fix: refresh OAuth2 tokens in long-running watch/subscribe loops#396
fix: refresh OAuth2 tokens in long-running watch/subscribe loops#396zerone0x wants to merge 1 commit intogoogleworkspace:mainfrom
Conversation
The `+watch` and `+subscribe` commands obtained OAuth2 access tokens once at startup and passed them as static `&str` values into their pull loops. Since Google access tokens expire after 3600 seconds, both commands would exit with a 401 error after ~1 hour. Fix by calling `auth::get_token()` on each loop iteration instead of once before the loop. The underlying `yup_oauth2` authenticator uses cached credentials and only contacts the OAuth server when the current access token has expired, so this adds negligible overhead. Also refresh the token before cleanup operations that run after the potentially long-lived loop. Fixes googleworkspace#392 Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
|
googleworkspace-bot
added
the
area: core
|
Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA). View this failed invocation of the CLA check for more information. For the most up to date status, view the checks section at the bottom of the pull request. |
Summary of ChangesHello, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request addresses an issue where long-running watch and subscribe operations for Gmail and events would fail after approximately one hour due to expired OAuth2 tokens. The changes introduce a robust token refresh mechanism, ensuring that access tokens are renewed dynamically within the application's main loops and during subsequent cleanup phases. This significantly improves the stability and reliability of these long-lived processes without incurring substantial overhead, as the underlying authentication library efficiently handles token caching. Highlights
Changelog
Activity
Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here. You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension. Footnotes
|
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
The pull request refactors token management in both Pub/Sub subscription and Gmail watch functionalities. Previously, tokens were passed into long-running pull loops, risking expiration. The changes introduce on-demand token refreshing within these loops and during cleanup operations, ensuring that API calls always use valid, non-expired tokens. This is achieved by removing token parameters from the pull_loop and watch_pull_loop functions and instead calling auth::get_token at the beginning of each iteration or before cleanup, which efficiently retrieves a fresh token when needed.
2 participants
Fixes #392
Summary
gmail +watchandevents +subscribeby callingauth::get_token()on each iteration, instead of obtaining the token once at startupget_token()uses cached credentials viayup_oauth2and only contacts the OAuth server when the cached access token has expired, so this adds negligible overheadChanges
src/helpers/gmail/watch.rs: Removedpubsub_tokenandgmail_tokenparameters fromwatch_pull_loop; tokens are now refreshed inside the loop. Cleanup section also refreshes its token.src/helpers/events/subscribe.rs: Removedtokenparameter frompull_loop; token is now refreshed inside the loop. Cleanup section also refreshes its token.Test plan
cargo checkpassescargo test— all 550 tests passcargo clippy— no warningsgws gmail +watchfor >1 hour and verify it does not exit with 401gws events +subscribefor >1 hour and verify it does not exit with 401Co-Authored-By: Claude Opus 4.6 noreply@anthropic.com