stacklok / toolhive / 38576322591

71%

Build Type

push

github

Committed by web-flow

Commit Message

Refresh upstream tokens when the ID token expires (#6773)

* Add opt-in refresh on expired upstream ID token

Upstream token refresh was keyed only on access-token expiry, so a
provider whose ID token expires before its access token (e.g. Entra ID)
left consumers holding an expired ID token for part of every cycle.

Implements changes for issue #6237:
- Add WithRefreshOnExpiredIDToken option to InProcessService; when set,
  an expired stored ID token triggers a refresh in both GetValidTokens
  and GetAllUpstreamCredentials, reusing the refresher path
- Suppress the trigger until the access token next expires when a
  refresh leaves the ID token expired (provider omitted id_token) or
  fails, so reads do not loop on refresh
- Default behaviour is unchanged; document the option and the
  omitted-id_token caveat on Identity.UpstreamIDTokens

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* Let ID-token refresh reach the upstream provider

The refresher short-circuited whenever the re-read row's access token
was unexpired, so the opt-in ID-token trigger never actually rotated
the ID token in production. It now skips the upstream call only when
the row was rewritten since the caller read it.

- Add an end-to-end test against the real refresher and mockoidc
- Back off briefly after a failed ID-token refresh instead of until
  access-token expiry, so a transient error does not reopen the window

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* Compare expiry when detecting a rotated token row

A provider that re-issues the same access token string with a new
expiry would not count as a change, so a queued caller would redeem
the refresh token a second time. Also test the failed-refresh backoff
window.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* Always refresh upstream tokens on expired ID token

The opt-in option was not wired into any production caller, so #6237
stayed unfixed in practice. Refreshing on an expired ID toke... (continued)

Coverage Stats

98 of 98 new or added lines in 2 files covered. (100.0%)

436 existing lines in 7 files now uncovered.

86545 of 121469 relevant lines covered (71.25%)

126.58 hits per line