feat: keep original token refresh error in external auth#19339
Merged
Conversation
aslilac
approved these changes
Aug 13, 2025
Member
aslilac
left a comment
There was a problem hiding this comment.
mostly makes sense to me, though I'm not very familiar with external auth stuff. might be worth waiting to see if someone else comes along to review.
External auth refresh errors lose the original error thrown on the first refresh. This PR saves that error to the database to be raised on subsequent refresh attempts
cccd7ae to
b0a1694
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
External auth refresh errors lose the original error thrown on the first refresh. This PR saves that error to the database to be raised on subsequent refresh attempts
Addresses: #18811
The issue assumed refresh tokens were being tossed for temporary issues (like an IdP being down). We have code to handle this, however the original error being lost made that code invisible. By keeping the original error, now the reason for the token being invalid is saved (assuming it is a refresh error).
Error now
Before
This is the behavior before. The first time this failure occurs, it is raised. Subsequent errors always show
Error: token expired, refreshing is either disabled or refreshing failed and will not be retried. This subsequent error makes it difficult to debug the original cause.Screencast.From.2025-08-13.10-29-11.webm
Future work
The error could be better formatted. This PR does not attempt to update the error format, it just retains the first error message.