fix(egress): remint once on upstream 403 - #1694
Closed
sentry-junior[bot] wants to merge 1 commit into
Closed
Conversation
Treat injected-credential upstream 403 as transient: clear the cached lease, mint a replacement, and retry the hop once before recording permission denied. Co-Authored-By: Ivan Dlugos <ivan.dlugos@sentry.io>
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Contributor
Author
|
Superseded by #1700, which keeps the upstream-403 remint/retry and also simplifies host installation lease caching (drop per-sandbox/context and repo-scoped mint thrash). |
dcramer
added a commit
that referenced
this pull request
Aug 26, 2026
Recovers the unfinished work from the mid-PR push thread. **Problem** Intermittent GitHub receive-pack 403s after a good installation-token mint looked like Junior lost App write access mid-PR. The lease cache was also keyed by sandbox `egressId` + `contextId` and repository lease scope, so each new sandbox minted tokens too often and made the failure more likely. **Change** Keep the real security boundary: the sandbox never sees tokens; host egress injects them. Simplify the machinery around it: - cache installation leases on the host by `provider + grant` (shared across sandboxes) - keep user and broker grants bound to the actor - stop repository filters on `installation-write` token mint bodies (use full installed App permissions; repo allowlist stays policy and install scope) - refresh cached leases 5 minutes before expiry - on upstream 403 after injection: clear lease → issue a new token → retry once, then record permission denied Supersedes the narrower retry-only draft in #1694. Thread: https://sentry.slack.com/archives/C0AHB7N2JCR/p1787690872538269 <!-- junior-request-attribution:start --> Requested by **David Cramer**. <!-- junior-request-attribution:end --> <!-- junior-session-footer:start --> <!-- junior-conversation-id:slack%3AC0B595QDZLL%3A1787710087.743069 --> -- [View Junior Session](https://junior-prod.sentry.dev/conversations/slack%3AC0B595QDZLL%3A1787710087.743069) [[Sentry]](https://sentry.sentry.io/explore/conversations/slack%3AC0B595QDZLL%3A1787710087.743069/?project=4510944073809921) <!-- junior-session-footer:end --> --------- Co-authored-by: sentry-junior[bot] <264270552+sentry-junior[bot]@users.noreply.github.com> Co-authored-by: David Cramer <david@sentry.io>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Intermittent GitHub
git-receive-pack403s after a successful installation-token mint were failing the whole push path. Junior cleared the lease and recorded hardpermission_deniedwith no retry, so mid-PR work looked like lost App write access.This change treats an upstream 403 after credential injection as transient:
permission_deniedif the second attempt still fails401 handling is unchanged. Local policy 403s are unchanged. Telemetry adds
sandbox.egress.upstream_auth.retrying.Requested by Ivan Dlugos.
--
View Junior Session [Sentry]