fixes

Author: ksroda-sa

samples/android/manifest.yaml

@@ -29,7 +29,7 @@ scenarios:
     app_type: mobile_desktop
     display_name: "Token Refresh"
     grant: "Refresh Token"
-    description: "Use refresh tokens to renew access tokens without re-prompting. Requires offline_access. Refresh tokens are stored in Android EncryptedSharedPreferences (Keystore-backed)."
+    description: "Use refresh tokens to renew access tokens without re-prompting. Requires offline_access. Refresh tokens are stored in platform secure storage (Keychain / EncryptedSharedPreferences)."
     callout: "Requires refresh_token grant type enabled in workspace [OAuth settings](workspace-oauth-general) and in the application's [Grant Types](workspace-applications-oauth). Also requires the offline_access scope."
     run_command: "./gradlew :app:installDebug"
     required_scopes:

samples/android/token-refresh/app/src/main/AndroidManifest.xml

@@ -8,8 +8,7 @@
         android:name=".QuickstartApp"
         android:label="@string/app_name"
         android:theme="@android:style/Theme.DeviceDefault.Light.NoActionBar"
-        android:allowBackup="false"
-        tools:targetApi="33">
+        android:allowBackup="false">
 
         <activity
             android:name=".MainActivity"

samples/android/token-refresh/app/src/main/java/com/secureauth/quickstart/AuthViewModel.kt

@@ -115,9 +115,10 @@ class AuthViewModel(app: Application) : AndroidViewModel(app) {
             )
                 .setScopes(AuthConfig.scopes)
                 .build()
+            val intent = authService.getAuthorizationRequestIntent(request)
             pendingAuthState = AuthState(config)
-            authService.getAuthorizationRequestIntent(request)
-        } catch (e: Throwable) {
+            intent
+        } catch (e: Exception) {
             _error.value = e.localizedMessage ?: "Authorization failed"
             null
         }
@@ -132,6 +133,7 @@ class AuthViewModel(app: Application) : AndroidViewModel(app) {
         val ex = AuthorizationException.fromIntent(intent)
         val pending = pendingAuthState
         if (response == null || pending == null) {
+            pendingAuthState = null
             _error.value = ex?.localizedMessage ?: "Authorization failed"
             return
         }
@@ -142,9 +144,9 @@ class AuthViewModel(app: Application) : AndroidViewModel(app) {
                 pending.update(tokenResponse, null)
                 val next = toTokens(tokenResponse, fallback = null)
                 _tokens.value = next
-                next.refreshToken?.let { store.save(it) }
+                next.refreshToken?.let { persistRefreshToken(it) }
                 scheduleRefreshTimer()
-            } catch (e: Throwable) {
+            } catch (e: Exception) {
                 _error.value = e.localizedMessage ?: "Token exchange failed"
             } finally {
                 pendingAuthState = null
@@ -158,6 +160,9 @@ class AuthViewModel(app: Application) : AndroidViewModel(app) {
         _error.value = null
         val issuerJavaUri = AuthConfig.issuer
             ?: run { _error.value = "CIAM_ISSUER_HOST is missing — fill in local.properties"; return }
+        if (AuthConfig.clientId.isEmpty()) {
+            _error.value = "CIAM_CLIENT_ID is missing — fill in local.properties"; return
+        }
         val storedRefresh = _tokens.value?.refreshToken?.takeIf { it.isNotEmpty() }
             ?: store.load()
             ?: run { _error.value = "No refresh token available. Sign in first."; return }
@@ -172,10 +177,10 @@ class AuthViewModel(app: Application) : AndroidViewModel(app) {
             _tokens.value = next
             // If the IdP rotated the refresh token, persist the new one.
             if (next.refreshToken != null && next.refreshToken != storedRefresh) {
-                store.save(next.refreshToken)
+                persistRefreshToken(next.refreshToken)
             }
             scheduleRefreshTimer()
-        } catch (e: Throwable) {
+        } catch (e: Exception) {
             // Refresh tokens can be revoked or expire — clear local state and force re-login.
             store.clear()
             _tokens.value = null
@@ -187,7 +192,7 @@ class AuthViewModel(app: Application) : AndroidViewModel(app) {
 
     suspend fun signOut() {
         _tokens.value?.accessToken?.let { token ->
-            try { revokeToken(token) } catch (_: Throwable) { /* best-effort */ }
+            try { revokeToken(token) } catch (_: Exception) { /* best-effort */ }
         }
         store.clear()
         refreshJob?.cancel()
@@ -202,6 +207,7 @@ class AuthViewModel(app: Application) : AndroidViewModel(app) {
         if (_tokens.value != null) return
         val stored = store.load()?.takeIf { it.isNotEmpty() } ?: return
         val issuerJavaUri = AuthConfig.issuer ?: return
+        if (AuthConfig.clientId.isEmpty()) return
         try {
             val config = discoverConfiguration(Uri.parse(issuerJavaUri.toString()))
             val request = TokenRequest.Builder(config, AuthConfig.clientId)
@@ -214,10 +220,10 @@ class AuthViewModel(app: Application) : AndroidViewModel(app) {
             val next = toTokens(response, fallback = null)
             _tokens.value = next
             if (next.refreshToken != null && next.refreshToken != stored) {
-                store.save(next.refreshToken)
+                persistRefreshToken(next.refreshToken)
             }
             scheduleRefreshTimer()
-        } catch (_: Throwable) {
+        } catch (_: Exception) {
             // Stored token is no longer valid — let the user sign in.
             store.clear()
         }
@@ -242,6 +248,18 @@ class AuthViewModel(app: Application) : AndroidViewModel(app) {
         }
     }
 
+    /** Save the refresh token to EncryptedSharedPreferences. If the write fails (e.g.,
+     *  Keystore unavailable), surface a warning so the user knows the README's silent
+     *  re-login promise won't hold on next launch — but keep the in-memory token so
+     *  the current session still refreshes the access token. */
+    private fun persistRefreshToken(refresh: String) {
+        try {
+            store.save(refresh)
+        } catch (e: Exception) {
+            _error.value = "Sign-in succeeded but refresh token could not be saved to secure storage (${e.localizedMessage}). Silent re-login on next launch will not work."
+        }
+    }
+
     /** Project an AppAuth TokenResponse onto our flat Tokens data class. Refresh
      *  responses sometimes omit a fresh refresh_token or id_token — when missing,
      *  fall back to the previously-known values so display state stays populated. */
@@ -283,13 +301,16 @@ class AuthViewModel(app: Application) : AndroidViewModel(app) {
             val conn = (URL(revokeUrl).openConnection() as HttpURLConnection).apply {
                 requestMethod = "POST"
                 doOutput = true
+                connectTimeout = 5_000
+                readTimeout = 5_000
                 setRequestProperty("Content-Type", "application/x-www-form-urlencoded")
             }
             try {
                 val body = "token=${URLEncoder.encode(token, "UTF-8")}" +
                     "&client_id=${URLEncoder.encode(AuthConfig.clientId, "UTF-8")}"
                 conn.outputStream.use { it.write(body.toByteArray(Charsets.UTF_8)) }
-                conn.inputStream.use { it.readBytes() }
+                val stream = if (conn.responseCode in 200..299) conn.inputStream else conn.errorStream
+                stream?.use { it.readBytes() }
             } finally {
                 conn.disconnect()
             }

snippet-manifest.yaml

@@ -81,7 +81,7 @@ scenarios:
     grant: Refresh Token
     description: >-
       Use refresh tokens to renew access tokens without re-prompting. Requires offline_access. Refresh tokens are stored
-      in Android EncryptedSharedPreferences (Keystore-backed).
+      in platform secure storage (Keychain / EncryptedSharedPreferences).
     required_scopes:
       - offline_access
     config_rows:

snippets.json

@@ -155,10 +155,10 @@
         {
           "step": 3,
           "description": "Trigger login with offline_access and capture the refresh token",
-          "code": "    suspend fun signIn(): Intent? {\n        _error.value = null\n        val issuerJavaUri = AuthConfig.issuer\n            ?: run { _error.value = \"CIAM_ISSUER_HOST is missing — fill in local.properties\"; return null }\n        if (AuthConfig.clientId.isEmpty()) {\n            _error.value = \"CIAM_CLIENT_ID is missing — fill in local.properties\"; return null\n        }\n        val redirect = AuthConfig.redirectUri\n            ?: run { _error.value = \"CIAM_REDIRECT_SCHEME is missing — fill in local.properties\"; return null }\n        return try {\n            val issuerAndroidUri = Uri.parse(issuerJavaUri.toString())\n            val config = discoverConfiguration(issuerAndroidUri)\n            val request = AuthorizationRequest.Builder(\n                config,\n                AuthConfig.clientId,\n                ResponseTypeValues.CODE,\n                redirect,\n            )\n                .setScopes(AuthConfig.scopes)\n                .build()\n            pendingAuthState = AuthState(config)\n            authService.getAuthorizationRequestIntent(request)\n        } catch (e: Throwable) {\n            _error.value = e.localizedMessage ?: \"Authorization failed\"\n            null\n        }\n    }",
+          "code": "    suspend fun signIn(): Intent? {\n        _error.value = null\n        val issuerJavaUri = AuthConfig.issuer\n            ?: run { _error.value = \"CIAM_ISSUER_HOST is missing — fill in local.properties\"; return null }\n        if (AuthConfig.clientId.isEmpty()) {\n            _error.value = \"CIAM_CLIENT_ID is missing — fill in local.properties\"; return null\n        }\n        val redirect = AuthConfig.redirectUri\n            ?: run { _error.value = \"CIAM_REDIRECT_SCHEME is missing — fill in local.properties\"; return null }\n        return try {\n            val issuerAndroidUri = Uri.parse(issuerJavaUri.toString())\n            val config = discoverConfiguration(issuerAndroidUri)\n            val request = AuthorizationRequest.Builder(\n                config,\n                AuthConfig.clientId,\n                ResponseTypeValues.CODE,\n                redirect,\n            )\n                .setScopes(AuthConfig.scopes)\n                .build()\n            // Assign pendingAuthState only after the Intent is successfully created so\n            // a thrown getAuthorizationRequestIntent doesn't leave stale state behind.\n            // Catch Exception (not Throwable) so coroutine CancellationException still\n            // propagates and structured concurrency works correctly.\n            val intent = authService.getAuthorizationRequestIntent(request)\n            pendingAuthState = AuthState(config)\n            intent\n        } catch (e: Exception) {\n            _error.value = e.localizedMessage ?: \"Authorization failed\"\n            null\n        }\n    }",
           "file": "app/src/main/java/com/secureauth/quickstart/AuthViewModel.kt",
           "lang": "kotlin",
-          "lines": "96-124"
+          "lines": "96-129"
         },
         {
           "step": 4,
@@ -171,10 +171,10 @@
         {
           "step": 5,
           "description": "Exchange the refresh token for a new access token; on failure clear local state and require re-login",
-          "code": "    suspend fun refreshTokens() {\n        _error.value = null\n        val issuerJavaUri = AuthConfig.issuer\n            ?: run { _error.value = \"CIAM_ISSUER_HOST is missing — fill in local.properties\"; return }\n        val storedRefresh = _tokens.value?.refreshToken?.takeIf { it.isNotEmpty() }\n            ?: store.load()\n            ?: run { _error.value = \"No refresh token available. Sign in first.\"; return }\n        try {\n            val config = discoverConfiguration(Uri.parse(issuerJavaUri.toString()))\n            val request = TokenRequest.Builder(config, AuthConfig.clientId)\n                .setGrantType(GrantTypeValues.REFRESH_TOKEN)\n                .setRefreshToken(storedRefresh)\n                .build()\n            val response = performTokenRequest(request)\n            val next = toTokens(response, fallback = _tokens.value)\n            _tokens.value = next\n            // If the IdP rotated the refresh token, persist the new one.\n            if (next.refreshToken != null && next.refreshToken != storedRefresh) {\n                store.save(next.refreshToken)\n            }\n            scheduleRefreshTimer()\n        } catch (e: Throwable) {\n            // Refresh tokens can be revoked or expire — clear local state and force re-login.\n            store.clear()\n            _tokens.value = null\n            refreshJob?.cancel()\n            _error.value = \"Refresh failed (${e.localizedMessage}). Sign in again.\"\n        }\n    }",
+          "code": "    suspend fun refreshTokens() {\n        _error.value = null\n        val issuerJavaUri = AuthConfig.issuer\n            ?: run { _error.value = \"CIAM_ISSUER_HOST is missing — fill in local.properties\"; return }\n        if (AuthConfig.clientId.isEmpty()) {\n            _error.value = \"CIAM_CLIENT_ID is missing — fill in local.properties\"; return\n        }\n        val storedRefresh = _tokens.value?.refreshToken?.takeIf { it.isNotEmpty() }\n            ?: store.load()\n            ?: run { _error.value = \"No refresh token available. Sign in first.\"; return }\n        try {\n            val config = discoverConfiguration(Uri.parse(issuerJavaUri.toString()))\n            val request = TokenRequest.Builder(config, AuthConfig.clientId)\n                .setGrantType(GrantTypeValues.REFRESH_TOKEN)\n                .setRefreshToken(storedRefresh)\n                .build()\n            val response = performTokenRequest(request)\n            val next = toTokens(response, fallback = _tokens.value)\n            _tokens.value = next\n            // If the IdP rotated the refresh token, persist the new one.\n            if (next.refreshToken != null && next.refreshToken != storedRefresh) {\n                persistRefreshToken(next.refreshToken)\n            }\n            scheduleRefreshTimer()\n        } catch (e: Exception) {\n            // Refresh tokens can be revoked or expire — clear local state and force re-login.\n            store.clear()\n            _tokens.value = null\n            refreshJob?.cancel()\n            _error.value = \"Refresh failed (${e.localizedMessage}). Sign in again.\"\n        }\n    }",
           "file": "app/src/main/java/com/secureauth/quickstart/AuthViewModel.kt",
           "lang": "kotlin",
-          "lines": "155-185"
+          "lines": "163-196"
         }
       ],
       "framework": "android",