Repository navigation
fix(desktop): reissue the background service session after a server upgrade - #2
Merged
Merged
Conversation
…pgrade The desktop app stores the session it issues for the background service and reused it on every launch while it still authenticated. A session keeps the permissions it was issued with, so one issued before upstream split out environment:maintain (and settings:write, providers:manage) can no longer update the server: "The authenticated token is missing required scope: environment:maintain." The stored session now records the server version that issued it and only serves that version; any other version, or a file written before this field existed, gets a fresh session from that server's own CLI.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Updating the background service from the desktop app failed with "The authenticated token is missing required scope: environment:maintain."
Cause: the desktop app stores the session it issues for the background service (
~/.t3/userdata/desktop-service-session.json) and reused it on every launch while it still authenticated. Sessions keep the permissions they were issued with, and upstream pingdotgg#9786 (in since mk.8) splitenvironment:maintain,settings:writeandproviders:manageout oforchestration:operatewith no grant expansion. A session issued by an mk.7-or-older service therefore can't update the server, change settings or manage providers on mk.8+.Fix: the stored session records the server version that issued it and only serves that version. A different version, or a file from before this field, gets a fresh session from that server's own CLI (administrative scopes of that version). Also keys the in-memory cache by version.
Tests: new test (fails without the fix) for a legacy session file → one new session issued and stored with the version; DesktopBackgroundService 20/20; desktop
tsc --noEmitclean.