[dev] [Marfuen] mariano/gcp-refresh

[github-actions]

This is an automated pull request to merge mariano/gcp-refresh into dev.
It was created by the [Auto Pull Request] action.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

2 Skipped Deployments

Project	Deployment	Preview	Comments	Updated (UTC)
app	Skipped			Dec 11, 2025 5:02pm
portal	Skipped			Dec 11, 2025 5:02pm

[cursor]

PR Summary

Improves OAuth token handling by checking refresh needs, obtaining a valid access token, adding detailed logs, and failing fast on missing tokens during cloud security scans.

• Backend
  • Cloud Security (apps/api/src/cloud-security/cloud-security.service.ts)
    • OAuth token management:
      • Check needsRefresh via credentialVaultService.needsRefresh and log result.
      • Acquire valid token with getValidAccessToken (supports refresh); error-log and return failure if unavailable.
      • Log whether a refreshed or existing token is used.
      • Update decrypted credentials with fresh access_token before scanning.
    • Error handling/logging: More explicit logs for token retrieval failures.

^{Written by Cursor Bugbot for commit 886f5ff. This will update automatically on new commits. Configure here.}

[graphite-app]

Graphite Automations

"Auto-assign PRs to Author" took an action on this PR • (12/11/25)

1 reviewer was added to this PR based on Mariano Fuentes's automation.

[cursor]

Bug: Misleading log message after failed token refresh

The log message uses the needsRefresh variable captured earlier to determine whether to say "refreshed" or "existing" token. However, getValidAccessToken can fail to refresh and fall back to returning the existing token. In this case, needsRefresh would be true but the actual token returned is the existing (not refreshed) one. The log would incorrectly say "Using refreshed access token" when it's actually the existing potentially-expiring token.