Repository navigation
fix(oauth): restore pre-6.45.5 token expiry parsing in Python OAuth authenticators - #1188
Merged
Merged
Conversation
…verrides Since 6.45.5 refresh_access_token returns the expiry as a datetime and set_token_expiry_date stores its argument unparsed. Overrides written earlier still return the raw expires_in: the next expiry check raises a TypeError, and SingleUseRefreshTokenOauth2Authenticator stores it as a 1970 epoch and refreshes on every request. - Oauth2Authenticator and DeclarativeOauth2Authenticator set_token_expiry_date parse a non-datetime value again, as before 6.45.5. A value that cannot be parsed is stored as before. - SingleUseRefreshTokenOauth2Authenticator.set_token_expiry_date reads a numeric value as seconds when neither token_expiry_is_time_of_expiration nor token_expiry_date_format is set. Other values are stored as before. - _parse_token_expiration_date passes datetimes through, for custom setters that parse the CDK's own result with it.
👋 Greetings, Airbyte Team Member!Here are some helpful tips and reminders for your convenience. 💡 Show Tips and TricksTesting This CDK VersionYou can test this version of the CDK using the following: # Run the CLI from this branch:
uvx 'git+https://github.com/airbytehq/airbyte-python-cdk.git@bazarnov/fix-oauth-raw-expires-in#egg=airbyte-python-cdk[dev]' --help
# Update a connector to use the CDK from this branch ref:
cd airbyte-integrations/connectors/source-example
poe use-cdk-branch bazarnov/fix-oauth-raw-expires-inPR Slash CommandsAirbyte Maintainers can execute the following slash commands on your PR:
|
![github-code-quality[bot]](https://avatars.githubusercontent.com/u/9919?s=60&v=4){kind=small}
…iration, as before 6.45.5
Baz (bazarnov)
changed the title
Daryna Ishchenko (darynaishchenko)
approved these changes
Oct 2, 2026
ZaneHyattAB
added a commit
that referenced
this pull request
Oct 5, 2026
Resolves the test_requests_native_auth.py conflict with #1188: both sides appended tests to the same class, so all are kept. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Since #462 (v6.45.5),
set_token_expiry_datestores whatever it receives. Connectors that overriderefresh_access_tokenagainst the older contract return the rawexpires_in(e.g.3600):Oauth2Authenticator/DeclarativeOauth2Authenticatorsubclasses crash on the next expiry check:TypeError: '>' not supported between instances of 'AirbyteDateTime' and 'int'.SingleUseRefreshTokenOauth2Authenticatorsubclasses store"3600", which reads back as a 1970 epoch, so every request refreshes and rotates the refresh token.The same release broke a
SingleUseRefreshTokenOauth2Authenticatorbuilt with onlytoken_expiry_date_format(#1185): a dateexpires_inraisesValueError: Invalid expires_in value, and an epoch is read as seconds. v6.45.4 parsed a date whenever a format was set; #637 restored that for the declarative factory only.Changes
set_token_expiry_datesetters parse a non-datetime value again, as before v6.45.5. SingleUse only converts numeric seconds when neithertoken_expiry_is_time_of_expirationnortoken_expiry_date_formatis set. Values that cannot be parsed are stored as before._parse_token_expiration_datepasses adatetimethrough, for custom setters copied from the pre-6.45.5 CDK.SingleUseRefreshTokenOauth2Authenticator.__init__setstoken_expiry_is_time_of_expirationwhen a format is given, as the factory does since fix: properly set token_expiry_is_time_of_expiration and mask access token when logging #637. The format check in the SingleUse setter is then redundant and is dropped.Compatibility
The CDK's own refresh path is unchanged (datetimes are stored as before), so manifest-only, Builder and SDM connectors are not affected. Only three niche shapes behave differently, each contrary to the typed contract or to its own configured format, and unused in the monorepo:
_token_expiry_dateback now gets a parsed datetime;Tests
25 new tests in the existing modules: 8 fail on
main(the reported cases), 17 guard shapes that already work onmain. Each production change is covered by a mutation.For #1185,
test_given_no_message_repository_get_access_tokendrops thetoken_expiry_is_time_of_expiration=bool(expiry_date_format)workaround that #462 added (it hid this regression) and gains an epoch case. 2 of its cases fail onmain.Fixes #824
Fixes #1185