scala-oauth2-provider

scala-oauth2-provider copied to clipboard

Since expiresIn is calculated at the moment of AccessToken creation (https://github.com/nulab/scala-oauth2-provider/pull/107), it remains the same no matter how many times it has been requested. Also, since it is apparently non-negative at the moment of creation, AccessToken#isExpired method will never return true, which renders GrantHandler#shouldRefreshAccessToken and corresponding branch in GrantHandler#issueAccessToken useless.

Wouldn't it be better if expiresIn was recalculated upon each request? Shouldn't the expiration date/time be immutable, not the time until expiration?

We expect that AccessToken use only one instance for one request coming.

The access token is created when user authorize via OAuth server first. With the created access token, expiresIn is evaluated when calling the API in a request, so that AccessToken#isExpired can call true.

If AccessToken has to be reissued upon each request, what's the use of methods such as getStoredAccessToken or even the logic to refresh it? Just send a new request and get a new token every time.

My understanding was different. I assumed that created AccessToken remains valid and is returned for all requests until it expires, so there is no need to reissue it until then.

Also, I don't see how expiresIn can evaluate to false. It is eagerly evaluated in AccessToken constructor when createAccessToken is called, and the only way it can be expired at the same moment is if you provide a negative lifeSeconds which is not a valid use case anyway.

If AccessToken has to be reissued upon each request, what's the use of methods such as getStoredAccessToken or even the logic to refresh it?

We expect that getStoredAccessToken is used for cache on your datastore.

I assumed that created AccessToken remains valid and is returned for all requests until it expires, so there is no need to reissue it until then.

So you can return cached access token from datastore until access token expires by getStoredAccessToken. You just return None on the method if you want to create new access token everytime.

I don't see how expiresIn can evaluate to false. It is eagerly evaluated in AccessToken constructor when createAccessToken is called,

By saving and getting the access token created time in the datastore, you should be able to specify lifeSeconds and take expiresIn to false.

I made a sample code before. I hope it help you. https://github.com/tsuyoshizawa/scala-oauth2-provider-example-skinny-orm/blob/master/app/controllers/OAuthController.scala

you can return cached access token

But when you return this cached access token, it will have expiresIn from the time it was first calculated, i.e. when it was created! That was my point. When I retrieve access token from cache, I expect to see actual time until expiration.