Handle refresh token rotation

sdk/src/main/java/com/oursky/authgear/AuthgearCore.kt

@@ -34,6 +34,7 @@ import kotlinx.serialization.json.booleanOrNull
 import kotlinx.serialization.json.jsonPrimitive
 import kotlinx.serialization.json.longOrNull
 import java.lang.RuntimeException
+import java.lang.ref.WeakReference
 import java.net.URLEncoder
 import java.nio.charset.StandardCharsets
 import java.security.KeyPair
@@ -117,11 +118,13 @@ internal class AuthgearCore(
         storage,
         oauthRepo,
         keyRepo,
-        assetLinkRepo
+        assetLinkRepo,
+        tokenStorage
     )
 
     init {
         oauthRepo.endpoint = authgearEndpoint
+        app2app.authgearCore = WeakReference(this)
 
         if (app2AppOptions.isEnabled) {
             requireMinimumApp2AppAPILevel()
@@ -270,7 +273,11 @@ internal class AuthgearCore(
 
         val token: String
         try {
-            token = oauthRepo.oauthAppSessionToken(refreshToken).appSessionToken
+            val response = oauthRepo.oauthAppSessionToken(refreshToken)
+            response.refreshToken?.let {
+                this.updateRefreshToken(response.refreshToken)
+            }
+            token = response.appSessionToken
         } catch (e: Exception) {
             handleInvalidGrantError(e)
             throw e
@@ -399,7 +406,11 @@ internal class AuthgearCore(
 
         val token: String
         try {
-            token = oauthRepo.oauthAppSessionToken(refreshToken).appSessionToken
+            val response = oauthRepo.oauthAppSessionToken(refreshToken)
+            response.refreshToken?.let {
+                this.updateRefreshToken(response.refreshToken)
+            }
+            token = response.appSessionToken
         } catch (e: Exception) {
             handleInvalidGrantError(e)
             throw e
@@ -679,13 +690,13 @@ internal class AuthgearCore(
     }
 
     private fun saveToken(tokenResponse: OidcTokenResponse, reason: SessionStateChangeReason) {
+        if (tokenResponse.refreshToken != null) {
+            updateRefreshToken(tokenResponse.refreshToken)
+        }
         synchronized(this) {
             if (tokenResponse.accessToken != null) {
                 accessToken = tokenResponse.accessToken
             }
-            if (tokenResponse.refreshToken != null) {
-                refreshToken = tokenResponse.refreshToken
-            }
             if (tokenResponse.idToken != null) {
                 idToken = tokenResponse.idToken
             }
@@ -695,12 +706,8 @@ internal class AuthgearCore(
             }
             updateSessionState(SessionState.AUTHENTICATED, reason)
         }
-        val refreshToken = this.refreshToken
         val idToken = this.idToken
         val deviceSecret = tokenResponse.deviceSecret
-        if (refreshToken != null) {
-            tokenStorage.setRefreshToken(name, refreshToken)
-        }
         if (idToken != null) {
             sharedStorage.setIDToken(name, idToken)
         }
@@ -709,6 +716,16 @@ internal class AuthgearCore(
         }
     }
 
+    internal fun updateRefreshToken(refreshToken: String) {
+        tokenStorage.setRefreshToken(name, refreshToken)
+        synchronized(this) {
+            this.refreshToken = refreshToken
+            // We should invalidate the existing access token whenever we got a new refresh token
+            this.accessToken = null
+            this.expireAt = null
+        }
+    }
+
     internal fun clearSession(changeReason: SessionStateChangeReason) {
         tokenStorage.deleteRefreshToken(name)
         sharedStorage.onLogout(name)

sdk/src/main/java/com/oursky/authgear/app2app/App2App.kt

@@ -25,15 +25,19 @@ import java.time.Instant
 import java.util.*
 import kotlin.coroutines.resume
 import kotlin.coroutines.suspendCoroutine
+import java.lang.ref.WeakReference
 
 internal class App2App(
     private val application: Application,
     private val namespace: String,
     private val storage: ContainerStorage,
     private val oauthRepo: OAuthRepo,
     private val keyRepo: KeyRepo,
-    private val assetLinkRepo: AssetLinkRepo
+    private val assetLinkRepo: AssetLinkRepo,
+    private val tokenStorage: TokenStorage
 ) {
+    var authgearCore = WeakReference<AuthgearCore>(null)
+
     companion object {
         internal fun makeSignature(privateKey: PrivateKey): Signature {
             val signature = Signature.getInstance("SHA256withRSA")
@@ -164,6 +168,9 @@ internal class App2App(
                 codeChallengeMethod = AuthgearCore.CODE_CHALLENGE_METHOD
             )
         )
+        tokenResponse.refreshToken?.let {
+            this.authgearCore.get()?.updateRefreshToken(tokenResponse.refreshToken)
+        }
         val query = hashMapOf(
             "code" to tokenResponse.code!!
         )

sdk/src/main/java/com/oursky/authgear/oauth/AppSessionTokenResponse.kt

@@ -8,5 +8,7 @@ internal data class AppSessionTokenResponse(
     @SerialName("app_session_token")
     val appSessionToken: String,
     @SerialName("expire_at")
-    val expireAt: String
+    val expireAt: String,
+    @SerialName("refresh_token")
+    val refreshToken: String? = null
 )