Skip to content

feat: remove the VS Code Auth provider in favor of custom OAuth flow

Problem this is solving

The OAuth authentication (and only the OAuth authentication) uses the vscode.authentication API. So when you log in to gitlab.com using OAuth, your account shows in the "Account menu" in VS Code:

image

However, if you add PAT account, this menu is not used. So some accounts show in that menu and some don't.

We will eventually add support for PAT accounts to our Authentication provider, but until we do, we stop using it.

Description

This MR deprecates the current implementation of VS Code Authentication in favour of our OAuth flow. This streamlines and unifies the account management behaviour.

This MR is mainly a refactoring. The only user-facing change is that the user is not prompted to "trust" the GitLab Workflow Extension during OAuth flow because we don't create the account through vscode.authentication API.

In other words, you won't see this anymore:

image

Notes for reviewers

This MR should be reviewed commit-by-commit

Most of the code is copy pasted from the gitlab_authentication_provider.ts and token_refresh_service.ts into the oauth_flow.ts. I almost didn't touch it otherwise.

Related Issues

Resolves Streamline VS Code authentication (#1379 - closed)

How has this been tested?

Backwards compatibility

Old OAuth accounts still work

  1. Don't start the development extension host yet
  2. If you don't have OAuth account for gitlab.com, create one.
  3. Start the development extension host
  4. See that the extension still works and is authenticated
    • For example, you can see the open issues in the side tree

Old OAuth accounts can be removed using the "Account menu"

  1. Start the extension development host
  2. Remove the existing OAuth account using the account menu

image

OAuth still works

  1. Start the extension development host
  2. Remove all accounts
  3. Run GitLab: Authenticate command
  4. select https://gitlab.com and use OAuth flow
  5. See that account was successfully created

Token refresh still works

  1. Apply the following patch that will cause OAuth token refresh every 30s

    diff --git a/src/desktop/gitlab/token_exchange_service.ts b/src/desktop/gitlab/token_exchange_service.ts
    index 22976828..dfa17c16 100644
    --- a/src/desktop/gitlab/token_exchange_service.ts
    +++ b/src/desktop/gitlab/token_exchange_service.ts
    @@ -15,7 +15,7 @@ import { createExpiresTimestamp, GitLabService } from './gitlab_service';
     
       Note: change this value to 7170 to simulate token expiration every 30s
     */
    -const SMALL_GRACE_DURATION_JUST_TO_BE_SURE = 40;
    +const SMALL_GRACE_DURATION_JUST_TO_BE_SURE = 7170;
     
     const needsRefresh = (account: Account) => {
       if (account.type === 'token') return false;
  2. Start the extension, wait for 30s, refresh the side tree with issues

  3. See that the refresh happened successfully.

Screenshots (if appropriate)

oauth-refactor

What CHANGELOG entry will this MR create?

  • fix: Bug fix fixes - a user-facing issue in production - included in changelog
  • feature: New feature - a user-facing change which adds functionality - included in changelog
  • BREAKING CHANGE: (fix or feature that would cause existing functionality to change) - should bump major version, mentioned in the changelog
  • None - other non-user-facing changes
Edited by Tomas Vik (OOO back on 2026-01-05)

Merge request reports

Loading