feat(refresh-token): Add refresh token option to the rest connector, add it to the MS email as well#7446
Open
mathias-vandaele wants to merge 1 commit into
Open
feat(refresh-token): Add refresh token option to the rest connector, add it to the MS email as well#7446mathias-vandaele wants to merge 1 commit into
mathias-vandaele wants to merge 1 commit into
Conversation
…add it to the MS email as well
Contributor
There was a problem hiding this comment.
Pull request overview
This PR adds OAuth 2.0 Refresh Token authentication support to the shared HTTP client stack and exposes it through the REST/GraphQL/HTTP-polling element templates, plus wires the option into the Microsoft O365 Mail template.
Changes:
- Introduces a new
OAuthRefreshTokenAuthenticationtype (client + http-base model) and registers it in the polymorphic authentication hierarchies/mappers. - Implements refresh-token grant request/response handling (including common OAuth error cases) and uses it in the Apache request auth builder.
- Updates multiple element templates (REST, GraphQL, polling, O365 Mail) and bumps REST connector/template versions accordingly.
Reviewed changes
Copilot reviewed 20 out of 20 changed files in this pull request and generated 10 comments.
Show a summary per file
| File | Description |
|---|---|
| connectors/microsoft/mail/element-templates/versioned/microsoft-office365-mail-connector-4.json | Adds a new versioned v4 O365 Mail element template snapshot. |
| connectors/microsoft/mail/element-templates/microsoft-office365-mail-connector.json | Bumps template to v5 and adds refresh-token auth configuration fields. |
| connectors/http/rest/src/main/java/io/camunda/connector/http/rest/HttpJsonFunction.java | Bumps REST connector element template version annotation to 14. |
| connectors/http/rest/README.md | Updates documented REST connector version to 14. |
| connectors/http/rest/element-templates/versioned/http-connector.json-13.json | Adds a versioned template snapshot for REST connector version 13. |
| connectors/http/rest/element-templates/hybrid/http-json-connector-hybrid.json | Bumps to v14 and adds refresh-token auth fields for hybrid template. |
| connectors/http/rest/element-templates/http-json-connector.json | Bumps to v14 and adds refresh-token auth fields. |
| connectors/http/polling/element-templates/http-polling-connector.json | Adds refresh-token auth fields to HTTP polling template. |
| connectors/http/polling/element-templates/http-polling-boundary-catch-event-connector.json | Adds refresh-token auth fields to HTTP polling boundary template. |
| connectors/http/http-base/src/main/java/io/camunda/connector/http/base/model/auth/OAuthRefreshTokenAuthentication.java | Adds http-base model subtype for refresh-token auth (template-generation model). |
| connectors/http/http-base/src/main/java/io/camunda/connector/http/base/model/auth/AuthenticationMapper.java | Maps http-base refresh-token auth model into http-client auth model. |
| connectors/http/http-base/src/main/java/io/camunda/connector/http/base/model/auth/Authentication.java | Registers refresh-token auth subtype in the sealed/auth polymorphic config. |
| connectors/http/graphql/element-templates/hybrid/graphql-outbound-connector-hybrid.json | Adds refresh-token auth fields to GraphQL hybrid template. |
| connectors/http/graphql/element-templates/graphql-outbound-connector.json | Adds refresh-token auth fields to GraphQL standard template. |
| connector-commons/http-client/src/test/java/io/camunda/connector/http/client/authentication/OAuthRefreshTokenServiceTest.java | Adds tests for refresh-token request creation and token/error extraction. |
| connector-commons/http-client/src/main/java/io/camunda/connector/http/client/model/auth/OAuthRefreshTokenAuthentication.java | Adds http-client refresh-token auth model and form body builder. |
| connector-commons/http-client/src/main/java/io/camunda/connector/http/client/model/auth/HttpAuthentication.java | Registers refresh-token auth subtype in the http-client polymorphic hierarchy. |
| connector-commons/http-client/src/main/java/io/camunda/connector/http/client/client/apache/builder/parts/ApacheRequestAuthenticationBuilder.java | Adds support for applying refresh-token based access tokens to requests. |
| connector-commons/http-client/src/main/java/io/camunda/connector/http/client/authentication/OAuthService.java | Adds refresh-token grant request creation and token/error extraction logic. |
| connector-commons/http-client/src/main/java/io/camunda/connector/http/client/authentication/OAuthConstants.java | Adds constants needed for refresh-token parameters and OAuth error fields. |
Comments suppressed due to low confidence (1)
connectors/microsoft/mail/element-templates/microsoft-office365-mail-connector.json:970
- The template's top-level version was bumped to 5, but the elementTemplateVersion task header is set to 4. Other Microsoft templates keep these aligned (e.g., azure-open-ai-connector.json uses value "2" for version 2), so this likely should be updated to 5 to avoid confusion and inconsistent metadata at runtime.
"id": "version",
"label": "Version",
"description": "Version of the element template",
"value": "4",
"group": "connector",
"binding": {
"key": "elementTemplateVersion",
"type": "zeebe:taskHeader"
},
"type": "Hidden"
| * for common failure modes ({@code invalid_grant}, {@code interaction_required}). | ||
| * | ||
| * @param body the raw token endpoint response | ||
| * @return the access token |
Comment on lines
+57
to
+60
| case OAuthRefreshTokenAuthentication auth -> { | ||
| var token = fetchOAuthRefreshToken(auth); | ||
| builder.addHeader(AUTHORIZATION, String.format(BEARER, token)); | ||
| } |
Comment on lines
+410
to
+412
| "id" : "authentication.oauthRefreshToken.scopes", | ||
| "label" : "Oauth refresh token.scopes", | ||
| "description" : "The scopes to request authorization for (space-separated)", |
Comment on lines
+415
to
+417
| "id" : "authentication.oauthRefreshToken.scopes", | ||
| "label" : "Oauth refresh token.scopes", | ||
| "description" : "The scopes to request authorization for (space-separated)", |
Comment on lines
+410
to
+412
| "id" : "authentication.oauthRefreshToken.scopes", | ||
| "label" : "Oauth refresh token.scopes", | ||
| "description" : "The scopes to request authorization for (space-separated)", |
Comment on lines
+415
to
+417
| "id" : "authentication.oauthRefreshToken.scopes", | ||
| "label" : "Oauth refresh token.scopes", | ||
| "description" : "The scopes to request authorization for (space-separated)", |
Comment on lines
+398
to
+400
| "id" : "authentication.oauthRefreshToken.scopes", | ||
| "label" : "Oauth refresh token.scopes", | ||
| "description" : "The scopes to request authorization for (space-separated)", |
Comment on lines
+398
to
+400
| "id" : "authentication.oauthRefreshToken.scopes", | ||
| "label" : "Oauth refresh token.scopes", | ||
| "description" : "The scopes to request authorization for (space-separated)", |
Comment on lines
+846
to
+855
| "id": "version", | ||
| "label": "Version", | ||
| "description": "Version of the element template", | ||
| "value": "3", | ||
| "group": "connector", | ||
| "binding": { | ||
| "key": "elementTemplateVersion", | ||
| "type": "zeebe:taskHeader" | ||
| }, | ||
| "type": "Hidden" |
Comment on lines
+1
to
+8
| { | ||
| "$schema" : "https://unpkg.com/@camunda/zeebe-element-templates-json-schema/resources/schema.json", | ||
| "name" : "REST Outbound Connector", | ||
| "id" : "io.camunda.connectors.HttpJson.v2", | ||
| "description" : "Invoke REST API", | ||
| "keywords" : [ "HTTP", "REST", "API call", "web request", "GET", "POST", "PUT", "PATCH", "DELETE", "fetch data", "send request", "invoke API" ], | ||
| "documentationRef" : "https://docs.camunda.io/docs/components/connectors/protocol/rest/", | ||
| "version" : 13, |
Collaborator
Code reviewFound 2 issues:
🤖 Generated with Claude Code - If this code review was useful, please react with 👍. Otherwise, react with 👎. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This pull request adds support for OAuth 2.0 Refresh Token authentication to the HTTP client library and updates the GraphQL connector templates to allow users to configure this new authentication method. The implementation includes a new authentication type, request/response handling logic, error handling for common OAuth failure modes, and comprehensive tests to ensure correct behavior.
OAuth 2.0 Refresh Token Authentication Support
OAuthRefreshTokenAuthenticationtype, including its data model and logic for building the refresh token grant request body. (OAuthRefreshTokenAuthentication.java)HttpAuthenticationhierarchy. (HttpAuthentication.java)Request and Token Handling
OAuthServiceto create OAuth refresh token requests and extract tokens from responses, with detailed error handling forinvalid_grant,interaction_required, and other OAuth errors. (OAuthService.java) [1] [2]ApacheRequestAuthenticationBuilder.java) [1] [2]OAuthConstants.java)Connector Template Updates
graphql-outbound-connector.json,graphql-outbound-connector-hybrid.json) [1] [2] [3] [4]Testing
OAuthRefreshTokenServiceTest.java)