Skip to content

feat(auth): guard single-use refresh grants with the shared journal - #22

Open
yordis wants to merge 1 commit into
yordis/feat-natsstore-journalprobefrom
yordis/feat-natsstore-journalwire
Open

yordis wants to merge 1 commit into
yordis/feat-natsstore-journalprobefrom
yordis/feat-natsstore-journalwire

Conversation

@yordis

@yordis yordis commented Nov 8, 2026 •

Copy link
Copy Markdown
Member
  • Claude, Kimi and xAI rotate their refresh tokens but had no journal, so two replicas could spend the same grant and lose the credential. Each provider now declares whether its grant is single-use, and a store whose journal is shared guards every one that is. Stores without a shared journal behave as before.

Claude, Kimi and xAI rotate their refresh tokens but had no journal, so
two replicas could spend the same grant and lose the credential. Each
provider now declares whether its grant is single-use, and a store whose
journal is shared guards every one that is. Stores without a shared
journal behave as before.

Signed-off-by: Yordis Prieto <yordis.prieto@gmail.com>
@coderabbitai

coderabbitai Bot commented Nov 8, 2026 •

Copy link
Copy Markdown

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 11 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

Run configuration

  • Source mode: Auto
  • Repository: Unavailable
  • Branch: Unavailable
  • File: No configuration file from this repository applied
  • Commit: Unavailable
  • Layers: Organization UI
  • Review profile: CHILL
  • Plan: Advanced
  • Run ID: 8073867d-e79a-4e52-8d6d-6eabb9cab70e
Commits

Reviewing files that changed from the base of the PR and between 5899a70 and 2388b72.

Files selected for processing: 13

  • internal/auth/claude/anthropic_auth.go
  • internal/auth/claude/refresh_journal_test.go
  • internal/auth/codex/refresh_journal.go
  • internal/auth/kimi/kimi.go
  • internal/auth/kimi/kimi_refresh_test.go
  • internal/auth/xai/xai.go
  • internal/auth/xai/xai_auth_test.go
  • internal/runtime/executor/refresh_policy.go
  • internal/store/natsstore/refresh_journal.go
  • internal/store/natsstore/store.go
  • sdk/cliproxy/auth/conductor_refresh.go
  • sdk/cliproxy/auth/refresh_policy.go
  • sdk/cliproxy/auth/refresh_policy_test.go
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

@yordis
yordis added this pull request to stack #9 November 8, 2026 02:37

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant