Skip to content

Commit d52806d

Browse files
RomanNikitenkoRomanNikitenko
committed
Fix
Signed-off-by: Roman Nikitenko <rnikiten@redhat.com> fix Signed-off-by: Roman Nikitenko <rnikiten@redhat.com> fix Signed-off-by: Roman Nikitenko <rnikiten@redhat.com> fix start Signed-off-by: Roman Nikitenko <rnikiten@redhat.com> fix Signed-off-by: Roman Nikitenko <rnikiten@redhat.com> fix Signed-off-by: Roman Nikitenko <rnikiten@redhat.com> fix Signed-off-by: Roman Nikitenko <rnikiten@redhat.com> fix Signed-off-by: Roman Nikitenko <rnikiten@redhat.com> fix: waitForToken Signed-off-by: Roman Nikitenko <rnikiten@redhat.com> fix Signed-off-by: Roman Nikitenko <rnikiten@redhat.com>
1 parent f53495b commit d52806d

11 files changed

Lines changed: 149 additions & 32 deletions

File tree

‎.rebase/replace/code/extensions/copilot/src/platform/authentication/vscode-node/copilotTokenManager.ts.json‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
[
2+
{
3+
"from": "\t\t\tif (tokenResult.kind === 'success') {\n\t\t\t\tthis._logService.info(`Got Copilot token for ${session.account.label}`);\n\t\t\t\tthis._logService.info(`Copilot Chat: ${this._envService.getVersion()}, VS Code: ${this._envService.vscodeVersion}`);\n\t\t\t}\n\t\t\treturn tokenResult;",
4+
"by": "\t\t\tif (tokenResult.kind === 'success') {\n\t\t\t\tthis._logService.info(`Got Copilot token for ${session.account.label}`);\n\t\t\t\tthis._logService.info(`Copilot Chat: ${this._envService.getVersion()}, VS Code: ${this._envService.vscodeVersion}`);\n\t\t\t}\n\n\t\t\tif (tokenResult.kind === 'failure' && tokenResult.reason === 'NotAuthorized' && !tokenResult.notification_id) {\n\t\t\t\tthis._logService.info('Copilot token exchange failed (workspace token cannot be exchanged for Copilot token), triggering sign-in flow');\n\t\t\t\treturn { kind: 'failure', reason: 'GitHubLoginFailed' };\n\t\t\t}\n\n\t\t\treturn tokenResult;"
5+
}
6+
]

‎.rebase/replace/code/src/vs/workbench/contrib/chat/browser/chatSetup/chatSetupContributions.ts.json‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
[
2+
{
3+
"from": "\t\t\t\t\t\t}));\n\t\t\t\t\t\t}\n\n\t\t\t\t\t\t// Inline Agents",
4+
"by": "\t\t\t\t\t\t}));\n\t\t\t\t\t\t}\n\n\t\t\t\t\t\t// Proactively clear panel agents when Copilot reports GitHub login failure\n\t\t\t\t\t\t// (e.g. workspace PAT cannot be exchanged for a Copilot token)\n\t\t\t\t\t\tconst gitHubLoginFailedKey = 'github.copilot.interactiveSession.gitHubLoginFailed';\n\t\t\t\t\t\tconst checkGitHubLoginFailed = () => {\n\t\t\t\t\t\t\tif (this.contextKeyService.getContextKeyValue<boolean>(gitHubLoginFailedKey)) {\n\t\t\t\t\t\t\t\tconst panelAgentHasGuidance = chatViewsWelcomeRegistry.get().some(descriptor => this.contextKeyService.contextMatchesRules(descriptor.when));\n\t\t\t\t\t\t\t\tif (panelAgentHasGuidance) {\n\t\t\t\t\t\t\t\t\tthis.logService.error('[chat setup] GitHub login failed detected, clearing panel agent registration to show welcome view.');\n\t\t\t\t\t\t\t\t\tpanelAgentDisposables.dispose();\n\t\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\t}\n\t\t\t\t\t\t};\n\t\t\t\t\t\tpanelAgentDisposables.add(this.contextKeyService.onDidChangeContext(e => {\n\t\t\t\t\t\t\tif (e.affectsSome(new Set([gitHubLoginFailedKey]))) {\n\t\t\t\t\t\t\t\tcheckGitHubLoginFailed();\n\t\t\t\t\t\t\t}\n\t\t\t\t\t\t}));\n\t\t\t\t\t\tcheckGitHubLoginFailed();\n\n\t\t\t\t\t\t// Inline Agents"
5+
}
6+
]

‎code/extensions/che-api/src/api/github-service.ts‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -34,4 +34,7 @@ export interface GithubService {
3434

3535
getUser(): Promise<GithubUser>;
3636
getTokenScopes(token: string): Promise<string[]>;
37+
38+
/** True when the active token comes from the device-authentication secret (OAuth), not a workspace PAT. */
39+
isDeviceAuthToken(): Promise<boolean>;
3740
}

‎code/extensions/che-api/src/impl/github-service-impl.ts‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -67,6 +67,10 @@ export class GithubServiceImpl implements GithubService {
6767
return result.scopes;
6868
}
6969

70+
async isDeviceAuthToken(): Promise<boolean> {
71+
return (await this.getDeviceAuthToken()) !== undefined;
72+
}
73+
7074
private async fetchGithubUser(token: string): Promise<{ user: GithubUser; scopes: string[] }> {
7175
try {
7276
this.logger.info('Github Service: fetching GitHub user using fetch...');

‎code/extensions/che-github-authentication/src/device-authentication.ts‎

Lines changed: 9 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -40,25 +40,23 @@ export class DeviceAuthentication {
4040
const scopeString = sortedScopes.join(' ');
4141
this.logger.info(`Device Authentication: running interactive flow for scopes: ${scopeString}`);
4242

43-
const existingSessions = await this.gitHubAuthProvider.getSessions();
44-
this.logger.info(`Device Authentication: found ${existingSessions.length} existing sessions to clear`);
43+
const token = await vscode.commands.executeCommand<string>('github-authentication.device-code-flow', scopeString);
44+
if (!token) {
45+
throw new Error('Device authentication was cancelled or failed');
46+
}
47+
48+
this.logger.info(`Device Authentication: token for scopes: ${scopeString} has been generated successfully`);
4549

50+
const existingSessions = await this.gitHubAuthProvider.getSessions();
51+
this.logger.info(`Device Authentication: clearing ${existingSessions.length} existing sessions`);
4652
for (const session of existingSessions) {
4753
try {
4854
await this.gitHubAuthProvider.removeSession(session.id);
49-
this.logger.info(`Device Authentication: removed session with scopes: ${session.scopes}`);
5055
} catch (e) {
51-
console.warn(e.message);
52-
this.logger.warn(`Device Authentication: an error happened at removing a session with scopes: ${session.scopes}`);
56+
this.logger.warn(`Device Authentication: failed to remove session: ${e.message}`);
5357
}
5458
}
5559

56-
const token = await vscode.commands.executeCommand<string>('github-authentication.device-code-flow', scopeString);
57-
if (!token) {
58-
throw new Error('Device authentication was cancelled or failed');
59-
}
60-
61-
this.logger.info(`Device Authentication: token for scopes: ${scopeString} has been generated successfully`);
6260
await this.githubService.persistDeviceAuthToken(token);
6361
return token;
6462
}

‎code/extensions/che-github-authentication/src/extension.ts‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -49,7 +49,7 @@ export async function activate(context: vscode.ExtensionContext): Promise<void>
4949

5050
vscode.authentication.registerAuthenticationProvider('github', 'GitHub', authenticationProvider);
5151

52-
await authenticationProvider.hydrateFromK8sToken();
52+
authenticationProvider.hydrateFromK8sToken();
5353
}
5454

5555
export function deactivate(): void {

‎code/extensions/che-github-authentication/src/github.ts‎

Lines changed: 73 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@ import type { DeviceAuthentication } from './device-authentication';
1717
import { ErrorHandler } from './error-handler';
1818
import { ExtensionContext } from './extension-context';
1919
import { Logger } from './logger';
20-
import { arrayEquals, getMatchingHydrationScopeBundles, hasAllScopes, isUnauthorizedError } from './utils';
20+
import { getMatchingHydrationScopeBundles, hasAllScopes, isUnauthorizedError, isWorkspacePatSession, sessionMatchesRequestedScopes, WORKSPACE_PAT_SCOPE } from './utils';
2121

2222
export interface GithubUser {
2323
login: string;
@@ -32,6 +32,7 @@ export interface GithubService {
3232
removeDeviceAuthToken(): Promise<void>;
3333
getUser(): Promise<GithubUser>;
3434
getTokenScopes(token: string): Promise<string[]>;
35+
isDeviceAuthToken(): Promise<boolean>;
3536
}
3637

3738
@injectable()
@@ -64,8 +65,15 @@ export class GitHubAuthProvider implements vscode.AuthenticationProvider {
6465
if (sessions.length > 0) {
6566
try {
6667
await this.githubService.getTokenScopes(sessions[0].accessToken);
67-
this.logger.trace('GitHubAuthProvider: existing session token is valid');
68-
return;
68+
const isDeviceAuthToken = await this.githubService.isDeviceAuthToken();
69+
const sessionsNeedRetag = isDeviceAuthToken
70+
? sessions.some(session => isWorkspacePatSession(session.scopes))
71+
: sessions.some(session => !isWorkspacePatSession(session.scopes));
72+
if (!sessionsNeedRetag) {
73+
this.logger.info('GitHubAuthProvider: existing session token is valid');
74+
return;
75+
}
76+
this.logger.info('GitHubAuthProvider: re-hydrating sessions to match current token source');
6977
} catch (error) {
7078
if (isUnauthorizedError(error)) {
7179
this.logger.warn('GitHubAuthProvider: existing session token is not valid, clearing sessions');
@@ -74,57 +82,80 @@ export class GitHubAuthProvider implements vscode.AuthenticationProvider {
7482
this.sessionChangeEmitter.fire({ added: [], removed, changed: [] });
7583
sessions = [];
7684
} else {
77-
this.logger.trace(`GitHubAuthProvider: session validation skipped: ${(error as Error).message}`);
85+
this.logger.warn(`GitHubAuthProvider: session validation skipped: ${(error as Error).message}`);
7886
return;
7987
}
8088
}
8189
}
8290

91+
await this.doHydrate();
92+
}
93+
94+
private async waitForToken(timeoutMs: number, intervalMs: number): Promise<string | undefined> {
95+
const deadline = Date.now() + timeoutMs;
96+
while (Date.now() < deadline) {
97+
try {
98+
return await this.githubService.getToken();
99+
} catch {
100+
await new Promise(resolve => setTimeout(resolve, intervalMs));
101+
}
102+
}
103+
return undefined;
104+
}
105+
106+
private async doHydrate(): Promise<void> {
107+
const token = await this.waitForToken(30000, 500);
108+
if (!token) {
109+
this.logger.warn('GitHubAuthProvider: hydrate failed, token not available after 30s');
110+
return;
111+
}
112+
83113
try {
84-
const token = await this.githubService.getToken();
85114
const tokenScopes = await this.githubService.getTokenScopes(token);
86115
if (tokenScopes.length === 0) {
87-
this.logger.trace('GitHubAuthProvider: hydrate skipped, token has no scopes');
116+
this.logger.info('GitHubAuthProvider: hydrate skipped, token has no scopes');
88117
return;
89118
}
90119

91120
const githubUser = await this.githubService.getUser();
92121
const matchingBundles = getMatchingHydrationScopeBundles(tokenScopes);
93122
if (matchingBundles.length === 0) {
94-
this.logger.trace('GitHubAuthProvider: hydrate skipped, token scopes match no known bundle');
123+
this.logger.info('GitHubAuthProvider: hydrate skipped, token scopes match no known bundle');
95124
return;
96125
}
97126

127+
const isDeviceAuthToken = await this.githubService.isDeviceAuthToken();
98128
const account = { label: githubUser.login, id: githubUser.id.toString() };
99129
const hydratedSessions = matchingBundles.map(scopes => ({
100130
id: v4(),
101131
accessToken: token,
102132
account,
103-
scopes,
133+
scopes: isDeviceAuthToken ? scopes : [...scopes, WORKSPACE_PAT_SCOPE],
104134
}));
105135

106136
await this.storeSessions(hydratedSessions);
107137
this.sessionChangeEmitter.fire({ added: hydratedSessions, removed: [], changed: [] });
108-
this.logger.info(`GitHubAuthProvider: hydrated ${hydratedSessions.length} session(s) from K8s token`);
138+
const tokenSource = isDeviceAuthToken ? 'device authentication' : 'workspace PAT';
139+
this.logger.info(`GitHubAuthProvider: hydrated ${hydratedSessions.length} session(s) from K8s ${tokenSource}`);
109140
} catch (error) {
110141
if (isUnauthorizedError(error)) {
111142
this.logger.warn('GitHubAuthProvider: hydrate failed, token is not valid');
112143
} else {
113-
this.logger.trace(`GitHubAuthProvider: hydrate skipped: ${(error as Error).message}`);
144+
this.logger.warn(`GitHubAuthProvider: hydrate failed: ${(error as Error).message}`);
114145
}
115146
}
116147
}
117148

118149
async getSessions(sessionScopes?: string[]): Promise<vscode.AuthenticationSession[]> {
119-
this.logger.trace(`GitHubAuthProvider: GET SESSIONS for scopes: ${sessionScopes}`);
150+
this.logger.info(`GitHubAuthProvider: GET SESSIONS for scopes: ${sessionScopes}`);
120151

121152
const sessions = await this.sessionsPromise;
122153
const sortedScopes = sessionScopes ? [...sessionScopes].sort() : [];
123154
const filteredSessions = sortedScopes.length
124-
? sessions.filter(session => arrayEquals([...session.scopes].sort(), sortedScopes))
155+
? sessions.filter(session => sessionMatchesRequestedScopes(session.scopes, sortedScopes))
125156
: [...sessions];
126157

127-
this.logger.trace(`GitHubAuthProvider: GET sessions - found ${filteredSessions.length} sessions for scopes: ${sessionScopes}`);
158+
this.logger.info(`GitHubAuthProvider: GET sessions - found ${filteredSessions.length} sessions for scopes: ${sessionScopes}`);
128159
return filteredSessions;
129160
}
130161

@@ -160,14 +191,15 @@ export class GitHubAuthProvider implements vscode.AuthenticationProvider {
160191
}
161192

162193
const sessions = await this.sessionsPromise;
194+
const isDeviceAuthToken = await this.githubService.isDeviceAuthToken();
163195
const session: vscode.AuthenticationSession = {
164196
id: v4(),
165197
accessToken: token,
166198
account: { label: githubUser.login, id: githubUser.id.toString() },
167-
scopes,
199+
scopes: isDeviceAuthToken ? scopes : [...scopes, WORKSPACE_PAT_SCOPE],
168200
};
169201

170-
const sessionIndex = sessions.findIndex(s => arrayEquals([...s.scopes].sort(), sortedScopes));
202+
const sessionIndex = sessions.findIndex(s => sessionMatchesRequestedScopes(s.scopes, sortedScopes));
171203
const removed: vscode.AuthenticationSession[] = [];
172204
const updatedSessions = [...sessions];
173205
if (sessionIndex > -1) {
@@ -184,21 +216,42 @@ export class GitHubAuthProvider implements vscode.AuthenticationProvider {
184216
}
185217

186218
private async resolveToken(sortedScopes: string[]): Promise<string> {
219+
const token = await this.getTokenIfSufficient(sortedScopes);
220+
if (!token) {
221+
return await this.getDeviceAuthentication().runInteractiveFlow(sortedScopes);
222+
}
223+
return token;
224+
}
225+
226+
private async getTokenIfSufficient(sortedScopes: string[]): Promise<string | undefined> {
187227
try {
188228
const token = await this.githubService.getToken();
189229
const existingScopes = await this.githubService.getTokenScopes(token);
190230
if (!hasAllScopes(existingScopes, sortedScopes)) {
191-
this.logger.info(`GitHubAuthProvider: token lacks required scopes, starting device flow`);
192-
return await this.getDeviceAuthentication().runInteractiveFlow(sortedScopes);
231+
this.logger.info('GitHubAuthProvider: token lacks required scopes, starting device flow');
232+
return undefined;
193233
}
234+
235+
const isDeviceAuth = await this.githubService.isDeviceAuthToken();
236+
if (!isDeviceAuth) {
237+
const sessions = await this.sessionsPromise;
238+
const hasExistingSession = sessions.some(s =>
239+
sessionMatchesRequestedScopes(s.scopes, sortedScopes)
240+
);
241+
if (hasExistingSession) {
242+
this.logger.info('GitHubAuthProvider: PAT session already exists for requested scopes, starting device auth flow');
243+
return undefined;
244+
}
245+
}
246+
194247
return token;
195248
} catch (error) {
196249
if (isUnauthorizedError(error)) {
197-
this.logger.info(`GitHubAuthProvider: token is not valid, starting device flow`);
250+
this.logger.info('GitHubAuthProvider: token is not valid, starting device flow');
198251
} else {
199-
this.logger.info(`GitHubAuthProvider: no token available, starting device flow`);
252+
this.logger.info('GitHubAuthProvider: no token available, starting device flow');
200253
}
201-
return await this.getDeviceAuthentication().runInteractiveFlow(sortedScopes);
254+
return undefined;
202255
}
203256
}
204257

‎code/extensions/che-github-authentication/src/utils.ts‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -38,6 +38,24 @@ export function hasAllScopes(existingScopes: string[], requestedScopes: string[]
3838
return requestedScopes.every(scope => existingScopes.includes(scope));
3939
}
4040

41+
/**
42+
* Marker scope on sessions backed by a workspace PAT. Copilot requests exact scope lists and
43+
* will not match these sessions; other extensions use superset matching in getSessions.
44+
*/
45+
export const WORKSPACE_PAT_SCOPE = 'che:workspace-pat';
46+
47+
export function isWorkspacePatSession(scopes: readonly string[]): boolean {
48+
return scopes.includes(WORKSPACE_PAT_SCOPE);
49+
}
50+
51+
export function sessionMatchesRequestedScopes(sessionScopes: readonly string[], requestedScopes: readonly string[]): boolean {
52+
if (isWorkspacePatSession(sessionScopes)) {
53+
const tokenScopes = sessionScopes.filter(scope => scope !== WORKSPACE_PAT_SCOPE);
54+
return hasAllScopes(tokenScopes, [...requestedScopes]);
55+
}
56+
return arrayEquals([...sessionScopes].sort(), [...requestedScopes].sort());
57+
}
58+
4159
/** Scope bundles used by Copilot / github / GHPRI / Agent Host — session keys match vanilla createSession. */
4260
export const HYDRATION_SCOPE_BUNDLES: readonly string[][] = [
4361
['read:user', 'user:email', 'repo', 'workflow', 'project', 'read:org'],

‎code/extensions/copilot/src/platform/authentication/vscode-node/copilotTokenManager.ts‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -85,6 +85,12 @@ export class VSCodeCopilotTokenManager extends BaseCopilotTokenManager {
8585
this._logService.info(`Got Copilot token for ${session.account.label}`);
8686
this._logService.info(`Copilot Chat: ${this._envService.getVersion()}, VS Code: ${this._envService.vscodeVersion}`);
8787
}
88+
89+
if (tokenResult.kind === 'failure' && tokenResult.reason === 'NotAuthorized' && !tokenResult.notification_id) {
90+
this._logService.info('Copilot token exchange failed (workspace token cannot be exchanged for Copilot token), triggering sign-in flow');
91+
return { kind: 'failure', reason: 'GitHubLoginFailed' };
92+
}
93+
8894
return tokenResult;
8995
} else {
9096
this._logService.info(`Allowing anonymous access with devDeviceId`);

‎code/src/vs/workbench/contrib/chat/browser/chatSetup/chatSetupContributions.ts‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -138,6 +138,25 @@ export class ChatSetupContribution extends Disposable implements IWorkbenchContr
138138
}));
139139
}
140140

141+
// Proactively clear panel agents when Copilot reports GitHub login failure
142+
// (e.g. workspace PAT cannot be exchanged for a Copilot token)
143+
const gitHubLoginFailedKey = 'github.copilot.interactiveSession.gitHubLoginFailed';
144+
const checkGitHubLoginFailed = () => {
145+
if (this.contextKeyService.getContextKeyValue<boolean>(gitHubLoginFailedKey)) {
146+
const panelAgentHasGuidance = chatViewsWelcomeRegistry.get().some(descriptor => this.contextKeyService.contextMatchesRules(descriptor.when));
147+
if (panelAgentHasGuidance) {
148+
this.logService.error('[chat setup] GitHub login failed detected, clearing panel agent registration to show welcome view.');
149+
panelAgentDisposables.dispose();
150+
}
151+
}
152+
};
153+
panelAgentDisposables.add(this.contextKeyService.onDidChangeContext(e => {
154+
if (e.affectsSome(new Set([gitHubLoginFailedKey]))) {
155+
checkGitHubLoginFailed();
156+
}
157+
}));
158+
checkGitHubLoginFailed();
159+
141160
// Inline Agents
142161
disposables.add(SetupAgent.registerDefaultAgents(this.instantiationService, ChatAgentLocation.Terminal, ChatModeKind.Ask, context, controller).disposable);
143162
disposables.add(SetupAgent.registerDefaultAgents(this.instantiationService, ChatAgentLocation.Notebook, ChatModeKind.Ask, context, controller).disposable);

0 commit comments

Comments
 (0)