Auth: Refresh OAuth access_token automatically using the refresh_token (#56076)

* Verify OAuth token expiration for oauth users in the ctx handler middleware

* Use refresh token to get a new access token

* Refactor oauth_token.go

* Add tests for the middleware changes

* Align other tests

* Add tests, wip

* Add more tests

* Add InvalidateOAuthTokens method

* Fix ExpiryDate update to default

* Invalidate OAuth tokens during logout

* Improve logout

* Add more comments

* Cleanup

* Fix import order

* Add error to HasOAuthEntry return values

* add dev debug logs

* Fix tests

Co-authored-by: jguer <joao.guerreiro@grafana.com>

pkg/services/auth/testing.go

@@ -3,9 +3,12 @@ package auth
 import (
 	"context"
 	"net"
+	"time"
 
 	"github.com/grafana/grafana/pkg/models"
+	"github.com/grafana/grafana/pkg/services/datasources"
 	"github.com/grafana/grafana/pkg/services/user"
+	"golang.org/x/oauth2"
 )
 
 type FakeUserAuthTokenService struct {
@@ -105,3 +108,46 @@ func (s *FakeUserAuthTokenService) GetUserRevokedTokens(ctx context.Context, use
 func (s *FakeUserAuthTokenService) BatchRevokeAllUserTokens(ctx context.Context, userIds []int64) error {
 	return s.BatchRevokedTokenProvider(ctx, userIds)
 }
+
+type FakeOAuthTokenService struct {
+	passThruEnabled  bool
+	ExpectedAuthUser *models.UserAuth
+	ExpectedErrors   map[string]error
+}
+
+func (ts *FakeOAuthTokenService) GetCurrentOAuthToken(context.Context, *user.SignedInUser) *oauth2.Token {
+	return &oauth2.Token{
+		AccessToken:  ts.ExpectedAuthUser.OAuthAccessToken,
+		RefreshToken: ts.ExpectedAuthUser.OAuthRefreshToken,
+		Expiry:       ts.ExpectedAuthUser.OAuthExpiry,
+		TokenType:    ts.ExpectedAuthUser.OAuthTokenType,
+	}
+}
+
+func (ts *FakeOAuthTokenService) IsOAuthPassThruEnabled(*datasources.DataSource) bool {
+	return ts.passThruEnabled
+}
+
+func (ts *FakeOAuthTokenService) HasOAuthEntry(context.Context, *user.SignedInUser) (*models.UserAuth, bool, error) {
+	if ts.ExpectedAuthUser != nil {
+		return ts.ExpectedAuthUser, true, nil
+	}
+	if error, ok := ts.ExpectedErrors["HasOAuthEntry"]; ok {
+		return nil, false, error
+	}
+	return nil, false, nil
+}
+
+func (ts *FakeOAuthTokenService) InvalidateOAuthTokens(ctx context.Context, usr *models.UserAuth) error {
+	ts.ExpectedAuthUser.OAuthAccessToken = ""
+	ts.ExpectedAuthUser.OAuthRefreshToken = ""
+	ts.ExpectedAuthUser.OAuthExpiry = time.Time{}
+	return nil
+}
+
+func (ts *FakeOAuthTokenService) TryTokenRefresh(ctx context.Context, usr *models.UserAuth) error {
+	if err, ok := ts.ExpectedErrors["TryTokenRefresh"]; ok {
+		return err
+	}
+	return nil
+}