Repository navigation
fix(ghcli): refresh login with token - #259
Merged
Merged
Conversation
Keep the authenticated login in each TokenSource and invalidate it when gh returns a different token. Return token and login as one credential pair so independent sources and account switches cannot reuse a process-wide identity. Fixes aenix-io#186 Assisted-by: LLM Signed-off-by: frolov.so <opsmon.sh@yandex.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
fix(ghcli): refresh login with token
Summary
TokenSourceTokenAndLoginso a token and its owner are returned from one locked view of the sourceProblem
internal/ghclirefreshed the token every five minutes but cached the corresponding GitHub login for the lifetime of the process. Aftergh auth loginswitched accounts, a long-running server could therefore push with the new credential while attributing commits to the previous account. The package-level login cache could also leak an identity between separate credential sources.Solution
The token and identity caches now have the same owner and lifecycle.
Loginreads the current token before trusting its cached identity, and a changed token clears that identity sogh api useris queried again. IndependentTokenSourceinstances no longer share login state.TokenSourcealso implementsforge.Credential, allowing callers to obtain the token and login together without a refresh splitting the pair across credentials.Testing
go test -race ./internal/ghcli ./cmd/aeman ./docs/designgolangci-lint run ./internal/ghcli/...git diff --checkThe full repository checks currently report unrelated existing failures:
make test: date-sensitive September/October assertions inpkg/boardservicemake lint: existinggosec G703finding incmd/aeman/service.go:651Fixes #186