mirror of
https://github.com/Nezumi-2711/9router.git
synced 2026-09-22 13:38:31 +00:00
fix(codex): durable OAuth refresh lifecycle
Add shared OAuth credential lifecycle manager with provider-aware refresh decisions. Implement CodexExecutor.refreshCredentials so 401/403 retry refresh works for Codex, track lastRefreshAt and refresh before the upstream stale-token window, preserve omitted idToken, and add per-connection single-flight refresh to avoid refresh-token rotation races. Merged from PR #1664. Co-authored-by: Cursor <cursoragent@cursor.com>
This commit is contained in:
Kevin Le
committed by
decolua
decolua
co-authored by
Cursor
Cursor
parent
38b73bfc6b
commit
c233c7c8fc
@@ -0,0 +1,151 @@
|
||||
import {
|
||||
getRefreshLeadMs,
|
||||
isUnrecoverableRefreshError,
|
||||
refreshTokenByProvider,
|
||||
} from "./tokenRefresh.js";
|
||||
|
||||
export const CODEX_MAX_REFRESH_AGE_MS = 8 * 24 * 60 * 60 * 1000;
|
||||
|
||||
const refreshLocks = new Map();
|
||||
|
||||
function parseTimeMs(value) {
|
||||
if (value === undefined || value === null || value === "") return null;
|
||||
if (typeof value === "number") {
|
||||
return value < 1e12 ? value * 1000 : value;
|
||||
}
|
||||
|
||||
const parsed = new Date(value).getTime();
|
||||
return Number.isFinite(parsed) ? parsed : null;
|
||||
}
|
||||
|
||||
function toExpiresAt(expiresIn, nowMs = Date.now()) {
|
||||
if (!expiresIn) return null;
|
||||
return new Date(nowMs + expiresIn * 1000).toISOString();
|
||||
}
|
||||
|
||||
export function getCredentialExpiryMs(credentials) {
|
||||
return parseTimeMs(credentials?.expiresAt ?? credentials?.tokenExpiresAt);
|
||||
}
|
||||
|
||||
export function getCredentialLastRefreshMs(credentials) {
|
||||
return parseTimeMs(
|
||||
credentials?.lastRefreshAt ??
|
||||
credentials?.lastRefresh ??
|
||||
credentials?.providerSpecificData?.lastRefreshAt
|
||||
);
|
||||
}
|
||||
|
||||
export function isCodexRefreshStale(credentials, nowMs = Date.now()) {
|
||||
const lastRefreshMs = getCredentialLastRefreshMs(credentials);
|
||||
return !lastRefreshMs || nowMs - lastRefreshMs >= CODEX_MAX_REFRESH_AGE_MS;
|
||||
}
|
||||
|
||||
export function shouldRefreshCredentials(provider, credentials, nowMs = Date.now()) {
|
||||
if (!credentials) return false;
|
||||
|
||||
const expiresAtMs = getCredentialExpiryMs(credentials);
|
||||
if (expiresAtMs !== null && expiresAtMs - nowMs < getRefreshLeadMs(provider)) {
|
||||
return true;
|
||||
}
|
||||
|
||||
if (provider === "codex" && credentials.refreshToken && isCodexRefreshStale(credentials, nowMs)) {
|
||||
return true;
|
||||
}
|
||||
|
||||
return false;
|
||||
}
|
||||
|
||||
export function mergeProviderSpecificData(existing, next) {
|
||||
if (!next || typeof next !== "object") return existing;
|
||||
return {
|
||||
...(existing || {}),
|
||||
...next,
|
||||
};
|
||||
}
|
||||
|
||||
export function mergeRefreshedCredentials(provider, currentCredentials, refreshedCredentials, nowMs = Date.now()) {
|
||||
if (!refreshedCredentials) return null;
|
||||
if (isUnrecoverableRefreshError(refreshedCredentials)) return refreshedCredentials;
|
||||
|
||||
const next = {};
|
||||
const nowIso = new Date(nowMs).toISOString();
|
||||
|
||||
if (refreshedCredentials.accessToken) next.accessToken = refreshedCredentials.accessToken;
|
||||
if (refreshedCredentials.apiKey) next.apiKey = refreshedCredentials.apiKey;
|
||||
if (refreshedCredentials.token) next.token = refreshedCredentials.token;
|
||||
|
||||
const refreshToken = refreshedCredentials.refreshToken ?? currentCredentials?.refreshToken;
|
||||
if (refreshToken) next.refreshToken = refreshToken;
|
||||
|
||||
const idToken = refreshedCredentials.idToken ?? currentCredentials?.idToken;
|
||||
if (idToken) next.idToken = idToken;
|
||||
|
||||
if (refreshedCredentials.expiresIn) {
|
||||
next.expiresIn = refreshedCredentials.expiresIn;
|
||||
next.expiresAt = toExpiresAt(refreshedCredentials.expiresIn, nowMs);
|
||||
} else if (refreshedCredentials.expiresAt) {
|
||||
next.expiresAt = refreshedCredentials.expiresAt;
|
||||
}
|
||||
|
||||
if (refreshedCredentials.projectId) next.projectId = refreshedCredentials.projectId;
|
||||
|
||||
if (refreshedCredentials.providerSpecificData) {
|
||||
next.providerSpecificData = mergeProviderSpecificData(
|
||||
currentCredentials?.providerSpecificData,
|
||||
refreshedCredentials.providerSpecificData
|
||||
);
|
||||
}
|
||||
|
||||
if (refreshedCredentials.copilotToken) next.copilotToken = refreshedCredentials.copilotToken;
|
||||
if (refreshedCredentials.copilotTokenExpiresAt) {
|
||||
next.copilotTokenExpiresAt = refreshedCredentials.copilotTokenExpiresAt;
|
||||
}
|
||||
|
||||
if (
|
||||
provider === "codex" ||
|
||||
next.accessToken ||
|
||||
next.apiKey ||
|
||||
next.token ||
|
||||
next.refreshToken ||
|
||||
next.copilotToken
|
||||
) {
|
||||
next.lastRefreshAt = refreshedCredentials.lastRefreshAt || nowIso;
|
||||
}
|
||||
|
||||
return next;
|
||||
}
|
||||
|
||||
function getRefreshLockKey(provider, credentials) {
|
||||
const stableId =
|
||||
credentials?.connectionId ||
|
||||
credentials?.id ||
|
||||
credentials?.email ||
|
||||
credentials?.name ||
|
||||
credentials?.refreshToken?.slice?.(-16) ||
|
||||
"default";
|
||||
return `${provider}:${stableId}`;
|
||||
}
|
||||
|
||||
export async function withCredentialRefreshLock(provider, credentials, refreshFn) {
|
||||
const key = getRefreshLockKey(provider, credentials);
|
||||
const existing = refreshLocks.get(key);
|
||||
if (existing) return existing;
|
||||
|
||||
const pending = Promise.resolve()
|
||||
.then(refreshFn)
|
||||
.finally(() => {
|
||||
refreshLocks.delete(key);
|
||||
});
|
||||
|
||||
refreshLocks.set(key, pending);
|
||||
return pending;
|
||||
}
|
||||
|
||||
export async function refreshProviderCredentials(provider, credentials, log) {
|
||||
if (!credentials) return null;
|
||||
|
||||
return withCredentialRefreshLock(provider, credentials, async () => {
|
||||
const refreshed = await refreshTokenByProvider(provider, credentials, log);
|
||||
return mergeRefreshedCredentials(provider, credentials, refreshed);
|
||||
});
|
||||
}
|
||||
@@ -277,6 +277,27 @@ export async function refreshQwenToken(refreshToken, log) {
|
||||
}, log);
|
||||
}
|
||||
|
||||
export function classifyOAuthRefreshError(errorText = "", status = 0) {
|
||||
let parsed = null;
|
||||
try {
|
||||
parsed = errorText ? JSON.parse(errorText) : null;
|
||||
} catch {
|
||||
parsed = null;
|
||||
}
|
||||
|
||||
const code = parsed?.error?.code || parsed?.error || parsed?.error_code || "";
|
||||
const description = parsed?.error_description || parsed?.message || errorText || "";
|
||||
const combined = `${code} ${description}`.toLowerCase();
|
||||
const permanent = [
|
||||
"refresh_token_expired",
|
||||
"refresh_token_reused",
|
||||
"refresh_token_invalidated",
|
||||
"invalid_grant",
|
||||
].some((marker) => combined.includes(marker));
|
||||
|
||||
return { status, code, description, permanent };
|
||||
}
|
||||
|
||||
/**
|
||||
* Specialized refresh for Codex (OpenAI) OAuth tokens.
|
||||
* OpenAI uses rotating (one-time-use) refresh tokens.
|
||||
@@ -286,68 +307,59 @@ export async function refreshQwenToken(refreshToken, log) {
|
||||
export async function refreshCodexToken(refreshToken, log) {
|
||||
if (!refreshToken) return null;
|
||||
return dedupRefresh("codex", refreshToken, async () => {
|
||||
try {
|
||||
const response = await fetch(OAUTH_ENDPOINTS.openai.token, {
|
||||
method: "POST",
|
||||
headers: {
|
||||
"Content-Type": "application/x-www-form-urlencoded",
|
||||
Accept: "application/json",
|
||||
},
|
||||
body: new URLSearchParams({
|
||||
grant_type: "refresh_token",
|
||||
refresh_token: refreshToken,
|
||||
client_id: PROVIDERS.codex.clientId,
|
||||
scope: "openid profile email offline_access",
|
||||
}),
|
||||
});
|
||||
|
||||
if (!response.ok) {
|
||||
const errorText = await response.text();
|
||||
|
||||
// Detect unrecoverable errors (token reused/expired) — Auth0 revokes whole family on retry
|
||||
let errorCode = null;
|
||||
try {
|
||||
const parsed = JSON.parse(errorText);
|
||||
errorCode = parsed?.error?.code || (typeof parsed?.error === "string" ? parsed.error : null);
|
||||
} catch {}
|
||||
|
||||
if (
|
||||
errorCode === "refresh_token_reused" ||
|
||||
errorCode === "invalid_grant" ||
|
||||
errorCode === "token_expired" ||
|
||||
errorCode === "invalid_token"
|
||||
) {
|
||||
log?.error?.("TOKEN_REFRESH", "Codex refresh token already used or invalid. Re-auth required.", {
|
||||
status: response.status,
|
||||
errorCode,
|
||||
const response = await fetch(OAUTH_ENDPOINTS.openai.token, {
|
||||
method: "POST",
|
||||
headers: {
|
||||
"Content-Type": "application/json",
|
||||
Accept: "application/json",
|
||||
},
|
||||
body: JSON.stringify({
|
||||
client_id: PROVIDERS.codex.clientId,
|
||||
grant_type: "refresh_token",
|
||||
refresh_token: refreshToken,
|
||||
}),
|
||||
});
|
||||
return { error: "unrecoverable_refresh_error", code: errorCode };
|
||||
|
||||
if (!response.ok) {
|
||||
const errorText = await response.text();
|
||||
const failure = classifyOAuthRefreshError(errorText, response.status);
|
||||
if (failure.permanent) {
|
||||
log?.error?.("TOKEN_REFRESH", "Codex refresh token already used or invalid. Re-auth required.", {
|
||||
status: response.status,
|
||||
code: failure.code,
|
||||
});
|
||||
return { error: "unrecoverable_refresh_error", code: failure.code };
|
||||
}
|
||||
|
||||
log?.error?.("TOKEN_REFRESH", "Failed to refresh Codex token", {
|
||||
status: response.status,
|
||||
error: errorText,
|
||||
code: failure.code,
|
||||
permanent: failure.permanent,
|
||||
});
|
||||
return null;
|
||||
}
|
||||
|
||||
const tokens = await response.json();
|
||||
|
||||
log?.info?.("TOKEN_REFRESH", "Successfully refreshed Codex token", {
|
||||
hasNewAccessToken: !!tokens.access_token,
|
||||
hasNewRefreshToken: !!tokens.refresh_token,
|
||||
hasIdToken: !!tokens.id_token,
|
||||
expiresIn: tokens.expires_in,
|
||||
});
|
||||
|
||||
return {
|
||||
accessToken: tokens.access_token,
|
||||
refreshToken: tokens.refresh_token || refreshToken,
|
||||
idToken: tokens.id_token,
|
||||
expiresIn: tokens.expires_in,
|
||||
};
|
||||
} catch (error) {
|
||||
log?.error?.("TOKEN_REFRESH", `Network error refreshing Codex token: ${error.message}`);
|
||||
return null;
|
||||
}
|
||||
|
||||
log?.error?.("TOKEN_REFRESH", "Failed to refresh Codex token", {
|
||||
status: response.status,
|
||||
error: errorText,
|
||||
});
|
||||
return null;
|
||||
}
|
||||
|
||||
const tokens = await response.json();
|
||||
|
||||
log?.info?.("TOKEN_REFRESH", "Successfully refreshed Codex token", {
|
||||
hasNewAccessToken: !!tokens.access_token,
|
||||
hasNewRefreshToken: !!tokens.refresh_token,
|
||||
expiresIn: tokens.expires_in,
|
||||
});
|
||||
|
||||
return {
|
||||
accessToken: tokens.access_token,
|
||||
refreshToken: tokens.refresh_token || refreshToken,
|
||||
expiresIn: tokens.expires_in,
|
||||
};
|
||||
} catch (error) {
|
||||
log?.error?.("TOKEN_REFRESH", `Network error refreshing Codex token: ${error.message}`);
|
||||
return null;
|
||||
}
|
||||
}, log);
|
||||
}
|
||||
|
||||
|
||||
Reference in New Issue
Block a user