fix(tangle): never cache or share single-use broker tokens - #579
Conversation
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 6035d62395
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| - uses: pnpm/action-setup@v4 | ||
| - uses: actions/setup-node@v4 | ||
| with: | ||
| node-version: 22 |
There was a problem hiding this comment.
Pin this pull-request workflow to .nvmrc rather than Node 22. resolveNodeRequirement() scans every workflow triggered by pull_request and explicitly refuses when its major differs from .nvmrc; with .nvmrc at 24.18.0, every required pnpm signoff --source head invocation now exits before running any checks.
AGENTS.md reference: AGENTS.md:L88-L90
Useful? React with 👍 / 👎.
| env: | ||
| NODE_OPTIONS: --max-old-space-size=12288 | ||
| steps: | ||
| - uses: actions/checkout@v4 |
There was a problem hiding this comment.
Replace the version tags here and on the other three uses: entries with the repository's required 40-character action SHAs. On every post-merge publish run, Check release contract invokes .github/scripts/test-publish-workflow.mjs, which scans all workflow files and exits unless every action reference is an exact SHA; this new actions/checkout@v4 alone reproduces publish workflow contract failed: every action must use an exact commit SHA, blocking the release before source verification or packaging.
Useful? React with 👍 / 👎.
| pnpm docs:gen | ||
| git diff -- docs > verification/generated-docs.patch |
There was a problem hiding this comment.
Run the generator in check mode, or fail when this diff is nonempty, rather than regenerating before the tests. For a commit with stale generated documentation—as this one is, since docs/api/tangle.md still documents cached tokens—pnpm docs:gen silently repairs the runner's working tree and the redirected git diff still exits successfully, so the later codemap-freshness test sees updated files and the workflow reports green even though the exact committed HEAD fails the required sign-off.
AGENTS.md reference: AGENTS.md:L88-L90
Useful? React with 👍 / 👎.
1 participant
Problem
A broker bearer authorizes one Hub execution. Caching it for its TTL or sharing an in-flight mint gives concurrent or later executions a token another request has consumed.
Implementation
Mint independently on every getToken() call. Remove both bearer caching and in-flight sharing. Preserve API compatibility: deprecated refreshSkewMs/now options are inert; invalidate() remains callable and cannot revoke authoritative grants. Mint failures propagate without retrying external actions. No dependencies, alternate Hub client or runtime redesign.
Tests cover out-of-order concurrent completion, unique tokens per consuming execution, burst uniqueness, issuer errors, exact mint inputs and legacy options. Generated API docs/codemap were regenerated with the maintained generator, not hand-edited.
Verification — latest head
Complete Verify PR workflow passed at
1f8cea4e0cb95e20bec95e82737f35d9639e137c.Run: https://github.com/tangle-network/agent-app/actions/runs/34728075883
Includes frozen dependency installation; generated documentation and clean-doc diff; typecheck; test:gates; build; the complete Vitest suite; generated-application tests; and knip. Read-only CI uses SHA-pinned actions and stores verification archives outside the dependency-audited source tree.
The earlier before/after reproduction failed 5 of 10 checks before the fix and passed all 10 after. Full repository CI now supersedes the former local-only limitation.
Companion work
No live token minting, paid-number purchase, production deployment, merge or package release was performed. This is a non-draft implementation PR; live activation is a separate operational gate.