feat: refresh dynamic auth credentials by mturac · Pull Request #1008 · redis/rueidis

mturac · 2026-07-08T16:15:27Z

Summary

Add AuthCredentials.RefreshAfter so dynamic credential providers can schedule per-pipe credential refreshes after a caller-selected duration.
Refresh credentials with AUTH for RESP2 and RESP3 connections, including password-only RESP3 connections that authenticate as the default user.
Pause lifetime and credential-refresh timers while a pooled pipe is checked out, restart them when the pipe is returned, and discard a pipe if a timer callback is already active.
Close the pipe when fetching or applying refreshed credentials fails, honoring the configured connection timeout for AUTH.

Testing

git diff --check upstream/main...HEAD
go test -run '^TestNewPipe$' -count=1 -timeout=3m .
go test -race -run '^(TestNewPipe|TestPoolWithConnLifetime)$' -count=1 -timeout=5m .

Note

High Risk
Changes authentication timing and in-flight AUTH on pooled connections; mis-timed refresh or pool/timer races could drop connections or leave stale credentials until exit.

Overview
Adds AuthCredentials.RefreshAfter so AuthCredentialsFn can schedule per-connection credential rotation. Each pipe runs an authTimer that re-invokes the provider and issues AUTH on the live connection (RESP2/RESP3, including password-only RESP3 as default).

Timer lifecycle is aligned with connection lifetime: StopTimer / ResetTimer now pause and resume both lifetime and auth refresh while a pipe is checked out from the pool; _exit no longer stops timers globally. The pool drops newly created connections if StopTimer fails (timer already fired), matching reuse behavior for stale wires.

Failures while fetching or applying refreshed credentials close the pipe, with refresh AUTH bounded by ConnWriteTimeout. Broad pipe_test coverage plus pool tests for expired new connections.

^{Reviewed by Cursor Bugbot for commit 0e3a859. Bugbot is set up for automated code reviews on this repo. Configure here.}

mturac · 2026-07-09T05:41:40Z

Validation refreshed on the current head:

git diff --check origin/main...HEAD
go test ./... -run 'TestPipe/Auth Credentials Refresh' -count=1
go test -race ./... -run 'TestPipe/Auth Credentials Refresh' -count=1
go test . -run TestPipe -count=1 -timeout=120s

All passed locally. The current CircleCI build/setup checks are also green.

mturac · 2026-07-09T07:11:07Z

Updated in 10ad622:

replaced RefreshBefore time.Time with RefreshAfter time.Duration;
removed the auth timer mutex and reuse the timer with Reset;
moved the refresh work out of the timer callback;
kept the busy-pipe, no-background, RESP2, and RESP3 default-user refresh coverage aligned with the new API.

Validation:

go test -run '^TestNewPipe$/Auth_Credentials_Refresh' -count=1 -timeout=2m .
go test -race -run '^TestNewPipe$/Auth_Credentials_Refresh' -count=1 -timeout=3m .
go test -run '^TestNewPipe$' -count=1 -timeout=2m .
go test ./... -run 'TestPipe|Auth Credentials Refresh|TestNewPipe' -count=1 -timeout=180s
go test -race -run '^TestNewPipe$/Auth_Credentials_Refresh_(Closes_Busy_Pipe|Timeout|After_StopTimer)$' -count=20 -timeout=5m .
go test -race -run '^TestNewPipe$/Auth_Credentials_Refresh' -count=3 -timeout=5m .
git diff --check origin/main...HEAD

mturac · 2026-07-09T07:17:06Z

Updated in d9a5659:

removed the custom auth-refresh blocked error and reuse the existing closing error when refresh cannot safely run while a command is pending;
removed the stored default-user flag and derive the refresh AUTH shape from the pipe protocol state instead.

Validation:

go test -run '^TestNewPipe$/Auth_Credentials_Refresh_(RESP3|RESP3_Default_User|RESP2|Closes_Busy_Pipe)$' -count=1 -timeout=2m .
go test -race -run '^TestNewPipe$/Auth_Credentials_Refresh' -count=3 -timeout=5m .
go test -run '^TestNewPipe$' -count=1 -timeout=2m .
git diff --check origin/main...HEAD

mturac · 2026-07-09T09:13:24Z

Update: refreshed against the current head after the follow-up commits.

Current commit: 29ed971d2d6e0accd4306d411dd716325754e228

Current CI status:

ci/circleci: setup  success
ci/circleci: build  success
all visible checks passing

Local validation on this head:

git diff --check upstream/main...HEAD
go test -run '^TestNewPipe$/Auth_Credentials_Refresh' -count=1 -timeout=2m .
go test -race -run '^TestNewPipe$/Auth_Credentials_Refresh' -count=1 -timeout=5m .

mturac · 2026-07-10T05:11:15Z

Updated in 3907028.

Added comments explaining why auth refresh tracks pending/open MULTI state.
Added comments explaining why refresh is rescheduled while a transaction or synchronous command is using the connection.

Validation:

git diff --check upstream/main...HEAD
go test -run '^TestNewPipe$/Auth_Credentials_Refresh' -count=1 -timeout=2m .
go test -race -run '^TestNewPipe$/Auth_Credentials_Refresh' -count=1 -timeout=5m .

mturac · 2026-07-10T05:42:47Z

Updated in 89d1ec6.

Removed the extra auth timer mutex and stored auth callback/context/refresh interval fields.
The timer callback now captures the auth callback/context and keeps the current retry interval local to the callback.
Kept the busy-pipe / transaction deferral behavior intact, including the race case where credentials are fetched but AUTH cannot be safely sent yet.

Validation:

git diff --check upstream/main...HEAD
go test -run '^TestNewPipe$/Auth_Credentials_Refresh' -count=1 -timeout=2m .
go test -race -run '^TestNewPipe$/Auth_Credentials_Refresh' -count=1 -timeout=5m .
PATH="$(go env GOPATH)/bin:$PATH" ./dockertest.sh -skip Integration

cursor

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{Reviewed by Cursor Bugbot for commit c514a7f. Configure here.}

rueian · 2026-07-14T03:31:44Z

+		p.authRefreshAfter = authCredentials.RefreshAfter
+		ready := make(chan struct{})
+		p.authTimer = time.AfterFunc(p.authRefreshAfter, func() {
+			<-ready


is this really needed?

rueian · 2026-07-14T03:43:11Z

 	if err := ctx.Err(); err != nil {
 		return newErrResult(err)
 	}
-


keep these empty lines

rueian · 2026-07-14T03:44:56Z

+		reset = p.lftmTimer.Reset(p.lftm)
+	}
+	if p.authTimer != nil && p.authRefreshAfter > 0 {
+		reset = p.authTimer.Reset(p.authRefreshAfter) && reset


Hmm, my bad, let's go back to make RefreshAfter a time.Time so that we can be more accurate when resetting the timer.

rueian · 2026-07-14T03:45:33Z

+		return
+	}
+	if auth.Username != "" || auth.Password != "" {
+		args := []string{"AUTH"}


Please preallocate the slice slots for username and password.

rueian · 2026-07-14T03:47:34Z

+	r2ps             bool // identify this pipe is used for resp2 pubsub or not
+	noNoDelay        bool
+	optIn            bool
+	authRefreshAfter time.Duration


My bad, please make this a time.Time. Also, fields should be aligned by size. It won't be the last field.

mturac · 2026-07-14T06:36:11Z

Updated in 48eed1c.

Changed AuthCredentials.RefreshAfter back to an absolute time.Time and reset the auth refresh timer with time.Until(...).
Removed the extra ready channel around the auth refresh timer.
Preallocated the AUTH argument slice and restored the requested blank line in Do.
Kept the current pool guard/test shape: reverting that guard locally reproduced the TestPoolWithAcquireCtx/Acquire connections, all exceed context deadline pool-size leak (actual: 1), so I left the guard in place and covered it with the targeted pool tests.

Validation:

go test . -run 'TestPipe/Auth Credentials Refresh|TestPoolWithConnLifetime|TestPoolWithAcquireCtx'

cursor Bot reviewed Jul 8, 2026

View reviewed changes

Comment thread pipe.go

Comment thread pipe.go Outdated

Comment thread pipe.go Outdated

rueian reviewed Jul 9, 2026

View reviewed changes

Comment thread pipe.go Outdated

Comment thread pipe.go Outdated

Comment thread pipe.go Outdated

Comment thread pipe.go Outdated

Comment thread pipe.go

Comment thread rueidis.go Outdated

mturac added 4 commits July 9, 2026 11:50

feat: refresh dynamic auth credentials

851ba3e

fix: avoid auth refresh on busy pipes

cb015a1

fix: simplify auth refresh timer scheduling

138309b

fix: simplify auth refresh state

3c88942

mturac force-pushed the izon/fix-1007-auth-refresh branch from d9a5659 to 3c88942 Compare July 9, 2026 08:51

cursor Bot reviewed Jul 9, 2026

View reviewed changes

Comment thread pipe.go

fix: defer auth refresh during transactions

bdc0e65

cursor Bot reviewed Jul 9, 2026

View reviewed changes

Comment thread pipe.go Outdated

fix: track transactions in DoMulti

b997245

cursor Bot reviewed Jul 9, 2026

View reviewed changes

Comment thread pipe.go Outdated

fix: track aborted transaction replies

3a4ad5d

cursor Bot reviewed Jul 9, 2026

View reviewed changes

Comment thread pipe.go

fix: defer auth refresh for in-flight multi

1b24f28

cursor Bot reviewed Jul 9, 2026

View reviewed changes

Comment thread pipe.go

Comment thread pipe.go Outdated

mturac added 2 commits July 9, 2026 13:58

fix: reschedule auth refresh on busy sync pipes

9914a56

fix: harden auth refresh scheduling

29ed971

rueian reviewed Jul 10, 2026

View reviewed changes

Comment thread pipe.go Outdated

Comment thread pipe.go Outdated

Comment thread pipe.go Outdated

Comment thread pipe.go Outdated

Comment thread pipe.go Outdated

docs: clarify auth refresh transaction guards

3907028

fix: simplify auth refresh timer state

89d1ec6

mturac added 2 commits July 10, 2026 09:18

clarify auth refresh deferral

71ad2ab

simplify auth refresh command construction

c035c95

rueian reviewed Jul 10, 2026

View reviewed changes

Comment thread pipe.go Outdated

fix: simplify auth refresh deferral

8e3e051

cursor Bot reviewed Jul 10, 2026

View reviewed changes

Comment thread pipe.go Outdated

fix: stop auth refresh on pipe exit

e752ebe

cursor Bot reviewed Jul 10, 2026

View reviewed changes

Comment thread pipe.go

mturac added 2 commits July 11, 2026 00:09

fix: guard auth refresh timer updates

42c445d

fix: clear auth refresh timer on close

9b874e7

rueian reviewed Jul 11, 2026

View reviewed changes

Comment thread pipe.go Outdated

Comment thread pipe.go Outdated

Comment thread pipe.go Outdated

Comment thread pipe.go Outdated

Comment thread pipe.go Outdated

rueian reviewed Jul 11, 2026

View reviewed changes

Comment thread pipe.go Outdated

fix: simplify auth refresh lifecycle

238aec9

cursor Bot reviewed Jul 12, 2026

View reviewed changes

Comment thread pipe.go

mturac added 2 commits July 12, 2026 08:37

fix: serialize no-background auth refresh

8f74e5b

fix: preserve stream result layout

4b7d256

cursor Bot reviewed Jul 12, 2026

View reviewed changes

Comment thread pipe.go Outdated

fix: stop auth refresh on close

435a477

cursor Bot reviewed Jul 12, 2026

View reviewed changes

Comment thread pipe.go Outdated

fix: avoid blocking auth refresh on streams

401e58a

rueian reviewed Jul 12, 2026

View reviewed changes

Comment thread pipe.go Outdated

Comment thread pipe.go Outdated

fix: align auth refresh with pool timers

c514a7f

cursor Bot reviewed Jul 13, 2026

View reviewed changes

Comment thread pipe.go

mturac added 2 commits July 13, 2026 06:29

fix: discard active timer refreshes

ae87e56

fix: return new error wires from pool acquire

657484c

rueian reviewed Jul 14, 2026

View reviewed changes

fix: use absolute auth refresh time

48eed1c

test: cover pool stale wire paths separately

0e3a859

Uh oh!

Conversation

mturac commented Jul 8, 2026 • edited by cursor Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Testing

Uh oh!

Uh oh!

Uh oh!

Uh oh!

mturac commented Jul 9, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

mturac commented Jul 9, 2026

Uh oh!

mturac commented Jul 9, 2026

Uh oh!

Uh oh!

mturac commented Jul 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

mturac commented Jul 10, 2026

Uh oh!

mturac commented Jul 10, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

cursor Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

rueian Jul 14, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

rueian Jul 14, 2026

Choose a reason for hiding this comment

Uh oh!

rueian Jul 14, 2026

Choose a reason for hiding this comment

Uh oh!

rueian Jul 14, 2026

Choose a reason for hiding this comment

Uh oh!

rueian Jul 14, 2026

Choose a reason for hiding this comment

Uh oh!

mturac commented Jul 14, 2026

Uh oh!

Reviewers

Assignees

Labels

mturac commented Jul 8, 2026 •

edited by cursor Bot

Loading

mturac commented Jul 9, 2026 •

edited

Loading