Repository navigation
feat(auth): renew browser logins with the stored refresh token - #2
Open
trukhinyuri wants to merge 1 commit into
Open
trukhinyuri wants to merge 1 commit into
trukhinyuri wants to merge 1 commit into
Conversation
Browser logins kept Cursor's refresh token but never used it, so every account had to sign in again when its access token expired (about two months after login). auth.refresh now exchanges the refresh token at api2.cursor.sh/oauth/token (grant_type refresh_token, the client id Cursor's IDE and CLI use) once the access token is within a day of expiry, and reports shouldLogout or a rejected grant as 401. Fresh tokens are still checked locally without a request. Cursor's login poll returns one session token as both access and refresh token, and renewal answers with a new session token and no refresh token. When the stored refresh token is a JWT that expires before the new token, the new token becomes the refresh token as well, so renewal does not depend on the original login's expiry. A rotated refresh token is stored as returned; opaque or longer-lived ones are kept. CPA's refresh loop only calls auth.refresh for plugin credentials that name an interval, so renewable logins now carry the host attribute refresh_interval_seconds=3600. API keys and cursor-agent imports are unchanged.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Browser logins are never renewed. CPA's refresh loop only calls
auth.refreshfor plugin credentials that name a refresh interval, and the plugin never sets one, so an account has to sign in again when its session token expires. Cursor's login poll issues a 60-day session token, so a login made today stops working in about two months with401 Cursor token expired; sign in to Cursor again.Change
auth.refreshexchanges the stored refresh token atapi2.cursor.sh/oauth/token(grant_type=refresh_token, the client id Cursor's IDE and CLI use) once the access token is within a day of expiry; fresh tokens are still checked locally without a request.shouldLogoutor a rejected grant is reported as 401.refresh_interval_seconds=3600, which makes CPA scheduleauth.refresh. API keys andcursor-agentimports are unchanged./oauth/requests are sent withoutConnect-Protocol-Version. README and README_CN describe renewal.Tests
refresh_test.go: renewal inside and outside the one-day window,shouldLogout, rejected grant, chained refresh token (four cases), refresh-token rotation, API-key and import credentials untouched, interval attribute set only for renewable logins.go test -race ./...,gofmtandgo vetpass.renewal_state=awaiting_first_renewal, the forced refresh leaves the file unchanged, then chat fails with 401 after expiry). With this change CPA's scheduler renews the credential on its own, a followingcomposer-2.5chat succeeds, and a second and third renewal (using the renewed token as the refresh credential) are accepted.