Skip to content

Add the refresh tokens relationship to the account protocols - #1307

Merged
gmazoyer merged 1 commit into
stablefrom
chore/add-account-refresh-tokens-protocol
Sep 1, 2026
Merged

Add the refresh tokens relationship to the account protocols#1307
gmazoyer merged 1 commit into
stablefrom
chore/add-account-refresh-tokens-protocol

Conversation

@gmazoyer

@gmazoyer gmazoyer commented Sep 1, 2026

Copy link
Copy Markdown
Contributor

Why

Infrahub declares a refresh_tokens relationship on CoreGenericAccount, so that
the delete of an account also removes its refresh tokens. This file is generated
from that schema, so it has to carry the same relationship. Without it,
invoke backend.generate in the Infrahub repository leaves this file dirty and the
validate-generated job stays red.

Needed by opsmill/infrahub#10435, which fixes opsmill/infrahub#10304.

What changed

  • refresh_tokens is added to CoreGenericAccount and CoreGenericAccountSync.

Nothing else. The file is rendered by invoke backend.generate in the Infrahub
repository, not written by hand.

How to review

One commit on top of stable, two lines. The Infrahub submodule already pins the
stable head, so the pointer bump on that side moves by this commit alone.

Infrahub declares a `refresh_tokens` relationship on
CoreGenericAccount, so that the delete of an account also removes its
refresh tokens. This file is generated from that schema, so it needs
the same relationship.

Rendered with `invoke backend.generate` in the Infrahub repository. Do
not edit it by hand.
@gmazoyer
gmazoyer requested a review from a team as a code owner September 1, 2026 08:55
gmazoyer added a commit to opsmill/infrahub that referenced this pull request Sep 1, 2026
The account now declares a `refresh_tokens` relationship, and the SDK
protocols are generated from that schema. Without this bump,
`invoke backend.validate-generated` stays red.

The pinned commit is the head of opsmill/infrahub-sdk-python#1307. It
has to move to the squashed commit once that PR merges.
@cloudflare-workers-and-pages

cloudflare-workers-and-pages Bot commented Sep 1, 2026

Copy link
Copy Markdown

Deploying infrahub-sdk-python with  Cloudflare Pages  Cloudflare Pages

Latest commit: 95e5a26
Status: ✅  Deploy successful!
Preview URL: https://b390a78c.infrahub-sdk-python.pages.dev
Branch Preview URL: https://chore-add-account-refresh-to.infrahub-sdk-python.pages.dev

View logs

@codecov

codecov Bot commented Sep 1, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.

@@           Coverage Diff           @@
##           stable    #1307   +/-   ##
=======================================
  Coverage   84.23%   84.24%           
=======================================
  Files         147      147           
  Lines       13045    13047    +2     
  Branches     1930     1930           
=======================================
+ Hits        10989    10991    +2     
  Misses       1493     1493           
  Partials      563      563           
Flag Coverage Δ
integration-tests 39.10% <100.00%> (+0.01%) ⬆️
python-3.10 57.06% <100.00%> (+<0.01%) ⬆️
python-3.11 57.06% <100.00%> (+<0.01%) ⬆️
python-3.12 57.06% <100.00%> (-0.01%) ⬇️
python-3.13 57.07% <100.00%> (+<0.01%) ⬆️
python-3.14 57.06% <100.00%> (+<0.01%) ⬆️
python-filler-3.12 23.68% <0.00%> (-0.01%) ⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines Coverage Δ
infrahub_sdk/protocols.py 100.00% <100.00%> (ø)
🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@cubic-dev-ai cubic-dev-ai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

No issues found across 1 file

Re-trigger cubic

@gmazoyer
gmazoyer force-pushed the chore/add-account-refresh-tokens-protocol branch from f797f5c to 95e5a26 Compare September 1, 2026 09:08
gmazoyer added a commit to opsmill/infrahub that referenced this pull request Sep 1, 2026
The account now declares a `refresh_tokens` relationship, and the SDK
protocols are generated from that schema. Without this bump,
`invoke backend.validate-generated` stays red.

The pinned commit is the head of opsmill/infrahub-sdk-python#1307. It
has to move to the squashed commit once that PR merges.

@ogenstad ogenstad left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Sanity check for this one. These are in the Internal namespace. I don't think they are exposed through the GraphQL API?

Are we sure this is needed?

@gmazoyer

gmazoyer commented Sep 1, 2026

Copy link
Copy Markdown
Contributor Author

Sanity check for this one. These are in the Internal namespace. I don't think they are exposed through the GraphQL API?

Are we sure this is needed?

I guess we have a code generator bug for Python SDK protocols then, because we have internal stuff in there already (even though we do not expose them over the graphql API).

@polmichel

Copy link
Copy Markdown
Contributor

Sanity check for this one. These are in the Internal namespace. I don't think they are exposed through the GraphQL API?

Are we sure this is needed?

External identities are also exposed in the SDK and they also belong to the Internal namespace backend/infrahub/core/schema/definitions/core/account.py:183. This is why I thought it was expected.

@ogenstad ogenstad left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Approving instead since this is just a temporary fix to resolve a CI validation issue and no consumers will attempt to use these. The target will then be to avoid these to be generated within the 1.12.0 cycle for Infrahub.

gmazoyer added a commit to opsmill/infrahub that referenced this pull request Sep 1, 2026
The account now declares a `refresh_tokens` relationship, and the SDK
protocols are generated from that schema. Without this bump,
`invoke backend.validate-generated` stays red.

The pinned commit is the head of opsmill/infrahub-sdk-python#1307. It
has to move to the squashed commit once that PR merges.
@gmazoyer
gmazoyer merged commit 66a2543 into stable Sep 1, 2026
21 checks passed
@gmazoyer
gmazoyer deleted the chore/add-account-refresh-tokens-protocol branch September 1, 2026 19:34
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

bug: deleting an SSO user's account leaves its external identity behind, permanently locking the user out of SSO login

3 participants