sendToExitNode used axios without a timeout, so a Gerbil that accepted
the connection but never answered left the caller (peer updates, SNI
sync, client association rebuilds) waiting indefinitely. Apply a 15s
default, overridable per request.
With prompt caching enabled, Bedrock reports inputTokens as the non-cached input only; cacheReadInputTokens and cacheWriteInputTokens are separate counters. Subtracting the cache reads again undercounted promptTokens (clamped to 0) in both the JSON and the stream-scan paths.
Pangolin consults the IdP only at login and keeps its own session
afterwards, so disabling a user or revoking their sessions in the IdP
does not end their Pangolin sessions.
Store the IdP refresh token at OIDC login as a grant and redeem it at
most every server.idp_session_revalidation_minutes (default 5). If the
IdP rejects it with invalid_grant, the grant is marked revoked and all
sessions backed by it and their resource sessions are deleted. Other
errors (IdP unreachable or slower than 10 seconds, invalid_client after
a secret change) keep the sessions valid and are retried after at most
a minute instead of on every request.
Only the instance holding a lease on the grant in the primary database
redeems its refresh token, and it writes the result only while it still
holds the lease, so instances never redeem the same token concurrently.
The per-request lookup reads from a replica through safeRead.
Device logins of the Pangolin clients share the grant of the browser
session that approved them, read from the primary database, so a rotated
refresh token is never redeemed twice by separate sessions.
The Entra ID provider type hardcodes its scopes, so it now requests
offline_access to get a refresh token.
miloschwartz
Owen
Alex Castillo
Severin Enzler
Owen SchwartzandGitHub