Repository navigation
SK-3253:Add gated retry on 401 status code for flowvault SDK. - #449
yaswanth-pula-skyflow merged 4 commits into
Conversation
|
✅ Gitleaks Findings: No secrets detected. Safe to proceed! |
|
Semgrep Findings: Issues with Error level severity are found (Error is Highest severity in Semgrep), Please resolve the issues before merging. |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## flowvault-release/26.10.28 #449 +/- ##
================================================================
+ Coverage 90.99% 91.25% +0.26%
- Complexity 0 570 +570
================================================================
Files 174 174
Lines 7350 7399 +49
Branches 1013 1022 +9
================================================================
+ Hits 6688 6752 +64
+ Misses 437 424 -13
+ Partials 225 223 -2
Flags with carried forward coverage won't be shown. Click here to find out more.
... and 2 files with indirect coverage changes Continue to review full report in Codecov by Harness.
🚀 New features to boost your workflow:
|
There was a problem hiding this comment.
🟡 Changes recommended
Refresh operations can exceed the originating call’s timeout, and concurrent requests do not share unsuccessful refresh outcomes.
2 open issues
What changed in this PR
Adds expiry-gated bearer-token refresh and a single resend after a 401 in the shared authentication layer used by flowvault and skyvault.
Changes:
- Adds a 60-second expiry gate, synchronized token access, and refresh-path logging.
- Wires both vault clients to shared retry handling while leaving connection calls unchanged.
- Adds tests for refresh eligibility, resend limits, concurrency, and interceptor ordering.
| File | Description |
|---|---|
skyvault/src/main/java/com/skyflow/VaultClient.java |
Uses synchronized token reads for shared HTTP authentication. |
flowvault/src/test/java/com/skyflow/utils/FakeChain.java |
Exposes response-body closure for assertions. |
flowvault/src/test/java/com/skyflow/AuthInterceptorTests.java |
Tests refresh behavior and interceptor ordering. |
flowvault/src/main/java/com/skyflow/VaultClient.java |
Installs shared authentication inside transport retries. |
common/src/test/java/com/skyflow/serviceaccount/util/TokenTests.java |
Tests expiry-window checks and malformed tokens. |
common/src/test/java/com/skyflow/BaseVaultClientTests.java |
Tests refresh gating, caching, concurrency, and resend limits. |
common/src/main/java/com/skyflow/serviceaccount/util/Token.java |
Adds isExpiringWithin. |
common/src/main/java/com/skyflow/logs/WarningLogs.java |
Adds refresh-failure warnings. |
common/src/main/java/com/skyflow/logs/InfoLogs.java |
Adds refresh-decision messages. |
common/src/main/java/com/skyflow/BaseVaultClient.java |
Implements shared refresh-and-resend handling. |
Review effort: Balanced
Promptless documentation updates
|
|
✅ Gitleaks Findings: No secrets detected. Safe to proceed! |
|
Semgrep Findings: Issues with Error level severity are found (Error is Highest severity in Semgrep), Please resolve the issues before merging. |
There was a problem hiding this comment.
🟢 Approval recommended
Static review found no unresolved blocking issues in the retry gates, credential exclusions, or concurrent refresh handling; test suites were not independently executed.
No open issues 🎉
2 resolved since last review
Review effort: Balanced
|
✅ Gitleaks Findings: No secrets detected. Safe to proceed! |
|
Semgrep Findings: Issues with Error level severity are found (Error is Highest severity in Semgrep), Please resolve the issues before merging. |
yaswanth-pula-skyflow
changed the title
23391b0
into
flowvault-release/26.10.28
SK-3253: Retry once on
401when the bearer token expired mid-callTicket: SK-3253 (customer case CUST-4591)
Problem
Every vault method checks the bearer token once, at its start, with
now > exp. The token is then used for every HTTP request that method sends. If it expires while a request is in flight, or between the check and a later request of the same method, the gateway answers401and the SDK returns that as the result. Nothing regenerates the token until the next method call.In flowvault a bulk method splits records into batches and sends each batch as its own request under that one check. A customer's bulk tokenize of 2,000 records started a few seconds before expiry, passed the check, and lost every batch after
expas per-recordhttpCode=401errors.Fix
When a request fails with
401and the SDK can see from its own copy of the token that the token is at or past expiry, the SDK generates a new token once and resends that request once.401only. Any other status is returned as today.setToken) or an API key returns the401unchanged.expis within 60 seconds of now. A401on a token with more life than that is not expiry and is returned unchanged, with no token generated.401s on one token cost one generation.401is returned.Later requests in the same method read the refreshed token from the cache, so a bulk call that crosses expiry now completes in full. No new configuration. The start-of-method check is unchanged.
Changes
common
BaseVaultClient: the auth interceptor used by every OkHttp client now handles the401branch. NewrefreshBearerTokenAfterUnauthorizedimplements the rules above, synchronized withsetBearerToken. Token reads go through a synchronizedgetToken()so a token refreshed on one thread is seen by the others.Token.isExpiringWithin(token, windowSeconds): public, additive.isExpiredis unchanged.InfoLogs/WarningLogsentries for the refresh path. No new logging on the happy path.flowvault
VaultClient: uses the shared auth interceptor from common. The transport retry interceptor stays outside it, so configured 408/429/5xx retries and the call timeout still bound the whole exchange.skyvault
VaultClient: token supplier switched togetToken(). Vault and detect calls get the retry through the shared interceptor.401can come from the proxied third party, and a resend there is not guaranteed to be side-effect free.Not covered, by design
setTokentokens, API keys, any401on a token that is not near expiry, a connection call that straddles expiry. All behave exactly as today.Tests
BaseVaultClientTests(interceptor branches, gate, single-flight, same-token-back, failure),TokenTests(isExpiringWithinboundaries, malformed and missingexp).AuthInterceptorTests(retry ordering, resend once, static token and API key untouched).Token.isExpiringWithin.