Show reauthorize prompt when an OAuth token is revoked (#4953)

elias-ba · midigofrank · web-flow · commit f49e5527dafc · 2026-07-09T09:21:45.000+03:00
* Show reauthorize prompt when an OAuth token is revoked

When a stored OAuth token is rejected by the provider as expired or
revoked, the credential editor now distinguishes that from a transport
failure. Token refreshes that fail because the user must reauthorize are
routed to the tailored "reauthorize" message and logged as warnings,
while genuine faults and transient provider errors keep their existing
messages and error-level logging.

This stops an expected, user-actionable condition from surfacing in the
error stream, and gives the user a clear path to recover instead of a
generic error.

* Name the reauthorization flag in log_token_error via a guard

---------

Co-authored-by: Frank Midigo &lt;midigofrank@gmail.com&gt;
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -53,6 +53,11 @@ and this project adheres to
   project is opt-in. [#4919](https://github.com/OpenFn/lightning/issues/4919)
 - Fixed an issue where LOCAL_ADAPTORS is not respected by install_schemas task
   [#4943](https://github.com/OpenFn/lightning/issues/4943)
+- When an OAuth provider reports that a credential's stored token has expired or
+  been revoked, the credential editor now shows a clear "reauthorize" prompt
+  instead of a generic error, and the condition is logged as a warning rather
+  than an application error.
+  [#4947](https://github.com/OpenFn/lightning/issues/4947)
 
 ## [2.16.8] - 2026-07-01
 
diff --git a/lib/lightning_web/live/credential_live/generic_oauth_component.ex b/lib/lightning_web/live/credential_live/generic_oauth_component.ex
@@ -24,7 +24,8 @@ defmodule LightningWeb.CredentialLive.GenericOauthComponent do
        authorize_url: nil,
        scopes_changed: false,
        previous_oauth_state: nil,
-       oauth_token: nil
+       oauth_token: nil,
+       token_action: :fetch
      )}
   end
 
@@ -132,7 +133,11 @@ defmodule LightningWeb.CredentialLive.GenericOauthComponent do
 
       {:ok,
        socket
-       |> assign(code: code, oauth_progress: :authenticating)
+       |> assign(
+         code: code,
+         oauth_progress: :authenticating,
+         token_action: :fetch
+       )
        |> start_async(:token, fn ->
          OauthHTTPClient.fetch_token(client, code)
        end)}
@@ -212,15 +217,22 @@ defmodule LightningWeb.CredentialLive.GenericOauthComponent do
     end
   end
 
-  def handle_async(:token, {:ok, {:error, http_error}}, socket) do
-    Logger.error(
-      "Failed to fetch token for environment '#{socket.assigns.current_tab}' from #{socket.assigns.selected_client.name}: #{inspect(http_error)}"
-    )
+  def handle_async(:token, {:ok, {:error, error}}, socket) do
+    reauthorization_required =
+      socket.assigns.token_action == :refresh and
+        reauthorization_required?(error)
+
+    log_token_error(reauthorization_required, error, socket)
+
+    oauth_error =
+      if reauthorization_required,
+        do: {:refresh_failed, error},
+        else: {:http_error, error}
 
     {:noreply,
      socket
      |> assign(oauth_progress: :error)
-     |> assign(oauth_error: {:http_error, http_error})}
+     |> assign(oauth_error: oauth_error)}
   end
 
   def handle_async(:token, {:exit, reason}, socket) do
@@ -248,7 +260,7 @@ defmodule LightningWeb.CredentialLive.GenericOauthComponent do
   def handle_async(:userinfo, {:ok, {:error, error}}, socket) do
     case error do
       %{status: 401} ->
-        Logger.error(
+        Logger.warning(
           "Token is invalid or revoked for environment '#{socket.assigns.current_tab}' for #{socket.assigns.selected_client.name}: #{inspect(error)}"
         )
 
@@ -359,6 +371,23 @@ defmodule LightningWeb.CredentialLive.GenericOauthComponent do
      |> assign(authorize_url: authorize_url)}
   end
 
+  defp log_token_error(reauthorization_required, error, socket)
+       when reauthorization_required do
+    Logger.warning(
+      "Token refresh rejected for environment '#{socket.assigns.current_tab}' from #{socket.assigns.selected_client.name}, reauthorization required: #{inspect(error)}"
+    )
+  end
+
+  defp log_token_error(_reauthorization_required, error, socket) do
+    Logger.error(
+      "Failed to fetch token for environment '#{socket.assigns.current_tab}' from #{socket.assigns.selected_client.name}: #{inspect(error)}"
+    )
+  end
+
+  defp reauthorization_required?(%{error: "invalid_grant"}), do: true
+  defp reauthorization_required?(%{status: 401}), do: true
+  defp reauthorization_required?(_), do: false
+
   defp refresh_token_or_fetch_userinfo(socket, selected_client, credential_body) do
     cond do
       not Map.has_key?(credential_body, "access_token") ->
@@ -381,7 +410,7 @@ defmodule LightningWeb.CredentialLive.GenericOauthComponent do
     )
 
     socket
-    |> assign(oauth_progress: :authenticating)
+    |> assign(oauth_progress: :authenticating, token_action: :refresh)
     |> start_async(:token, fn ->
       OauthHTTPClient.refresh_token(client, token)
     end)
diff --git a/test/lightning_web/live/credential_live_test.exs b/test/lightning_web/live/credential_live_test.exs
@@ -1248,7 +1248,10 @@ defmodule LightningWeb.CredentialLiveTest do
       button_html = delete_credential_button(view, project.id) |> render()
 
       assert button_html =~
-               "data-confirm=\"Warning: This credential is in use by the following workflows: #{workflow_with_credential_1.name}, #{workflow_with_credential_2.name}. If you revoke access to the &quot;#{project.name}&quot; project, runs for those workflows will probably fail until you provide a new credential. Are you sure you want to revoke access?"
+               "data-confirm=\"Warning: This credential is in use by the following workflows:"
+
+      assert button_html =~
+               ". If you revoke access to the &quot;#{project.name}&quot; project, runs for those workflows will probably fail until you provide a new credential. Are you sure you want to revoke access?"
 
       assert button_html =~ workflow_with_credential_1.name
       assert button_html =~ workflow_with_credential_2.name
@@ -1391,21 +1394,201 @@ defmodule LightningWeb.CredentialLiveTest do
         :error === assigns[:oauth_progress]
       end)
 
-      # After the error state, check the rendered content
       html = view |> element("#credential-form-#{credential.id}") |> render()
 
-      # Check for 401 error message content
-      assert html =~ "Your authorization with"
-      assert html =~ "expired or was revoked"
+      assert html =~ "session has expired"
 
-      # The button text for 401 errors is "Sign In Again"
       assert view
              |> element(
                "#credential-form-#{credential.id} button",
                "Sign In Again"
              )
              |> has_element?()
     end
+
+    test "renders reauthorize prompt when refresh token is revoked",
+         %{
+           conn: conn,
+           user: user,
+           token: token
+         } do
+      oauth_client = insert(:oauth_client, user: user, userinfo_endpoint: nil)
+
+      expired_token =
+        Map.put(token, "expires_at", DateTime.to_unix(DateTime.utc_now()) - 3600)
+
+      credential =
+        insert(:credential,
+          user: user,
+          schema: "oauth",
+          oauth_client: oauth_client
+        )
+        |> with_body(%{
+          name: "main",
+          body: expired_token
+        })
+
+      Mox.stub(Lightning.AuthProviders.OauthHTTPClient.Mock, :call, fn env,
+                                                                       _opts ->
+        case env.url do
+          "http://example.com/oauth2/revoke" ->
+            {:ok, %Tesla.Env{status: 200, body: Jason.encode!(%{})}}
+
+          "http://example.com/oauth2/token" ->
+            {:ok,
+             %Tesla.Env{
+               status: 400,
+               body:
+                 Jason.encode!(%{
+                   "error" => "invalid_grant",
+                   "error_description" => "Token has been expired or revoked."
+                 })
+             }}
+        end
+      end)
+
+      {:ok, view, _html} = live(conn, ~p"/credentials", on_error: :raise)
+
+      open_edit_credential_modal(view, credential.id)
+
+      Lightning.ApplicationHelpers.dynamically_absorb_delay(fn ->
+        {_, assigns} =
+          Lightning.LiveViewHelpers.get_component_assigns_by(view,
+            id: "generic-oauth-component-#{credential.id}-main"
+          )
+
+        :error === assigns[:oauth_progress]
+      end)
+
+      html = view |> element("#credential-form-#{credential.id}") |> render()
+
+      assert html =~ "revoked"
+      refute html =~ "An error occurred during authentication"
+
+      assert view
+             |> element(
+               "#credential-form-#{credential.id} button",
+               "Reauthorize"
+             )
+             |> has_element?()
+    end
+
+    test "a failed refresh with a 5xx keeps the transient provider-error message",
+         %{conn: conn, user: user, token: token} do
+      oauth_client = insert(:oauth_client, user: user, userinfo_endpoint: nil)
+
+      expired_token =
+        Map.put(token, "expires_at", DateTime.to_unix(DateTime.utc_now()) - 3600)
+
+      credential =
+        insert(:credential,
+          user: user,
+          schema: "oauth",
+          oauth_client: oauth_client
+        )
+        |> with_body(%{name: "main", body: expired_token})
+
+      Mox.stub(Lightning.AuthProviders.OauthHTTPClient.Mock, :call, fn env,
+                                                                       _opts ->
+        case env.url do
+          "http://example.com/oauth2/revoke" ->
+            {:ok, %Tesla.Env{status: 200, body: Jason.encode!(%{})}}
+
+          "http://example.com/oauth2/token" ->
+            {:ok,
+             %Tesla.Env{
+               status: 503,
+               body: Jason.encode!(%{"error" => "server_error"})
+             }}
+        end
+      end)
+
+      {:ok, view, _html} = live(conn, ~p"/credentials", on_error: :raise)
+
+      open_edit_credential_modal(view, credential.id)
+
+      Lightning.ApplicationHelpers.dynamically_absorb_delay(fn ->
+        {_, assigns} =
+          Lightning.LiveViewHelpers.get_component_assigns_by(view,
+            id: "generic-oauth-component-#{credential.id}-main"
+          )
+
+        :error === assigns[:oauth_progress]
+      end)
+
+      html = view |> element("#credential-form-#{credential.id}") |> render()
+
+      assert html =~ "technical difficulties"
+      refute html =~ "revoked"
+      refute html =~ "An error occurred during authentication"
+    end
+
+    test "a code-exchange failure is not treated as a refresh reauthorization",
+         %{conn: conn, user: user} do
+      insert(:project, project_users: [%{user: user, role: :owner}])
+
+      oauth_client =
+        insert(:oauth_client,
+          user: user,
+          mandatory_scopes: "",
+          optional_scopes: ""
+        )
+
+      Mox.stub(Lightning.AuthProviders.OauthHTTPClient.Mock, :call, fn env,
+                                                                       _opts ->
+        case env.url do
+          "http://example.com/oauth2/token" ->
+            {:ok,
+             %Tesla.Env{
+               status: 400,
+               body:
+                 Jason.encode!(%{
+                   "error" => "invalid_grant",
+                   "error_description" => "Bad authorization code."
+                 })
+             }}
+        end
+      end)
+
+      {:ok, view, _html} = live(conn, ~p"/credentials", on_error: :raise)
+
+      open_create_credential_modal(view)
+      view |> select_credential_type(oauth_client.id)
+      view |> click_continue()
+      view |> fill_credential(%{name: "My Generic OAuth Credential"})
+
+      {_, component_assigns} =
+        Lightning.LiveViewHelpers.get_component_assigns_by(view,
+          id: "generic-oauth-component-new-main"
+        )
+
+      [subscription_id, mod, _component_id, _env] =
+        get_decoded_state(component_assigns[:authorize_url])
+
+      view |> element("#authorize-button") |> render_click()
+
+      LightningWeb.OauthCredentialHelper.broadcast_forward(
+        subscription_id,
+        mod,
+        id: "generic-oauth-component-new-main",
+        code: "authcode123",
+        current_tab: "main"
+      )
+
+      Lightning.ApplicationHelpers.dynamically_absorb_delay(fn ->
+        {_, assigns} =
+          Lightning.LiveViewHelpers.get_component_assigns_by(view,
+            id: "generic-oauth-component-new-main"
+          )
+
+        :error === assigns[:oauth_progress]
+      end)
+
+      html = view |> render()
+
+      assert html =~ "An error occurred during authentication"
+      refute html =~ "Refresh Token Revoked"
+    end
   end
 
   describe "generic oauth credential when flow fails" do
