fix: unexpected re-auth when auth-token is expired#549
Conversation
📋 Review SummaryThis PR fixes unexpected re-authentication prompts when starting qwen-code after auth tokens expire by improving the SharedTokenManager's handling of persistent storage credentials. The changes include enhanced synchronization mechanisms, better error handling with a new CredentialsClearRequiredError class, and elimination of race conditions that occurred due to reliance on empty qwenClient credentials. 🔍 General Feedback
🎯 Specific Feedback🔴 CriticalNo critical issues identified in this review. 🟡 HighNo high priority issues identified in this review. 🟢 Medium
🔵 Low
✅ Highlights
|
Code Coverage Summary
CLI Package - Full Text ReportCore Package - Full Text ReportFor detailed HTML reports, please see the 'coverage-reports-22.x-ubuntu-latest' artifact from the main CI run. |
Fix: Unexpected Re-auth When Auth-token Is Expired
TLDR
Fixed unexpected re-authentication prompts when starting qwen-code after auth tokens expire (6-hour validity). The issue was caused by SharedTokenManager incorrectly using empty credentials from qwenClient to determine if re-authentication was needed, always triggering re-auth when credentials were empty. This PR fixes the logic to properly check token validity from persistent storage.
修复了在认证令牌过期(6小时有效期)后启动qwen-code时出现的意外重新认证提示。问题是由于SharedTokenManager错误地使用qwenClient中的空凭据来判断是否需要重新认证,当凭据为空时总是触发重新认证。此PR修复了逻辑,使其能够正确地从持久化存储中检查令牌有效性。
Dive Deeper
Problem
Users were experiencing unexpected re-authentication prompts when starting qwen-code after auth tokens expired (6-hour validity period), even when valid refresh tokens were available in the persistent storage. The root cause was that SharedTokenManager incorrectly relied on qwenClient's empty credentials to determine authentication status. When starting a fresh qwen-code session, qwenClient has no loaded credentials, causing the system to assume no valid credentials exist and trigger unnecessary re-authentication instead of checking the persistent oauth_creds.json file.
用户在认证令牌过期(6小时有效期)后启动qwen-code时遇到意外的重新认证提示,即使持久化存储中有有效的刷新令牌。根本原因是SharedTokenManager错误地依赖qwenClient的空凭据来判断认证状态。当启动新的qwen-code会话时,qwenClient没有加载凭据,导致系统认为没有有效凭据存在,触发不必要的重新认证,而不是检查持久化的oauth_creds.json文件。
This was caused by:
这是由以下原因造成的:
Empty credentials on startup - Fresh sessions had no loaded credentials in qwenClient to evaluate
Incorrect authentication logic - System assumed empty qwenClient credentials meant no valid credentials
Missing persistent storage check - Failed to verify tokens in oauth_creds.json before prompting re-auth
启动时凭据为空 - 新会话在qwenClient中没有加载的凭据可供评估
错误的认证逻辑 - 系统假设qwenClient凭据为空意味着没有有效凭据
缺少持久化存储检查 - 在提示重新认证之前未能验证oauth_creds.json中的令牌
qwen-code/packages/core/src/qwen/sharedTokenManager.ts
Line 331 in 17fd843
qwen-code/packages/core/src/qwen/qwenOAuth2.ts
Line 252 in 17fd843
Solution
This PR implements several improvements to fix the empty credentials dependency issue and ensure proper token validation from persistent storage:
此PR实现了几个改进,以修复空凭据依赖问题并确保从持久化存储进行正确的令牌验证:
增强的持久化存储检查 - 在确定认证状态之前始终从oauth_creds.json文件验证凭据,而不仅仅依赖qwenClient的已加载凭据
QwenOAuth2Client.getAccessToken()to ensure single source of truth throughSharedTokenManager改进的Token刷新逻辑 - 在
QwenOAuth2Client.getAccessToken()中消除了对可能过时的本地凭据的回退,确保通过SharedTokenManager实现单一数据源CredentialsClearRequiredErrorclass for better handling of 400 status errors during token refresh增强的错误处理 - 新增
CredentialsClearRequiredError类,更好地处理令牌刷新期间的400状态错误改进的SharedTokenManager同步机制:
Key Changes
isTokenValid()method and fallback logic to prevent race conditionsReviewer Test Plan
Token Expiration Handling:
oauth_creds.json)oauth_creds.jsonis updated with new tokensMulti-Session Race Conditions:
Invalid Refresh Token Handling:
oauth_creds.jsonFile System Edge Cases:
Testing Matrix
Linked issues / bugs
Fixes #533
Fixes #524
Fixes #503
Fixes #378