{"action":"created","issue":{"url":"https://api.github.com/repos/getsentry/sentry/issues/10050","repository_url":"https://api.github.com/repos/getsentry/sentry","labels_url":"https://api.github.com/repos/getsentry/sentry/issues/10050/labels{/name}","comments_url":"https://api.github.com/repos/getsentry/sentry/issues/10050/comments","events_url":"https://api.github.com/repos/getsentry/sentry/issues/10050/events","html_url":"https://github.com/getsentry/sentry/pull/10050","id":368012920,"node_id":"MDExOlB1bGxSZXF1ZXN0MjIxMjg4MDk3","number":10050,"title":"ref(integrations): Refactor identity / integration oauth refresh","user":{"login":"EvanPurkhiser","id":1421724,"node_id":"MDQ6VXNlcjE0MjE3MjQ=","avatar_url":"https://avatars0.githubusercontent.com/u/1421724?v=4","gravatar_id":"","url":"https://api.github.com/users/EvanPurkhiser","html_url":"https://github.com/EvanPurkhiser","followers_url":"https://api.github.com/users/EvanPurkhiser/followers","following_url":"https://api.github.com/users/EvanPurkhiser/following{/other_user}","gists_url":"https://api.github.com/users/EvanPurkhiser/gists{/gist_id}","starred_url":"https://api.github.com/users/EvanPurkhiser/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/EvanPurkhiser/subscriptions","organizations_url":"https://api.github.com/users/EvanPurkhiser/orgs","repos_url":"https://api.github.com/users/EvanPurkhiser/repos","events_url":"https://api.github.com/users/EvanPurkhiser/events{/privacy}","received_events_url":"https://api.github.com/users/EvanPurkhiser/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":1,"created_at":"2018-10-09T02:04:56Z","updated_at":"2018-10-17T18:06:26Z","closed_at":null,"author_association":"MEMBER","pull_request":{"url":"https://api.github.com/repos/getsentry/sentry/pulls/10050","html_url":"https://github.com/getsentry/sentry/pull/10050","diff_url":"https://github.com/getsentry/sentry/pull/10050.diff","patch_url":"https://github.com/getsentry/sentry/pull/10050.patch"},"body":"This makes a number of changes to provide a cleaner interface for dealing with refreshing tokens used with integrations and external identities.\n\n - The `AuthApiClient` has been removed from sentry.integrations.client as this was not in use at all.\n\n - A new `ClientTokenRefresh` object has been introduced which encapsulates the functionality needed to refresh access tokens. It has the functionality to refresh access tokens stored in Integration and Identity objects.\n\n   - Azure DevOps has been migrated to use this and the OAuth2RefreshMixin has been removed.\n\n   - GitHub now uses the ClientTokenRefresh functionality with a custom refresh strategy.\n\n - The `oauth_refresh_url` is now retrieved using the `_get_oauth_parameter` method, allowing the parameter to be looked up from the variety of places where the parameter may exist depending on the current context of the provider instance.\n\n - `get_refresh_token_headers` is moved down in the class to live near other token refresh methods.\n\n - A new staticmethod `get_oauth_data` is introduced onto the OAuth2Provider which provides data mapping for common OAuth2 parameters.\n\n   A method by the same name previously lived on the provider class instance. We expose it as a static method so that integration providers which use the identity provider pipeline may consistently use this method to map the oauth2 parameters.\n\n   Both Gitlab and Azure DevOps have been switched to use this.  - The `expires` parameter has been renamed `expires_at`.\n\n   **IMPORTANT**: Since token expirations for providers using the identity provider (Azure DevOps, GitLab) previously used the `expires` key, tokens will be immediately renewed since we will now be looking for the `expires_at` key. When renewed the expires_at key will be used.\n\n - The `refresh_identity` method on the OAuth2Provider has been split into two separate methods\n\n   - `refresh_oauth_data`: Makes the necessary API requests to refresh the token, but does not update any models. This method will return the new oauth data.\n\n   - `refresh_identity`: Does what it did before, refreshes the OAuth token and updates the identity model.\n\n     The `*args` parameter has also been removed from this method as it was not used.\n\nThese changes will also support Slack's \"new\" workspace token requirement for refresh tokens."},"comment":{"url":"https://api.github.com/repos/getsentry/sentry/issues/comments/430730250","html_url":"https://github.com/getsentry/sentry/pull/10050#issuecomment-430730250","issue_url":"https://api.github.com/repos/getsentry/sentry/issues/10050","id":430730250,"node_id":"MDEyOklzc3VlQ29tbWVudDQzMDczMDI1MA==","user":{"login":"lauryndbrown","id":12959365,"node_id":"MDQ6VXNlcjEyOTU5MzY1","avatar_url":"https://avatars0.githubusercontent.com/u/12959365?v=4","gravatar_id":"","url":"https://api.github.com/users/lauryndbrown","html_url":"https://github.com/lauryndbrown","followers_url":"https://api.github.com/users/lauryndbrown/followers","following_url":"https://api.github.com/users/lauryndbrown/following{/other_user}","gists_url":"https://api.github.com/users/lauryndbrown/gists{/gist_id}","starred_url":"https://api.github.com/users/lauryndbrown/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/lauryndbrown/subscriptions","organizations_url":"https://api.github.com/users/lauryndbrown/orgs","repos_url":"https://api.github.com/users/lauryndbrown/repos","events_url":"https://api.github.com/users/lauryndbrown/events{/privacy}","received_events_url":"https://api.github.com/users/lauryndbrown/received_events","type":"User","site_admin":false},"created_at":"2018-10-17T18:06:26Z","updated_at":"2018-10-17T18:06:26Z","author_association":"CONTRIBUTOR","body":"@EvanPurkhiser so the docs for GitLab are wrong. https://docs.gitlab.com/ee/api/oauth2.html#doc-nav It does not give us an expiration time. In GitLab when the api token expires (if at all!) can be configured. It instead gives us a `created_at` number instead. Meredith so, wonderfully documented it in the code here: https://github.com/getsentry/sentry/blob/master/src/sentry/integrations/gitlab/integration.py#L213:L221\r\n\r\nTo my knowledge there is no way to find out when it expires. I know there was talk about instead doing: if you make a request and get an unauthorized response, then try to refresh the token.\r\n\r\nGitLab is such an outlier that perhaps, it need to be included here, but from what I can see it doesn't appear what is written so far will fit it very well. I don't know if that's just because GitLab is on-prem or if it's just different. But I would be curious what GitHub Enterprise and Jira Server do."}}
{"actor":{"display_login":"lauryndbrown"}}