hasValidCredentials base on refreshToken to check the token validity

[jmbreleurTL]

Describe the problem you'd like to have solved

Hello,

I'm using CredentialsManager to store and check the credentials stored validity by using hasValidCredentials().

As I understand it, hasValidCredentials base on 2/3 criteria to determine if the credentials are valid :

• 1 : the credentials are empty
• 2: the credentials will expire (check on the expiresAt date) 3 - AND the refreshToken is null.

In case we still have refreshToken stored, hasValidCredentials() will still return true even though the credential, based on expiresAt, has already expired for some time.

So I'm a bit confusing when I'm creating a test :

 @Test
    fun test() {
        val credentials = Credentials(
            idToken = "idToken",
            accessToken = "accessToken",
            type = "type",
            refreshToken ="refreshToken",
            expiresAt = // Date in past,
            scope = "scope"
        )

        credentialsManager.saveCredentials(credentials)

        val result = credentialsManager.hasValidCredentials()

        assertFalse(result)
    }

to have hasValidCredentials() returning true whereas expiresAt has a date in a past.

Describe the ideal solution

Please provide a way to give access to a method that doesn't take refreshToken as a strong criteria to check the token validity.

Alternatives and current work-arounds

Not using getCredentials() and not store refreshToken.

Additional information, if any

A recent comment related to this:
#614 (comment)

Thank you in advance 🙌🏽

[lucanicoletti]

a refresh token is a credential artifact that lets a client application get new access tokens without having to ask the user to log in again.

As stated here, if a user has a valid refreshToken it's not required to log in again.
If you want to save credentials that can't be refreshed, provide null as refreshToken. This way, the user can't retrieve a new valid accessToken and should be forced to log in again.

[poovamraj]

@jmbreleurTL Thanks a lot for the detailed report. As @lucanicoletti mentioned with refreshToken, you wouldn't be requiring the expiry of an access token. I am curious what scenario raises this particular requirement?

[poovamraj]

Hi @jmbreleurTL we are closing this issue now. Please feel free to comment here and we can reopen it.