feat(rest): support OAuth token exchange sessions - #867
Conversation
Add RFC 8693 token exchange support, including token type helpers, request form construction, OAuth endpoint normalization, and response handling. Preserve OAuth metadata in auth sessions and create contextual and table-scoped child sessions from direct tokens, credentials, or typed tokens. Disable child refresh until session lifecycle management is available.
| if (token_it != credentials.end()) { | ||
| ICEBERG_ASSIGN_OR_RAISE(auto config, | ||
| ChildConfig(*parent_info, parent_info->credential)); | ||
| return MakeSession(AccessTokenResponse(token_it->second), config, |
There was a problem hiding this comment.
Child sessions are always created with keep_refreshed=false, so a token-exchange response with expires_in or JWT exp is never refreshed. A long-lived table/context session will keep sending an expired token. Can we either schedule child refresh or explicitly limit expiring child tokens here?
There was a problem hiding this comment.
This patch intentionally supports initial token exchange only.
Child-session caching and refresh are deferred to a follow-up change, because enabling refresh without cache/session ownership would create unmanaged refresh tasks.
|
|
||
| Result<std::shared_ptr<AuthSession>> ContextualSession( | ||
| const SessionContext& context, std::shared_ptr<AuthSession> parent) override { | ||
| return MaybeCreateChildSession(context.credentials, /*allow_credential=*/true, |
There was a problem hiding this comment.
This path creates a new child session for every contextual operation. Without a cache, repeated operations with the same context re-exchange or fetch a token each time, which can hit OAuth rate limits. Can we cache child sessions by context/credential before enabling this path?
There was a problem hiding this comment.
Agreed. This is part of the session lifecycle limitation.
This patch only supports initial child-session creation. Session caching and child-session refresh will be implemented in a follow-up PR.
Add RFC 8693 token exchange support, including token type helpers,
request form construction, OAuth endpoint normalization, and response
handling.
Preserve OAuth metadata in auth sessions and create contextual and
table-scoped child sessions from direct tokens, credentials, or typed
tokens. Disable child refresh until session lifecycle management is
available.
2 participants
Add RFC 8693 token exchange support, including token type helpers, request form construction, OAuth endpoint normalization, and response handling.
Preserve OAuth metadata in auth sessions and create contextual and table-scoped child sessions from direct tokens, credentials, or typed tokens. Disable child refresh until session lifecycle management is available.