Spike Curtis 1a41608035 fix: stop extending API key access if OIDC refresh is available (#17878) ...

fixes #17070

Cleans up our handling of APIKey expiration and OIDC to keep them separate concepts. For an OIDC-login APIKey, both the APIKey and OIDC link must be valid to login. If the OIDC link is expired and we have a refresh token, we will attempt to refresh.

OIDC refreshes do not have any effect on APIKey expiry.

https://github.com/coder/coder/issues/17070#issuecomment-2886183613 explains why this is the correct behavior.

2025-05-19 12:05:35 +04:00

..

helper.go

chore: implement user link claims as a typed golang object (#15502)

2024-11-14 10:05:44 -06:00

idp_test.go

feat: implement disabling oidc issuer checks (#13991)

2024-07-24 16:45:47 -05:00

idp.go

fix: stop extending API key access if OIDC refresh is available (#17878)

2025-05-19 12:05:35 +04:00