Skip to content

Conversation

@EhabY
Copy link
Collaborator

@EhabY EhabY commented Jan 16, 2026

Summary

  • Improves the user experience when sessions expire by showing a "Log In" button
  • Keeps deployment context after expiry so users don't have to re-enter the URL
  • Adds automatic session recovery when tokens are updated from another window
  • Adds OAuth scope validation to detect when required permissions change

Fixes #723

@EhabY EhabY force-pushed the oauth-failure-handling branch from 9f9b099 to 87cd9c1 Compare January 16, 2026 16:39
@EhabY EhabY requested a review from code-asher January 19, 2026 11:56
@EhabY EhabY self-assigned this Jan 19, 2026
- Show "Log In" button when session expires instead of just a message
- Keep deployment info after session expiry for easier re-login
- Automatically recover session when tokens are refreshed in another window
- Validate OAuth scopes to detect permission changes
- Consolidate duplicated OAuth constants
@EhabY EhabY force-pushed the oauth-failure-handling branch from 87cd9c1 to ae4df51 Compare January 20, 2026 10:17
Copy link
Member

@code-asher code-asher left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good!


if (auth) {
this.client.setCredentials(auth.url, auth.token);
if (this.contextManager.get("coder.authenticated")) {
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nbd but would calling this.isAuthenticated() make sense here since it does the same thing?

this.refresh();
}

public dispose() {
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Feels like if we have dispose and clear they should do different things, like is dispose meant to ensure the provider cannot be used again or something? In which case maybe we can formalize that with a boolean check or something.

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

dispose meant to ensure the provider cannot be used again or something?

Indeed, I'll add a boolean check then!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

UX papercuts when an oauth token is revoked

2 participants