turbo25
commented
2 years ago I am about to make the most useless of comments but I got fed up that Ubisoft wasn't showing up in my GoG library so I decided to dig a bit. I verified Backend.py and it does support OAUTH2 and it does handle refreshing tokens already, but I've noticed disconnection there.
I have looked through some of my logs and the originator of the issue seems to begin from a call to _do_safe_request which receives a weird answer. Not wanting to wait, I decided to log to file the tokens and expiry dates, and to subtract a good chunk of time from expiry time.... and it just called _refresh_auth properly? And then again and again and again. So using the fix by @wearepariah in combination by just refreshing the token long before it expires, I seem to be doing good. There is no refresh token rotation. Always the same refresh token.
Now, I am not sure what happens if I turn off GoG for a couple of hours, but combing through the code I've found a couple potential issues, the main ones revolving around improper handling of errors on requests.
We have 3 layers of requests.
We have request which handles the actual request. If it fails, it raises an error, it uses an handle_exception function.
We have _do_request which is a wrapper around request, it has zero error handling.
We have _do_safe_request which is a wrapper around _do_request. It has a preemptive ticket refresh (which is what I used) and a try/except situation to refresh auth but only on AccessDenied, AuthenticationRequired errors, as defined by handle_exception, any errors outside of those 2 is a dead end.
My take aways right now are: Gotta refactor requests so that they always fallback to refreshing auth if it fails and if that fails, kill stored credentials. Request and _do_request are called and can cause this situation. There will probably need to be some method of fallback for exceptions. Some errors I've noticed is that a request returns 401 but the handle_exception doesn't know what to do with it, so it returns unknown handle. We do have situations where we get 401 while doing a token refresh.
Oh and for some reasons _do_options_request has an hardcoded appID
This is one of the most useful comments instead, but I agree, it's also useless because we have no control on the PRs and merges so these changes will never go live for anyone
KS-HTK
fl4shback
Some parts of the Ubisoft API recently started to reject requests made by the legacy "Ubisoft Club" app IDs.
I changed the IDs to the new ones.
Fixes #33, #37