Repository navigation
Conversation
|
Thanks for your contribution! This PR doesn't have a linked issue. All PRs must reference an existing issue. Please:
See CONTRIBUTING.md for details. |
There was a problem hiding this comment.
I pulled this out since it was essentially doubling integration.test.ts's line count, but not sure if this is better organizationally - please lmk!
There was a problem hiding this comment.
Copilot review overview
🟡 Changes recommended
File locking currently affects all stored credential resolutions, causing unnecessary latency and filesystem dependency for non-refresh paths.
Review effort: Balanced
Findings: 1
Open (1)
What changed in this PR
Coordinates OAuth credential refreshes across locations and processes sharing credential storage.
Changes:
- Adds file-lock-based refresh coordination, expiry margin, timeout, and failed-refresh replay protection.
- Adds compare-and-swap credential updates to prevent stale overwrites.
- Adds comprehensive concurrency, rotation, cancellation, and process-level tests.
| File | Description |
|---|---|
packages/core/src/integration.ts |
Coordinates OAuth refresh operations. |
packages/core/src/credential.ts |
Adds guarded credential-value updates. |
packages/core/src/database/database.ts |
Exposes the backing database path. |
packages/core/test/integration-refresh.test.ts |
Tests refresh coordination and failure scenarios. |
packages/core/test/credential.test.ts |
Tests guarded updates. |
packages/core/test/integration.test.ts |
Updates integration test layers and mocks. |
packages/core/test/mcp-oauth.test.ts |
Updates the credential mock interface. |
packages/core/test/config/config.test.ts |
Updates configuration-test mocks. |
packages/core/test/fixture/config-nodes.ts |
Updates shared credential fixtures. |
packages/core/test/fixture/oauth-refresh.ts |
Adds a refresh endpoint fixture. |
packages/core/test/fixture/integration-refresh-worker.ts |
Adds cross-process refresh workers. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
| const lockKey = `credential:${connection.id}` | ||
| return yield* flock | ||
| .withLock( |
|
Automated PR Cleanup Thank you for contributing to opencode. Due to the high volume of PRs from users and AI agents, we periodically close older PRs using automated criteria so maintainers can focus review time on the most active and community-supported contributions. This PR was closed because it matched the following cleanup criteria:
PRs created within the last month are not affected by this cleanup. If you believe this PR was closed incorrectly, or if you are still actively working on it, please leave a comment explaining why it should be reopened. A maintainer can review and reopen it if appropriate. Thanks again for taking the time to contribute. |
Issue for this PR
Closes #50759
Related to #34520, which tracks the separate MCP OAuth path.
Type of change
What does this PR do?
Coordinates OAuth credential refreshes across locations and processes that share a credential database. The refresh path now rereads the credential while holding a file lock, uses a 30-second expiry margin for short-lived tokens, persists rotated credentials with a guarded update, and blocks replay after an exchange has an uncertain outcome.
This prevents a five-minute token from refreshing immediately and prevents concurrent callers from spending the same rotating refresh token twice.
How did you verify your code works?
Screenshots / recordings
Not applicable.
Checklist