Adds a mobile token provider to the SDK #123
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,50 @@ | ||
| package com.chargebee.android.network | ||
|
|
||
| import com.chargebee.android.Chargebee | ||
| import okhttp3.Authenticator | ||
| import okhttp3.Request | ||
| import okhttp3.Response | ||
| import okhttp3.Route | ||
| import java.util.concurrent.CountDownLatch | ||
| import java.util.concurrent.TimeUnit | ||
|
|
||
| /** | ||
| * Handles expired/revoked mobile tokens: when a request authenticated with a mobile token comes back | ||
| * 401, a fresh token is fetched from the provider and the request is retried once | ||
| * with it. Requests that do not use a mobile token (no provider configured) are left untouched. | ||
| */ | ||
| internal class MobileTokenAuthenticator : Authenticator { | ||
|
|
||
| override fun authenticate(route: Route?, response: Response): Request? { | ||
| if (Chargebee.tokenProvider == null) { | ||
| return null | ||
| } | ||
| // Retry only once: a non-null priorResponse means we already refreshed and retried. | ||
| if (response.priorResponse() != null) { | ||
| return null | ||
| } | ||
| val refreshedHeader = refreshTokenBlocking() ?: return null | ||
| return response.request().newBuilder() | ||
| .header("Authorization", refreshedHeader) | ||
| .build() | ||
|
Comment on lines
+22
to
+29
There was a problem hiding this comment. 🎯 Functional Correctness | 🟠 Major | ⚡ Quick win 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -eu
printf '%s\n' '--- candidate file ---'
fd -i 'MobileTokenAuthenticator.kt' . -x sh -c 'cat -n "$1"' sh {}
printf '%s\n' '--- OkHttp declarations and authenticator usage ---'
rg -n -S 'okhttp|Authenticator|MobileTokenAuthenticator|priorResponse|refreshTokenBlocking' \
-g '!build' -g '!**/node_modules/**' .
printf '%s\n' '--- relevant dependency files ---'
fd -i '(build.gradle|build.gradle.kts|libs.versions.toml|gradle.properties|pom.xml)' . -x sh -c '
if rg -n -i "okhttp|com.squareup.okhttp" "$1" >/dev/null; then
echo "### $1"
rg -n -i -C 2 "okhttp|com.squareup.okhttp" "$1"
fi
' sh {}Repository: chargebee/chargebee-android Length of output: 4446 🏁 Script executed: #!/bin/bash
set -eu
printf '%s\n' '--- project files related to dependencies ---'
git ls-files | rg '(^|/)(build\.gradle(\.kts)?|settings\.gradle(\.kts)?|libs\.versions\.toml|gradle\.properties|pom\.xml)$|(^|/)gradle/'
printf '%s\n' '--- dependency declarations ---'
rg -n -i -C 3 'okhttp|com\.squareup\.okhttp|com\.squareup\.okhttp3' \
$(git ls-files | rg '(^|/)(build\.gradle(\.kts)?|settings\.gradle(\.kts)?|libs\.versions\.toml|gradle\.properties|pom\.xml)$') || true
printf '%s\n' '--- client construction ---'
cat -n chargebee/src/main/java/com/chargebee/android/resources/BaseResource.ktRepository: chargebee/chargebee-android Length of output: 1613 🏁 Script executed: #!/bin/bash
set -eu
printf '%s\n' '--- root build configuration ---'
cat -n build.gradle
printf '%s\n' '--- chargebee module build configuration ---'
cat -n chargebee/build.gradle
printf '%s\n' '--- settings and properties ---'
cat -n settings.gradle
cat -n gradle.properties
printf '%s\n' '--- tests and mocks related to authentication or redirects ---'
rg -n -i -C 4 'MobileTokenAuthenticator|authenticator|401|redirect|tokenProvider|refreshMobileToken' \
chargebee app -g '*Test*' -g '*test*' -g '*.kt' -g '*.java' || trueRepository: chargebee/chargebee-android Length of output: 21784 🌐 Web query:
💡 Result: In OkHttp, the Response.priorResponse property and the Authenticator interface are key components for handling authentication challenges (such as 401 Unauthorized or 407 Proxy Authentication Required) within the RetryAndFollowUpInterceptor [1][2][3]. 1. Response.priorResponse The priorResponse property returns the previous response that triggered the current request (e.g., a 401 challenge) [1][4]. If the current request was not triggered by an automatic retry, this returns null [1]. This property is primarily used to detect previous attempts to authenticate or follow redirects, helping prevent infinite request-response loops [2][5]. 2. Authenticator and 401 Handling When a server returns a 401 (Unauthorized) status code, OkHttp calls the registered Authenticator implementation [2][6]. The authenticator is responsible for providing a new request with the appropriate "Authorization" header or returning null to decline the challenge [2][7]. To prevent infinite loops when credentials are invalid or expired, the standard practice is to check the current request's headers before attempting to re-authenticate [2][7][8]. If the request already contains an "Authorization" header, the authenticator should return null [2][8]. 3. RetryAndFollowUpInterceptor This internal interceptor is responsible for coordinating redirects, retries, and authentication challenges [9][3][6]. When it receives a 401 response, it calls the Authenticator [3][6]. If the authenticator returns a new, non-null request, the interceptor retries the call with this new request [3][6]. 4. Detecting Attempt Counts If you need to limit the number of authentication retries, you can calculate the current attempt count by traversing the chain of prior responses [2][5]. The following common pattern is used for this purpose: private fun responseCount(response: Response): Int { var result = 1 var prior = response.priorResponse while (prior!= null) { result++ prior = prior.priorResponse } return result } By checking this count or simply verifying if an "Authorization" header is already present, you can safely abort authentication attempts if they are not successful [2][7][8]. Citations:
🏁 Script executed: #!/bin/bash
set -eu
printf '%s\n' '--- Retrofit 2.9.0 resolved OkHttp dependency ---'
curl -fsSL https://repo1.maven.org/maven2/com/squareup/retrofit2/retrofit/2.9.0/retrofit-2.9.0.pom |
sed -n '/<artifactId>okhttp<\/artifactId>/,/<\/dependency>/p'
printf '%s\n' '--- OkHttp 3.14.9 redirect and authentication response-chain logic ---'
curl -fsSL https://raw.githubusercontent.com/square/okhttp/okhttp_3.14.x/okhttp/src/main/java/okhttp3/internal/http/RetryAndFollowUpInterceptor.java |
rg -n -C 5 'priorResponse|followUpRequest|followRedirects|401|Authenticator'
printf '%s\n' '--- behavioral probe for the guard ---'
python3 - <<'PY'
class Response:
def __init__(self, code, prior=None):
self.code = code
self.prior = prior
def authenticate(response, provider_configured=True):
if not provider_configured:
return None
if response.prior is not None:
return None
return "retry-with-refreshed-header"
cases = {
"direct 401": Response(401),
"redirect then 401": Response(401, Response(302)),
"redirect chain then 401": Response(401, Response(302, Response(301))),
}
for name, response in cases.items():
print(f"{name}: {authenticate(response)!r}")
PYRepository: chargebee/chargebee-android Length of output: 4553 Track this authenticator’s retry separately from When OkHttp follows a redirect before returning 401, 🤖 Prompt for AI AgentsSource: Path instructions |
||
| } | ||
|
|
||
| // The token provider is asynchronous while the authenticator runs synchronously on OkHttp's | ||
| // background thread, so we bridge the callback with a short-lived latch. | ||
| private fun refreshTokenBlocking(): String? { | ||
| val latch = CountDownLatch(1) | ||
| var refreshedHeader: String? = null | ||
| Chargebee.refreshMobileToken { success -> | ||
| if (success) { | ||
| refreshedHeader = Chargebee.encodedApiKey | ||
| } | ||
| latch.countDown() | ||
| } | ||
| latch.await(TOKEN_REFRESH_TIMEOUT_SECONDS, TimeUnit.SECONDS) | ||
| return refreshedHeader | ||
| } | ||
|
|
||
| private companion object { | ||
| private const val TOKEN_REFRESH_TIMEOUT_SECONDS = 30L | ||
| } | ||
| } | ||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🎯 Functional Correctness | 🟠 Major | 🏗️ Heavy lift
Make the mobile-token example functional before merge.
fetchMobileTokenalways returns a placeholder token. Any request usingconfigureWithMobileToken()will fail authentication, including the one-time refresh retry. The visible Configure flow still usespublishableApiKey, so the new path is not integrated into the example. Replace the placeholder with an asynchronous backend request and invoke this configuration path from the example flow.As per path instructions, this is a functionality-breaking issue that must be resolved before merge.
🤖 Prompt for AI Agents
Source: Path instructions