From 01f831700ab50b5a1d3dba9d99f50378a52b95bf Mon Sep 17 00:00:00 2001 From: Steven Lee Date: Tue, 7 Jul 2026 22:46:59 +0000 Subject: [PATCH] Use resolved store operations in refresh transaction --- codex-rs/rmcp-client/src/oauth/refresh_transaction.rs | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/codex-rs/rmcp-client/src/oauth/refresh_transaction.rs b/codex-rs/rmcp-client/src/oauth/refresh_transaction.rs index 275dbb601e..9a656ed3cf 100644 --- a/codex-rs/rmcp-client/src/oauth/refresh_transaction.rs +++ b/codex-rs/rmcp-client/src/oauth/refresh_transaction.rs @@ -24,9 +24,7 @@ use super::OAuthPersistorInner; use super::StoredOAuthTokens; use super::WrappedOAuthTokenResponse; use super::compute_expires_at_millis; -use super::load_oauth_tokens_from_store; use super::refresh_lock::RefreshCredentialLock; -use super::save_to_resolved_store; use super::token_needs_refresh; const REFRESH_REQUEST_TIMEOUT: Duration = Duration::from_secs(45); @@ -111,11 +109,10 @@ impl OAuthPersistor { // Stay on the lifecycle-pinned store. A failure is surfaced rather than falling back and // possibly replaying an older rotating refresh token from the other store. debug!("rereading authoritative MCP OAuth credentials"); - let latest = load_oauth_tokens_from_store( + let latest = self.inner.credential_store.load( keyring_store, &self.inner.server_name, &self.inner.url, - self.inner.credential_store, )?; // The pre-lock snapshot is only a hint. This locked reread is authoritative, so adopt a @@ -229,7 +226,11 @@ impl OAuthPersistor { // TODO: Add a bounded persistence retry only if telemetry shows this is common; never // silently switch stores or continue with an unpersisted credential. debug!("persisting refreshed MCP OAuth credentials to the resolved store"); - if let Err(error) = save_to_resolved_store(keyring_store, &self.inner, &refreshed) { + if let Err(error) = + self.inner + .credential_store + .save(keyring_store, &self.inner.server_name, &refreshed) + { warn!( error = %error, "failed to persist refreshed MCP OAuth credentials; returning the error and restoring the previous in-process credentials"