fix(oauth2): Fixing issue with oauth2 manual and auto refresh#7573
Open
RVBastien wants to merge 1 commit intousebruno:mainfrom
Open
fix(oauth2): Fixing issue with oauth2 manual and auto refresh#7573RVBastien wants to merge 1 commit intousebruno:mainfrom
RVBastien wants to merge 1 commit intousebruno:mainfrom
Conversation
Contributor
WalkthroughModified OAuth2 token refresh logic to introduce validation checking for successful credential acquisition and refactored URL handling to distinguish between credential cache operations and refresh HTTP requests across three authorization flows. Changes
Estimated code review effort🎯 4 (Complex) | ⏱️ ~35 minutes Possibly related PRs
Suggested labels
Suggested reviewers
Poem
🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
5 tasks
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@packages/bruno-electron/src/utils/oauth2.js`:
- Around line 698-705: The current flow persists only the fresh token response
from getCredentialsFromTokenUrl, which can drop unchanged fields like
refresh_token; instead, load the existing cached credentials for the given
collectionUid/cacheUrl/credentialsId, merge the existing credential object with
the new credentials (new values overwrite cached ones but preserve any fields
missing from the response), then call persistOauth2Credentials with the merged
object; keep the existing clearOauth2Credentials path when credentials is falsy
or has error and continue returning the same tuple (collectionUid, url:
cacheUrl, credentials, credentialsId, debugInfo).
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 1d9ccb0d-3a9e-408c-8118-54b94014d1bd
📒 Files selected for processing (1)
packages/bruno-electron/src/utils/oauth2.js
Comment on lines
698
to
+705
| const { credentials, requestDetails } = await getCredentialsFromTokenUrl({ requestConfig: axiosRequestConfig, certsAndProxyConfig }); | ||
| debugInfo.data.push(requestDetails); | ||
| if (!credentials || credentials?.error) { | ||
| clearOauth2Credentials({ collectionUid, url, credentialsId }); | ||
| return { collectionUid, url, credentials: null, credentialsId, debugInfo }; | ||
| clearOauth2Credentials({ collectionUid, url: cacheUrl, credentialsId }); | ||
| return { collectionUid, url: cacheUrl, credentials: null, credentialsId, debugInfo }; | ||
| } | ||
| credentials && persistOauth2Credentials({ collectionUid, url, credentials, credentialsId }); | ||
| return { collectionUid, url, credentials, credentialsId, debugInfo }; | ||
| credentials && persistOauth2Credentials({ collectionUid, url: cacheUrl, credentials, credentialsId }); | ||
| return { collectionUid, url: cacheUrl, credentials, credentialsId, debugInfo }; |
Contributor
There was a problem hiding this comment.
Merge refresh responses with the cached credentials before persisting.
Some OAuth2 servers do not repeat unchanged fields on refresh. Persisting only the response payload here can drop the cached refresh_token and make the next refresh fail even though this one succeeded.
Proposed fix
- if (!credentials || credentials?.error) {
+ if (!credentials || credentials?.error || !credentials.access_token) {
clearOauth2Credentials({ collectionUid, url: cacheUrl, credentialsId });
return { collectionUid, url: cacheUrl, credentials: null, credentialsId, debugInfo };
}
- credentials && persistOauth2Credentials({ collectionUid, url: cacheUrl, credentials, credentialsId });
- return { collectionUid, url: cacheUrl, credentials, credentialsId, debugInfo };
+ const refreshedCredentials = {
+ ...storedCredentials,
+ ...credentials,
+ refresh_token: credentials.refresh_token ?? storedCredentials.refresh_token
+ };
+ persistOauth2Credentials({ collectionUid, url: cacheUrl, credentials: refreshedCredentials, credentialsId });
+ return { collectionUid, url: cacheUrl, credentials: refreshedCredentials, credentialsId, debugInfo };🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@packages/bruno-electron/src/utils/oauth2.js` around lines 698 - 705, The
current flow persists only the fresh token response from
getCredentialsFromTokenUrl, which can drop unchanged fields like refresh_token;
instead, load the existing cached credentials for the given
collectionUid/cacheUrl/credentialsId, merge the existing credential object with
the new credentials (new values overwrite cached ones but preserve any fields
missing from the response), then call persistOauth2Credentials with the merged
object; keep the existing clearOauth2Credentials path when credentials is falsy
or has error and continue returning the same tuple (collectionUid, url:
cacheUrl, credentials, credentialsId, debugInfo).
lohit-bruno
requested review from
bijin-bruno,
helloanoop,
lohit-bruno and
naman-bruno
as code owners
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
This change fixes Bruno's OAuth2 refresh flow.
What changed
refreshOauth2Token()now separates:access_tokenas a failed refreshWhy
refreshTokenUrldiffers fromaccessTokenUrl, looking up cached credentials with the refresh URL can prevent Bruno from finding the storedrefresh_token, so no refresh request is maderefreshOauth2Token()can fail by returningcredentials: null, not only by throwing, so callers need to handle that case explicitlyResult
Contribution Checklist:
Note: Keeping the PR small and focused helps make it easier to review and merge. If you have multiple changes you want to make, please consider submitting them as separate pull requests.
Publishing to New Package Managers
Please see here for more information.
Summary by CodeRabbit
Bug Fixes
Refactor