fix(oauth): revoke replaced sessions and preserve token metadata - #1147

Summary

Follow-up to #1138's token-cleanup comment: clean up replaced OAuth sessions without forcing an immediate re-login when required scopes change. Closes #1140: this PR covers items 1 and 3, and #1128 covers item 2.

• Keep existing expiry behavior: missing required scopes stop refresh but keep the stored access token, so normal 401 recovery applies after expiry. The eligibility check is renamed to canRefreshOAuthSession.
• Revoke replaced sessions: a successful sign-in saves first, then revokes the overwritten OAuth pair in the background (best effort). Failed or canceled sign-ins, same-token reuse, and stored-session adoption revoke nothing.
• Refresh and revoke as the issuing registration: each OAuth session records the registration (client ID and secret) its tokens were issued to, so refresh and revocation keep working when another window re-registers. Sessions saved before this change fall back to the stored registration, which login now saves only after it succeeds, so a failed login can't replace it.
• Preserve OAuth metadata on reuse: reusing the same token on the same origin keeps its refresh credentials, scopes, and registration. If a refresh rotates the session while its stored token is checked, the rotated session wins.
• Keep credentials out of logs: every logged argument goes through one redaction walk, for both the output channel and the connection log buffer. It redacts credential fields (token, refresh_token, client_secret, ...) with string values in plain objects and errors, and reduces an Axios error at any depth, including an error's cause, to its request line, status, and the server's reply. The error's config and socket hold the session token, OAuth tokens, and client secret. The walk reads only data properties, never throws, and skips entries the channel drops.
• Share OAuth plumbing: revokeOAuthTokens in src/oauth/revocation.ts serves logout and replacement. withOAuthMetadata in src/oauth/metadataClient.ts creates the client and fetches metadata for revocation and token refresh.
• Scopes: request user:update_personal, which coder start needs to refresh expired external-auth links. No narrower scope exists, so it also allows profile and Git SSH key changes; a comment next to the scope says so. Inbox permissions stay optional.
• Dynamic client registration disabled (OAuth follow-ups: DCR off by default on 2.38, unnoticed nightly scope failures, CLI inheriting CODER_SESSION_TOKEN #1140, item 1): OAuth is offered only when discovery advertises registration_endpoint. From Coder 2.37, discovery omits it while dynamic_client_registration_enabled is off (the default), and the register endpoint returns 403; 2.25 to 2.36 always advertise it and always allow registration. Otherwise sign-in falls back to a session token: when DCR is off, a notice says so and a warning is logged; when the server has no OAuth discovery (404 or network error), only an info line is logged. The changelog notes that OAuth becomes the default sign-in method and links the OAuth2 provider docs.
• CLI token from the environment (OAuth follow-ups: DCR off by default on 2.38, unnoticed nightly scope failures, CLI inheriting CODER_SESSION_TOKEN #1140, item 3): CLI processes the extension starts (start, update, speedtest, netcheck, support bundle, ping, login, logout, and the app-command terminal with strictEnv) get process.env without CODER_SESSION_TOKEN, matched the way the CLI reads it: any letter case, with or without the HOMEBREW_ prefix. AGENTS.md adds this to the CLI execution rules. The SSH ProxyCommand runs in an environment Remote-SSH sets, so it starts with an empty --token= instead; the CLI applies flags over the environment, and a user's own --token in coder.globalFlags comes later and still wins. No other CODER_* variable changes which session is used: --url and --use-keyring already override theirs, and CODER_AGENT_TOKEN is read only by agent commands.

Out of scope: startup or remote admission gates, per-action permission maps, and a background-refresh redesign. Before expiry, users can still see feature-specific permission errors; those don't prompt for sign-in.

Change size

Diff against the merge base; counts include moved code and renames.

Validation

Four commits on top of main.

• pnpm test: 191 files, 3,055 passed, 6 skipped.
• pnpm typecheck, pnpm lint, and pnpm format:check: passed.
• Integration tests were not rerun for this revision.
• Regression tests cover stored and provided token reuse; manual, provided, and OAuth replacement; refresh rotation during a stored-token login; save-before-revoke ordering; failed and canceled sign-in; a failed login keeping the stored registration; discovery without registration_endpoint disabling OAuth with a notice, and failed discovery falling back without one; the host session token (any case, HOMEBREW_ prefix) dropped from every spawned CLI's environment, including the app-command terminal, while storeToken passes its own; the empty --token= in the ProxyCommand flags with a user --token overriding it; refresh and revocation as the recorded registration, with the stored registration as fallback; an Axios error, alone or nested in an error's cause, whose logged form omits its token, client secret, and session header; credential fields redacted in any logged object, on both the output channel and the buffer; and redaction that keeps references when nothing changes, never runs getters, never throws, and keeps a redacted error's stack.

Known limitations

• A background refresh already in flight when an OAuth sign-in replaces the session can race the revocation. Fixing that needs refresh coordination, which is out of scope here.
• A user whose deployment turned DCR off but who already holds a registration is offered session-token sign-in, though the existing registration would still work.

Generated by Coder Agents on behalf of @EhabY.