fix(ts,py,rust): refresh web-fallback sessions with the correct key (v2.2.1) - #105
Merged
Merged
Conversation
…v2.2.1) Port the Go v2.2.1 fix to TypeScript, Python and Rust: a session obtained via the alternate login endpoint is issued under the web API key, so its OAuth token refresh must use that key for the Basic credential — refreshing with the app key 401s. Each SDK now tracks the key that established the session, uses it as the OAuth Basic credential (header injection + refresh), persists it in the session (omitted for default app sessions) and restores it on a cache hit. Signing is unaffected and keeps using the app key. Brings TS / Py / Rust to v2.2.1, matching Go. Contract in PORTING.md 6.2.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Ports the Go v2.2.1 fix to TypeScript, Python and Rust, bringing all four languages to v2.2.1.
A session established via the alternate login endpoint is issued under the web API key, so its OAuth token refresh (
POST /api/v1/oauth/token,Authorization: Basic base64(key)) must use that same key — refreshing with the app key returns 401.Fix (identical across languages)
oauth_key(omitted for default app sessions so their files stay byte-identical) and restore it on a cache hit.signed_info) stays on the app key — only the OAuth Basic credential is session-scoped.Tests
Each language's auth suite gains three refresh scenarios: web session refreshes with the web key, app session with the app key (no
oauth_keypersisted), restored web session with the web key. Rust/Python drive a real refresh round-trip through an oauth mock that only accepts the expected key; TS captures the Authorization header. Full suites green (Python, TypeScript, Rust).Version
TypeScript / Python / Rust bumped to
2.2.1. Contract in PORTING.md 6.2.