[stephanmiehe]

Description

This PR adds support for expiring oauth tokens. Using expiring tokens ensures that should a token ever leak, the exposure is limited by the lifetime of the oauth token. There is an influx in security incidents going on around the world because threat actors are finding oauth tokens and weaponizing them.

Type of change

• Dependency upgrade
• Bugfix (non-breaking change which fixes an issue)
• New feature (which adds functionality)
• Breaking change (fix/feature causing existing functionality to break)
• Code quality improvements

Checklist

• Tests pass locally (scripts/test)
• Code has been formatted (scripts/lint)
• Tests added for new functionality (if applicable)

[Copilot]

🟡 Changes recommended

The refresh request ignores configured timeout, header, and client-name settings that registration and activation correctly honor.

1 open issue

• Honor configured client settings in refresh requests · New

What changed in this PR

This PR adds support for expiring OAuth credentials to the device authentication flow, allowing callers to refresh tokens and update existing API clients.

Changes:

• Add refresh-token handling, expiration timestamps, and credential validation.
• Allow access-token replacement without recreating API namespaces.
• Add tests for refresh responses, error handling, cancellation, and header preservation.

File	Description
tests/​device/​test_refresh.py	Tests token refresh, expiration, failures, and token replacement.
tests/​common.py	Adds async context-manager support to mock responses.
aiogithubapi/​models/​login_oauth.py	Validates credentials and calculates expiration timestamps.
aiogithubapi/​github.py	Exposes token replacement on the public API client.
aiogithubapi/​device.py	Adds token refresh and captures activation request timing.
aiogithubapi/​client.py	Updates the token used by existing namespaces.

_{Review effort: Balanced}

[Copilot]

🔵 Needs a closer look

Token changes can leave an old Authorization credential active, and refresh requests with automatic HTTP-error raising can misclassify authentication and rate-limit failures as connection errors.

No open issues 🎉

2 previously missed issues

In code that hasn't changed since last review

Token updates leave the configured Authorization header in effect

aiogithubapi/​client.py:87

If the client was constructed with headers={'Authorization': 'token old'}, both set_token('new') and set_token(None) leave that credential active. GitHubBaseRequestDataModel.headers applies the configured headers after the token-derived header, so subsequent requests still authenticate with the old token. Remove or update the base Authorization override here while preserving the other configured headers.

Disable automatic status raising to classify refresh responses

aiogithubapi/​device.py:241

With an injected aiohttp.ClientSession(raise_for_status=True), this request inherits automatic HTTP-error raising. A 400/401 rejected refresh token or a 429 response then raises ClientResponseError before this block is entered and is caught as GitHubConnectionException, bypassing the authentication and rate-limit classification below. Explicitly pass raise_for_status=False so this method can inspect and classify those responses.

1 resolved since last review

• Honor configured client settings in refresh requests

_{Review effort: Balanced}

[Copilot]

🔵 Needs a closer look

A successful response with an explicitly null refresh token is accepted, risking loss of the stored refresh token and preventing future access-token renewal.

No open issues 🎉

1 previously missed issue

In code that hasn't changed since last review

Reject null refresh tokens in successful OAuth responses

aiogithubapi/​device.py:261

A successful response containing "refresh_token": null bypasses this fallback and is accepted by GitHubLoginOauthModel. A caller persisting the returned credentials would overwrite its refresh token with None and lose the ability to renew the access token. Reject an explicitly null refresh token as a malformed response before constructing the model.

_{Review effort: Balanced}

[Copilot]

🟢 Approval recommended

No active review issues were identified for the OAuth credential refresh and token-replacement changes.

No open issues 🎉

_{Review effort: Balanced}