Repository navigation
fix(adapters/linear): default a token without expires_in to 30 days - #131
Conversation
… days Both the single-install and the multi-tenant path keep a client-credentials token forever when the token response has no expires_in. These tests advance the adapter clock past 30 days minus the 1-hour refresh buffer and expect a new token request. They fail on this commit.
When the client-credentials response has no positive expires_in, set the expiry to Linear's documented 30-day lifetime. The existing 1-hour refresh buffer then refreshes the token before Linear expires it. Before this, the expiry was the zero time and both ensureToken and tenantToken kept the token until the process restarted. The zero-expiry branches in both checks are now unreachable, so they are removed. Update the README token contract to match.
|
@codex review |
|
@codex security review |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
Codex Review: Didn't find any major issues. 👍 Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
🛡️ Codex Security ReviewSecurity review completed. No security issues were found in this pull request. Reviewed commit: Only the user who started this review can view the report in Codex. ℹ️ About Codex security reviews in GitHubThis is an experimental Codex feature. Security reviews are triggered when:
Once complete, Codex will leave suggestions, or a comment if no findings are found. |
Why
The operator goal is one small, reviewed PR for every open follow-up issue in coder/chat. This PR closes the token-lifetime issue in
adapters/linear.When Linear's client-credentials token response has no positive
expires_in, the adapter sets no expiry and keeps the token until the process restarts. After Linear expires the token, every call fails. Linear's OAuth docs give these tokens a 30-day lifetime, and RFC 6749 section 5.1 makesexpires_inoptional.What changed
exchangeClientCredentialssets the expiry to 30 days whenexpires_inis missing or not positive. The existing 1-hour refresh buffer then refreshes the token.ensureTokenandtenantTokenno longer treat a zero expiry as "never expires". No code path sets a zero expiry now.adapters/linear/README.mddescribes the new behavior.Scope
Blast Radius
The change affects only token responses without a positive
expires_in. Responses withexpires_inkeep their exact expiry.Verification
TestSingleInstallRefreshesTokenWithoutExpiresInandTestMultiTenantRefreshesTokenWithoutExpiresIn. They fail on that commit with "token requests past 30 days minus refresh buffer = 1, want 2". They pass after the fix. Each test checks that the adapter reuses the token 1 minute before the refresh point and fetches a new one 1 minute after it.go vet,go testfor the root, adapter, state, and example modules,go test -race ./adapters/linear/..., andgofmt -l .pass.Closes #126
Generated with
xum• Model:anthropic:claude-opus-5-5• Thinking:high