stacklok / toolhive / 25211490103

65%

Build Type

push

github

Committed by web-flow

Commit Message

Carry forward upstream refresh token on re-authorization (#5132)

* Add GetLatestUpstreamTokensForUser to storage

Introduces a secondary upstream-token lookup keyed on (userID, providerID)
on the UpstreamTokenStorage interface. The OAuth callback handler will use
this in a follow-on commit to preserve a previously-issued refresh token
when the upstream IdP omits refresh_token on re-authorization (e.g. Google
without prompt=consent), which today silently clobbers the prior good RT
and forces a refresh-token-orphaning loop.

This commit only adds the interface surface plus stub implementations on
both backends that return ErrNotFound. The real Memory and Redis logic, the
callback wiring, and tests land in subsequent commits so each diff stays
small and independently reviewable. The godoc explicitly calls out the
liveness contract (expired rows are returned, callers handle it) and the
cross-identity caller responsibility (verify UpstreamSubject before reusing
the prior RT) so future callers cannot misuse the lookup.

Refs #5047

* Implement GetLatestUpstreamTokensForUser for memory

Replaces the Step 1 stub on MemoryStorage with the real lookup. Iterates
the upstream-tokens map under RLock, filters by (UserID, ProviderID), and
picks the row with the highest ExpiresAt. Expired access tokens are
intentionally returned (matching the interface contract) so the OAuth
callback can carry forward a still-valid refresh token even when the
access token is dead.

Returns a defensive deep copy on hit and the same wrapped ErrNotFound
shape that GetUpstreamTokens uses on miss, so callers cannot accidentally
mutate stored state through the returned pointer.

Adds a 7-case table-driven test covering: no match, one match (with a
deep-copy mutation assertion), latest-by-ExpiresAt across three rows,
different-user/different-provider misses, expired-row tolerance, and
zero-ExpiresAt losing to non-zero.

Refs #5047

* Implement GetLatestUpstreamTokensForUser for redis

Repl... (continued)

Coverage Stats

153 of 188 new or added lines in 4 files covered. (81.38%)

40 existing lines in 5 files now uncovered.

61310 of 95347 relevant lines covered (64.3%)

59.11 hits per line