Automatic device authentication when refresh token is expired

[adombeck]

⚠️ This is based on #349, please review and merge that first

When refreshing the token fails because the refresh token is expired, we should automatically start device authentication.

Closes ubuntu/authd#575
UDENG-4911

[adombeck]

I tested this by applying this patch:

commit 49c9c3aeb2d58d7b68cebd816ebb887befb080ca (HEAD -> 575-automatic-device-auth-on-expired-refresh-token)
Author: Adrian Dombeck <[email protected]>
Date:   Mon Feb 3 15:36:36 2025 +0100

    XXX: Test expired refresh token

diff --git a/internal/broker/broker.go b/internal/broker/broker.go
index 93d0d82..193e2c8 100644
--- a/internal/broker/broker.go
+++ b/internal/broker/broker.go
@@ -810,6 +810,9 @@ func (b *Broker) updateSession(sessionID string, session session) error {
 func (b *Broker) refreshToken(ctx context.Context, oauth2Config oauth2.Config, oldToken token.AuthCachedInfo) (token.AuthCachedInfo, error) {
        timeoutCtx, cancel := context.WithTimeout(ctx, maxRequestDuration)
        defer cancel()
+
+       return token.AuthCachedInfo{}, &oauth2.RetrieveError{ErrorCode: "invalid_grant", ErrorDescription: "AADSTS50173: Refresh token is expired"}
+
        // set cached token expiry time to one hour in the past
        // this makes sure the token is refreshed even if it has not 'actually' expired
        oldToken.Token.Expiry = time.Now().Add(-time.Hour)

[adombeck]

I created ubuntu/authd#774 to track the "show a message" part.

[denisonbarbosa]

Some considerations, but nothing big...