Skip to content

Conversation

@FenTiger
Copy link

I made a crude start on #447. It roughly "Works For Me (TM)", but it has some problems:

  • It only knows about IndieAuth. It doesn't support any of the other auth methods. This should be fixed; Mastodon is planning to add refresh tokens (Access Tokens should have expiration date mastodon/mastodon#26838, Feature: enable oauth refresh tokens mastodon/mastodon#27948) though it probably won't happen quickly.
  • If there's no refresh_token then ideally we should send the user back through the OAuth flow from the beginning. I started looking at this, but this will mean rearranging AuthActivity.java so that the flow can be started by triggering an intent or something, rather than only when the user clicks on the "Sign In" button.
  • Calling into AccountManager from HTTPRequest.java feels like a bit of a layering violation. Is there a clearer way to structure things without too much refactoring?
  • We could save a round-trip in many situations by paying attention to the token's expires_in value and refreshing automatically when we know it's expired, rather than relying on the server to tell us when we need to refresh.
  • Applying the new TokenRetryPolicy to the requests that AuthActivity.java issues feels kind of circular. I don't think this will break anything, but I'm not entirely certain.

@FenTiger FenTiger marked this pull request as draft February 23, 2025 16:10
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant