From 48f8bdc8f3b3c3a33b752cdc90242900ee1c0214 Mon Sep 17 00:00:00 2001 From: marius-mather Date: Wed, 29 Apr 2026 14:07:26 +1000 Subject: [PATCH] fix: make sure refresh logic works with unified provider name --- lib/galaxy/authnz/managers.py | 13 +++++++++---- test/unit/authnz/test_authnz.py | 13 +++++++++++++ 2 files changed, 22 insertions(+), 4 deletions(-) diff --git a/lib/galaxy/authnz/managers.py b/lib/galaxy/authnz/managers.py index 2578db9ebf3..35c0227ba6e 100644 --- a/lib/galaxy/authnz/managers.py +++ b/lib/galaxy/authnz/managers.py @@ -335,19 +335,24 @@ class AuthnzManager: Refresh expiring OIDC tokens for all providers associated with a user. Returns: - str | None: The provider name if refresh fails and require_refresh is enabled, otherwise None + str | None: The provider name if refresh fails and require_session_refresh is enabled, otherwise None """ user = trans.user or user if not isinstance(user, model.User): return None for auth in user.social_auth or []: result = self.refresh_expiring_oidc_tokens_for_provider(trans, auth) - config = self.oidc_backends_config.get(auth.provider, None) + if auth.provider is None: + continue + provider = self._unify_provider_name(auth.provider) + if provider is None: + continue + config = self.oidc_backends_config.get(provider, None) if config is None: continue - # Redirect to OIDC login if refresh fails and require_refresh is enabled + # Redirect to OIDC login if refresh fails and require_session_refresh is enabled if config.get("require_session_refresh") and result["reauthentication_required"]: - return auth.provider + return provider return None def authenticate( diff --git a/test/unit/authnz/test_authnz.py b/test/unit/authnz/test_authnz.py index 5e972b0596e..9d17188df0f 100644 --- a/test/unit/authnz/test_authnz.py +++ b/test/unit/authnz/test_authnz.py @@ -361,6 +361,19 @@ def test_refresh_expiring_oidc_tokens_returns_none_on_optional_terminal_refresh_ assert reauth_provider is None +def test_refresh_expiring_oidc_tokens_uses_unified_provider_for_refresh_config(mock_app): + user = _make_user_with_social_auth(provider="google-openidconnect") + trans = _make_mock_trans_with_user(user) + manager = _make_authnz_manager(trans.app, provider_name="google", require_session_refresh="true") + FakeRefreshBackend.refresh_result = False + FakeRefreshBackend.refresh_exception = AuthTokenError(backend=FAKE_SOCIAL_AUTH_BACKEND) + + with patch.object(AuthnzManager, "_get_identity_provider_factory", return_value=FakeRefreshBackend): + reauth_provider = manager.refresh_expiring_oidc_tokens(cast(Any, trans)) + + assert reauth_provider == "google" + + def test_refresh_expiring_oidc_tokens_returns_none_on_unexpected_refresh_failure(mock_app): user = _make_user_with_social_auth() trans = _make_mock_trans_with_user(user)