fix(core): stop rotating internal tokens on startup - #132
Conversation
BK1031
commented
Sep 10, 2026
BK1031
commented
- Remove the completed sentinel:internal scope migration from core startup
- Leave mismatched service-account scopes untouched and log the configuration error
- Preserve fresh internal account creation and missing-token recovery
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 6dc2515e5c
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| if sa.Scope != authz.SentinelInternalScope { | ||
| if err := database.DB.Model(&model.ServiceAccount{}). | ||
| Where("id = ?", sa.ID). | ||
| Updates(map[string]any{ | ||
| "scope": authz.SentinelInternalScope, | ||
| "signed_token": "", | ||
| }).Error; err != nil { | ||
| logger.SugarLogger.Errorf("Failed to migrate internal SA %s scope: %v", name, err) | ||
| continue | ||
| } | ||
| sa.Scope = authz.SentinelInternalScope | ||
| sa.SignedToken = "" | ||
| logger.SugarLogger.Errorf( | ||
| "Internal service account %s has scope %q; expected %q", | ||
| name, | ||
| sa.Scope, | ||
| authz.SentinelInternalScope, | ||
| ) | ||
| continue |
There was a problem hiding this comment.
When an installation upgrades directly from v5.10.7 or earlier to a release containing this commit, its existing internal service accounts still have the previously seeded sentinel:all scope because it never ran the migration introduced immediately before v5.11.0. This branch now only logs the mismatch; BootstrapToken rejects the account at core/api/bootstrap.go:82-85, and every non-core service treats bootstrap failure as fatal, leaving OAuth, Discord, SAML, and Google in restart loops. Keep the idempotent migration, or otherwise support skipped releases without rotating tokens whose scope is already correct.
Useful? React with 👍 / 👎.
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
1 participant
