Repository navigation
Conversation
Provider logins used the default 5-minute expiry margin, so a 5-minute token refreshed on every resolve. Use a 30-second margin for provider logins. MCP OAuth keeps its own margin. Fixes anomalyco#50759
There was a problem hiding this comment.
🟢 Approval recommended
No active review issues remain for the provider OAuth refresh-margin change.
No open issues 🎉
What changed in this PR
This PR addresses the short-lived-token refresh problem in #50759 by using a 30-second refresh margin for provider OAuth credentials. MCP OAuth behavior remains unchanged.
Changes:
- Apply the same 30-second margin to both the initial expiry check and the refresh-time stale check.
- Add regression tests verifying that fresh 300-second tokens are reused and tokens nearing expiry refresh only once.
| File | Description |
|---|---|
packages/core/test/integration-refresh.test.ts |
Adds coverage for short-lived token reuse and the 30-second refresh threshold. |
packages/core/src/integration.ts |
Applies a shared 30-second expiry check to provider credential resolution and refresh. |
Review effort: Balanced
![opencodejr[bot]](https://avatars.githubusercontent.com/in/5497873?s=60&v=4){kind=small}
There was a problem hiding this comment.
This looks good to me. On the base, I ran the reproduction from #50759: a freshly issued 300-second token was refreshed on every resolve (refresh-0, refresh-1, refresh-2). With this change it isn't refreshed at all. Both new tests fail on the base and pass here. The integration and credential tests (34) and tsc -b in packages/core pass.
The same 30-second margin is used for the first check and for the re-check inside Credential.refresh, so the two stay consistent. It matches the margin MCP OAuth already uses (REFRESH_AHEAD).
Public API: unchanged. This is internal to Integration.connection.resolve, and Credential.expiring keeps its signature and default.
No blocking concerns.
Issue for this PR
Closes #50759
Type of change
What does this PR do?
Provider logins refresh an OAuth token when it expires within
Credential.expiring's default margin of 5 minutes. A provider that issues 5-minute access tokens therefore refreshes on every resolve, which also rotates the refresh token each time.This passes a 30-second margin from
Integration.connection.resolve. MCP OAuth keeps its ownREFRESH_AHEAD.How did you verify your code works?
bun run teston the integration, integration-refresh, credential and credential-refresh tests passes (34 tests), and so dobun typecheck, oxlint and prettier.Screenshots / recordings
Not a UI change.
Checklist