hypothesis / lms

LTI app for integrating with learning management systems
BSD 2-Clause "Simplified" License
46 stars 14 forks source link

Fix Canvas Studio admin token refreshes triggered by students #6446

Closed robertknight closed 1 month ago

robertknight commented 1 month ago

When handling refreshable OAuth2TokenError exceptions, don't try to look up the existing access token in the special case where the token that needs to be refreshed is the Canvas Studio admin user's token, instead of the current user's access token.

This issue caused Canvas Studio assignment launches to fail for users if:

In this scenario the refresh field was omitted from the response, so users would see a non-working "Authorize Hypothesis" screen, instead of having the frontend initiate an admin user token refresh.

Fixes https://github.com/hypothesis/support/issues/134

robertknight commented 1 month ago

The engineers on this project are away today. I'm going to get this merged to try and resolve the issue for affected users.