2f4b974130
X OAuth2 refresh tokens are single-use: each refresh rotates the pair and invalidates the previous refresh_token, and reusing a rotated one kills the whole family. Three things made this fragile and disconnected accounts far more often than necessary: - The proactive refresh job called refreshToken() directly, bypassing the access-token-first guard in verify() and rotating on every run. - RefreshExpiringTokens used a 2h window on an hourly schedule — equal to the 2h access-token lifetime — so every X account was rotated every hour even while its token was still valid. - A single 4xx refresh failure disconnected the account without checking whether a concurrent refresh had already persisted a working token. Changes: - RefreshSocialToken now routes through verify() (access-token-first), so it only rotates when the access_token is actually invalid. - Shrink the proactive window to 30m and run the command every 15m, so the window still covers the run interval but rotation happens near real expiry. - verify() tolerates the lost-rotation race: on a 4xx refresh, reload and verify with a concurrently-refreshed token before marking TokenExpired. Refs #126
73 lines
2.5 KiB
PHP
73 lines
2.5 KiB
PHP
<?php
|
|
|
|
declare(strict_types=1);
|
|
|
|
use App\Enums\SocialAccount\Platform;
|
|
use App\Enums\SocialAccount\Status;
|
|
use App\Jobs\RefreshSocialToken;
|
|
use App\Models\SocialAccount;
|
|
use App\Models\Workspace;
|
|
use Illuminate\Support\Facades\Queue;
|
|
|
|
test('it dispatches refresh jobs for tokens expiring within 30 minutes or already expired', function () {
|
|
Queue::fake();
|
|
|
|
$workspace = Workspace::factory()->create();
|
|
|
|
// Should be refreshed (expires in 15 minutes — inside the proactive window)
|
|
$expiringSoon = SocialAccount::factory()->create([
|
|
'workspace_id' => $workspace->id,
|
|
'platform' => Platform::LinkedIn,
|
|
'status' => Status::Connected,
|
|
'token_expires_at' => now()->addMinutes(15),
|
|
]);
|
|
|
|
// Should NOT be refreshed (expires in 1 hour — outside the proactive window)
|
|
SocialAccount::factory()->create([
|
|
'workspace_id' => $workspace->id,
|
|
'platform' => Platform::Instagram,
|
|
'status' => Status::Connected,
|
|
'token_expires_at' => now()->addHour(),
|
|
]);
|
|
|
|
// SHOULD be refreshed (already expired — last-chance attempt before the
|
|
// refresh_token also dies at the provider).
|
|
$justExpired = SocialAccount::factory()->create([
|
|
'workspace_id' => $workspace->id,
|
|
'platform' => Platform::TikTok,
|
|
'status' => Status::Connected,
|
|
'token_expires_at' => now()->subHour(),
|
|
]);
|
|
|
|
// Should NOT be refreshed (disconnected)
|
|
SocialAccount::factory()->create([
|
|
'workspace_id' => $workspace->id,
|
|
'platform' => Platform::X,
|
|
'status' => Status::Disconnected,
|
|
'token_expires_at' => now()->addHour(),
|
|
]);
|
|
|
|
// Should NOT be refreshed (already token expired — daily verify handles these)
|
|
SocialAccount::factory()->create([
|
|
'workspace_id' => $workspace->id,
|
|
'platform' => Platform::Pinterest,
|
|
'status' => Status::TokenExpired,
|
|
'token_expires_at' => now()->subHour(),
|
|
]);
|
|
|
|
$this->artisan('social:refresh-expiring-tokens')
|
|
->assertSuccessful();
|
|
|
|
Queue::assertPushed(RefreshSocialToken::class, 2);
|
|
Queue::assertPushed(RefreshSocialToken::class, fn ($job) => $job->account->id === $expiringSoon->id);
|
|
Queue::assertPushed(RefreshSocialToken::class, fn ($job) => $job->account->id === $justExpired->id);
|
|
});
|
|
|
|
test('it dispatches nothing when no tokens are expiring', function () {
|
|
Queue::fake();
|
|
|
|
$this->artisan('social:refresh-expiring-tokens')
|
|
->assertSuccessful();
|
|
|
|
Queue::assertNothingPushed();
|
|
});
|