SEAT 4.0 does not store new refresh tokens when migrating from old auth to new JWT auth (v2)

eveseat / seat

🌀✳️ SeAT: A Simple, EVE Online API Tool and Corporation Manager

https://eveseat.github.io/docs/

GNU General Public License v2.0

434 stars 142 forks source link

SEAT 4.0 does not store new refresh tokens when migrating from old auth to new JWT auth (v2) #675

Closed stebet closed 4 years ago

stebet commented 4 years ago

Problem: SEAT 4.0 always migrates old refresh tokens and doesn't update to the new refresh token returned when upgrading takes place, causing unnecessary load on the EVE Online SSO
Expected: Refresh token is updated to the new v2 refresh token.
Logs / Screenshots / Proof: Contact CCP Ghostrider on Tweetfleet Slack for details.
Version Info: SeAT Version 4.0.0

stebet commented 4 years ago

As we are about to make a change to the EVE Online SSO to only allow migrating a refresh token once, this will cause SEAT auths to break unless fixed relatively quickly.

warlof commented 4 years ago

As for now, I only spot two cases when we might not keep an updated token. All are tied to job flow and esi call :

1) if esi return a 304 because cached data based on etag are still up-to-date

2) if a job which ask to renew a token had crash during the overall process (job exception or any response between 4xx and 5xx)

https://github.com/eveseat/eveapi/blob/3327171f3bbe0d705d0b465a48175574f6b824d2/src/Jobs/EsiBase.php#L269

A patch will be sent during the day to address those two cases.

warlof commented 4 years ago

Could be partially addressed by eveseat/eveapi#260

BiekerUdan commented 4 years ago

I recently upgraded from Seat3 to Seat4, during this process it seems that all my users tokens were invalidated. I followed all the instructions in the upgrade documentation and it seems there is no warning on that page that indicates that all tokens will be invalidated.

I do have a database backup and a backup of the application directory is there any way to restore that will result in those tokens being useable?

warlof commented 4 years ago

@rhulsker nope, tokens are expired. However, your data are still there.

Still working on it, tried multiple things and our last hope is that the issue is related to concurrent running jobs attempting to upgrade token at same time.

There is a fix in progress that will force token conversion during upgrade instead leaving jobs handling the task.

BiekerUdan commented 4 years ago

You should probably put a warning on the upgrade instructions page. I have now permanently lost the tokens for a few important characters which I will never be able to get back (spies who were kicked from the corp and never revoked their tokens).