Hacktoberfest 2026：メンテナが10月に向けて印を付けた、オープンで初心者向けの issue。 Hacktoberfest の issue を見る

User token stops working 8 hours after /github connect (classic OAuth App)

オープン
  • 何か問題がありますか？
#1,069 コメント 0 件 リアクション 0 件 担当者 0 名 GitHub で見る

まだ誰も着手していません。

評価

難易度
4/5
見積もり時間
3〜5日
初心者へのやさしさ
52/100
issue の種類
バグ
明瞭さ
明確に書かれている
活発さ
活発
技術スタック
github, go
領域
authentication, backend

調査の方向性

Start with the OAuth flow and token storage around server/plugin/plugin.go, then inspect server/plugin/graphql/client.go and the existing mm_34646_token_refresh.go reset path. Confirm whether GitHub returns expires_in and refresh_token for this OAuth flow, then reproduce the failure and identify the point where refresh handling and tests should be added. Done means expiring tokens are refreshed before the next GitHub call, revoked-token behavior remains covered, and relevant tests pass.

索引モデルが issue の本文から書いたものです。

説明

On our self-hosted Mattermost, the token the plugin gets from /github connect stops working about 8 hours later. From then on every GitHub call returns 401 Bad credentials, and the next morning the daily reminder triggers the “Your Github account was disconnected due to an invalid or revoked authorization token” DM.

Environment
  • Mattermost Team Edition 11.11.1 (since upgraded to 12.0.0)
  • GitHub plugin 2.6.0
  • A classic OAuth App owned by our organization, not a GitHub App. Its settings page has no token expiration option.
  • One connected user, a bot account
Timing
Connect (UTC) First 401 (UTC) Lifetime
13 Oct 07:29:36 13 Oct 15:30:11 8h 00m
14 Oct 07:58:04 14 Oct 16:15:51 8h 17m
15 Oct 06:20:15 15 Oct 14:31:47 8h 11m
16 Oct 08:33:43 16 Oct 16:35:11 8h 01m

Connect times come from the account’s security log (oauth_access.create), 401 times from the plugin’s Failed to search for the sidebar data errors. The 401 appears at the first plugin call after the 8 hours, which explains the extra minutes.

What we ruled out
  • The MM-34646 reset in mm_34646_token_refresh.go. It skips users who connected through /github connect, since those get MM34646ResetTokenDone: true, and its Updated user access token for MM-34646 debug line never appears in our logs.
  • Revocation. The security log has no oauth_authorization.destroy, password change or 2FA change. It does have an oauth_access.regenerate by “GitHub System” within a second of every oauth_access.create, but that also happens for an unrelated integration (Copilot), so it looks like part of normal token issuance.
  • Mattermost itself. No restart or plugin configuration change around the first failure.
Suggestion

Eight hours is the lifetime of GitHub’s expiring user tokens. If GitHub now issues those to OAuth Apps too, the plugin needs to keep the refresh token and refresh on expiry. Today it wraps the stored token in oauth2.StaticTokenSource (server/plugin/plugin.go, server/plugin/graphql/client.go), so it never refreshes. We inferred the 8 hours from the timings above and haven’t inspected the token response for expires_in or refresh_token. Can anyone confirm whether GitHub changed this for classic OAuth Apps?

主要言語
Go
スター
181
フォーク
181
平均マージ
22時間 10分
マージ済み PR（30日）
5

環境構築

はじめの一歩

  1. issue を最後まで読み、次にプロジェクトのコントリビューションガイドを読みます。
  2. 着手することを issue にコメントします — 二人が同じ作業をするのを防げます。
  3. リポジトリをフォークし、ブランチを切って変更します。
  4. issue 番号を参照したプルリクエストを送ります。

mattermost/mattermost-plugin-github のほかの issue

mattermost/mattermost-plugin-github の issue をすべて見る

似ている issue

Go の issue をもっと見る

新しい issue をメールで受け取る

初心者向けの GitHub issue を短くまとめたダイジェスト。