public/grafana
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

iam: Refresh live connection when ID tokens expire (#107209)

Browse Source 
* iam: refresh live connection when ID tokens expire

* add coverage for the handler functions

* reinstate inadvertently broken unit test
This commit is contained in:
Victor Cinaglia
2025-07-03 10:16:24 -03:00
committed by GitHub
parent 8d8b824f73
commit 4f66c4a2a1
6 changed files with 337 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/services/live/live.go
+30
View File
@@ -641,6 +641,20 @@ func runConcurrentlyIfNeeded(ctx context.Context, semaphore chan struct{}, fn fu
return nil
}
func (g *GrafanaLive) checkIDTokenExpirationAndRefresh(user identity.Requester, client *centrifuge.Client) bool {
if !identity.IsIDTokenExpired(user) {
return false
}
logger.Debug("ID token expired, triggering refresh", "user", client.UserID(), "client", client.ID())
err := g.node.Refresh(client.UserID(), centrifuge.WithRefreshExpired(true))
if err != nil {
logger.Error("Failed to refresh expired ID token", "user", client.UserID(), "client", client.ID(), "error", err)
}
return true
}
func (g *GrafanaLive) HandleDatasourceDelete(orgID int64, dsUID string) {
if g.runStreamManager == nil {
return
@@ -676,6 +690,12 @@ func (g *GrafanaLive) handleOnRPC(clientContextWithSpan context.Context, client
logger.Error("No user found in context", "user", client.UserID(), "client", client.ID(), "method", e.Method)
return centrifuge.RPCReply{}, centrifuge.ErrorInternal
}
// Check if ID token is expired and trigger refresh if needed
if expired := g.checkIDTokenExpirationAndRefresh(user, client); expired {
return centrifuge.RPCReply{}, centrifuge.ErrorExpired
}
var req dtos.MetricRequest
err := json.Unmarshal(e.Data, &req)
if err != nil {
@@ -712,6 +732,11 @@ func (g *GrafanaLive) handleOnSubscribe(clientContextWithSpan context.Context, c
return centrifuge.SubscribeReply{}, centrifuge.ErrorInternal
}
// Check if ID token is expired and trigger refresh if needed
if expired := g.checkIDTokenExpirationAndRefresh(user, client); expired {
return centrifuge.SubscribeReply{}, centrifuge.ErrorExpired
}
// See a detailed comment for StripOrgID about orgID management in Live.
orgID, channel, err := orgchannel.StripOrgID(e.Channel)
if err != nil {
@@ -813,6 +838,11 @@ func (g *GrafanaLive) handleOnPublish(clientCtxWithSpan context.Context, client
return centrifuge.PublishReply{}, centrifuge.ErrorInternal
}
// Check if ID token is expired and trigger refresh if needed
if expired := g.checkIDTokenExpirationAndRefresh(user, client); expired {
return centrifuge.PublishReply{}, centrifuge.ErrorExpired
}
// See a detailed comment for StripOrgID about orgID management in Live.
orgID, channel, err := orgchannel.StripOrgID(e.Channel)
if err != nil {