MythEclipse/9router
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(codex): durable OAuth refresh lifecycle

Browse Source 
Add shared OAuth credential lifecycle manager with provider-aware refresh
decisions. Implement CodexExecutor.refreshCredentials so 401/403 retry
refresh works for Codex, track lastRefreshAt and refresh before the
upstream stale-token window, preserve omitted idToken, and add
per-connection single-flight refresh to avoid refresh-token rotation races.

Merged from PR #1664.

Co-authored-by: Cursor <cursoragent@cursor.com>
This commit is contained in:
Kevin Le
2026-06-06 11:04:36 +07:00
committed by decolua
co-authored by Cursor
parent 38b73bfc6b
commit c233c7c8fc
15 changed files with 484 additions and 140 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/app/api/providers/[id]/test/testUtils.js
+19 -19
View File
@@ -5,10 +5,13 @@ import { isOpenAICompatibleProvider, isAnthropicCompatibleProvider } from "@/sha
import { PROVIDER_ENDPOINTS } from "@/shared/constants/config";
import { getDefaultModel } from "open-sse/config/providerModels.js";
import { resolveOllamaLocalHost } from "open-sse/config/providers.js";
import {
refreshProviderCredentials,
shouldRefreshCredentials,
} from "open-sse/services/oauthCredentialManager.js";
import {
GEMINI_CONFIG,
ANTIGRAVITY_CONFIG,
CODEX_CONFIG,
KIRO_CONFIG,
QWEN_CONFIG,
CLAUDE_CONFIG,
@@ -126,18 +129,7 @@ async function refreshOAuthToken(connection) {
}
if (provider === "codex") {
const response = await fetch(CODEX_CONFIG.tokenUrl, {
method: "POST",
headers: { "Content-Type": "application/x-www-form-urlencoded" },
body: new URLSearchParams({
grant_type: "refresh_token",
client_id: CODEX_CONFIG.clientId,
refresh_token: refreshToken,
}),
});
if (!response.ok) return null;
const data = await response.json();
return { accessToken: data.access_token, expiresIn: data.expires_in, refreshToken: data.refresh_token || refreshToken };
return await refreshProviderCredentials(provider, connection, console);
}
if (provider === "claude") {
@@ -227,10 +219,7 @@ async function refreshOAuthToken(connection) {
}
function isTokenExpired(connection) {
if (!connection.expiresAt) return false;
const expiresAt = new Date(connection.expiresAt).getTime();
const buffer = 5 * 60 * 1000;
return expiresAt <= Date.now() + buffer;
return shouldRefreshCredentials(connection.provider, connection);
}
async function testOAuthConnection(connection, effectiveProxy = null) {
@@ -673,14 +662,25 @@ export async function testSingleConnection(id) {
};
if (result.refreshed && result.newTokens) {
updateData.accessToken = result.newTokens.accessToken;
if (result.newTokens.accessToken) updateData.accessToken = result.newTokens.accessToken;
if (result.newTokens.refreshToken) updateData.refreshToken = result.newTokens.refreshToken;
if (result.newTokens.idToken) updateData.idToken = result.newTokens.idToken;
if (result.newTokens.lastRefreshAt) updateData.lastRefreshAt = result.newTokens.lastRefreshAt;
if (result.newTokens.expiresIn) updateData.expiresIn = result.newTokens.expiresIn;
if (result.newTokens.expiresIn) {
updateData.expiresAt = new Date(Date.now() + result.newTokens.expiresIn * 1000).toISOString();
} else if (result.newTokens.expiresAt) {
updateData.expiresAt = result.newTokens.expiresAt;
}
if (result.newTokens.providerSpecificData) {
updateData.providerSpecificData = {
...(connection.providerSpecificData || {}),
...result.newTokens.providerSpecificData,
};
}
}
await updateProviderConnection(id, updateData);
return { valid: result.valid, error: result.error, latencyMs, testedAt: new Date().toISOString() };
return { valid: result.valid, error: result.error, refreshed: !!result.refreshed, latencyMs, testedAt: new Date().toISOString() };
}