cloudflare / cloudflare/cloudflare-os

GitHub connection cannot recover from stale credentials through reauthorization

Open
#10 2 comments 0 reactions 0 assignees View on GitHub
Dominant language
TypeScript
Stars
9.9k
Forks
1.2k
Avg merge
1d 20h
Merged PRs (30d)
107

Description

## Description

We installed the GitHub gatekeeper by following the documented Cloudflare OS setup steps.

After connecting our GitHub account, the repository selector returned `Bad credentials`. We have not determined what originally caused the credential to become invalid, so this report is not claiming that the initial credential failure was necessarily caused by Cloudflare OS.

The reproducible problem was that completing the GitHub authorization flow again with the same account did not repair the connection, and there is no way to "remove" an account (at least that we could find in the admin UI).

## Steps observed

1. Installed and configured the GitHub gatekeeper using the documented process.
2. Connected a GitHub account successfully through OAuth.
3. Opened the GitHub Repository connector.
4. Repository search returned `Bad credentials`.
5. Selected **Use another GitHub account** and authorized the same identity again.
6. OAuth completed successfully, but repository search continued to return `Bad credentials`.

The UI did not provide an apparent way to remove the invalid connected account.

## Expected behavior

Reauthorizing the same GitHub identity should refresh or replace the stale credential, regardless of what originally caused it to become invalid.

## Fix confirmed in our deployment

We made two code changes:

1. Updated `putConnectedAccount()` so reauthorizing the same vendor and identity replaces the existing account capability with the newly authorized one while preserving the account ID.
2. Changed GitHub revocation from the grant-wide `/applications/{client_id}/grant` endpoint to the token-specific `/applications/{client_id}/token` endpoint.

After deploying these changes, we repeated the same authorization flow and repository search worked immediately.

We did not change the OAuth application, callback URL, requested permissions, client credentials, or gatekeeper bindings between the failing and successful attempts.

The original cause of `Bad credentials` remains unknown, but Cloudflare OS’s inability to recover through reauthorization appears reproducible.

Contributor guide

Open the contributing guide

Research direction

Locate putConnectedAccount() and the GitHub revocation handling first. Compare the current behavior with the issue’s confirmed changes, including replacement of the same-vendor identity and use of the token-specific revocation endpoint. Re-run the OAuth flow with an invalid credential and verify that repository search succeeds while the account ID is preserved.

Written by the indexing model from the issue text.

Assessment

Tech stack
github, typescript
Domain
authentication
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Clearly specified
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.