bug(python): OIDC refresh drops the gateway's oidc_scopes

未關閉 適合新手
  • 哪裡不對？
#4,919 3 則留言 0 個 reaction 已指派 0 人 在 GitHub 檢視

維護者通常 1 天內回覆

@jyotir07 已經在處理了。

開始於 2026年10月26日。

評估

難度
2/5
預估耗時
1-3 小時
新手友好度
84/100
Issue 類型
缺陷
描述清晰度
描述清楚
活躍度
活躍
技術堆疊
python
領域
authentication

研究方向

從 python/openshell/sandbox.py 中的 _OidcRefresher._refresh 著手，並將其 token 格式與 issue 中描述的 CLI 更新路徑進行比較。閱讀附近的 gateway metadata 處理邏輯，接著執行 python/openshell/sandbox_test.py 中針對 refresher 的測試。完成條件是：測試顯示有 oidc_scopes 時，請求會包含以空格分隔的值；沒有時，請求保持不變。

由索引模型根據 Issue 內容生成。

描述

state:triage-needed
User Story

As a student building a personal project that creates and drives OpenShell sandboxes from the Python SDK (SandboxClient.from_active_cluster), I want the SDK to refresh my OIDC session the same way the CLI does, so that my scripts keep working after the access token expires without me running a CLI command to renew it.

I noticed the Python refresh behaving differently from the CLI while working on the project. Comparing the two refresh paths showed that the Python refresher never sends the gateway's oidc_scopes, and I then reproduced it with a unit test.

Problem Statement

_OidcRefresher._refresh in python/openshell/sandbox.py posts the refresh_token grant with only grant_type, refresh_token, and client_id. It never sends the gateway's oidc_scopes. The CLI does send them (ensure_valid_oidc_token_bundle → oidc_refresh_token(..., scopes)), and the docs say refresh uses "the OIDC scopes saved in the gateway metadata". The Python client-credentials provider in the same file already reads oidc_scopes / oidc_audience from metadata; only the refresh path omits them.

Impact / Why This Matters

With identity providers that require scope on the refresh grant, or that pick the token's resource from it (for example Microsoft Entra ID), the Python SDK's first automatic refresh fails or returns a token the gateway rejects. The same gateway works with the CLI. The current workaround is to run openshell gateway login or a CLI command before the token expires so the CLI rewrites oidc_token.json. That does not work for long-running Python processes.

Acceptance Criteria
  • When gateway metadata has oidc_scopes, the Python refresh request includes scope=<space-separated scopes>, matching the CLI.
  • Without oidc_scopes, the refresh request is unchanged.
  • A unit test covers both cases.
Reproduction Steps
  1. Register a gateway whose metadata.json has "auth_mode": "oidc" and "oidc_scopes": "openid api://openshell/.default", with an expired access token and a valid refresh token in oidc_token.json.
  2. Build the provider with _make_cluster_bearer_provider(gateway_dir, name) (the path SandboxClient.from_active_cluster uses) and call it once, with the refresher's httpx.Client bound to an httpx.MockTransport that records the token request.
  3. The posted form contains grant_type, refresh_token, and client_id, but no scope. The CLI's refresh for the same gateway sends scope=openid api://openshell/.default.
Suggested UX (if applicable)

No response

Environment
  • OpenShell: main @ c4688aa8
  • SDK: Python (python/openshell/sandbox.py, _OidcRefresher)
Logs
FAILED python/openshell/sandbox_test.py::test_refresher_sends_gateway_oidc_scopes
E   AssertionError: assert None == 'openid api://openshell/.default'
主要語言
Rust
星號
20.6k
分支
2k
平均合併
2 天 13 小時
30 天內合併 PR
262

環境準備

從這裡開始

  1. 先讀完整個 Issue，再讀專案的貢獻指南。
  2. 在 Issue 下留言說明你要接手 —— 這能避免兩個人做同樣的事。
  3. Fork 儲存庫，在一個分支上完成修改。
  4. 送出 Pull Request，並在描述裡引用這個 Issue 編號。

NVIDIA/OpenShell 的其他 Issue

查看 NVIDIA/OpenShell 的全部 Issue

相似的 Issue

更多 Rust Issue

把新 issue 寄到你的電子郵件信箱

精選適合新手參與的 GitHub issue 摘要。