feat: purge OAuth2 tokens when DB changes

[betodealmeida]

SUMMARY

Add a new method to the UpdateDatabaseCommand so that, if the OAuth2 client information has changed, existing tokens are purged, since they are unlikely to still be valid. This is done if any of these keys change:

• Client ID (but not client secret)
• Scope (tokens are associated with a given scope)
• Endpoint URLs (likely a new OAuth2 provider, but not necessarily — we purge to be safe)

BEFORE/AFTER SCREENSHOTS OR ANIMATED GIF

N/A

TESTING INSTRUCTIONS

Added tests.

ADDITIONAL INFORMATION

• Has associated issue:
• Required feature flags:
• Changes UI
• Includes DB Migration (follow approval process in SIP-59)
  • Migration is atomic, supports rollback & is backwards-compatible
  • Confirm DB migration upgrade and downgrade tested
  • Runtime estimates and downtime expectations provided
• Introduces new feature or API
• Removes existing feature or API

[fisjac]

Changes look good to me.

When OAuth2 client info is changed through DATABASE_OAUTH2_CLIENTS in the config.py file, will the purge trigger as well, or only when a PUT request is made to the db connection?

[betodealmeida]

Changes look good to me.

When OAuth2 client info is changed through DATABASE_OAUTH2_CLIENTS in the config.py file, will the purge trigger as well, or only when a PUT request is made to the db connection?

Ah, good point! I added a notice to the config.py about this, if people are changing the config.py file they should be able to handle the token deletion themselves.