Uh oh!
There was an error while loading. Please reload this page.
remote/oidc: discriminated credential record + session-aware resolve (T4) - #203
Merged
Conversation
…(T4)
Extends the 0600 credential store to carry OIDC sessions alongside the
existing static tokens (LLP 0046 D4), and adds the attach-path resolver
(LLP 0046 D5):
- Records gain a kind discriminator. readCredentials normalizes each
record; a legacy token-only record (no kind) reads as static, so
existing files keep working without a rewrite. writeToken now stamps
kind: 'static'.
- writeSession(stateDir, target, { refreshToken, accessJwt, expiresAt,
org }) writes a kind: 'oidc' record through the same atomic 0600 path.
- resolveAccessJwt({ target, env, stateDir, identityBase, now, fetchImpl
}): env override wins; a static record returns its token; an oidc
record returns a fresh access JWT, refreshing + persisting when the
cached one is within a 60s skew of expiry, and propagating a refresh
failure (typed invalid_grant). resolveToken stays for the stdio proxy.
- removeToken drops either kind (whole-record delete, unchanged).
- types.d.ts: RemoteStaticRecord / RemoteOidcRecord / the union.
Unit tests cover the round-trip, legacy normalization, env override,
fresh vs stale refresh + persistence, and failure propagation. Full
suite green.… record Review follow-up (PR #199): an incomplete oidc shape (refreshToken but no accessJwt) on a hand-edited record no longer returns null and drop a working static `token`; it falls through to the static branch. Added boundary tests: the static fallthrough, a malformed-oidc drop, resolveToken on an oidc record, and a skew-window-boundary refresh.
platypii
commented
Jun 29, 2026
ContributorAuthor
Review (independent agent review) — carried from #199Verdict: approve-with-nits. Read-implicit migration, env-override precedence, Findings: (minor) Addressed here: |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Chunk 3 of the OIDC client login (LLP 0046-0048). Recreated against the integration branch (the original #199 was auto-closed when its stacked base branch was deleted during merge; its review is at #199).
What (LLP 0046 D4/D5)
kind: 'static' | 'oidc'discriminator; a legacytoken-only record reads asstatic(read-implicit migration).writeTokenstampsstatic;writeSessionwritesoidc.resolveAccessJwt: env override wins; static returns its token; oidc returns a fresh JWT, refreshing + persisting within a 60s skew of expiry, propagatinginvalid_grant.resolveTokenstays for the stdio proxy.removeTokendrops either kind.types.d.tsgains the record interfaces.Review + fixes applied
Independent review (approve-with-nits); fix applied here:
normalizeRecordnow keeps a usable statictokenwhen a corrupt record carries an incomplete oidc shape. Added boundary tests (skew-window edge, malformed-oidc drop,resolveTokenon oidc). Full credential suite green (21), typecheck clean.