From b0974c97446dfbc2a2f5f88e309461d5bc8f96fd Mon Sep 17 00:00:00 2001 From: Nguyen Thanh Dat Date: Mon, 24 Aug 2026 15:43:49 +0700 Subject: [PATCH 1/2] fix(db): keep tokenExpiresAt when a connection is created MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit `createProviderConnection` copies optional fields onto the row through an allowlist. `tokenExpiresAt` was not on it and the initial object does not set it either, so `_insertConnectionRow` always bound `conn.tokenExpiresAt || null` — NULL on every insert. That makes #5326 a no-op end to end. `buildOAuthConnectionCreatePayload` mirrors the computed expiry into `tokenExpiresAt` precisely so the dashboard badge does not flash "Token Expired" before the first background refresh, and the value was discarded one layer down. The update path already carries it, so a connection only gained the field after its first refresh. The existing #5326 test asserts the payload object and never persists it, which is why it stayed green throughout. The new case creates the connection and reads it back through `getProviderConnections`. --- src/lib/db/providers.ts | 4 ++ ...uth-connection-tokenexpiresat-5326.test.ts | 52 +++++++++++++++++-- 2 files changed, 51 insertions(+), 5 deletions(-) diff --git a/src/lib/db/providers.ts b/src/lib/db/providers.ts index 6c7b6ea34c80..e63b85bf09af 100644 --- a/src/lib/db/providers.ts +++ b/src/lib/db/providers.ts @@ -625,6 +625,10 @@ export async function createProviderConnection(data: JsonRecord) { "accessToken", "refreshToken", "expiresAt", + // #5326's payload sets this and _insertConnectionRow binds it, but it was + // missing from this allowlist — so every created row stored NULL however good + // the payload was. The update path already carries it (`data.tokenExpiresAt`). + "tokenExpiresAt", "tokenType", "scope", "idToken", diff --git a/tests/unit/oauth-connection-tokenexpiresat-5326.test.ts b/tests/unit/oauth-connection-tokenexpiresat-5326.test.ts index 206183ee8582..950750622180 100644 --- a/tests/unit/oauth-connection-tokenexpiresat-5326.test.ts +++ b/tests/unit/oauth-connection-tokenexpiresat-5326.test.ts @@ -1,7 +1,22 @@ import test from "node:test"; import assert from "node:assert/strict"; +import fs from "node:fs"; +import os from "node:os"; +import path from "node:path"; -import { buildOAuthConnectionCreatePayload } from "../../src/lib/oauth/connectionPersistence.ts"; +const TEST_DATA_DIR = fs.mkdtempSync(path.join(os.tmpdir(), "omniroute-tokenexpiresat-")); +process.env.DATA_DIR = TEST_DATA_DIR; +process.env.API_KEY_SECRET = process.env.API_KEY_SECRET || "tokenexpiresat-test-secret"; + +const core = await import("../../src/lib/db/core.ts"); +const providersDb = await import("../../src/lib/db/providers.ts"); +const { buildOAuthConnectionCreatePayload } = + await import("../../src/lib/oauth/connectionPersistence.ts"); + +test.after(() => { + core.resetDbInstance(); + fs.rmSync(TEST_DATA_DIR, { recursive: true, force: true }); +}); // Regression for #5326: a freshly created OAuth connection (e.g. antigravity) used // to persist only `expiresAt`, leaving `tokenExpiresAt` null. The dashboard token @@ -32,12 +47,39 @@ test("buildOAuthConnectionCreatePayload mirrors expiresAt into tokenExpiresAt (# }); test("buildOAuthConnectionCreatePayload keeps tokenExpiresAt null when expiry is unknown", () => { + const payload = buildOAuthConnectionCreatePayload("antigravity", { accessToken: "at-456" }, null); + + assert.equal(payload.expiresAt, null); + assert.equal(payload.tokenExpiresAt, null); +}); + +// The two cases above assert the payload object only, which is why the create path +// could drop the field for as long as it did. `createProviderConnection` copies +// optional fields through an allowlist, and `tokenExpiresAt` was not on it, so the +// insert bound NULL however good the payload was. Persist and read it back. +test("a created connection keeps tokenExpiresAt through the database", async () => { + core.resetDbInstance(); + const expiresAt = new Date(Date.now() + 3600 * 1000).toISOString(); const payload = buildOAuthConnectionCreatePayload( "antigravity", - { accessToken: "at-456" }, - null + { + accessToken: "at-789", + refreshToken: "rt-789", + email: "roundtrip@example.com", + expiresIn: 3600, + }, + expiresAt ); + assert.equal(payload.tokenExpiresAt, expiresAt, "precondition: the payload carries it"); - assert.equal(payload.expiresAt, null); - assert.equal(payload.tokenExpiresAt, null); + const created = await providersDb.createProviderConnection(payload); + const readBack = (await providersDb.getProviderConnections({})).find( + (c: { id: string }) => c.id === created.id + ); + + assert.ok(readBack, "the connection was persisted"); + assert.equal(readBack.expiresAt, expiresAt); + // The dashboard badge and tokenHealthCheck both prefer tokenExpiresAt and fall back + // to expiresAt only when it is null, so a NULL here is a false "Token Expired". + assert.equal(readBack.tokenExpiresAt, expiresAt); }); From 041a436ee068e04be8b02a6eb88c3d498e7bc95b Mon Sep 17 00:00:00 2001 From: Nguyen Thanh Dat Date: Mon, 24 Aug 2026 15:44:41 +0700 Subject: [PATCH 2/2] docs(changelog): fragment for #11368 --- changelog.d/fixes/11368-create-connection-tokenexpiresat.md | 1 + 1 file changed, 1 insertion(+) create mode 100644 changelog.d/fixes/11368-create-connection-tokenexpiresat.md diff --git a/changelog.d/fixes/11368-create-connection-tokenexpiresat.md b/changelog.d/fixes/11368-create-connection-tokenexpiresat.md new file mode 100644 index 000000000000..e69ce198f9e3 --- /dev/null +++ b/changelog.d/fixes/11368-create-connection-tokenexpiresat.md @@ -0,0 +1 @@ +- **Provider connections:** keep `tokenExpiresAt` when a connection is created. The create-path allowlist omitted it, so every insert stored NULL and the dashboard token badge could read a fresh connection as expired until its first background refresh ([#11368](https://github.com/diegosouzapw/OmniRoute/pull/11368)).