fix: restore OAuth token expiry across process restarts - #3248
Conversation
Sorry, something went wrong.
|
Thanks for the contribution. This repository only keeps pull requests open when they're linked to an issue that a maintainer has assigned to the author — CONTRIBUTING.md explains why and how we work. This PR has been closed for now because its description doesn't yet link an open issue in this repository (with Fixes #123 or similar). If there isn't an issue for this yet, please open one — a clear description of the problem is genuinely the most useful thing for us. Then add Fixes #<number> to this PR's description. If a maintainer would like the change as a PR from you, they'll assign you to the issue and this PR will reopen automatically. There's no need to open a new PR — this one will be reopened. While it's closed, please push any updates as new commits rather than force-pushing, since GitHub can't reopen a PR whose branch has been rewritten. Maintainers: reopening this PR, removing the missing-issue-link label, or adding bypass-issue-check bypasses the check. |
Sorry, something went wrong.
Problem
OAuthClientProvider._initialize (and the client-credentials providers) reloads current_tokens from storage but never restores token_expiry_time. The persisted OAuthToken only carries the relative expires_in, so on a fresh process is_token_valid() returns True for an already-expired access token — a stale Bearer is sent and a 401 round-trip is wasted before re-authentication (mcp2cli issues #50, #57).
Fix
Persist the absolute expiry and restore it on init:
Backwards compatible: expires_at defaults to None; existing stored tokens simply re-auth once, then persist the absolute expiry going forward.
Test
test_init_restores_expired_token_expiry — fails on main (expired token reported valid), passes with the fix. 210 auth tests pass, ruff + pyright clean.