Repository navigation
fix(credentials): age-gate 403 token eviction and tidy the client-credential paths - #9918
Merged
Merged
Conversation
…sient mint failures An internal operation's 403 now drops this instance's cached client-credential token only once it is older than a minute, matching the external-request path, so a 403 from a file-access refusal or per-record permission no longer re-mints on every call. The coordinated token's failure memo keeps only refusals of the credentials themselves; provider_unavailable propagates with no memo row.
…oint and HubSpot docs fetchProvider already refuses redirects by default. Zendesk's hidden token param uses savedCredentialTokenParam, the SailPoint minter takes its token URL from resolveSailPointHosts, and the SailPoint host and HubSpot fallback TSDoc now match the code.
|
The latest updates on your projects. Learn more about Vercel for GitHub. |
Contributor
 [Medium impact] The PR appears safe to merge; no new actionable issues remain. SummaryAdds a 60-second age check before an internal operation’s 403 removes a cached token. A 401 still removes it immediately.
Reviews (2) · Last reviewed commit: "fix(credentials): keep the coordinated t..." · Reviewed by Greptile |
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
1 issue found across 16 files
Confidence score: 3/5
- During rollout,
decodeFailureinapps/sim/lib/credentials/coordinated-client-token.tsrejects unexpired legacyprovider_unavailablememos, so resolution throws without callinginput.exchange. Handle that legacy format or invalidate those memos.
Prompt for AI agents (unresolved issues)
Check if these issues are valid — if so, understand the root cause of each and fix them. When an issue isn't valid or won't be fixed in this PR, reply in its thread with the reason and then resolve the thread. If appropriate, use sub-agents to investigate and fix each issue separately.
<file name="apps/sim/lib/credentials/coordinated-client-token.ts">
<violation number="1" location="apps/sim/lib/credentials/coordinated-client-token.ts:144">
P2: `decodeFailure` rejects the `provider_unavailable` rows written by the previous implementation as malformed. During rollout, an unexpired legacy memo makes resolution throw without calling `input.exchange`, so transient failures remain cached; ignore and delete legacy transient rows instead of treating them as fatal.</violation>
</file>
Reply with feedback, questions, or to request a fix.
Turn on auto-fix | Re-trigger cubic
…every failed exchange Remembering only credential refusals in the shared row left the per-instance mint cache and the Vanta chain still backing off on outages, so the policy differed by layer. Keep the long-standing 30-second backoff everywhere and document it.
waleedlatif1
changed the title
Collaborator
Author
Collaborator
Author
|
@cubic-dev-ai review this PR |
Contributor
@waleedlatif1 I have started the AI code review. It will take a few minutes to complete. |
This branch was previously deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
redirect: 'error'options, sincefetchProvideralready defaults to it.savedCredentialTokenParamhelper.resolveSailPointHosts.Type of Change
Testing
lib/credentials, credential-service,lib/internal/sailpoint,tools/index.test.tsandtools/zendesk.bunx biome check,check:test-patterns,check:comment-hygiene,check:utils,check:explicit-any,check:tool-metadataand the pre-push type-check pass.Checklist
test-auditauthoring gate)