Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix: automatically clear auth token if refresh token is invalid #6760

Draft
wants to merge 6 commits into
base: main
Choose a base branch
from
Draft

fix: automatically clear auth token if refresh token is invalid #6760

Changes from 1 commit
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
3a7bdcb
fix: automatically clear auth token if refresh token is invalid
vvagaytsev Jan 13, 2025
feaa8d2
chore: get actual status code from the error instance
vvagaytsev Jan 14, 2025
86bb530
Merge branch 'main' into fix/clear-refresh-token
vvagaytsev Jan 15, 2025
78e12d1
chore: add helper function to recognize `TRPCClientError`
vvagaytsev Jan 15, 2025
1be465c
Merge branch 'main' into fix/clear-refresh-token
vvagaytsev Jan 21, 2025
d0090b5
Merge branch 'main' into fix/clear-refresh-token
vvagaytsev Feb 3, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 10 additions & 2 deletions core/src/cloud/grow/auth.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,8 +14,9 @@ import type { Log } from "../../logger/log-entry.js"
import { getNonAuthenticatedApiClient } from "./trpc.js"
import { CloudApiTokenRefreshError } from "../api.js"
import { CloudApiError } from "../../exceptions.js"
import { saveAuthToken } from "../auth.js"
import { clearAuthToken, saveAuthToken } from "../auth.js"
import { getCloudDistributionName } from "../util.js"
import dedent from "dedent"

export function isTokenExpired(token: ClientAuthToken) {
const now = new Date()
Expand Down Expand Up @@ -86,8 +87,15 @@ export async function refreshAuthTokenAndWriteToConfigStore(
}

log.debug({ msg: `Failed to refresh the token.` })
if (err.message.toLowerCase().includes("invalid refresh token")) {
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can we also determine the token validity using the response status code?

Suggested change
if (err.message.toLowerCase().includes("invalid refresh token")) {
if (err.statusCode >= 400 && err.statusCode < 500) {

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Maybe we should even test for 401 explicitly

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If we ever migrate to other kinds of tokens that need to be decoded, e.g. JWT tokens then we should also delete the token on 400 response though, so I think 400 <= code < 500 is fine

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Backend V2 did not return any status code for invalid token.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We need to change the backend in that case, to make sure that it will emit correct status code in this case then. Maybe @hph can support you on this?

Copy link
Contributor

@hph hph Jan 13, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The error returned is UNAUTHORIZED, which should map to 401. This status code is available in the httpStatus property, at least when using the frontend client, but I think it should be the same in core. Reference (see error shape above the linked table)

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I double-check that and did not see the status code in the TRPCClientError instance. The data property (that should contain httpStatus) was undefined, I'm not sure why.

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I found the original error code deep inside the error object.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is it maybe helpful to infer the specific error shape for the router? See also https://trpc.io/docs/client/vanilla/infer-types#infer-trpcclienterror-types

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I did it in feaa8d2 - we need the nested cause there. Not sure why the error is wrapped in such a way,

await clearAuthToken(log, globalConfigStore, cloudDomain)
log.info("Invalid refresh token was removed from the configuration store.")
}

throw new CloudApiTokenRefreshError({
message: `An error occurred while verifying client auth token with ${getCloudDistributionName(cloudDomain)}: ${err.message}`,
message: dedent`An error occurred while verifying client auth token with ${getCloudDistributionName(cloudDomain)}: ${err.message}
Please try again.
`,
responseStatusCode: err.data?.httpStatus,
})
}
Expand Down