fix: stop extending API key access if OIDC refresh is available #17878
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
473d5a4 to
c430f42
Compare
spikecurtis
commented
May 16, 2025
| // Checking if the key is expired. | ||
| // NOTE: The `RequireAuth` React component depends on this `Detail` to detect when | ||
| // the users token has expired. If you change the text here, make sure to update it | ||
| // in site/src/components/RequireAuth/RequireAuth.tsx as well. |
There was a problem hiding this comment.
Note that RequireAuth.tsx was modified to not have this string match dependency in #9442
|
Also includes some extra logging in |
c430f42 to
e6f157c
Compare
05131e2 to
45df24d
Compare
Merge activity
|
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
fixes #17070
Cleans up our handling of APIKey expiration and OIDC to keep them separate concepts. For an OIDC-login APIKey, both the APIKey and OIDC link must be valid to login. If the OIDC link is expired and we have a refresh token, we will attempt to refresh.
OIDC refreshes do not have any effect on APIKey expiry.
#17070 (comment) explains why this is the correct behavior.