V2 provider OAuth refresh races across locations and processes #50759

Activity

1. github-actions

   assigned

   neriousy

   on Sep 22, 2026
2. hcrosse commented on Sep 23, 2026

   

   hcrosse

   on Sep 23, 2026

   Author

   More actions

   👋 Hi @neriousy , I see you got assigned to this! This is my first real issue with OpenCode - how should I proceed towards getting a review? I know y'all must have an overwhelming amount of issues and PRs to wade through, so absolutely no rush, I just don't want this to end up closed by the bot 😅
3. opencodejr commented on Oct 28, 2026

   

   opencodejrBot

   on Oct 28, 2026

   Contributor

   More actions

   Thanks for the detailed report. I reproduced the refresh-margin part on the latest dev (fa1260d6).

   I used a fake OAuth provider that gives out 300-second access tokens and a new refresh token on every exchange. I saved a freshly issued credential and resolved it three times, and every resolve refreshed it: refresh-0, refresh-1, refresh-2, when none should have. The cause is the fixed 5-minute margin in Integration.connection.resolve (packages/core/src/integration.ts): a token that lives 5 minutes or less always counts as expiring, so it is refreshed right after login, as in your logs. The test script below reproduces it.

   The race between locations and processes has been addressed on dev by #54023, which adds a shared per-credential lock, a cross-process file lock and a reread before refreshing. I didn't test that part again here, and I didn't test the case of a refresh result overwriting a credential that was removed or replaced in the meantime.

   Related: #50760 (your earlier PR), #34520 (the MCP OAuth path).

   Reproduction script (integration-refresh-margin.test.ts)

   // Reproduction for anomalyco/opencode#50759 (refresh margin part).
   // Copy into packages/core/test/ and run: cd packages/core && bun test test/integration-refresh-margin.test.ts
   import { expect } from "bun:test"
   import { Clock, Context, Effect, Layer } from "effect"
   import { Node } from "@opencode/util/effect/app-node"
   import { LayerNode } from "@opencode/util/effect/layer-node"
   import { Credential } from "@opencode/core/credential"
   import { Integration } from "@opencode/core/integration"
   import { testEffect } from "./lib/effect"
   
   const it = testEffect(Layer.empty)
   
   it.effect("a fresh 300-second OAuth token is used without refreshing", () =>
     Effect.gen(function* () {
       const layer = LayerNode.compile(LayerNode.group([Integration.node, Credential.node]), {
         shared: Node.tags.values.global,
       })
       const ctx = yield* Layer.build(layer)
       const integration = Context.get(ctx, Integration.Service)
       const credentials = Context.get(ctx, Credential.Service)
       const integrationID = Integration.ID.make("openai")
       const methodID = Integration.MethodID.make("oauth")
       const exchanged: string[] = []
       let n = 0
       yield* integration.transform((editor) =>
         editor.method.update({
           integrationID,
           method: { id: methodID, type: "oauth", label: "OAuth" },
           authorize: () => Effect.die("unused sign-in"),
           // Provider issues 300-second access tokens and rotates the refresh token on each exchange.
           refresh: (value: Credential.OAuth) =>
             Effect.gen(function* () {
               exchanged.push(value.refresh)
               n++
               const now = yield* Clock.currentTimeMillis
               return Credential.OAuth.make({ ...value, access: `access-${n}`, refresh: `refresh-${n}`, expires: now + 300_000 })
             }),
         }),
       )
       const now = yield* Clock.currentTimeMillis
       // Just logged in: token valid for the full 300 seconds.
       const stored = yield* credentials.create({
         integrationID,
         value: Credential.OAuth.make({ type: "oauth", methodID, access: "access-0", refresh: "refresh-0", expires: now + 300_000 }),
       })
       const connection = { type: "credential" as const, id: stored.id, label: stored.label, method: "oauth" as const }
       for (let i = 0; i < 3; i++) yield* integration.connection.resolve(connection)
       console.log("refresh tokens exchanged:", exchanged)
       expect(exchanged).toEqual([])
     }),
   )

   Run it: bun integration-refresh-margin.test.ts
4. opencodejr

   added

   reproduced

   on Oct 28, 2026