Refactor handling of OAuth client tokens - #24684 - #24726
Open
NobodysNightmare wants to merge 5 commits into
Open
Refactor handling of OAuth client tokens - #24684#24726NobodysNightmare wants to merge 5 commits into
NobodysNightmare wants to merge 5 commits into
Conversation
This class provides generic helpers to perform OAuth 2.0 token requests, which are not only useful in the context of OpenID Connect, but also for other kinds of OAuth clients.
Previously the fetching and updating of `OAuthClientToken` was left as an implementation detail of specific integrations, even though the concept of `OAuthClient` and `OAuthClientToken` were defined in the core and even their creation is already handled through a core class (the `ConnectionManager`). This commit introduces the `OAuthClients::TokenFetcher` that serves as the new main interface to obtain the access token of an `OAuthClientToken`.
The previous cassette contained a refresh of an OAuth token that was performed through the previous "try-and-error"-based approach for authentication. I.e. the first request failed with an authentication error, then there was an additional request included to refresh the OAuth token and the second request to the first endpoint succeeded. This VCR cassette is incompatible with the new TTL-based authentication approach, where a token is refreshed shortly before expiry, but not based on negative request outcomes.
Introducing a core class for logging that's inspired by the
Storages::TaggedLogging module. Though it aims to natively
support key-value-pairs during logging.
What still needs to be added is a way to temporarily add tags,
i.e. `with_log_tags { ... }`.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Previously the fetching and updating of
OAuthClientTokenwas left as an implementation detail of specific integrations, even though the concept ofOAuthClientandOAuthClientTokenwere defined in the core and even their creation is already handled through a core class (theConnectionManager).This PR introduces the
OAuthClients::TokenFetcherthat serves as the new main interface to obtain the access token of anOAuthClientToken. A relevant difference compared to the previous approach is that we refresh access tokens based on their time-to-live (i.e.expires_in), not based on receiving an error response and then retrying.Ticket
https://community.openproject.org/wp/SI-236