nezumi/9router
1
0
Fork 0
mirror of https://github.com/Nezumi-2711/9router.git synced 2026-09-22 20:00:47 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(codex): durable OAuth refresh lifecycle

Browse Source 
Add shared OAuth credential lifecycle manager with provider-aware refresh
decisions. Implement CodexExecutor.refreshCredentials so 401/403 retry
refresh works for Codex, track lastRefreshAt and refresh before the
upstream stale-token window, preserve omitted idToken, and add
per-connection single-flight refresh to avoid refresh-token rotation races.

Merged from PR #1664.

Co-authored-by: Cursor <cursoragent@cursor.com>
This commit is contained in:
Kevin Le
2026-06-06 11:04:36 +07:00
committed by decolua
co-authored by Cursor
parent 38b73bfc6b
commit c233c7c8fc
15 changed files with 484 additions and 140 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/app/api/usage/[connectionId]/route.js
+21 -4
View File
@@ -27,7 +27,10 @@ async function refreshAndUpdateCredentials(connection, force = false, proxyOptio
const credentials = {
accessToken: connection.accessToken,
refreshToken: connection.refreshToken,
idToken: connection.idToken,
expiresAt: connection.expiresAt || connection.tokenExpiresAt,
lastRefreshAt: connection.lastRefreshAt,
connectionId: connection.id,
providerSpecificData: connection.providerSpecificData,
// For GitHub
copilotToken: connection.providerSpecificData?.copilotToken,
@@ -68,19 +71,32 @@ async function refreshAndUpdateCredentials(connection, force = false, proxyOptio
updateData.refreshToken = refreshResult.refreshToken;
}
if (refreshResult.idToken) {
updateData.idToken = refreshResult.idToken;
}
if (refreshResult.lastRefreshAt) {
updateData.lastRefreshAt = refreshResult.lastRefreshAt;
}
// Update token expiry
if (refreshResult.expiresIn) {
updateData.expiresAt = new Date(Date.now() + refreshResult.expiresIn * 1000).toISOString();
updateData.expiresIn = refreshResult.expiresIn;
} else if (refreshResult.expiresAt) {
updateData.expiresAt = refreshResult.expiresAt;
}
// Handle provider-specific data (copilotToken for GitHub, etc.)
if (refreshResult.copilotToken || refreshResult.copilotTokenExpiresAt) {
const providerSpecificUpdates = {
...(refreshResult.providerSpecificData || {}),
...(refreshResult.copilotToken ? { copilotToken: refreshResult.copilotToken } : {}),
...(refreshResult.copilotTokenExpiresAt ? { copilotTokenExpiresAt: refreshResult.copilotTokenExpiresAt } : {}),
};
if (Object.keys(providerSpecificUpdates).length > 0) {
updateData.providerSpecificData = {
...connection.providerSpecificData,
copilotToken: refreshResult.copilotToken,
copilotTokenExpiresAt: refreshResult.copilotTokenExpiresAt,
...(connection.providerSpecificData || {}),
...providerSpecificUpdates,
};
}
@@ -91,6 +107,7 @@ async function refreshAndUpdateCredentials(connection, force = false, proxyOptio
const updatedConnection = {
...connection,
...updateData,
providerSpecificData: updateData.providerSpecificData || connection.providerSpecificData,
};
return {