feature: [ANDROSDK-2372] identify expired or missing OAuth2 tokens

[taridepaco]

The SDK can now tell the app when an OAuth2 session is no longer usable. A new D2ErrorCode.OAUTH2_NO_VALID_TOKEN is thrown when there is no OAuth2 state, no access token, no refresh token, or when the server explicitly rejects the refresh token, and also on login for an account registered as OAUTH2 that has no tokens on this device (for example, after importing a database). Token rotation is now centralized in OAuth2TokenRefresher.rotate, which serializes concurrent refreshes with a mutex and returns a RefreshResult distinguishing success, a retryable failure, and an unrecoverable one.

The distinction matters because the previous implementation logged the user out on any refresh failure, including transient ones: going offline or hitting a server error closed the session. Now only a 400/401 from the token endpoint discards the stored tokens; anything else leaves the credentials untouched and the caller sees the original 401 so it can retry later. Proactive refreshing based on expiresAt was dropped along with OAuth2State.needsTokenRefresh() — refresh is driven by the actual 401 response instead, which also removes the reliance on device clock accuracy.

Related task: ANDROSDK-2372

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
88.3% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud