I have added tests to cover my changes
  • A short description of the change has been added to the CHANGELOG if the change is customer-facing in the IDE.
  • I have added metrics for my changes (if required)

License

I confirm that my contribution is made under the terms of the Apache 2.0 license.

…/ clear tokens on InvalidGrantException

when a user reauthenticates while reusing a connection, the cached supplier can incorrectly retain the last token instead of immediately returning the new one

additionally, the cached supplier can infinitely attempt token refresh since we are retaining invalid tokens instead of destroying them
Copy link

github-actions bot commented Jul 3, 2025

Qodana Community for JVM

It seems all right 👌

No new problems were found according to the checks applied

💡 Qodana analysis was run in the pull request mode: only the changed files were checked
☁️ View the detailed Qodana report

Contact Qodana team

Contact us at [email protected]

@rli rli force-pushed the rli/auth-supplier-fix branch from 522f5f3 to 7bc23fb Compare July 8, 2025 00:28
@rli rli marked this pull request as ready for review July 8, 2025 00:28
@rli rli requested review from a team as code owners July 8, 2025 00:28
?.tokenProvider
?.delegate
?.let { it as? BearerTokenProvider } ?: return@scheduleWithFixedDelay
tokenProvider.resolveToken()
Copy link
Contributor

@manodnyab manodnyab Jul 8, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

does this attempt to use the cached supplier to refresh? should the refresh called be used here?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

cached supplier will refresh if needed

this.lastToken.set(it)
}
}
override fun refresh(): AccessToken = supplier.supplier.refresh()
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

should this also refresh cached supplier?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

deleted

@rli rli requested a review from a team as a code owner July 8, 2025 21:49
@rli rli merged commit 3b9b6c1 into main Jul 9, 2025
15 of 16 checks passed
@rli rli deleted the rli/auth-supplier-fix branch July 9, 2025 06:13
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants