auth0 / Auth0.Android

Android toolkit for Auth0 API
https://auth0.com
MIT License
208 stars 129 forks source link

Refresh token does not use stored scope #726

Open monochkov opened 3 months ago

monochkov commented 3 months ago

Checklist

Description

Library version: 2.10.2.

When I use credentialManager.awaitCredentials() I expect that when access token is expired then it is refreshed by refresh token with the scope I used when saved credentials to credentialsManager. credentialManager.awaitCredentials(scope: String?, minTtl: Int) function says: Params: scope - the scope to request for the access token. If null is passed, the previous scope will be kept.

But, it actually does not use previous scope. CredentialsManager line 239 does not use previously saved scope for refreshing token. If I do not send scope into function as parameter, the scope will be just ignored.

What I expect to have: Replace this one:

if (scope != null) {
    request.addParameter("scope", scope)
}

with this one:

val scopeForRenew = scope ?: storedScope
if (scopeForRenew != null) {
   request.addParameter("scope", scopeForRenew)
}

Reproduction

  1. Sign in to the app
  2. Wait for access token expiration
  3. Open app again
  4. Refresh token using credentialManager.awaitCredentials() with scope == null

Expected: access token is refreshed using previously stored scope. Actual: scope is ignored for refreshing token.

Additional context

No response

Auth0.Android version

2.10.2

Android version(s)

Any