Diego Rodrigues de Sa e Souza 032387401a fix(oauth): GitHub Copilot token refresh sends the public client_id (#4320) ...

GitHub Copilot is a public device-flow OAuth client (client_id, no client_secret),
but the github provider config never populated clientId. The standalone refresh path
omitted client_id (buildFormParams drops undefined) and the executor path sent the
literal "client_id=undefined&client_secret=undefined" — both rejected by GitHub, so a
Copilot connection got stuck once its short-lived token expired and the long-lived
refresh path was needed. Populate the provider clientId from the embedded public cred
(resolvePublicCred, never a literal) and only send client_secret when one exists. The
prior github refresh test patched a fake clientId/clientSecret onto PROVIDERS.github,
masking the broken real config — it now exercises the real config.

Co-authored-by: Manuel B. <1494154+baslr@users.noreply.github.com>

2026-06-19 21:31:42 -03:00

11 KiB

Raw Blame History

View Raw