Problem

The current OAuth2 token refresh implementation has several limitations:

1. Token refresh logic doesn't properly handle OpenID Connect configurations where tokenUrl is accessed as an object property instead of a dictionary key
2. Test coverage for token refresh scenarios is insufficient and doesn't accurately mock OAuth2 session behaviour

Proposed Changes

Implementation Updates

• Fixed token URL access in OAuth2 exchanger to properly handle both OpenID Connect and OAuth2 configurations:

  # Before
  token_url = auth_scheme.openIdConnect.tokenUrl or auth_scheme.oauth2.tokenUrl
  
  # After
  token_url = (auth_scheme.openIdConnect.get("tokenUrl") if auth_scheme.openIdConnect else None) or auth_scheme.oauth2.tokenUrl

Test Improvements

• Added comprehensive test coverage for token refresh scenarios:
  • Successful token refresh
  • Missing token URL handling
  • Network request failures
  • Fallback to existing token when refresh fails
• Improved mock setup to accurately reflect real OAuth2 session behavior
• Added parameterized tests for both GOOGLE_AI and VERTEX configurations