mirror of
https://github.com/coder/coder.git
synced 2026-06-03 21:18:24 +00:00
Kyle Carberry
53e52aef78
## Problem When multiple concurrent callers (e.g., parallel workspace builds) read the same single-use OAuth2 refresh token from the database and race to exchange it with the provider, the first caller succeeds but subsequent callers get `bad_refresh_token`. The losing caller then **clears the valid new token** from the database, permanently breaking the auth link until the user manually re-authenticates. This is reliably reproducible when launching multiple workspaces simultaneously with GitHub App external auth and user-to-server token expiration enabled. ## Solution Two layers of protection: ### 1. Singleflight deduplication (`Config.RefreshToken` + `ObtainOIDCAccessToken`) Concurrent callers for the same user/provider share a single refresh call via `golang.org/x/sync/singleflight`, keyed by `userID`. The singleflight callback re-reads the link from the database to pick up any token already refreshed by a prior in-flight call, avoiding redundant IDP round-trips entirely. ### 2. Optimistic locking on `UpdateExternalAuthLinkRefreshToken` The SQL `WHERE` clause now includes `AND oauth_refresh_token = @old_oauth_refresh_token`, so if two replicas (HA) race past singleflight, the loser's destructive UPDATE is a harmless no-op rather than overwriting the winner's valid token. ## Changes | File | Change | |------|--------| | `coderd/externalauth/externalauth.go` | Added `singleflight.Group` to `Config`; split `RefreshToken` into public wrapper + `refreshTokenInner`; pass `OldOauthRefreshToken` to DB update | | `coderd/provisionerdserver/provisionerdserver.go` | Wrapped OIDC refresh in `ObtainOIDCAccessToken` with package-level singleflight | | `coderd/database/queries/externalauth.sql` | Added optimistic lock (`WHERE ... AND oauth_refresh_token = @old_oauth_refresh_token`) | | `coderd/database/queries.sql.go` | Regenerated | | `coderd/database/querier.go` | Regenerated | | `coderd/database/dbauthz/dbauthz_test.go` | Updated test params for new field | | `coderd/externalauth/externalauth_test.go` | Added `ConcurrentRefreshDedup` test; updated existing tests for singleflight DB re-read | ## Testing - **New test `ConcurrentRefreshDedup`**: 5 goroutines call `RefreshToken` concurrently, asserts IDP refresh called exactly once, all callers get same token. - All existing `TestRefreshToken/*` subtests updated and passing. - `TestObtainOIDCAccessToken` passing. - `dbauthz` tests passing.
72 lines
2.1 KiB
SQL
72 lines
2.1 KiB
SQL
-- name: GetExternalAuthLink :one
|
|
SELECT * FROM external_auth_links WHERE provider_id = $1 AND user_id = $2;
|
|
|
|
-- name: DeleteExternalAuthLink :exec
|
|
DELETE FROM external_auth_links WHERE provider_id = $1 AND user_id = $2;
|
|
|
|
-- name: GetExternalAuthLinksByUserID :many
|
|
SELECT * FROM external_auth_links WHERE user_id = $1;
|
|
|
|
-- name: InsertExternalAuthLink :one
|
|
INSERT INTO external_auth_links (
|
|
provider_id,
|
|
user_id,
|
|
created_at,
|
|
updated_at,
|
|
oauth_access_token,
|
|
oauth_access_token_key_id,
|
|
oauth_refresh_token,
|
|
oauth_refresh_token_key_id,
|
|
oauth_expiry,
|
|
oauth_extra
|
|
) VALUES (
|
|
$1,
|
|
$2,
|
|
$3,
|
|
$4,
|
|
$5,
|
|
$6,
|
|
$7,
|
|
$8,
|
|
$9,
|
|
$10
|
|
) RETURNING *;
|
|
|
|
-- name: UpdateExternalAuthLink :one
|
|
UPDATE external_auth_links SET
|
|
updated_at = $3,
|
|
oauth_access_token = $4,
|
|
oauth_access_token_key_id = $5,
|
|
oauth_refresh_token = $6,
|
|
oauth_refresh_token_key_id = $7,
|
|
oauth_expiry = $8,
|
|
oauth_extra = $9,
|
|
-- Only 'UpdateExternalAuthLinkRefreshToken' supports updating the oauth_refresh_failure_reason.
|
|
-- Any updates to the external auth link, will be assumed to change the state and clear
|
|
-- any cached errors.
|
|
oauth_refresh_failure_reason = ''
|
|
WHERE provider_id = $1 AND user_id = $2 RETURNING *;
|
|
|
|
-- name: UpdateExternalAuthLinkRefreshToken :exec
|
|
-- Optimistic lock: only update the row if the refresh token in the database
|
|
-- still matches the one we read before attempting the refresh. This prevents
|
|
-- a concurrent caller that lost a token-refresh race from overwriting a valid
|
|
-- token stored by the winner.
|
|
UPDATE
|
|
external_auth_links
|
|
SET
|
|
-- oauth_refresh_failure_reason can be set to cache the failure reason
|
|
-- for subsequent refresh attempts.
|
|
oauth_refresh_failure_reason = @oauth_refresh_failure_reason,
|
|
oauth_refresh_token = @oauth_refresh_token,
|
|
updated_at = @updated_at
|
|
WHERE
|
|
provider_id = @provider_id
|
|
AND
|
|
user_id = @user_id
|
|
AND
|
|
oauth_refresh_token = @old_oauth_refresh_token
|
|
AND
|
|
-- Required for sqlc to generate a parameter for the oauth_refresh_token_key_id
|
|
@oauth_refresh_token_key_id :: text = @oauth_refresh_token_key_id :: text;
|