feat(oauth): add refresh token and expiry support to OAuth token flow by vinokurig · Pull Request #1047 · eclipse-che/che-server

vinokurig · 2026-08-31T13:25:28Z

What does this PR do?

Persist OAuth refresh tokens and expiration times in Kubernetes secrets alongside access tokens, enabling token refresh without re-authorization after server restarts.
Adds a POST /oauth/refresh endpoint, updates the OAuthToken DTO, PersonalAccessToken, and PersonalAccessTokenParams with refreshToken/expiresIn fields, and restores in-memory credentials from persisted secrets when the credential store is empty.

Screenshot/screencast of this PR

What issues does this PR fix or reference?

https://redhat.atlassian.net/browse/CRW-4121

How to test this PR?

Start Che from the che-server pull request image: quay.io/eclipse/che-server:pr-1047
Configure an oauth, e.g. for gitlab: https://eclipse.dev/che/docs/stable/administration-guide/configuring-oauth-2-for-gitlab/
Start a workspace from a Gitlab repository url, an Oauth token must be added to the user-preferences -> Personal Access Tokens tab
Restart the che-server pod to clear the oauth data from the che-server pod memory.
Execute the POST API request: <che host url>/api/oauth/refresh?oauth_provider=gitlab&provider_url=https://gitlab.com
Check the token secret, the token and the refresh-token data must be refreshed.

PR Checklist

As the author of this Pull Request I made sure that:

Release Notes

Reviewers

Reviewers, please comment how you tested the PR when approving it.

openshift-ci · 2026-08-31T13:25:51Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: vinokurig

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

github-actions · 2026-08-31T13:43:28Z

Docker image build succeeded: quay.io/eclipse/che-server:pr-1047

kubectl patch command

kubectl patch -n eclipse-che "checluster/eclipse-che" --type=json -p="[{"op": "replace", "path": "/spec/components/cheServer/deployment", "value": {containers: [{image: "quay.io/eclipse/che-server:pr-1047", name: che}]}}]"

github-actions · 2026-09-03T13:40:15Z

Docker image build succeeded: quay.io/eclipse/che-server:pr-1047

kubectl patch command

kubectl patch -n eclipse-che "checluster/eclipse-che" --type=json -p="[{"op": "replace", "path": "/spec/components/cheServer/deployment", "value": {containers: [{image: "quay.io/eclipse/che-server:pr-1047", name: che}]}}]"

Persist OAuth refresh tokens and expiration times in Kubernetes secrets alongside access tokens, enabling token refresh without re-authorization after server restarts. Adds a POST /oauth/refresh endpoint, updates the OAuthToken DTO, PersonalAccessToken, and PersonalAccessTokenParams with refreshToken/expiresIn fields, and restores in-memory credentials from persisted secrets when the credential store is empty. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

github-actions · 2026-09-07T13:27:23Z

Docker image build succeeded: quay.io/eclipse/che-server:pr-1047

kubectl patch command

kubectl patch -n eclipse-che "checluster/eclipse-che" --type=json -p="[{"op": "replace", "path": "/spec/components/cheServer/deployment", "value": {containers: [{image: "quay.io/eclipse/che-server:pr-1047", name: che}]}}]"

tolusha · 2026-09-09T10:55:08Z

+  public static final String REFRESH_TOKEN_DATA_FIELD = "refresh-token";
+
+  /** Kubernetes secret data field key for the token expiration time in seconds. */
+  public static final String EXPIRES_IN_DATA_FIELD = "expires-in";


Is it better to move to annotation?

tolusha · 2026-09-09T10:59:35Z

+   */
+  @POST
+  @Path("refresh")
+  public void refresh(@Required @QueryParam("oauth_provider") String oauthProvider)


I can see that provider url is not considered.
What if we have different urls for a single provider, like GitHub

done, switched to provider_url parameter

tolusha · 2026-09-10T07:48:25Z

+            token.getRefreshToken(),
+            token.getExpiresIn());
+    personalAccessTokenManager.store(personalAccessToken);
+    gitCredentialManager.createOrReplace(personalAccessToken);


I think removePreviousTokenSecretsIfPresent is missed.
BTW, can we resue forceRefreshPersonalAccessToken(String scmServerUrl) ?

nice catch, switched to forceRefreshPersonalAccessToken(String scmServerUrl)

…en flow

github-actions · 2026-09-10T13:10:00Z

Docker image build succeeded: quay.io/eclipse/che-server:pr-1047

kubectl patch command

kubectl patch -n eclipse-che "checluster/eclipse-che" --type=json -p="[{"op": "replace", "path": "/spec/components/cheServer/deployment", "value": {containers: [{image: "quay.io/eclipse/che-server:pr-1047", name: che}]}}]"

github-actions · 2026-09-11T13:08:40Z

Docker image build succeeded: quay.io/eclipse/che-server:pr-1047

kubectl patch command

kubectl patch -n eclipse-che "checluster/eclipse-che" --type=json -p="[{"op": "replace", "path": "/spec/components/cheServer/deployment", "value": {containers: [{image: "quay.io/eclipse/che-server:pr-1047", name: che}]}}]"

…en flow Handle providers that omit `expires_in` and issue no refresh token: * `OAuthAuthenticator`: extract `newOAuthToken(Credential)` and set the expiration only when the credential provides one, since `OAuthToken#withExpiresIn` takes a primitive. * `EmbeddedOAuthAPI`: fall back to 0 when the token response has no `expires_in`. * `KubernetesPersonalAccessTokenManager`: only write the `refresh-token` secret field when a refresh token is present. Add tests for each case, including a new `OAuthAuthenticatorTest` for the OAuth2 authenticator. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

github-actions · 2026-09-14T07:55:52Z

Docker image build succeeded: quay.io/eclipse/che-server:pr-1047

kubectl patch command

kubectl patch -n eclipse-che "checluster/eclipse-che" --type=json -p="[{"op": "replace", "path": "/spec/components/cheServer/deployment", "value": {containers: [{image: "quay.io/eclipse/che-server:pr-1047", name: che}]}}]"

svor · 2026-09-14T13:34:33Z

/retest

tolusha · 2026-09-14T12:48:06Z

+   * Refreshes the OAuth token for the given provider and persists the updated token as a Kubernetes
+   * secret and git credential, so that subsequent SCM operations use the new access token.
+   *
+   * @param providerUrl URL of the OAuth provider instance the token belongs to. Optional, if not


providerUrl has @Required annotation

tolusha · 2026-09-14T13:19:28Z

                          personalAccessToken.getScmTokenName())
+                      .put(
+                          ANNOTATION_SCM_TOKEN_EXPIRES_IN,
+                          String.valueOf(personalAccessToken.getExpiresIn()))


I think it updates every PAT and most all of them will have 0
It misleads since 0 means expires immediately.
Should we check if personalAccessToken.getExpiresIn()) > 0 before adding annotation?

tolusha · 2026-09-14T13:41:45Z

      } else {
-        throw new UnauthorizedException(
-            "OAuth token for user " + subject.getUserId() + " was not found");
+        // Credential was not found in the in-memory store (e.g. after server restart).


I think it is a new workflow, can we have validation steps in the description of the issue?

tolusha · 2026-09-14T13:43:16Z

+              new TokenResponse()
+                  .setAccessToken(token.getToken())
+                  .setRefreshToken(token.getRefreshToken())
+                  .setExpiresInSeconds(token.getExpiresIn());


I wouldn't put 0 which is a default value.
Instead it is better to check if value > 0

openshift-ci · 2026-09-14T15:30:49Z

@vinokurig: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/v19-azure-no-pat-oauth-flow	`4de7942`	link	true	`/test v19-azure-no-pat-oauth-flow`
ci/prow/v19-bitbucket-no-pat-oauth-flow-ssh-url	`4de7942`	link	true	`/test v19-bitbucket-no-pat-oauth-flow-ssh-url`
ci/prow/v19-gitlab-no-pat-oauth-flow-raw-devfile-url	`4de7942`	link	true	`/test v19-gitlab-no-pat-oauth-flow-raw-devfile-url`
ci/prow/v19-github-no-pat-oauth-flow-ssh-url	`4de7942`	link	true	`/test v19-github-no-pat-oauth-flow-ssh-url`
ci/prow/v19-gitlab-with-oauth-setup-flow	`4de7942`	link	true	`/test v19-gitlab-with-oauth-setup-flow`
ci/prow/v19-azure-no-pat-oauth-flow-ssh-url	`4de7942`	link	true	`/test v19-azure-no-pat-oauth-flow-ssh-url`
ci/prow/v19-gitlab-no-pat-oauth-flow-ssh-url	`4de7942`	link	true	`/test v19-gitlab-no-pat-oauth-flow-ssh-url`
ci/prow/v19-che-smoke-test	`4de7942`	link	true	`/test v19-che-smoke-test`
ci/prow/v19-github-with-pat-setup-flow	`4de7942`	link	true	`/test v19-github-with-pat-setup-flow`

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

vinokurig requested review from SDawley, ibuziuk and tolusha as code owners August 31, 2026 13:25

vinokurig force-pushed the CRW-4121 branch from 5d073da to a0ffc1c Compare August 31, 2026 13:26

vinokurig force-pushed the CRW-4121 branch from a0ffc1c to 9c2352d Compare September 3, 2026 13:23

vinokurig force-pushed the CRW-4121 branch 3 times, most recently from fb69994 to 7a2aa30 Compare September 7, 2026 12:56

vinokurig force-pushed the CRW-4121 branch from 7a2aa30 to 6edf714 Compare September 7, 2026 13:10

vinokurig mentioned this pull request Sep 7, 2026

feat(ui): add refresh action for oAuth tokens eclipse-che/che-dashboard#1664

Open

tolusha mentioned this pull request Sep 9, 2026

fix(security): prevent SSRF by validating URL schemes in file content… #1048

Closed

9 tasks

tolusha reviewed Sep 9, 2026

View reviewed changes

tolusha reviewed Sep 10, 2026

View reviewed changes

vinokurig added 2 commits September 10, 2026 14:05

Merge branch 'main' of github.com:eclipse-che/che-server into CRW-4121

5d8450d

fixup! feat(oauth): add refresh token and expiry support to OAuth tok…

5817bd0

…en flow

vinokurig force-pushed the CRW-4121 branch from fa0953d to 5817bd0 Compare September 10, 2026 12:52

eclipse-che deleted a comment from openshift-ci Bot Sep 11, 2026

eclipse-che deleted a comment from openshift-ci Bot Sep 14, 2026

vinokurig force-pushed the CRW-4121 branch from cac3eb5 to 4de7942 Compare September 14, 2026 07:37

eclipse-che deleted a comment from openshift-ci Bot Sep 14, 2026

tolusha reviewed Sep 14, 2026

View reviewed changes

Uh oh!

Conversation

vinokurig commented Aug 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What does this PR do?

Screenshot/screencast of this PR

What issues does this PR fix or reference?

How to test this PR?

PR Checklist

Release Notes

Reviewers

Uh oh!

openshift-ci Bot commented Aug 31, 2026

Uh oh!

github-actions Bot commented Aug 31, 2026

Uh oh!

github-actions Bot commented Sep 3, 2026

Uh oh!

github-actions Bot commented Sep 7, 2026

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

github-actions Bot commented Sep 10, 2026

Uh oh!

github-actions Bot commented Sep 11, 2026

Uh oh!

github-actions Bot commented Sep 14, 2026

Uh oh!

svor commented Sep 14, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

openshift-ci Bot commented Sep 14, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

vinokurig commented Aug 31, 2026 •

edited

Loading