server: DELETE /auth/{id} removes credential but GET /provider still reports it connected; returns 200 true for unknown ids

Aperta
  • Qualcosa non va?
#62,761 3 commenti 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
3/5
Tempo stimato
1-2 giorni
Idoneità per principianti
68/100
Tipo di issue
Bug
Chiarezza
Specificata chiaramente
Stato di attività
Attiva
Stack tecnologico
typescript
Ambito
api, authentication, backend

Direzione di ricerca

Start by tracing the server handlers for DELETE /auth/{id} and GET /provider, then follow how the provider catalog gets its connected state and how stored credentials are deleted. Check the related API tests or add coverage for deleting an existing id and an unknown id. Done when /provider reflects deletion immediately and deleting an unknown id returns an error.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

severity:high

Summary

opencode serve serves stale auth state over HTTP: DELETE /auth/{providerId} deletes the credential from ~/.local/share/opencode/auth.json, but GET /provider continues to include the id in its connected array until the server restarts. DELETE /auth/<unknown-id> silently returns 200 true even when nothing was deleted, so clients cannot detect a no-op.

Environment

  • opencode version: 2.2.6 (also reproduced via image ghcr.io/anomalyco/opencode:latest)
  • OS: Darwin 25.5.0 (arm64); server itself ran inside Docker
  • Shell: zsh (client is a plain curl, terminal not relevant)
  • Install/channel: latest (homebrew opencode-v2)
  • Active plugins: none

Reproduction

  1. Start opencode serve with an OAuth credential present, e.g. openai in ~/.local/share/opencode/auth.json.
  2. Request curl http://server/auth/openai -X DELETE (with basic auth against the server) → returns true, HTTP 200.
  3. Read auth.json on disk → the openai key is gone.
  4. Request curl http://server/provider → connected still contains openai.
  5. Restart the server and repeat the GET /provider → connected now matches auth.json.

Also: DELETE /auth/__nonexistent__ → returns true with HTTP 200, even though no such credential existed.

Expected Behavior

  • GET /provider should reflect credential deletion immediately (in-memory auth catalog invalidated on delete).
  • DELETE /auth/{id} for an id with no stored credential should return an error (e.g. 404) instead of success, so API clients can distinguish real logout from a no-op.

Actual Behavior

DELETE reports true/200 both for a real and a nonexistent provider id; /provider's connected stays stale until process restart. Client UIs that briefly confirm the deletion and re-query /provider show the provider as still connected, which reads as "logout not working".

Additional Context

Discovered while a project dashboard called DELETE /auth/openai, refreshed its status from GET /provider right after, and still displayed the provider as connected despite auth.json on disk being updated and the mtime confirming the delete happened. docker restart opencode-server cleared the stale connected list; rewriting/touching the opencode config file (which normally triggers config reload) did not clear it, so the stale state appears to live in the in-memory provider catalog rather than config.

Lingua principale
TypeScript
Stelle
225k
Fork
30.4k
Merge medio
4h 16m
PR unite (30g)
528

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di anomalyco/opencode

Tutte le issue di anomalyco/opencode

Issue simili

Altre issue su TypeScript

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.