Carry the organizations a session must re-authenticate for - #213
Draft
ericmj wants to merge 1 commit into
Draft
Conversation
An organization can require its members to authenticate through its identity provider, and that authentication expires on a clock the organization sets. When it lapses, the token grant drops the organization's scopes and names them in sso_reauth_required rather than leaving the client to guess why a fetch started 403ing. The name is the whole point: a scope dropped because the member was removed is not named, because authenticating again would not give it back. Only the ones a browser visit would fix are. sso_authorization/2 asks for the URL that does the fixing. It is bound to the session asking, so opening it renews that session rather than starting a new one, and refresh_tokens/1 is how a build tool picks up the scopes afterwards without waiting out an access token that has not expired. The sso_reauth callback is optional and reports the flagged set after every grant, including as an empty list. Which of them the running command actually needs is the build tool's question, not this module's.
This was referenced Aug 4, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Carries the organizations a session must re-authenticate for from the token response through to the CLI.
hex_api_oauthparsessso_reauth_requiredout of a token response and threads it throughrefresh_token/3and the device-auth result.hex_cli_authreports it through a new optionalsso_reauthcallback, invoked after every token grant with the organizations the server says this session has to authenticate through their identity provider for. Clients that do not register the callback are unaffected.Needed by hexpm/hex#organization-sso-reauth, which registers the callback and prompts.