Add auto-refreshing of App installation access tokens

[movermeyer]

In order to authenticate as a specific GitHub App installation, you use a JWT token to produce a temporary installation access token.
You can then set Octokit to use that token.

client = Octokit::Client.new(bearer_token: new_jwt_token)	
resource = client.create_installation_access_token(INSTALLATION_ID, accept: 'application/vnd.github.machine-man-preview+json').to_h	

Octokit.configure do |c|
  c.access_token = resource.fetch(:token)
end

However, that token is only valid for an hour.

It would be nice if Octokit could automatically refresh the access_token as it expired.

[llance]

quick question, currently, how are you guys re-authenticating after the access_token expires after the hour?

[sarmad90]

quick question, currently, how are you guys re-authenticating after the access_token expires after the hour?

You don't need to re-authenticate. Just do this bearer_client.create_app_installation_access_token(installation_id) where bearer_client is the Octokit which is initialized by JWT as bearer_token.

[ccoffey]

@sarmad90 I do not think that your answer is correct.

installation_token = bearer_client.create_app_installation_access_token(installation_id)
client = ::Octokit::Client.new(bearer_token: installation_token)

client.check_run("myrepo", 123456789)[:id]
=> 123456789

# Wait for 5 minutes and repeat
client.check_run("myrepo", 123456789)[:id]
=> 123456789

# Wait for 1 hour and repeat
client.check_run("myrepo", 123456789)[:id]
=> 123456789
Octokit::Unauthorized: GET https://api.github.com/repos/myrepo/check-runs/123456789: 401 - Bad credentials // See: https://docs.github.com/rest
from /Users/cathalcoffey/.rbenv/versions/2.6.5/lib/ruby/gems/2.6.0/gems/octokit-4.19.0/lib/octokit/response/raise_error.rb:16:in `on_complete'

I believe @movermeyer is trying to avoid having to do something like the following:

def check_run(repo, id)
  @client.check_run(repo, id)
rescue Octokit::Unauthorized
  @client = create_new_client
  retry
end

And I believe that he is asking if Octokit could do this internally instead?

[movermeyer]

Correct. The fact that tokens expire is something I expect 99.9+% of the users of Octokit::Client don't care about at all, while also being something that could easily (??) be handled automatically for them.