cloudflare / cloudflare/cloudflare-os
GitHub connection cannot recover from stale credentials through reauthorization
- Dominant language
- TypeScript
- Stars
- 9.9k
- Forks
- 1.2k
- Avg merge
- 1d 20h
- Merged PRs (30d)
- 107
Description
## Description
We installed the GitHub gatekeeper by following the documented Cloudflare OS setup steps.
After connecting our GitHub account, the repository selector returned `Bad credentials`. We have not determined what originally caused the credential to become invalid, so this report is not claiming that the initial credential failure was necessarily caused by Cloudflare OS.
The reproducible problem was that completing the GitHub authorization flow again with the same account did not repair the connection, and there is no way to "remove" an account (at least that we could find in the admin UI).
## Steps observed
1. Installed and configured the GitHub gatekeeper using the documented process.
2. Connected a GitHub account successfully through OAuth.
3. Opened the GitHub Repository connector.
4. Repository search returned `Bad credentials`.
5. Selected **Use another GitHub account** and authorized the same identity again.
6. OAuth completed successfully, but repository search continued to return `Bad credentials`.
The UI did not provide an apparent way to remove the invalid connected account.
## Expected behavior
Reauthorizing the same GitHub identity should refresh or replace the stale credential, regardless of what originally caused it to become invalid.
## Fix confirmed in our deployment
We made two code changes:
1. Updated `putConnectedAccount()` so reauthorizing the same vendor and identity replaces the existing account capability with the newly authorized one while preserving the account ID.
2. Changed GitHub revocation from the grant-wide `/applications/{client_id}/grant` endpoint to the token-specific `/applications/{client_id}/token` endpoint.
After deploying these changes, we repeated the same authorization flow and repository search worked immediately.
We did not change the OAuth application, callback URL, requested permissions, client credentials, or gatekeeper bindings between the failing and successful attempts.
The original cause of `Bad credentials` remains unknown, but Cloudflare OS’s inability to recover through reauthorization appears reproducible.
Contributor guide
Research direction
Locate putConnectedAccount() and the GitHub revocation handling first. Compare the current behavior with the issue’s confirmed changes, including replacement of the same-vendor identity and use of the token-specific revocation endpoint. Re-run the OAuth flow with an invalid credential and verify that repository search succeeds while the account ID is preserved.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- github, typescript
- Domain
- authentication
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Quiet
- Clarity
- Clearly specified
- Newbie friendliness
- 45/100