feat(oauth): add refresh token and expiry support to OAuth token flow by vinokurig · Pull Request #1047 · eclipse-che/che-server

vinokurig · 2026-08-31T13:25:28Z

What does this PR do?

Persist OAuth refresh tokens and expiration times in Kubernetes secrets alongside access tokens, enabling token refresh without re-authorization after server restarts.
Adds a POST /oauth/refresh endpoint, updates the OAuthToken DTO, PersonalAccessToken, and PersonalAccessTokenParams with refreshToken/expiresIn fields, and restores in-memory credentials from persisted secrets when the credential store is empty.

Screenshot/screencast of this PR

What issues does this PR fix or reference?

https://redhat.atlassian.net/browse/CRW-4121

How to test this PR?

Start Che from the che-server pull request image: quay.io/eclipse/che-server:pr-1047
Configure an oauth, e.g. for gitlab: https://eclipse.dev/che/docs/stable/administration-guide/configuring-oauth-2-for-gitlab/
Start a workspace from a Gitlab repository url, an Oauth token must be added to the user-preferences -> Personal Access Tokens tab
Restart the che-server pod to clear the oauth data from the che-server pod memory.
Execute the POST API request: <che host url>/api/oauth/refresh?oauth_provider=gitlab&provider_url=https://gitlab.com
Check the token secret, the token and the refresh-token data must be refreshed.

PR Checklist

As the author of this Pull Request I made sure that:

Release Notes

Reviewers

Reviewers, please comment how you tested the PR when approving it.

openshift-ci · 2026-08-31T13:25:51Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: vinokurig

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

github-actions · 2026-08-31T13:43:28Z

Docker image build succeeded: quay.io/eclipse/che-server:pr-1047

kubectl patch command

kubectl patch -n eclipse-che "checluster/eclipse-che" --type=json -p="[{"op": "replace", "path": "/spec/components/cheServer/deployment", "value": {containers: [{image: "quay.io/eclipse/che-server:pr-1047", name: che}]}}]"

github-actions · 2026-09-03T13:40:15Z

Docker image build succeeded: quay.io/eclipse/che-server:pr-1047

kubectl patch command

kubectl patch -n eclipse-che "checluster/eclipse-che" --type=json -p="[{"op": "replace", "path": "/spec/components/cheServer/deployment", "value": {containers: [{image: "quay.io/eclipse/che-server:pr-1047", name: che}]}}]"

Persist OAuth refresh tokens and expiration times in Kubernetes secrets alongside access tokens, enabling token refresh without re-authorization after server restarts. Adds a POST /oauth/refresh endpoint, updates the OAuthToken DTO, PersonalAccessToken, and PersonalAccessTokenParams with refreshToken/expiresIn fields, and restores in-memory credentials from persisted secrets when the credential store is empty. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

github-actions · 2026-09-07T13:27:23Z

Docker image build succeeded: quay.io/eclipse/che-server:pr-1047

kubectl patch command

kubectl patch -n eclipse-che "checluster/eclipse-che" --type=json -p="[{"op": "replace", "path": "/spec/components/cheServer/deployment", "value": {containers: [{image: "quay.io/eclipse/che-server:pr-1047", name: che}]}}]"

tolusha · 2026-09-09T10:55:08Z

+  public static final String REFRESH_TOKEN_DATA_FIELD = "refresh-token";
+
+  /** Kubernetes secret data field key for the token expiration time in seconds. */
+  public static final String EXPIRES_IN_DATA_FIELD = "expires-in";


Is it better to move to annotation?

tolusha · 2026-09-09T10:59:35Z

+   */
+  @POST
+  @Path("refresh")
+  public void refresh(@Required @QueryParam("oauth_provider") String oauthProvider)


I can see that provider url is not considered.
What if we have different urls for a single provider, like GitHub

done, switched to provider_url parameter

tolusha · 2026-09-10T07:48:25Z

+            token.getRefreshToken(),
+            token.getExpiresIn());
+    personalAccessTokenManager.store(personalAccessToken);
+    gitCredentialManager.createOrReplace(personalAccessToken);


I think removePreviousTokenSecretsIfPresent is missed.
BTW, can we resue forceRefreshPersonalAccessToken(String scmServerUrl) ?

nice catch, switched to forceRefreshPersonalAccessToken(String scmServerUrl)

…en flow

github-actions · 2026-09-10T13:10:00Z

Docker image build succeeded: quay.io/eclipse/che-server:pr-1047

kubectl patch command

kubectl patch -n eclipse-che "checluster/eclipse-che" --type=json -p="[{"op": "replace", "path": "/spec/components/cheServer/deployment", "value": {containers: [{image: "quay.io/eclipse/che-server:pr-1047", name: che}]}}]"

github-actions · 2026-09-11T13:08:40Z

Docker image build succeeded: quay.io/eclipse/che-server:pr-1047

kubectl patch command

kubectl patch -n eclipse-che "checluster/eclipse-che" --type=json -p="[{"op": "replace", "path": "/spec/components/cheServer/deployment", "value": {containers: [{image: "quay.io/eclipse/che-server:pr-1047", name: che}]}}]"

…en flow Handle providers that omit `expires_in` and issue no refresh token: * `OAuthAuthenticator`: extract `newOAuthToken(Credential)` and set the expiration only when the credential provides one, since `OAuthToken#withExpiresIn` takes a primitive. * `EmbeddedOAuthAPI`: fall back to 0 when the token response has no `expires_in`. * `KubernetesPersonalAccessTokenManager`: only write the `refresh-token` secret field when a refresh token is present. Add tests for each case, including a new `OAuthAuthenticatorTest` for the OAuth2 authenticator. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

github-actions · 2026-09-14T07:55:52Z

Docker image build succeeded: quay.io/eclipse/che-server:pr-1047

kubectl patch command

kubectl patch -n eclipse-che "checluster/eclipse-che" --type=json -p="[{"op": "replace", "path": "/spec/components/cheServer/deployment", "value": {containers: [{image: "quay.io/eclipse/che-server:pr-1047", name: che}]}}]"

svor · 2026-09-14T13:34:33Z

/retest

tolusha · 2026-09-14T13:19:28Z

                          personalAccessToken.getScmTokenName())
+                      .put(
+                          ANNOTATION_SCM_TOKEN_EXPIRES_IN,
+                          String.valueOf(personalAccessToken.getExpiresIn()))


I think it updates every PAT and most all of them will have 0
It misleads since 0 means expires immediately.
Should we check if personalAccessToken.getExpiresIn()) > 0 before adding annotation?

tolusha · 2026-09-14T13:43:16Z

+              new TokenResponse()
+                  .setAccessToken(token.getToken())
+                  .setRefreshToken(token.getRefreshToken())
+                  .setExpiresInSeconds(token.getExpiresIn());


I wouldn't put 0 which is a default value.
Instead it is better to check if value > 0

done, added the check and covered it with tests

…en flow

…en flow Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

vinokurig · 2026-09-15T12:24:32Z

/retest

vinokurig · 2026-09-16T06:27:37Z

/retest

vinokurig · 2026-09-16T13:33:26Z

/retest

svor · 2026-09-17T08:18:43Z

/retest

svor · 2026-09-17T20:54:28Z

/retest

tolusha · 2026-09-18T10:53:40Z

        + token
        + '\''
+        + ", refreshToken='"
+        + refreshToken


I think we can avoid adding token data into toString()

tolusha · 2026-09-18T10:54:28Z

+        isNullOrEmpty(refreshTokenData)
+            ? null
+            : new String(Base64.getDecoder().decode(refreshTokenData)).trim();
+    long expiresIn = isNullOrEmpty(expiresInAnnotation) ? 0 : parseLong(expiresInAnnotation.trim());


pls try/catch parsing long data

tolusha · 2026-09-18T11:36:53Z

    String configuredCheUserId = secretAnnotations.get(ANNOTATION_CHE_USERID);
-    String configuredOAuthProviderName =
-        secretAnnotations.get(ANNOTATION_SCM_PERSONAL_ACCESS_TOKEN_NAME);
+    String configuredOAuthProviderName = secretAnnotations.get(ANNOTATION_SCM_PROVIDER_NAME);


Pls Have a look

This is a leftover fix from the pull request
The main branch is not affected by this leftover as we try to get token by url if we fail to get the token by provider name:

che-server/wsmaster/che-core-api-factory/src/main/java/org/eclipse/che/api/factory/server/scm/AbstractGitUserDataFetcher.java

Lines 46 to 52 in f86ab2f

Optional<PersonalAccessToken> tokenOptional =

personalAccessTokenManager.get(cheSubject, oAuthProviderName, null, namespaceName);

if (tokenOptional.isPresent()) {

return fetchGitUserDataWithPersonalAccessToken(tokenOptional.get());

} else {

Optional<PersonalAccessToken> oAuthTokenOptional =

personalAccessTokenManager.get(cheSubject, null, oAuthProviderUrl, namespaceName);

I would like to keep the fix

…en flow

github-actions · 2026-09-18T15:20:23Z

Docker image build succeeded: quay.io/eclipse/che-server:pr-1047

kubectl patch command

kubectl patch -n eclipse-che "checluster/eclipse-che" --type=json -p="[{"op": "replace", "path": "/spec/components/cheServer/deployment", "value": {containers: [{image: "quay.io/eclipse/che-server:pr-1047", name: che}]}}]"

github-actions · 2026-09-21T07:11:36Z

Docker image build succeeded: quay.io/eclipse/che-server:pr-1047

kubectl patch command

kubectl patch -n eclipse-che "checluster/eclipse-che" --type=json -p="[{"op": "replace", "path": "/spec/components/cheServer/deployment", "value": {containers: [{image: "quay.io/eclipse/che-server:pr-1047", name: che}]}}]"

vinokurig · 2026-09-21T09:20:34Z

/retest

vinokurig · 2026-09-21T11:07:56Z

/retest

vinokurig · 2026-09-21T11:16:16Z

/retest

openshift-ci · 2026-09-21T11:18:48Z

@vinokurig: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/v19-azure-no-pat-oauth-flow-ssh-url	`8adc005`	link	true	`/test v19-azure-no-pat-oauth-flow-ssh-url`
ci/prow/v19-gitea-no-pat-oauth-flow	`8adc005`	link	true	`/test v19-gitea-no-pat-oauth-flow`
ci/prow/v19-github-no-pat-oauth-flow-raw-devfile-url	`8adc005`	link	true	`/test v19-github-no-pat-oauth-flow-raw-devfile-url`
ci/prow/v19-azure-no-pat-oauth-flow	`8adc005`	link	true	`/test v19-azure-no-pat-oauth-flow`
ci/prow/v19-che-smoke-test	`8adc005`	link	true	`/test v19-che-smoke-test`
ci/prow/v19-bitbucket-no-pat-oauth-flow-ssh-url	`8adc005`	link	true	`/test v19-bitbucket-no-pat-oauth-flow-ssh-url`
ci/prow/v19-github-no-pat-oauth-flow-ssh-url	`8adc005`	link	true	`/test v19-github-no-pat-oauth-flow-ssh-url`
ci/prow/v19-azure-no-pat-oauth-flow-raw-devfile-url	`8adc005`	link	true	`/test v19-azure-no-pat-oauth-flow-raw-devfile-url`
ci/prow/v19-gitea-with-pat-setup-flow	`8adc005`	link	true	`/test v19-gitea-with-pat-setup-flow`
ci/prow/v19-github-no-pat-oauth-flow	`8adc005`	link	true	`/test v19-github-no-pat-oauth-flow`
ci/prow/v19-gitlab-with-pat-setup-flow	`8adc005`	link	true	`/test v19-gitlab-with-pat-setup-flow`
ci/prow/v19-gitlab-no-pat-oauth-flow-raw-devfile-url	`8adc005`	link	true	`/test v19-gitlab-no-pat-oauth-flow-raw-devfile-url`

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

vinokurig requested review from SDawley, ibuziuk and tolusha as code owners August 31, 2026 13:25

vinokurig force-pushed the CRW-4121 branch from 5d073da to a0ffc1c Compare August 31, 2026 13:26

vinokurig force-pushed the CRW-4121 branch from a0ffc1c to 9c2352d Compare September 3, 2026 13:23

vinokurig force-pushed the CRW-4121 branch 3 times, most recently from fb69994 to 7a2aa30 Compare September 7, 2026 12:56

vinokurig force-pushed the CRW-4121 branch from 7a2aa30 to 6edf714 Compare September 7, 2026 13:10

vinokurig mentioned this pull request Sep 7, 2026

feat(ui): add refresh action for oAuth tokens eclipse-che/che-dashboard#1664

Open

tolusha mentioned this pull request Sep 9, 2026

fix(security): prevent SSRF by validating URL schemes in file content… #1048

Closed

9 tasks

tolusha reviewed Sep 9, 2026

View reviewed changes

tolusha reviewed Sep 10, 2026

View reviewed changes

vinokurig added 2 commits September 10, 2026 14:05

Merge branch 'main' of github.com:eclipse-che/che-server into CRW-4121

5d8450d

fixup! feat(oauth): add refresh token and expiry support to OAuth tok…

5817bd0

…en flow

vinokurig force-pushed the CRW-4121 branch from fa0953d to 5817bd0 Compare September 10, 2026 12:52

eclipse-che deleted a comment from openshift-ci Bot Sep 11, 2026

eclipse-che deleted a comment from openshift-ci Bot Sep 14, 2026

vinokurig force-pushed the CRW-4121 branch from cac3eb5 to 4de7942 Compare September 14, 2026 07:37

eclipse-che deleted a comment from openshift-ci Bot Sep 14, 2026

tolusha reviewed Sep 14, 2026

View reviewed changes

fixup! feat(oauth): add refresh token and expiry support to OAuth tok…

98d7525

…en flow

vinokurig force-pushed the CRW-4121 branch from eb29ae2 to 98d7525 Compare September 15, 2026 08:10

fixup! feat(oauth): add refresh token and expiry support to OAuth tok…

213c3ef

…en flow Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

eclipse-che deleted a comment from openshift-ci Bot Sep 15, 2026

eclipse-che deleted a comment from github-actions Bot Sep 15, 2026

tolusha reviewed Sep 18, 2026

View reviewed changes

fixup! feat(oauth): add refresh token and expiry support to OAuth tok…

36a4c3a

…en flow

Merge branch 'main' of github.com:eclipse-che/che-server into CRW-4121

8adc005

	Optional<PersonalAccessToken> tokenOptional =
	personalAccessTokenManager.get(cheSubject, oAuthProviderName, null, namespaceName);
	if (tokenOptional.isPresent()) {
	return fetchGitUserDataWithPersonalAccessToken(tokenOptional.get());
	} else {
	Optional<PersonalAccessToken> oAuthTokenOptional =
	personalAccessTokenManager.get(cheSubject, null, oAuthProviderUrl, namespaceName);

Conversation

vinokurig commented Aug 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What does this PR do?

Screenshot/screencast of this PR

What issues does this PR fix or reference?

How to test this PR?

PR Checklist

Release Notes

Reviewers

Uh oh!

openshift-ci Bot commented Aug 31, 2026

Uh oh!

github-actions Bot commented Aug 31, 2026

Uh oh!

github-actions Bot commented Sep 3, 2026

Uh oh!

github-actions Bot commented Sep 7, 2026

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

github-actions Bot commented Sep 10, 2026

Uh oh!

github-actions Bot commented Sep 11, 2026

Uh oh!

github-actions Bot commented Sep 14, 2026

Uh oh!

svor commented Sep 14, 2026

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

vinokurig commented Sep 15, 2026

Uh oh!

vinokurig commented Sep 16, 2026

Uh oh!

vinokurig commented Sep 16, 2026

Uh oh!

svor commented Sep 17, 2026

Uh oh!

svor commented Sep 17, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

github-actions Bot commented Sep 18, 2026

Uh oh!

github-actions Bot commented Sep 21, 2026

Uh oh!

vinokurig commented Sep 21, 2026

Uh oh!

vinokurig commented Sep 21, 2026

Uh oh!

vinokurig commented Aug 31, 2026 •

edited

Loading