Garrett Delfosse 4bb1fd1a84 fix(coderd/externalauth): save refreshed token before validation (#24332) (backport to 2.29) (#24900) ...

Backport of https://github.com/coder/coder/pull/24332 to `release/2.29`.

Moves the `UpdateExternalAuthLink` call to immediately after
`TokenSource.Token()` succeeds (before validation). GitHub rotates
refresh tokens on use, so if post-refresh validation fails (e.g.
rate-limited 403), the new token was previously silently discarded,
forcing manual re-authentication.

Original PR: #24332
Merge commit: 2a1984f0e8

**Note:** This branch includes the cherry-pick of #22904 (optimistic
locking) as a prerequisite since #24332's tests depend on it. The #22904
backport PR is #24901. Once that merges, the overlapping commit in this
PR will be a no-op.

Cherry-picks applied cleanly with no conflicts.

> Generated by Coder Agents

---------

Co-authored-by: Kyle Carberry <kyle@coder.com>
Co-authored-by: Mathias Fredriksson <mafredri@gmail.com>

2026-05-01 14:37:27 -04:00

..

externalauth_internal_test.go

fix: set default values for RevokeURL property in external auth configs (#20270)

2025-10-13 14:04:08 +02:00

externalauth_test.go

fix(coderd/externalauth): save refreshed token before validation (#24332) (backport to 2.29) (#24900)

2026-05-01 14:37:27 -04:00

externalauth.go

fix(coderd/externalauth): save refreshed token before validation (#24332) (backport to 2.29) (#24900)

2026-05-01 14:37:27 -04:00