Don't ask user to click "Authorize" on every page load

[seanh]

The app is causing Canvas to show the user an OAuth 2 authorization dialog and ask the user to click Authorize whenever:

• An assignment is created or edited (regardless of whether a public URL, Canvas Files or Google Drive assignment)
• A Canvas files assignment is launched

It does not show the authorize dialog when a public URL (HTML or PDF) assignment is launched, though.

Repeatedly showing the authorize dialog is annoying for the user, reduces security, and creates a lot of access tokens in Canvas.

• The app should re-use the access token that it has saved for that user in the DB.
• When the saved access token has expired the app should use the user's saved refresh token to get a new access token without user interaction.
• The user should only be asked to click Authorize the first time they launch the app and, thereafter, only if both the access token and refresh token have expired.

[jeremydean]

I'll just add that this is definitely something people notice and grumble about when using the app. I think it should be prioritized once we get to cleaning up app and not adding features. It'd greatly improve the crispness of the app from a UX POV.

[jeremydean]

Here's a user in the wild confused by this part of the workflow:

https://community.canvaslms.com/groups/designers/blog/2019/01/14/using-the-hypothesis-collaborative-annotation-tool-in-canvas

[seanh]

This is fixed now that the new_oauth feature flag has been released