KTOR-9244 Update client auth and document provider selection#786
Open
KTOR-9244 Update client auth and document provider selection#786
Conversation
Contributor
WalkthroughAdded test dependencies and a new test verifying bearer token refresh behavior in the OAuth Google authentication example. Updated client authentication documentation across multiple topic files to improve organization, clarity, and provide standardized examples for bearer, basic, and digest authentication methods. Changes
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Possibly related PRs
Suggested reviewers
🚥 Pre-merge checks | ✅ 2 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (2 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches
🧪 Generate unit tests (beta)
📝 Coding Plan
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment Tip You can enable review details to help with troubleshooting, context usage and more.Enable the |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (2)
codeSnippets/snippets/client-auth-oauth-google/src/test/kotlin/ApplicationTest.kt (1)
44-58: Consider closing the HttpClient after use.While less critical for tests with
MockEngine, closing the client is good practice to demonstrate proper resource management in sample code.♻️ Suggested improvement
- val client = HttpClient(engine) { - install(Auth) { - bearer { - loadTokens { - BearerTokens("invalid", "refresh") - } - - refreshTokens { - BearerTokens("valid", "refresh") - } - } - } - } - val response = client.get("https://test.example") - assertEquals(HttpStatusCode.OK, response.status) + val client = HttpClient(engine) { + install(Auth) { + bearer { + loadTokens { + BearerTokens("invalid", "refresh") + } + + refreshTokens { + BearerTokens("valid", "refresh") + } + } + } + } + client.use { + val response = it.get("https://test.example") + assertEquals(HttpStatusCode.OK, response.status) + }🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@codeSnippets/snippets/client-auth-oauth-google/src/test/kotlin/ApplicationTest.kt` around lines 44 - 58, The HttpClient instance named client in the test is not closed; update the test to properly dispose of it after use by invoking client.close() or using the client's use/auto-close pattern around the request so HttpClient resources are released; locate the HttpClient(...) block and the subsequent client.get call and ensure the client is closed afterward (e.g., call client.close() or wrap client creation in a use scope).topics/client-auth.md (1)
174-176: Consider varying bullet sentence openings for smoother scanability.All three bullets start with “When”, which reads a bit repetitive.
✍️ Suggested wording tweak
-* When the user logs out. -* When credentials or tokens stored by your application change. -* When you need to force providers to reload the authentication state on the next request. +* After a user logs out. +* If credentials or tokens stored by your application change. +* To force providers to reload the authentication state on the next request.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@topics/client-auth.md` around lines 174 - 176, The three bullets ("When the user logs out.", "When credentials or tokens stored by your application change.", "When you need to force providers to reload the authentication state on the next request.") are repetitive because they all begin with "When"; reword them for variety and smoother scanning by changing sentence openings (e.g., "On user logout.", "If credentials or stored tokens change.", "To force providers to reload the auth state on the next request."). Update the three bullet lines in topics/client-auth.md accordingly while preserving their original meaning.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@topics/client-bearer-auth.md`:
- Around line 157-160: The step currently instructs creating an OAuth client of
type "Android" which is incorrect for a loopback redirect; update the sentence
that reads "Create an `OAuth client ID` with the `Android` application type" to
instruct creating an `OAuth client ID` with the "Desktop app" application type
and explicitly mention adding the loopback redirect URI (e.g.
http://127.0.0.1:8080) so the authorization grant flow referenced by the link
(`#step1`) works correctly.
---
Nitpick comments:
In
`@codeSnippets/snippets/client-auth-oauth-google/src/test/kotlin/ApplicationTest.kt`:
- Around line 44-58: The HttpClient instance named client in the test is not
closed; update the test to properly dispose of it after use by invoking
client.close() or using the client's use/auto-close pattern around the request
so HttpClient resources are released; locate the HttpClient(...) block and the
subsequent client.get call and ensure the client is closed afterward (e.g., call
client.close() or wrap client creation in a use scope).
In `@topics/client-auth.md`:
- Around line 174-176: The three bullets ("When the user logs out.", "When
credentials or tokens stored by your application change.", "When you need to
force providers to reload the authentication state on the next request.") are
repetitive because they all begin with "When"; reword them for variety and
smoother scanning by changing sentence openings (e.g., "On user logout.", "If
credentials or stored tokens change.", "To force providers to reload the auth
state on the next request."). Update the three bullet lines in
topics/client-auth.md accordingly while preserving their original meaning.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 2a0aeffe-b47d-4d6f-87a6-46cdc80e348f
📒 Files selected for processing (7)
codeSnippets/snippets/client-auth-oauth-google/build.gradle.ktscodeSnippets/snippets/client-auth-oauth-google/src/test/kotlin/ApplicationTest.kttopics/client-auth.mdtopics/client-basic-auth.mdtopics/client-bearer-auth.mdtopics/client-digest-auth.mdtopics/lib.topic
Comment on lines
+157
to
160
| 2. Open the [Google Cloud Console](https://console.cloud.google.com/apis/credentials) | ||
| 3. Create an `OAuth client ID` with the `Android` application type. You will use this client | ||
| ID to obtain an [authorization grant](#step1). | ||
|
|
Contributor
There was a problem hiding this comment.
🧩 Analysis chain
🌐 Web query:
For Google OAuth 2.0 with redirect_uri=http://127.0.0.1:8080 (loopback flow), which OAuth client type should be used in Google Cloud Console?
💡 Result:
Use an OAuth 2.0 Client ID of type “Desktop app” in Google Cloud Console for the loopback redirect URI flow (e.g., http://127.0.0.1:8080). [1]
Incorrect Google OAuth client type for loopback flow.
Lines 157–160 instruct creating an OAuth client with Android application type, but loopback redirect flows (http://127.0.0.1:8080) require a Desktop app client type. Using Android will cause setup failures.
Fix
-3. Create an `OAuth client ID` with the `Android` application type. You will use this client
-ID to obtain an [authorization grant](`#step1`).
+3. Create an `OAuth client ID` with the `Desktop app` application type. You will use this client
+ID to obtain an [authorization grant](`#step1`).📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
Suggested change
| 2. Open the [Google Cloud Console](https://console.cloud.google.com/apis/credentials) | |
| 3. Create an `OAuth client ID` with the `Android` application type. You will use this client | |
| ID to obtain an [authorization grant](#step1). | |
| 2. Open the [Google Cloud Console](https://console.cloud.google.com/apis/credentials) | |
| 3. Create an `OAuth client ID` with the `Desktop app` application type. You will use this client | |
| ID to obtain an [authorization grant](`#step1`). | |
🧰 Tools
🪛 markdownlint-cli2 (0.21.0)
[warning] 159-159: Link fragments should be valid
(MD051, link-fragments)
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@topics/client-bearer-auth.md` around lines 157 - 160, The step currently
instructs creating an OAuth client of type "Android" which is incorrect for a
loopback redirect; update the sentence that reads "Create an `OAuth client ID`
with the `Android` application type" to instruct creating an `OAuth client ID`
with the "Desktop app" application type and explicitly mention adding the
loopback redirect URI (e.g. http://127.0.0.1:8080) so the authorization grant
flow referenced by the link (`#step1`) works correctly.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description:
client-authandclient-bearer-auth.MockEngine.Relates issues:
KTOR-9244 Documentation for Auth/Bearer: Make BearerAuthProvider detect disguised Bearer scheme
KTOR-6591 MockEngine: Example of testing client with bearer auth
KTOR-8022 Show how to add dependencies in client auth topics
KTOR-8846 Document refreshTokens behavior in multiple parallel requests