fix: prevent refreshing tokens that don't exist (coder#4661)

sreya · web-flow · commit d0b1c36d5109 · 2022-10-20T00:25:57.000-05:00
- When logging in with Google OIDC refresh tokens are not
  provided unless explicitly asked for. This PR updates
  the logic to avoid attempting to refresh the token if
  a refresh token does not exist.

  A session should only be dependent on a valid Coder API
  key, the state of its OAuth token (beyond initial authentication)
  should be irrelevant.
diff --git a/coderd/httpmw/apikey.go b/coderd/httpmw/apikey.go
@@ -203,7 +203,7 @@ func ExtractAPIKey(cfg ExtractAPIKeyConfig) func(http.Handler) http.Handler {
 					return
 				}
 				// Check if the OAuth token is expired
-				if link.OAuthExpiry.Before(now) && !link.OAuthExpiry.IsZero() {
+				if link.OAuthExpiry.Before(now) && !link.OAuthExpiry.IsZero() && link.OAuthRefreshToken != "" {
 					var oauthConfig OAuth2Config
 					switch key.LoginType {
 					case database.LoginTypeGithub:
diff --git a/coderd/httpmw/apikey_test.go b/coderd/httpmw/apikey_test.go
@@ -468,9 +468,10 @@ func TestAPIKey(t *testing.T) {
 		})
 		require.NoError(t, err)
 		_, err = db.InsertUserLink(r.Context(), database.InsertUserLinkParams{
-			UserID:      user.ID,
-			LoginType:   database.LoginTypeGithub,
-			OAuthExpiry: database.Now().AddDate(0, 0, -1),
+			UserID:            user.ID,
+			LoginType:         database.LoginTypeGithub,
+			OAuthExpiry:       database.Now().AddDate(0, 0, -1),
+			OAuthRefreshToken: "hello",
 		})
 		require.NoError(t, err)
 

Original file line number	Diff line number	Diff line change
`@@ -203,7 +203,7 @@ func ExtractAPIKey(cfg ExtractAPIKeyConfig) func(http.Handler) http.Handler {`
`203`	`203`	`return`
`204`	`204`	`}`
`205`	`205`	`// Check if the OAuth token is expired`
`206`		`- if link.OAuthExpiry.Before(now) && !link.OAuthExpiry.IsZero() {`
	`206`	`+ if link.OAuthExpiry.Before(now) && !link.OAuthExpiry.IsZero() && link.OAuthRefreshToken != "" {`
`207`	`207`	`var oauthConfig OAuth2Config`
`208`	`208`	`switch key.LoginType {`
`209`	`209`	`case database.LoginTypeGithub:`