feat: add OAuth auth command with login, status, refresh and auto-401 retry - #37
Merged
Merged
Conversation
… retry Add `dremio auth` command group with subcommands: - `login`: browser-based OAuth 2.0 PKCE flow that stores access + refresh tokens in ~/.config/dremioai/config.yaml - `status`: shows current auth method, token expiry (JWT decode), redacted token values - `refresh`: manually refreshes the access token using stored refresh token - `logout`: removes OAuth tokens from config OAuth configuration: - Client ID defaults to https://connectors.dremio.app/claude - Redirect URI: http://localhost:{port}/Callback - Scopes: dremio.all offline_access - Endpoints discovered via .well-known/oauth-authorization-server with hardcoded fallbacks for US/EU regions using /oauth/authorize path Automatic 401 token refresh in DremioClient: - On any 401 response, if OAuth refresh_token + client_id are available, the client transparently refreshes the access token and retries once - New tokens are persisted to disk and httpx headers updated in-place - Guard flag prevents infinite refresh loops (one attempt per client instance) Auth priority chain (unchanged): CLI --token > DREMIO_TOKEN env > oauth.access_token from config > pat field from config New modules: - src/drs/oauth.py: PKCE flow, well-known discovery, token refresh - src/drs/commands/auth.py: typer command group for auth subcommands Tests: 4 new tests covering 401 refresh trigger, no-refresh without OAuth config, single-attempt guard, and refresh failure propagation.
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: e41ed31c98
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
…ath, transient retry 1. OAuth access_token now overrides file PAT (not just fills in when missing), so 'auth login' is effective even with an existing PAT from 'setup'. (review comment #1) 2. Track auth_source on DrsConfig ('oauth'|'file'|'env'|'cli'). Auto- refresh only activates when auth_source == 'oauth', preventing the client from silently switching identity when --token or DREMIO_TOKEN supplies the active credential. (review comment dremio#2) 3. Store the effective config_path on DrsConfig and pass it through to save_oauth_tokens during auto-refresh, so custom --config paths get their tokens updated correctly. (review comment dremio#3) 4. After a successful 401 refresh, the retried response now falls through to the transient-status retry loop instead of returning immediately, so a post-refresh 429/503 is still retried. (review comment dremio#4) Tests: 6 new tests (229 total) covering all four fixes.
rahim-bhojani
approved these changes
Aug 25, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Add
dremio authcommand group for OAuth 2.0 PKCE authentication with Dremio Cloud, plus automatic 401 token refresh in the HTTP client.New Commands
dremio auth logindremio auth statusdremio auth refreshdremio auth logoutOAuth Configuration
https://connectors.dremio.app/claude(default, overridable via--client-id)http://localhost:{port}/Callbackdremio.all offline_access.well-known/oauth-authorization-serverwith hardcoded fallbacks for US/EU (/oauth/authorizepath)Automatic 401 Token Refresh
The
DremioClientnow intercepts 401 responses and transparently:~/.config/dremioai/config.yamlA guard flag prevents infinite refresh loops (one attempt per client instance). If no OAuth config is present or refresh fails, the 401 propagates normally.
Auth Priority Chain (unchanged)
--tokenCLI arg →DREMIO_TOKENenv →oauth.access_tokenfrom config →patfield from configNew Modules
src/drs/oauth.py— PKCE flow, well-known discovery, token refreshsrc/drs/commands/auth.py— typer command groupTests
4 new tests for the 401 refresh logic:
Reference: modeled after dremio-mcp auth patterns