indiepass-android
indiepass-android copied to clipboard
Initial support for refresh tokens
I made a crude start on #447. It roughly "Works For Me (TM)", but it has some problems:
- It only knows about IndieAuth. It doesn't support any of the other auth methods. This should be fixed; Mastodon is planning to add refresh tokens (https://github.com/mastodon/mastodon/issues/26838, https://github.com/mastodon/mastodon/pull/27948) though it probably won't happen quickly.
- If there's no
refresh_tokenthen ideally we should send the user back through the OAuth flow from the beginning. I started looking at this, but this will mean rearranging AuthActivity.java so that the flow can be started by triggering an intent or something, rather than only when the user clicks on the "Sign In" button. - Calling into AccountManager from HTTPRequest.java feels like a bit of a layering violation. Is there a clearer way to structure things without too much refactoring?
- We could save a round-trip in many situations by paying attention to the token's
expires_invalue and refreshing automatically when we know it's expired, rather than relying on the server to tell us when we need to refresh. - Applying the new
TokenRetryPolicyto the requests thatAuthActivity.javaissues feels kind of circular. I don't think this will break anything, but I'm not entirely certain.