@gitkraken/core-gitlens 0.4.100 → 0.5.100

package/src/plus/integrations/authentication/integrationAuthenticationProvider.ts

@@ -32,6 +32,38 @@ export interface IntegrationAuthenticationSessionDescriptor {
 	[key: string]: unknown;
 }
 
+/**
+ * Options for {@link IntegrationAuthenticationProvider.getSession}. The two variants keep `sync` exclusive
+ * with the interactive flags: a sync resolves whatever the cloud already has, so it must never open a connect
+ * window.
+ *
+ * `refreshRejectedToken` marks the stored token as known-refused by the provider (an `AuthenticationError` on
+ * a previous read), which forces a cloud `/refresh` even when the token's expiry still claims it is valid —
+ * the case a purely time-based refresh cannot see. The refresh token itself never reaches the client: the GK
+ * cloud performs the exchange server-side.
+ */
+export type GetSessionOptions =
+	| {
+			createIfNeeded?: boolean;
+			forceNewSession?: boolean;
+			sync?: never;
+			refreshRejectedToken?: boolean;
+			source?: Sources;
+	  }
+	| {
+			createIfNeeded?: never;
+			forceNewSession?: never;
+			sync: boolean;
+			refreshRejectedToken?: boolean;
+			source?: Sources;
+	  };
+
+/**
+ * What {@link IntegrationAuthenticationProviderBase.getSession} passes down once it has decided the stored
+ * session can't be served as-is. `refreshIfExpired` is its own conclusion, not a caller's option.
+ */
+type GetNewSessionOptions = GetSessionOptions & { refreshIfExpired?: boolean };
+
 export interface IntegrationAuthenticationProvider extends Disposable {
 	/**
 	 * Clears the stored secret for one connection only (never the whole provider). Unlike
@@ -46,11 +78,13 @@ export interface IntegrationAuthenticationProvider extends Disposable {
 		options?: { preserveConfigured?: boolean },
 	): Promise<void>;
 	deleteAllSessions(descriptor?: IntegrationAuthenticationSessionDescriptor): Promise<void>;
+	/**
+	 * Resolves the session for `descriptor`, from storage when it is still usable and from the cloud
+	 * otherwise. See {@link GetSessionOptions}.
+	 */
 	getSession(
 		descriptor: IntegrationAuthenticationSessionDescriptor,
-		options?:
-			| { createIfNeeded?: boolean; forceNewSession?: boolean; sync?: never; source?: Sources }
-			| { createIfNeeded?: never; forceNewSession?: never; sync: boolean; source?: Sources },
+		options?: GetSessionOptions,
 	): Promise<ProviderAuthenticationSession | undefined>;
 	get onDidChange(): Event<void>;
 }
@@ -120,9 +154,7 @@ abstract class IntegrationAuthenticationProviderBase<
 	@trace()
 	async getSession(
 		descriptor: IntegrationAuthenticationSessionDescriptor,
-		options?:
-			| { createIfNeeded?: boolean; forceNewSession?: boolean; sync?: never; source?: Sources }
-			| { createIfNeeded?: never; forceNewSession?: never; sync: boolean; source?: Sources },
+		options?: GetSessionOptions,
 	): Promise<ProviderAuthenticationSession | undefined> {
 		let session;
 		let previousToken;
@@ -143,10 +175,15 @@ abstract class IntegrationAuthenticationProviderBase<
 		}
 
 		const isExpiredSession = session?.expiresAt != null && new Date(session.expiresAt).getTime() < Date.now();
-		if (session == null || isExpiredSession) {
+		// A rejected token has to re-resolve even when the stored session looks perfectly healthy: that is
+		// the whole point — the provider refused it while its expiry still says valid. Without this the
+		// stored session short-circuits here and the refresh below is never reached.
+		const refreshRejectedToken = options?.refreshRejectedToken === true && session != null;
+		if (session == null || isExpiredSession || refreshRejectedToken) {
 			session = await this.getNewSession(descriptor, {
 				...options,
 				refreshIfExpired: isExpiredSession,
+				refreshRejectedToken: refreshRejectedToken,
 			});
 
 			if (session != null) {
@@ -163,21 +200,7 @@ abstract class IntegrationAuthenticationProviderBase<
 
 	protected abstract getNewSession(
 		descriptor: IntegrationAuthenticationSessionDescriptor,
-		options?:
-			| {
-					createIfNeeded?: boolean;
-					forceNewSession?: boolean;
-					sync?: never;
-					refreshIfExpired?: boolean;
-					source?: Sources;
-			  }
-			| {
-					createIfNeeded?: never;
-					forceNewSession?: never;
-					sync: boolean;
-					refreshIfExpired?: boolean;
-					source?: Sources;
-			  },
+		options?: GetNewSessionOptions,
 	): Promise<ProviderAuthenticationSession | undefined>;
 
 	protected fireChange(): void {
@@ -202,21 +225,7 @@ export class CloudIntegrationAuthenticationProvider<
 
 	protected override async getNewSession(
 		descriptor: IntegrationAuthenticationSessionDescriptor,
-		options?:
-			| {
-					createIfNeeded?: boolean;
-					forceNewSession?: boolean;
-					sync?: never;
-					refreshIfExpired?: boolean;
-					source?: Sources;
-			  }
-			| {
-					createIfNeeded?: never;
-					forceNewSession?: never;
-					sync: boolean;
-					refreshIfExpired?: boolean;
-					source?: Sources;
-			  },
+		options?: GetNewSessionOptions,
 	): Promise<ProviderAuthenticationSession | undefined> {
 		if (options?.forceNewSession) {
 			if ((await this.disconnectCloudSession()) === 'failure') {
@@ -230,9 +239,15 @@ export class CloudIntegrationAuthenticationProvider<
 		// TODO: This is a stopgap to make sure we're not hammering the api on automatic calls to get the session.
 		// Ultimately we want to timestamp calls to syncCloudIntegrations and use that to determine whether we should
 		// make the call or not.
+		// `refreshRejectedToken` joins the list for the same reason `refreshIfExpired` is on it: both mean the
+		// session in hand is known-unusable, so skipping the cloud round trip would just re-serve it.
 		let session =
-			options?.refreshIfExpired || options?.createIfNeeded || options?.forceNewSession || options?.sync
-				? await this.getCloudSession(descriptor)
+			options?.refreshIfExpired ||
+			options?.refreshRejectedToken ||
+			options?.createIfNeeded ||
+			options?.forceNewSession ||
+			options?.sync
+				? await this.getCloudSession(descriptor, { refreshRejectedToken: options?.refreshRejectedToken })
 				: undefined;
 
 		const shouldCreateSession = options?.createIfNeeded && session == null;
@@ -269,6 +284,7 @@ export class CloudIntegrationAuthenticationProvider<
 
 	private async getCloudSession(
 		descriptor: IntegrationAuthenticationSessionDescriptor,
+		options?: { refreshRejectedToken?: boolean },
 	): Promise<ProviderAuthenticationSession | undefined> {
 		const loggedIn = (await this.authenticationService.ctx.account.getAccount()) != null;
 		if (!loggedIn) return undefined;
@@ -304,7 +320,13 @@ export class CloudIntegrationAuthenticationProvider<
 			session.expiresIn = maxSmallIntegerV8; // maximum expiration length
 		}
 
-		if (session != null && session.expiresIn < 60) {
+		// `expiresIn < 60` is a PREDICTION that the token is about to lapse, and it is the only trigger the
+		// refresh used to have. It cannot see a token the provider has already refused while the backend
+		// still believes it is valid — a revoked grant, retired scopes, an app removed from the org — where
+		// `expiresIn` stays high and the doomed token is re-sent on every read. `refreshRejectedToken` is
+		// the observed counterpart: the caller saw the provider reject this exact token, so refresh it
+		// regardless of what its expiry claims.
+		if (session != null && (session.expiresIn < 60 || options?.refreshRejectedToken)) {
 			session = await cloudIntegrations.getConnectionSession(
 				this.authProviderId,
 				session.accessToken,

package/src/plus/integrations/authentication/rejectedTokenTracker.ts

@@ -0,0 +1,56 @@
+/**
+ * Per-connection recovery state for a cloud token the provider REFUSED — a revoked grant, retired scopes, an
+ * app removed from the org. A purely predictive refresh (`expiresIn < 60`) cannot see that case, because the
+ * backend still believes the token is valid, so without this the refused token is re-sent on every read and
+ * the failure only clears when the user reconnects by hand.
+ *
+ * One recovery refresh per connection, then the connection is the failure budget's problem:
+ * - {@link recordRejection} on an `AuthenticationError` — arms the refresh, or reports that the rejection is
+ *   not recoverable so the caller counts it as a real failure instead.
+ * - {@link claimRefresh} before the next read resolves its session — spends the rejection, so the refresh
+ *   fires once and no further read of that connection asks the cloud again.
+ *
+ * Deliberately NOT re-armed when the refresh hands back a different token. The GK cloud mints a new access
+ * token on every `/refresh`, so a credential the provider refuses for a reason a refresh cannot fix (retired
+ * scopes being the plain case) would look "rotated" on each attempt: re-arming on that would refresh on every
+ * read forever and the failure budget — the thing that disconnects and prompts a reconnect — would never
+ * advance. What resets this instead is {@link clear}, called by every path that replaces or removes the stored
+ * tokens; a connection that is simply working never reaches here at all.
+ */
+export class RejectedTokenTracker {
+	private readonly _rejections = new Map<string, 'armed' | 'spent'>();
+
+	/**
+	 * Whether a read of `connectionId` must force the cloud refresh of a token known to be refused, spending
+	 * the rejection so the refresh runs at most once. Spent here rather than after the read because a resolve
+	 * that throws must not leave the refresh armed and ask the cloud again on the next read.
+	 */
+	claimRefresh(connectionId: string): boolean {
+		if (this._rejections.get(connectionId) !== 'armed') return false;
+
+		this._rejections.set(connectionId, 'spent');
+		return true;
+	}
+
+	/**
+	 * Arms the recovery refresh for `connectionId`. Returns `false` once this connection has had its refresh
+	 * (or already has one pending), so the caller falls back to its own failure handling: a token still
+	 * refused after the refresh is not self-healing, and only the failure budget ends in a reconnect prompt.
+	 */
+	recordRejection(connectionId: string): boolean {
+		if (this._rejections.has(connectionId)) return false;
+
+		this._rejections.set(connectionId, 'armed');
+		return true;
+	}
+
+	/** Drops all state, for when the stored tokens a rejection could name are replaced or gone. */
+	clear(): void {
+		this._rejections.clear();
+	}
+
+	/** Whether any connection is holding a rejection. For assertions; the read path uses {@link claimRefresh}. */
+	get empty(): boolean {
+		return this._rejections.size === 0;
+	}
+}

package/src/plus/integrations/errors.ts

@@ -97,8 +97,12 @@ async function readErrorBodyMessage(response: Response): Promise<{ message: stri
 				message = m;
 			} else if (typeof error === 'string') {
 				message = error;
-			} else if (error != null && typeof error === 'object' && typeof (error as any).message === 'string') {
-				message = (error as { message: string }).message;
+			} else if (error != null && typeof error === 'object') {
+				// Some hosts nest it as `{ error: { message } }`; narrow the same way as the outer object.
+				const nested = (error as { message?: unknown }).message;
+				if (typeof nested === 'string') {
+					message = nested;
+				}
 			}
 		}
 	} catch {