fix: handle expired OAuth token on git push/pull (issue #14)

[HahaSula]

Summary

• Detect Authentication failed errors in push/pull routes and return { code: 'TOKEN_EXPIRED' } with HTTP 401
• Frontend shows a persistent notification with a direct link to /hub/home to restart the JupyterHub server
• Fix root cause: init container now updates the git remote URL with the fresh token on every server spawn (previously the old expired token remained in .git/config)
• New user branches are pushed to remote during init so pull works correctly after restart

Reproduction (local)

k8s/gitea-values.yaml sets ACCESS_TOKEN_EXPIRATION_TIME: 300 to simulate token expiry locally with Gitea instead of GitLab.

Test plan

• Login to JupyterHub, wait for token to expire, attempt Push → see "Session Expired" notification with restart link
• Click restart link → stop server → restart server → Push succeeds within expiry window
• New user: verify branch is created and pushed to remote on first spawn
• Pull works correctly after server restart

Closes #14

🤖 Generated with Claude Code

Summary by CodeRabbit

• New Features

  • Improved Git push/pull feedback with a clear “Session Expired” notification and a direct re-authentication link when access tokens expire.
  • Single-user environments now include explicit GitLab connection details and automatically publish newly created branches during initialization.

• Bug Fixes

  • Git push and pull failures now distinguish expired credentials from other errors, returning a clearer authentication-needed response.
  • Existing workspaces now refresh their Git remote setup instead of skipping initialization when credentials change.

[rophy]

PR Preview Bot

Preview environment failed to start.

...(truncated)
#21 sending tarball
#21 sending tarball 1.4s done
#21 DONE 1.8s

#22 [app] importing to docker
#22 loading layer 0e500304ab5c 446.25kB / 446.25kB 0.2s done
#22 loading layer 661eef84f9ec 1.40kB / 1.40kB 0.1s done
#22 loading layer ad35371b7416 7.37kB / 7.37kB 0.1s done
#22 loading layer 6b3b08ce25e6 3.25kB / 3.25kB 0.1s done
#22 loading layer 33e4a5e0343a 336B / 336B 0.1s done
#22 DONE 0.2s

#23 [app] resolving provenance for metadata file
#23 DONE 0.0s
 app  Built
 Container null-ptr-exception-rulemgmt-pr-32-app-1  Recreate
 Container null-ptr-exception-rulemgmt-pr-32-app-1  Recreated
 Container null-ptr-exception-rulemgmt-pr-32-app-1  Starting
Error response from daemon: failed to set up container networking: driver failed programming external connectivity on endpoint null-ptr-exception-rulemgmt-pr-32-app-1 (da82d38c4a81c805332ee1e97ca32fbb653daab0abbf81222991d9f2f2b10535): Bind for 127.0.0.1:12101 failed: port is already allocated

[coderabbitai]

Warning

Review limit reached

@HahaSula, we couldn't start this review because you've reached your PR review rate limit.

More reviews will be available in 9 minutes and 11 seconds. Learn how PR review limits work.

Your organization has used up its prepaid credits, and credit purchases are no longer available. Enable the review add-on in the billing tab to keep reviews running — you're only billed for reviews past your plan's rate limits ($0.25/file).

⌛ How to resolve this issue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based credits.

🚦 How do rate limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please see our Fair Usage Limits Policy for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 354bda81-511c-47e9-a4cc-e39845dc4ac0

📥 Commits

Reviewing files that changed from the base of the PR and between 8be6f39 and 1f22c05.

📒 Files selected for processing (3)

• k8s/jupyterhub-values.yaml
• server/routes/git.js
• src/components/GitPanel.jsx

📝 Walkthrough

Walkthrough

The PR shortens Gitea OAuth token lifetime, updates the singleuser GitLab init flow, returns TOKEN_EXPIRED for auth-related push/pull failures, and shows a session-expired notification in the Git panel.

Changes

GitLab OAuth token expiry handling

Layer / File(s)	Summary
Token lifetime config k8s/gitea-values.yaml	gitea.config.oauth2.ACCESS_TOKEN_EXPIRATION_TIME is set to 300.
Singleuser git bootstrap k8s/jupyterhub-values.yaml	Singleuser env gains GITLAB_HOST and GITLAB_PROJECT, and the initContainer updates the git remote URL, safe-directory handling, REPO_URL scheme, and user-branch push step.
Expired-auth API responses server/routes/git.js	POST /push and POST /pull classify auth-related git errors with isAuthError(err) and return HTTP 401 with TOKEN_EXPIRED.
Session-expired notification src/components/GitPanel.jsx	GitPanel imports notification, adds showTokenExpired(), and switches push/pull TOKEN_EXPIRED responses to the session-expired notification.

Sequence Diagram(s)

sequenceDiagram
  participant User
  participant GitPanel
  participant GitRoute as server/routes/git.js
  participant AntdNotification as antd.notification
  User->>GitPanel: click Push or Pull
  GitPanel->>GitRoute: POST /push or POST /pull
  GitRoute-->>GitPanel: 401 { code: TOKEN_EXPIRED }
  GitPanel->>AntdNotification: showTokenExpired()

Loading

Estimated code review effort

🎯 4 (Complex) | ⏱️ ~45 minutes

Poem

🐇 I hopped through tokens, soft and new,
and sniffed the 401s in view.
A whisker twitch, a bell of light—
“Session expired? Hop again right!”
Git carrots bloomed in moonlit dew.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main change: handling expired OAuth tokens on git push/pull.
Linked Issues check	✅ Passed	The changes address expired token handling end-to-end and match the issue's restart-based recovery flow.
Out of Scope Changes check	✅ Passed	All touched files support the token-expiry fix or local reproduction; no unrelated changes are evident.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/token-expired-handling

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 4

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@k8s/jupyterhub-values.yaml`:
- Around line 115-120: The existing-workspace early-exit path in the JupyterHub
startup script only refreshes the remote URL and skips the new branch backfill
logic. Update this branch of the initialization flow so that, after resetting
the origin in the existing workspace path, it also ensures the user branch is
present on the remote by performing the same push/backfill behavior as the
normal initialization path, using the same branch and repo variables already
referenced there.

In `@server/routes/git.js`:
- Around line 98-100: The auth error response in git routes is leaking raw git
stderr via err.message, which can include the embedded remote URL and token.
Update the isAuthError branch in the git route handler to return a generic 401
message while preserving the stable TOKEN_EXPIRED code, and apply the same
change in the matching auth-error response path referenced by the other
occurrence.
- Around line 226-229: The isAuthError helper in git route handling is too broad
because it treats every 403 as an authentication expiration, which can mislabel
normal permission failures. Update isAuthError to keep the existing auth-related
message checks and 401 handling, but remove the generic 403 match so the push
route’s denied/permission branch can handle those cases correctly.

In `@src/components/GitPanel.jsx`:
- Around line 50-64: The persistent token-expired notice in showTokenExpired is
stacking because each call creates a new Ant Design notification with duration:
0. Update the notification.error call to use a stable key so repeated push/pull
failures reuse the same “Session Expired” notification instead of adding
duplicates. Locate the change in GitPanel and keep the existing
message/description behavior intact.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 26086c78-9d98-4cfe-9b3d-3eceb64678d5

📥 Commits

Reviewing files that changed from the base of the PR and between b1dae30 and 8be6f39.

📒 Files selected for processing (4)

• k8s/gitea-values.yaml
• k8s/jupyterhub-values.yaml
• server/routes/git.js
• src/components/GitPanel.jsx