Repository navigation
fix(115_open): refresh expired OSS credentials during upload - #3063
Conversation
- Refresh OSS credentials and retry the rejected multipart operation - Preserve upload IDs, completed parts, callbacks, and outer part retries - Rewind parts before resending and pass the upload context to OSS requests Co-authored-by: Codex <267193182+codex@users.noreply.github.com>
f986a05 to
ab23d1f
Compare
There was a problem hiding this comment.
🔵 Needs a closer look
Credential-refresh and multipart retry behavior is safety-sensitive, and real expiry scenarios were not verified.
Pull request overview
Refreshes expired OSS credentials during 115 Open multipart uploads while preserving upload state.
Changes:
- Refreshes credentials on expiration and retries multipart operations.
- Rewinds parts before retrying.
- Preserves upload IDs, completed parts, and callbacks.
File summaries
| File | Description |
|---|---|
drivers/115_open/upload.go |
Implements credential refresh and targeted multipart retries. |
Review details
- Files reviewed: 1/1 changed files
- Comments generated: 0
- Review effort level: Lite
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
|
Thanks for the fix. I noticed a possible remaining credential-expiration case in Alibaba Cloud's official Chinese OSS documentation, under InvalidAccessKeyId → "The OSS Access Key Id you provided does not exist in our records", identifies expired and invalidated temporary credentials as the cause. Its recommended solution is to obtain new temporary credentials. My earlier PR #2575 documented Could this STS upload path also perform a bounded credential refresh and retry for the expiration-related |
|
Please reference this in a new issue. |
Summary / 摘要
Long-running 115 Open uploads fail when OSS credentials expire because retries keep using the original credentials. Refresh credentials on
SecurityTokenExpiredand retry the rejected multipart initiation, part upload, or completion once, preserving the upload ID, completed parts, and callbacks.Part uploads retain their three outer attempts; each can make one additional attempt after refreshing expired credentials. Rewind the current part before resending it and pass the upload context to OSS requests. This PR changes only
drivers/115_open/upload.go.Related repository PRs / 关联仓库 PR: None.
Related Issues / 关联 Issue
Fixes #1376
Testing / 测试
Linux amd64, Go 1.27.1 in Docker:
go test -tags=jsoniter ./drivers/115_open -count=1passed with local, untracked tests. Those tests are not included in this PR. They exercise credential replacement and retries for multipart initiation, part upload, and completion, plus non-expiration errors and refresh failures.git diff --checkpassed./pingand frontend checks passed. The image was not rebuilt after that refactor.TestNewOSSClientUsesEnvironmentHTTPSProxy, fails because it expects*http.Transportbut receives*net.safeTransport. This was also reproduced on the unmodified base checkout.go test ./...— not run; validation focused on the affected driver and related network package.Checklist / 检查清单
gofmt,go fmt, orprettierwhere applicable.AI Disclosure / AI 使用声明
Tools used / 使用工具:
Usage scope / 使用范围:
Code generation / 代码生成
Refactoring / 重构
Documentation / 文档 — commit and PR descriptions
Tests / 测试 — local validation only; test files are not included
Review assistance / 审查辅助
I have reviewed and validated all AI-assisted content included in this PR.
I have ensured that all AI-assisted commits include
Co-Authored-Byattribution.I can reproduce all AI-assisted content included in this PR without any AI tools.
Codex implemented the change and performed the validation described above at the contributor's request. Human attestations not established during this work remain unchecked.