Automatic IDP access token refresh - #118
Open
rezib wants to merge 5 commits into
Open
Conversation
rezib
marked this pull request as draft
July 27, 2026 10:07
rezib
force-pushed
the
auth-renew
branch
6 times, most recently
from
July 30, 2026 08:18
8ad369a to
862d532
Compare
rezib
changed the title
rezib
marked this pull request as ready for review
July 30, 2026 09:02
Split Auth class by introducing AuthState class. The new AuthState class owns in-memory on on-disk tokens and metadata state. This object replaces the free-form config dict. The Auth classis the controller, it keeps interactions with end users and network authentication endpoints.
Instead of handling datetime in string format in memory, use native Python datetime objects. This simplifies comparisons. String conversions are performed at the border, when parsing token expiration date from S3 authentication endpoint response and on state file (de)serialization.
When remaining validity falls below idp_token_refresh_threshold Rift uses the IDP refresh_token grant to obtain a new access token and persists it in the credentials file. The default value is 300 seconds (5 minutes). Value 0 disables the feature. On interactive authentication, Rift retrieves refresh token and expiry datetime from IDP token endpoint. For non-interactive authentication based on environment variable, Rift expects a new RIFT_AUTH_IDP_REFRESH_TOKEN and it extracts access token expiry datetime from JWT exp claim. The state file is updated with new tokens upon refresh. The repository IDP proxy now checks token freshness on every requests so long-running builds pick up refreshes when needed.
The authenticated repos proxy shares one Auth instance across ThreadingMixIn request threads and fetches the IDP token on every upstream access. When the access token is near expiry, many threads can pass the refresh threshold check at once and each send an identical refresh_token grant. That wastes IdP traffic and can break refresh if the provider rotates or invalidates the refresh token on first use. Guard _ensure_idp_token_fresh with a lock and re-check remaining lifetime after acquiring it so only one thread performs the refresh; waiters reuse the updated in-memory token.
When tokens come from RIFT_AUTH_IDP_* environment variables, keep automatic refresh in memory only and skip writing the credentials state file, matching pre-refresh behavior.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Use IDP refresh token to automatically renew IDP access token when it reaches a remaining time before expiry threshold (300 seconds, or 5 minutes by default).
When IDP access token is read from environment variable, Rift also expects the refresh token to be available in environment as well.
The feature can be disabled by setting a refresh threshold to 0 in configuration.
The Auth class has been refactored with a new AuthState class to handle the token in memory and on disk with credentials file.