Skip to content

security/oidcauth: fix TestOIDCAuthorization_RoleGrantAndRevoke timeout flake#167913

Merged
trunk-io[bot] merged 1 commit intocockroachdb:masterfrom
cockroach-teamcity:fix/issue-167912
Apr 9, 2026
Merged

security/oidcauth: fix TestOIDCAuthorization_RoleGrantAndRevoke timeout flake#167913
trunk-io[bot] merged 1 commit intocockroachdb:masterfrom
cockroach-teamcity:fix/issue-167912

Conversation

@cockroach-teamcity
Copy link
Copy Markdown
Member

The test was failing with context deadline exceeded (Client.Timeout exceeded while awaiting headers) because the HTTP client used the
default 10-second timeout from GetHTTPClient(). Under the race
detector, the OIDC callback handler (which acquires a mutex, performs
token exchange, and executes SQL role grant/revoke operations) can
exceed this timeout.

Other OIDC tests in the same package already set `client.Timeout = 30

  • time.Second with the comment "Set a reasonable timeout for the client to prevent flakiness under stress." This change applies the same 30-second timeout to the three authorization test functions (TestOIDCAuthorization_TokenPaths, TestOIDCAuthorization_UserinfoPaths, and TestOIDCAuthorization_RoleGrantAndRevoke`) that were missing it.

Additionally, the retry loop in performOIDCLogin is removed because
it masked the root cause (insufficient timeout) and had correctness
issues with reusing http.Request objects after failed Do calls.
With the proper timeout, retries are unnecessary.

Resolves: #167912
Epic: none

Release note: None

Generated by Claude Code Auto-Solver
Co-Authored-By: Claude noreply@anthropic.com


 pkg/security/oidcauth/authorization_oidc_test.go | 47 +++---------------------
 1 file changed, 5 insertions(+), 42 deletions(-)

This PR was auto-generated by issue-autosolve using Claude Code.
Please review carefully before approving.

…ut flake

The test was failing with `context deadline exceeded (Client.Timeout
exceeded while awaiting headers)` because the HTTP client used the
default 10-second timeout from `GetHTTPClient()`. Under the race
detector, the OIDC callback handler (which acquires a mutex, performs
token exchange, and executes SQL role grant/revoke operations) can
exceed this timeout.

Other OIDC tests in the same package already set `client.Timeout = 30
* time.Second` with the comment "Set a reasonable timeout for the
client to prevent flakiness under stress." This change applies the
same 30-second timeout to the three authorization test functions
(`TestOIDCAuthorization_TokenPaths`, `TestOIDCAuthorization_UserinfoPaths`,
and `TestOIDCAuthorization_RoleGrantAndRevoke`) that were missing it.

Additionally, the retry loop in `performOIDCLogin` is removed because
it masked the root cause (insufficient timeout) and had correctness
issues with reusing `http.Request` objects after failed `Do` calls.
With the proper timeout, retries are unnecessary.

Resolves: cockroachdb#167912
Epic: none

Release note: None

Generated by Claude Code Auto-Solver
Co-Authored-By: Claude <noreply@anthropic.com>
@cockroach-teamcity cockroach-teamcity added the O-autosolver PRs originating from the autosolver bot label Apr 8, 2026
@trunk-io
Copy link
Copy Markdown
Contributor

trunk-io bot commented Apr 8, 2026

😎 Merged successfully - details.

@cockroach-teamcity
Copy link
Copy Markdown
Member Author

This change is Reviewable

@souravcrl souravcrl marked this pull request as ready for review April 9, 2026 09:48
@souravcrl souravcrl requested a review from a team as a code owner April 9, 2026 09:48
Copy link
Copy Markdown
Contributor

@souravcrl souravcrl left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Same retry logic worked here, so approving this https://github.com/cockroachdb/cockroach/pull/161381/changes

@souravcrl souravcrl added backport-25.4.x Flags PRs that need to be backported to 25.4 backport-26.1.x Flags PRs that need to be backported to 26.1 backport-26.2.x Flags PRs that need to be backported to 26.2 labels Apr 9, 2026
@souravcrl
Copy link
Copy Markdown
Contributor

/trunk merge

@github-actions
Copy link
Copy Markdown
Contributor

github-actions bot commented Apr 9, 2026

[autosolve-response]

I reviewed the comments but no code changes were necessary.

Analysis:

The comment is `/trunk merge` from `souravcrl`, which is a merge command — not code review feedback requiring changes. This is simply a command to merge the PR, not a request for code modifications.

No code changes are needed to address this comment.

CHANGES_RESULT - SUCCESS

Workflow run

@trunk-io trunk-io bot merged commit 606bca1 into cockroachdb:master Apr 9, 2026
32 checks passed
@blathers-crl
Copy link
Copy Markdown

blathers-crl bot commented Apr 9, 2026

Based on the specified backports for this PR, I applied new labels to the following linked issue(s). Please adjust the labels as needed to match the branches actually affected by the issue(s), including adding any known older branches.


Issue #167912: branch-release-26.1, branch-release-26.2.


🦉 Hoot! I am a Blathers, a bot for CockroachDB. My owner is dev-inf.

@blathers-crl
Copy link
Copy Markdown

blathers-crl bot commented Apr 9, 2026

Encountered an error creating backports. Some common things that can go wrong:

  1. The backport branch might have already existed.
  2. There was a merge conflict.
  3. The backport branch contained merge commits.

You might need to create your backport manually using the backport tool.


💡 Consider backporting to the fork repo instead of the main repo. See instructions for more details.

merge conflict cherry-picking 3691c2d to blathers/backport-release-25.4-167913

Backport to branch 25.4.x failed. See errors above.


💡 Consider backporting to the fork repo instead of the main repo. See instructions for more details.

merge conflict cherry-picking 3691c2d to blathers/backport-release-26.1-167913

Backport to branch 26.1.x failed. See errors above.


💡 Consider backporting to the fork repo instead of the main repo. See instructions for more details.

🦉 Hoot! I am a Blathers, a bot for CockroachDB. My owner is dev-inf.

souravcrl added a commit to souravcrl/cockroach that referenced this pull request Apr 14, 2026
…ke timeout flake"

This reverts commit 3691c2d (PR cockroachdb#167913).

PR cockroachdb#167913 was an auto-generated fix that removed the retry logic added
by PR cockroachdb#161381 and replaced it with increased client timeouts. However,
PR cockroachdb#161381 already properly addressed the flaky test issue (cockroachdb#159262) by
adding retry logic with exponential backoff. The auto-solver's changes
were unnecessary and removed a valid fix.

Epic: none
Release note: None

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
souravcrl added a commit to souravcrl/cockroach that referenced this pull request Apr 14, 2026
…AndRevoke flake

This reverts commit 3691c2d (PR cockroachdb#167913).

PR cockroachdb#167913 was an auto-generated fix that removed the retry logic added
by PR cockroachdb#161381 and replaced it with increased client timeouts. However,
PR cockroachdb#161381 already properly addressed the flaky test issue (cockroachdb#159262) by
adding retry logic with exponential backoff. The auto-solver's changes
were unnecessary and removed a valid fix.

Epic: none
Release note: None

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

backport-25.4.x Flags PRs that need to be backported to 25.4 backport-26.1.x Flags PRs that need to be backported to 26.1 backport-26.2.x Flags PRs that need to be backported to 26.2 backport-failed O-autosolver PRs originating from the autosolver bot target-release-26.3.0

Projects

None yet

Development

Successfully merging this pull request may close these issues.

ccl/oidcccl: TestOIDCAuthorization_RoleGrantAndRevoke failed

3 participants