server: DELETE /auth/{id} removes credential but GET /provider still reports it connected; returns 200 true for unknown ids

Abierto
  • ¿Algo no está bien?
#62,761 3 comentarios 0 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 1 día

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
3/5
Tiempo estimado
1-2 días
Aptitud para principiantes
68/100
Tipo de issue
Error
Claridad
Bien especificado
Estado de actividad
Activo
Stack tecnológico
typescript
Área
api, authentication, backend

Línea de trabajo

Start by tracing the server handlers for DELETE /auth/{id} and GET /provider, then follow how the provider catalog gets its connected state and how stored credentials are deleted. Check the related API tests or add coverage for deleting an existing id and an unknown id. Done when /provider reflects deletion immediately and deleting an unknown id returns an error.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

severity:high

Summary

opencode serve serves stale auth state over HTTP: DELETE /auth/{providerId} deletes the credential from ~/.local/share/opencode/auth.json, but GET /provider continues to include the id in its connected array until the server restarts. DELETE /auth/<unknown-id> silently returns 200 true even when nothing was deleted, so clients cannot detect a no-op.

Environment

  • opencode version: 2.2.6 (also reproduced via image ghcr.io/anomalyco/opencode:latest)
  • OS: Darwin 25.5.0 (arm64); server itself ran inside Docker
  • Shell: zsh (client is a plain curl, terminal not relevant)
  • Install/channel: latest (homebrew opencode-v2)
  • Active plugins: none

Reproduction

  1. Start opencode serve with an OAuth credential present, e.g. openai in ~/.local/share/opencode/auth.json.
  2. Request curl http://server/auth/openai -X DELETE (with basic auth against the server) → returns true, HTTP 200.
  3. Read auth.json on disk → the openai key is gone.
  4. Request curl http://server/provider → connected still contains openai.
  5. Restart the server and repeat the GET /provider → connected now matches auth.json.

Also: DELETE /auth/__nonexistent__ → returns true with HTTP 200, even though no such credential existed.

Expected Behavior

  • GET /provider should reflect credential deletion immediately (in-memory auth catalog invalidated on delete).
  • DELETE /auth/{id} for an id with no stored credential should return an error (e.g. 404) instead of success, so API clients can distinguish real logout from a no-op.

Actual Behavior

DELETE reports true/200 both for a real and a nonexistent provider id; /provider's connected stays stale until process restart. Client UIs that briefly confirm the deletion and re-query /provider show the provider as still connected, which reads as "logout not working".

Additional Context

Discovered while a project dashboard called DELETE /auth/openai, refreshed its status from GET /provider right after, and still displayed the provider as connected despite auth.json on disk being updated and the mtime confirming the delete happened. docker restart opencode-server cleared the stale connected list; rewriting/touching the opencode config file (which normally triggers config reload) did not clear it, so the stale state appears to live in the in-memory provider catalog rather than config.

Lenguaje dominante
TypeScript
Estrellas
225k
Forks
30.4k
Merge medio
4 h 16 min
PR fusionados (30 d)
528

Preparar el entorno

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de anomalyco/opencode

Todos los issues de anomalyco/opencode

Issues similares

Más issues de TypeScript

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.