Problem/Motivation
RemoteManager memoises the Guzzle clients per remote ($httpClients, $jsonApiHttpClients), and the OAuth access token is baked into the client's default headers when it is built, so getAccessToken(), and with it the expiry and refresh logic, runs only once per PHP process.
Any import that outlives the access token TTL sends the expired token for every subsequent request. This is harmless in a web request, but fatal in a queue worker or a long batch.
- Configure a remote with OAuth2.
- Start an import that runs longer than the remote TTL.
- After the TTL, every request returns 401. The stored token is still valid and refreshes correctly: only the in-process client is stale.
Proposed resolution
Stop caching the clients and build one per request.
Remaining tasks
User interface changes
API changes
Data model changes
Comments
Comment #3
alex.bukach commentedComment #4
alex.bukach commented