Extract proxy auth into a token.Source abstraction#228
Merged
Conversation
Token handling was split across two packages and implemented twice: the
interactive grant lived in pkg/auth/{client,store} while the proxy client
carried its own client_credentials token cache, mode branching, and a
mode-specific 401 retry. The proxy — whose job is to send authenticated
requests — knew which OAuth grant was in play and ran one of two token
caches.
Introduce pkg/auth/token with a single Source interface (Token /
Invalidate) and a NewSource factory that owns the grant decision and the
construction of the OAuth client and credential store. The proxy now
resolves only its issuer and holds an opaque Source; the ccTokens cache,
usesClientCredentials branching, and clientCredentialsToken all leave
pkg/proxy.
Refresh the access token proactively at 50% of its lifetime (shared
client.ShouldRefresh policy) instead of waiting for the 5-minute expiry
buffer, leaving a wide margin before expiry. Add a uniform
invalidate-and-retry-once on 401/403 across every server-to-proxy request
path (ClickHouseQuery, Discover, the server-side query funnel, and the
embedder), replacing the client_credentials-only retry, so a token
revoked before the local buffer self-heals regardless of grant.
Contributor
🐼 Smoke eval —
|
| question | result | tokens | tools |
|---|---|---|---|
forky_node_coverage |
✅ | 12,415 | 3 |
tracoor_node_coverage |
✅ | 13,117 | 4 |
mainnet_block_arrival_p50 |
✅ | 17,338 | 12 |
list_datasources |
✅ | 11,395 | 1 |
block_count_24h |
✅ | 14,571 | 8 |
missed_slots_24h |
✅ | 14,741 | 6 |
🔭 Langfuse traces (6 runs; ⚠️ = failed)
The report walks this branch's commits against the master baseline and the most recent release. A self-contained copy is in the run's eval-smoke-* artifact.
Restores pre-refactor behaviour: the interactive refresh Source now reloads the credential file on every Token call, so a login or logout performed by the host CLI on the bind-mounted credentials file is observed by a running server without a restart. Returns ErrNotAuthenticated when the file is absent.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Token handling was split across two packages and implemented twice — the interactive grant in
pkg/auth/{client,store}, and a separate in-memoryclient_credentialscache plus mode-branching and a mode-specific 401 retry living inside the proxy client. This introducespkg/auth/tokenwith oneSourceinterface (Token/Invalidate) and aNewSourcefactory that owns the grant decision and builds the OAuth client + credential store, so the proxy resolves only its issuer and holds an opaqueSource— theccTokenscache,usesClientCredentialsbranching, andclientCredentialsTokenall leavepkg/proxy. It also refreshes the access token proactively at 50% of its lifetime (sharedclient.ShouldRefreshpolicy, a one-line change to flip to 75%) rather than waiting for the 5-minute expiry buffer, and adds a uniform invalidate-and-retry-once on 401/403 across every server-to-proxy request path (ClickHouseQuery,Discover, the server-side query funnel, and the embedder), replacing theclient_credentials-only retry so a server-side token revocation self-heals regardless of grant.proxy.Servicegains anInvalidate()method (used by the retry), which required a one-line addition to the existing proxy implementations and test fakes.