[23.1] Renew access tokens from PSA using valid refresh tokens

[kysrpex]

Method PSAAuthnz.refresh() from psa_authnz.py holds its promise to refresh tokens only if they reached their half lifetime. However, that does not exclude expired tokens. Add an extra comparison to exclude expired refresh tokens.

This fix gets rid of this kind of error: Apr 17 15:54:53 sn06.galaxyproject.eu gunicorn[2716973]: requests.exceptions.HTTPError: 401 Client Error: 401 for url: https://login.elixir-czech.org/oidc/token.

How to test the changes?

(Select all options that apply)

• I've included appropriate automated tests.
• This is a refactoring of components with existing test coverage.
• Instructions for manual testing are as follows:
  1. [add testing steps and prerequisites here if you didn't write automated tests covering all your changes]

License

• I agree to license these and all my past contributions to the core galaxy codebase under the MIT license.

[kysrpex]

@bgruening this fixes some (not all) LS-AAI errors.

[bgruening]

@kysrpex thanks a lot.

@martenson ping ...

[martenson]

The tokens I am getting have e.g. "exp": 1739534619 so the operation you are doing here will compare to year ~2080. I think you just need the expiration time here.

[kysrpex]

That's confusing. In the database (table oidc_user_authnz_tokens), I have tokens with provider in ('elixir', 'egi-checkin') (those are the only providers) and their extra_data looks like this.

{
  "access_token": "************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************",
  "auth_time": 1738768462,
  "expires_in": 3600,
  "id_token": "**************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************",
  "refresh_token": "*************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************",
  "token_type": "Bearer"
}

Don't the tokens you are referring to come from table custos_authnz_token? Those indeed seem to use an expiration timestamp (rather than an increment that has to be added to a timestamp).

[martenson]

@kysrpex ugh, that is a disastrous split on how to handle this. :/

Maybe just my tokens (which are indeed from custos_authnz_token) are different, however on L174 you are checking for expires in addition to expires_in though -- could these two have different handling even in the same codepath?

[martenson]

if the expires is "seconds to expire from issue time" then this comparison is broken I think