Provide a way to access the request-id when refreshing an access token

Open
#1,453 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
4/5
Estimated time
3-5 days
Newbie friendliness
48/100
Issue type
Feature
Clarity
Mostly clear
Activity status
Quiet
Tech stack
ruby
Domain
api, authentication, backend

Research direction

Start in lib/shopify_api/auth/refresh_token.rb at refresh_access_token, then inspect client.request, response.body, and the ShopifyAPI::Auth::Session construction. Trace how successful and failed responses are handled; done means callers can obtain the request-id in both cases while existing token-refresh behavior remains available.

Written by the indexing model from the issue text.

Description

devtools-gardener

Background

When using ShopifyAPI::Auth::RefreshToken.refresh_access_token (lib/shopify_api/auth/refresh_token.rb) to refresh an offline access token (calling POST /admin/oauth/access_token with grant_type=refresh_token), we've run into an issue where the request itself succeeds, but the refresh_token returned in the response has an expiry that is far shorter than the documented 90 days.

In that thread, a Shopify staff member asked whether we had the request-id from the response (since it would help speed up their investigation). However, the return value of refresh_access_token — a ShopifyAPI::Auth::Session — provides no way to obtain the request-id, so we were unable to provide it.

Looking at the current implementation of refresh_access_token:
https://github.com/Shopify/shopify-api-ruby/blob/8c72cd222d346472a29e51c7a7dfb6b7239f7456/lib/shopify_api/auth/refresh_token.rb#L18-L54

The response object returned by client.request presumably includes the response headers (which contain the request-id), but only response.body is used to build the Session — the response itself is never exposed to the caller. As a result, there's no way for callers to retrieve the request-id.

Request

  • Provide a way for callers to obtain the request-id when refresh_access_token is used to refresh an access token
    • e.g. include the request-id on the return value (e.g. Session)
    • or return an object that includes the response headers, allow passing a callback, etc. — any approach along these lines would work
  • This should be available for both successful and failed responses (including cases like this one, where the HTTP request succeeds but the returned data itself is problematic)
Dominant language
Ruby
Stars
1.1k
Forks
484
No merged PRs in 30d

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from Shopify/shopify-api-ruby

All issues in Shopify/shopify-api-ruby

Similar issues

More Ruby issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.