OAuth2 Tokens from providers that don't provide an expiry date are incorrectly expired on first use

[James Henstridge]

I've been trying to use the Online Accounts system to manage log in to the SoundCloud web site, and hit a problem: I can sign in without problem through the control panel, but when I try to retrieve the token via libsignon-glib, I get an error and the account is marked as signed out.

Looking at the syslog chatter from signond, it apparently decides that the token has expired:

    May 5 14:11:50 scruffy signonpluginprocess[7357]: oauth2plugin.cpp 206 respondWithStoredToken : Stored token is expired

This was a bit surprising, since SoundCloud says their tokens are not set to expire. Looking furtherback to where the token was stored, I see:

    May 5 14:10:03 scruffy signonpluginprocess[7263]: oauth2plugin.cpp 631 storeResponse : QMap(("REDACTED_CLIENTID", QVariant(QVariantMap, QMap(("Expiry", QVariant(int, 0) ) ( "Scopes" , QVariant(QStringList, ("non-expiring") ) ) ( "Token" , QVariant(QString, "REDACTED_TOKEN") ) ( "refresh_token" , QVariant(QString, "") ) ( "timestamp" , QVariant(uint, 1399270203) ) ) ) ) )

In particular, Expiry==0. This seems to be the code where the expiry is set, where it reads the "expires_in" property from the response JSON:

    http://code.google.com/p/accounts-sso/source/browse/src/oauth2plugin.cpp?repo=signon-plugin-oauth2#444

However, looking at the SoundCloud HTTP API reference, it isn't sending this in their JSON response:

    http://developers.soundcloud.com/docs/api/reference#token

It looks like this method needs to check whether expires_in is actually included in the JSON response.

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[James Henstridge (jamesh)]

I gave mardy's branch a go with my test program and soundcloud provider XML, and was able to successfully retrieve the access token without any notifcations about being logged out. So I guess that's a +1 from me.

[Launchpad Janitor (janitor)]

This bug was fixed in the package signon-plugin-oauth2 - 0.19+14.10.20140513-0ubuntu1

---------------
signon-plugin-oauth2 (0.19+14.10.20140513-0ubuntu1) utopic; urgency=low

  [ Ubuntu daily release ]
  * New rebuild forced

  [ Alberto Mardegan ]
  * Do not store invalid expiration times (LP: #1316021)
 -- Ubuntu daily release <email address hidden> Tue, 13 May 2014 07:07:20 +0000