From a9729c30ccbd4a42cea1725831b449666da394eb Mon Sep 17 00:00:00 2001
From: Vivek Patel <ervicpatelwork@gmail.com>
Date: Tue, 28 Sep 2021 14:48:39 +0530
Subject: [PATCH] Fixes unauthorized access

Fetches existing accessToken using refreshToken when refreshing webapp or opening new tab if that fails we generate new accessToken along with refreshToken
---
 auth/auth.go                   |  1 +
 auth/handlers/handle_oauth2.go | 13 ++++++++++---
 auth/handlers/handler.go       |  5 +++++
 3 files changed, 16 insertions(+), 3 deletions(-)

diff --git a/auth/auth.go b/auth/auth.go
index 5d5886923..81562a7d4 100644
--- a/auth/auth.go
+++ b/auth/auth.go
@@ -217,6 +217,7 @@ func New(ctx context.Context, log *zap.Logger, s store.Storer, opt options.AuthO
 		Templates:      tpls,
 		SessionManager: sesManager,
 		OAuth2:         oauth2Server,
+		OAuth2Manager:  oauth2Manager,
 		AuthService:    systemService.DefaultAuth,
 		UserService:    systemService.DefaultUser,
 		ClientService:  &clientService{s},
diff --git a/auth/handlers/handle_oauth2.go b/auth/handlers/handle_oauth2.go
index dc1a31ded..701dbb653 100644
--- a/auth/handlers/handle_oauth2.go
+++ b/auth/handlers/handle_oauth2.go
@@ -351,6 +351,7 @@ func (h AuthHandlers) handleTokenRequest(req *request.AuthReq, client *types.Aut
 		r   = req.Request
 		w   = req.Response
 		ctx = req.Context()
+		ti  oauth2def.TokenInfo
 	)
 
 	req.Status = -1
@@ -383,9 +384,15 @@ func (h AuthHandlers) handleTokenRequest(req *request.AuthReq, client *types.Aut
 		), " ")
 	}
 
-	ti, err := h.OAuth2.GetAccessToken(ctx, gt, tgr)
-	if err != nil {
-		return h.tokenError(w, err)
+	if gt == oauth2def.Refreshing {
+		ti, err = h.OAuth2Manager.LoadRefreshToken(ctx, tgr.Refresh)
+	}
+
+	if gt != oauth2def.Refreshing || err != nil {
+		ti, err = h.OAuth2.GetAccessToken(ctx, gt, tgr)
+		if err != nil {
+			return h.tokenError(w, err)
+		}
 	}
 
 	return token(w, h.OAuth2.GetTokenData(ti), nil)
diff --git a/auth/handlers/handler.go b/auth/handlers/handler.go
index 61bc741fb..e56d0748a 100644
--- a/auth/handlers/handler.go
+++ b/auth/handlers/handler.go
@@ -88,6 +88,10 @@ type (
 		ValidationBearerToken(r *http.Request) (oauth2.TokenInfo, error)
 	}
 
+	oauth2Manager interface {
+		LoadRefreshToken(ctx context.Context, refresh string) (oauth2.TokenInfo, error)
+	}
+
 	localeService interface {
 		NS(ctx context.Context, ns string) func(key string, rr ...string) string
 		T(ctx context.Context, ns, key string, rr ...string) string
@@ -100,6 +104,7 @@ type (
 		Locale         localeService
 		Templates      templateExecutor
 		OAuth2         oauth2Service
+		OAuth2Manager  oauth2Manager
 		SessionManager *request.SessionManager
 		AuthService    authService
 		UserService    userService