langgenius/dify
1
0
Fork 0
mirror of https://github.com/langgenius/dify.git synced 2026-07-23 04:55:28 -04:00
Code Issues 775 Packages Projects Releases 10 Wiki Activity

[PR #30840] fix: move segment operations inside Redis lock scope #32979

New Issue
Open
opened 2026-02-21 20:52:26 -05:00 by yindo · 0 comments
yindo commented 2026-02-21 20:52:26 -05:00
Owner
Copy Link
Copy Source

Original Pull Request: https://github.com/langgenius/dify/pull/30840

State: open
Merged: No

fix: trigger subscription OAuth refresh fails with encrypted credentials

Summary

This PR fixes two issues in the trigger subscription refresh mechanism that prevented OAuth tokens and subscriptions from being refreshed correctly.

Problems & Fixes

1) OAuth token refresh fails with encrypted credentials

Symptom
When the Celery worker refreshes OAuth tokens for trigger subscriptions, it fails with:

  • AADSTS9002313: Invalid request. Request is malformed or invalid.

Root cause
In refresh_oauth_token(), the code used create_provider_encrypter() with get_oauth_client_schema() (schema for client_id / client_secret).
However, subscription credentials contain access_tokens / refresh_token, which require the schema from get_credentials_schema().

Because of this mismatch, decryption fails and encrypted (e.g., HYBRID-prefixed) tokens are passed to the OAuth provider.

Fix
Use create_trigger_provider_encrypter_for_subscription() so the correct credential schema is applied when decrypting subscription credentials.

2) Subscription refresh is always skipped before expiration

Symptom
Subscriptions were never proactively refreshed, even when approaching expiration.

Root cause
In refresh_subscription(), the skip condition was:

if subscription.expires_at == -1 or int(subscription.expires_at) > now_ts:
    return {"result": "skipped", ...}
This skips refresh for any subscription that has not expired yet.

But the caller (trigger_provider_refresh_task) already filters subscriptions using a refresh threshold (e.g., within 24 hours before expiration).
The service method should not duplicate this check.

Fix
Only skip when expires_at == -1 (no expiration). Threshold handling remains in the calling task.

Changes
api/services/trigger/trigger_provider_service.py

refresh_oauth_token(): Use the correct encrypter for subscription credentials

refresh_subscription(): Remove premature skip condition that prevented proactive refresh

Testing
Tested with Microsoft Teams Chat Trigger plugin:

OAuth token auto-refresh: ✅ Working

Subscription auto-refresh: ✅ Working

Teams message → Dify workflow trigger: ✅ Working
**Original Pull Request:** https://github.com/langgenius/dify/pull/30840 **State:** open **Merged:** No --- # fix: trigger subscription OAuth refresh fails with encrypted credentials ## Summary This PR fixes two issues in the trigger subscription refresh mechanism that prevented OAuth tokens and subscriptions from being refreshed correctly. ## Problems & Fixes ### 1) OAuth token refresh fails with encrypted credentials **Symptom** When the Celery worker refreshes OAuth tokens for trigger subscriptions, it fails with: - `AADSTS9002313: Invalid request. Request is malformed or invalid.` **Root cause** In `refresh_oauth_token()`, the code used `create_provider_encrypter()` with `get_oauth_client_schema()` (schema for `client_id` / `client_secret`). However, subscription credentials contain `access_tokens` / `refresh_token`, which require the schema from `get_credentials_schema()`. Because of this mismatch, decryption fails and encrypted (e.g., `HYBRID`-prefixed) tokens are passed to the OAuth provider. **Fix** Use `create_trigger_provider_encrypter_for_subscription()` so the correct credential schema is applied when decrypting subscription credentials. --- ### 2) Subscription refresh is always skipped before expiration **Symptom** Subscriptions were never proactively refreshed, even when approaching expiration. **Root cause** In `refresh_subscription()`, the skip condition was: ```python if subscription.expires_at == -1 or int(subscription.expires_at) > now_ts: return {"result": "skipped", ...} This skips refresh for any subscription that has not expired yet. But the caller (trigger_provider_refresh_task) already filters subscriptions using a refresh threshold (e.g., within 24 hours before expiration). The service method should not duplicate this check. Fix Only skip when expires_at == -1 (no expiration). Threshold handling remains in the calling task. Changes api/services/trigger/trigger_provider_service.py refresh_oauth_token(): Use the correct encrypter for subscription credentials refresh_subscription(): Remove premature skip condition that prevented proactive refresh Testing Tested with Microsoft Teams Chat Trigger plugin: OAuth token auto-refresh: ✅ Working Subscription auto-refresh: ✅ Working Teams message → Dify workflow trigger: ✅ Working
yindo added the pull-request label 2026-02-21 20:52:26 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
Knowledge Pipeline
Proposal
WIP
cloud
dependencies
feat:webapp
good first issue
outdated
performance
pull-request
Mirrored from GitHub Pull Request
 python:uv
refactor
size:L
stale
status: accepting prs
status: blocked
status: in discussion
stt & tts
vulnerablity
web
wont-fix
🌊 feat:workflow
🌚 invalid
🐞 bug
👻 feat:rag
💪 enhancement
📚 documentation
🔨 feat:tools
🙋‍♂️ question
🙏 help wanted
🤔 cant-reproduce
🤖 feat:agent
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: langgenius/dify#32979
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?