The 401 branch of OAuthClientProvider discovered metadata but never tried
the stored refresh token, and the pre-request refresh tried the refresh
token but never discovered metadata. After a restart nothing restores an
expiry, so the pre-request path is skipped, the stale bearer draws a 401,
and the flow went straight to interactive authorization with a usable
refresh token in hand; headless clients failed outright. When an
application forced the pre-request path, the refresh was posted to a
path guessed from the server origin, which 404s against an
authorization server under a path, and the refresh token was dropped.
The 401 branch now tries the refresh_token grant after discovery and
registration and runs the full authorization only when there is no
refresh token or the server rejects it. The pre-request refresh runs
only when authorization server metadata is already known, so it never
guesses an endpoint; a cold start takes the 401 and refreshes there. A
fresh dynamic registration clears any held tokens, which belonged to a
previous client.
Closes#3240, #3250, #1318.
Max Isbey
2bc618ab6d
