fix: Add username to the tokenStoreKey so the saved token is invalidated when the user changes in the environment (#426)

Co-authored-by: Gregory Schier <gschier1990@gmail.com>

plugins/auth-oauth2/src/grants/password.ts

@@ -32,6 +32,7 @@ export async function getPassword(
     clientId,
     accessTokenUrl,
     authorizationUrl: null,
+    username,
   };
   const token = await getOrRefreshAccessToken(ctx, tokenArgs, {
     accessTokenUrl,

plugins/auth-oauth2/src/index.ts

@@ -103,6 +103,7 @@ export const plugin: PluginDefinition = {
             authorizationUrl: stringArg(values, "authorizationUrl"),
             accessTokenUrl: stringArg(values, "accessTokenUrl"),
             clientId: stringArg(values, "clientId"),
+            username: usernameArg(values),
           };
           const token = await getToken(ctx, tokenArgs);
           if (token == null) {
@@ -128,6 +129,7 @@ export const plugin: PluginDefinition = {
             authorizationUrl: stringArg(values, "authorizationUrl"),
             accessTokenUrl: stringArg(values, "accessTokenUrl"),
             clientId: stringArg(values, "clientId"),
+            username: usernameArg(values),
           };
           if (await deleteToken(ctx, tokenArgs)) {
             await ctx.toast.show({
@@ -478,6 +480,7 @@ export const plugin: PluginDefinition = {
             authorizationUrl: stringArg(values, "authorizationUrl"),
             accessTokenUrl: stringArg(values, "accessTokenUrl"),
             clientId: stringArg(values, "clientId"),
+            username: usernameArg(values),
           };
           const token = await getToken(ctx, tokenArgs);
           if (token == null) {
@@ -609,6 +612,12 @@ function stringArgOrNull(
   return `${arg}`;
 }
 
+/** Only the password grant stores its token under a username, so the others must not key by one */
+function usernameArg(values: Record<string, JsonPrimitive | undefined>): string | null {
+  const grantType = String(values.grantType ?? defaultGrantType);
+  return grantType === "password" ? stringArgOrNull(values, "username") : null;
+}
+
 function stringArg(values: Record<string, JsonPrimitive | undefined>, name: string): string {
   const arg = stringArgOrNull(values, name);
   if (!arg) return "";

plugins/auth-oauth2/src/store.ts

@@ -47,6 +47,7 @@ export interface TokenStoreArgs {
   clientId: string;
   accessTokenUrl: string | null;
   authorizationUrl: string | null;
+  username?: string | null;
 }
 
 /**
@@ -59,6 +60,7 @@ function tokenStoreKey(args: TokenStoreArgs) {
   if (args.clientId) hash.update(args.clientId.trim());
   if (args.accessTokenUrl) hash.update(args.accessTokenUrl.trim().replace(/^https?:\/\//, ""));
   if (args.authorizationUrl) hash.update(args.authorizationUrl.trim().replace(/^https?:\/\//, ""));
+  if (args.username) hash.update(args.username);
   const key = hash.digest("hex");
   return ["token", key].join("::");
 }