docs+test(spotify): add re-auth cycle docs and client-level invalid_grant test - #48409
Closed
aieng-abdullah wants to merge 2 commits into
Closed
docs+test(spotify): add re-auth cycle docs and client-level invalid_grant test#48409aieng-abdullah wants to merge 2 commits into
aieng-abdullah wants to merge 2 commits into
Conversation
resolve_spotify_runtime_credentials() called _refresh_spotify_oauth_state() without a try/except, so a terminal failure (HTTP 400/401, invalid_grant, refresh_token_reused) raised AuthError but left the dead refresh_token in auth.json. Every subsequent session re-read and retried the same token over the network, failing identically each time. Fix: wrap the refresh call and, when exc.relogin_required is True and a refresh_token is present, clear the dead OAuth fields (access_token, refresh_token, expires_at, expires_in, obtained_at) and write a last_auth_error quarantine marker to auth.json before re-raising. The next call sees no access_token and fails fast with spotify_access_token_missing — no network retry — and the user is prompted to re-authenticate. Mirrors the quarantine pattern already in place for Nous, xAI-OAuth, Codex-OAuth (NousResearch#28116, NousResearch#28118), and MiniMax-OAuth (NousResearch#28119).
…valid_grant test - Remove the 'you only log in once per machine' claim from spotify.md and document the ~6-month refresh token expiry with re-auth instructions - Add test_client_wraps_invalid_grant_as_spotify_auth_required_error to confirm SpotifyClient wraps AuthError(code=spotify_refresh_invalid_grant) into SpotifyAuthRequiredError with a user-facing message Refs: NousResearch#28155
alt-glitch
added
type/security
aieng-abdullah
changed the title
tonydwb
approved these changes
Jun 19, 2026
tonydwb
left a comment
tonydwb
left a comment
There was a problem hiding this comment.
Code Review Summary
Verdict: Approved
Bug Fix + Test — Looks Good
- Correct quarantine pattern: When Spotify OAuth refresh fails with
relogin_required=True, dead tokens are now cleared fromauth.jsonso subsequent calls fail fast without retrying a known-bad refresh token. Mirrors the established pattern for Nous, xAI-OAuth, Codex-OAuth, and MiniMax. - Correct re-auth state tracking: Stores
last_auth_errorwith structured error metadata so clients can detect and prompt re-auth. - Best-effort save: Failed quarantine write is swallowed with debug log (never breaks the main flow).
- Good test coverage: New tests covering the
invalid_grant/ quarantined state re-auth cycle. - No debug artifacts or secrets
Reviewed by Hermes Agent
Contributor
|
Merged via PR #49944 (docs salvage cluster 2). Your commit was cherry-picked onto current main with your authorship preserved in git log — rebase-merged so it lands under your name. Thanks for the contribution! |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
5 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What does this PR do?
Adds the missing documentation update and client-level test for the Spotify
invalid_grantfix in #28155.SpotifyAuthRequiredErrorsurfaces correctly at the client level wheninvalid_grantis raised from the auth layer.This PR closes both gaps.
Related Issue
Fixes #48381
Contributes to #28155
Type of Change
Changes Made
website/docs/user-guide/features/spotify.md— removes the "you only log in once per machine" claim and documents the 6-month re-auth cycletests/tools/test_spotify_client.py— adds a test confirmingSpotifyAuthRequiredErroris raised with a user-facing message wheninvalid_grantpropagates from the auth layerHow to Test
pytest tests/tools/test_spotify_client.py -vand confirm the new test passeswebsite/docs/user-guide/features/spotify.mdto confirm the re-auth cycle is accurately documentedChecklist
Code
pytest tests/ -qand all tests passDocumentation & Housekeeping
website/docs/user-guide/features/spotify.md)cli-config.yaml.example— N/ACONTRIBUTING.md/AGENTS.md— N/A