[SOU-123] Fix GitLab token refresh with redirect_uri parameter#798
Merged
[SOU-123] Fix GitLab token refresh with redirect_uri parameter#798
Conversation
Contributor
WalkthroughThis pull request fixes GitLab OAuth token refresh failures by refactoring the token refresh request to include a conditionally-added Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~8 minutes 🚥 Pre-merge checks | ✅ 2 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (2 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
This comment has been minimized.
This comment has been minimized.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Fix all issues with AI agents
In `@packages/web/src/ee/features/permissionSyncing/tokenRefresh.ts`:
- Around line 122-143: The GitLab redirect_uri is built via string concatenation
in tokenRefresh.ts (bodyParams and provider) and will produce double slashes if
env.AUTH_URL has a trailing slash; change the assignment so when provider ===
'gitlab' you set bodyParams.redirect_uri by normalizing with the URL constructor
(e.g., construct the callback path against env.AUTH_URL to produce a canonical
URL) instead of string concatenation, ensuring the final redirect_uri exactly
matches the original authorization request format.
🧹 Nitpick comments (1)
docker-compose-niteshift.yml (1)
9-23: Prefer named volumes (or configurable paths) for portability.Line 10 and Line 23 hard-code
/root/...which will fail for non-root users and on macOS/Windows. Named volumes keep local dev friction low and avoid path permissions issues.♻️ Suggested refactor
services: redis: @@ - volumes: - - /root/.niteshift/data/redis:/data + volumes: + - redis_data:/data @@ postgres: @@ - volumes: - - /root/.niteshift/data/postgres:/var/lib/postgresql/data + volumes: + - postgres_data:/var/lib/postgresql/data @@ +volumes: + redis_data: + postgres_data:
msukkari
changed the title
…r GitLab token refresh fix Co-authored-by: michael <michael@sourcebot.dev>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Fixes GitLab OAuth token refresh failures caused by missing
redirect_uriparameter. GitLab's OAuth implementation requires theredirect_uriparameter to be included in token refresh requests and must match the original authorization request URI.Changes
Modified
tokenRefresh.ts: Added support for including theredirect_uriparameter in GitLab token refresh requestsAdded
docker-compose-niteshift.yml: Development configuration for local testing with Redis and PostgreSQL servicesTechnical Details
The error
invalid_grantoccurs because GitLab validates that theredirect_uriparameter in the refresh request matches the original authorization request. Previously, this parameter was omitted from the refresh token request, causing validation to fail.The fix:
Related Issues
View Niteshift Task
Summary by CodeRabbit
✏️ Tip: You can customize this high-level summary in your review settings.