Use caller-supplied HttpClient for token refresh (#324)

RefreshAccessToken sent the OAuth token request through the SDK's
internal default HttpClient, ignoring a caller-supplied client. In
high-traffic apps this leaked connections and exhausted ports. Route
the refresh through GetHttpClient(HostType.Api) like normal requests,
and add a regression test asserting the refresh uses the supplied client.

Author: AndreyVMarkelov

dropbox-sdk-dotnet/Dropbox.Api.Integration.Tests/DropboxApiTests.cs

@@ -173,6 +173,48 @@ public async Task TestRefreshClient()
             Assert.IsNotNull(result.Email);
         }
 
+        /// <summary>
+        /// Verifies that the token-refresh request is sent through the
+        /// caller-supplied <see cref="HttpClient"/>, not a client the SDK
+        /// creates internally. Previously the refresh path used its own default
+        /// HttpClient, leaking connections and causing port exhaustion in
+        /// high-traffic scenarios (issue #324).
+        /// </summary>
+        /// <returns>The <see cref="Task" />.</returns>
+        [TestMethod]
+        public async Task TestRefreshUsesSuppliedHttpClient()
+        {
+            var refreshRequests = 0;
+            var mockHandler = new MockHttpMessageHandler((r, s) =>
+            {
+                if (r.RequestUri.AbsoluteUri.Contains("oauth2/token"))
+                {
+                    refreshRequests++;
+                }
+
+                return s(r);
+            });
+
+            var mockClient = new HttpClient(mockHandler);
+            var config = new DropboxClientConfig { HttpClient = mockClient };
+
+            // An access token whose expiry is already in the past forces a
+            // proactive refresh on the first request. The SDK compares against
+            // DateTime.Now, so use local time here.
+            var client = new DropboxClient(
+                "expired-access-token",
+                userRefreshToken,
+                DateTime.Now.AddMinutes(-5),
+                appKey,
+                appSecret,
+                config);
+
+            var result = await client.Users.GetCurrentAccountAsync();
+
+            Assert.IsNotNull(result.Email);
+            Assert.AreEqual(1, refreshRequests, "The refresh request should flow through the supplied HttpClient.");
+        }
+
         /// <summary>
         /// Test get metadata.
         /// </summary>

dropbox-sdk-dotnet/Dropbox.Api/DropboxRequestHandler.cs

@@ -272,7 +272,11 @@ public async Task<bool> RefreshAccessToken(string[] scopeList = null)
 
             var bodyContent = new FormUrlEncodedContent(parameters);
 
-            var response = await this.defaultHttpClient.PostAsync(url, bodyContent).ConfigureAwait(false);
+            // Use the same HttpClient as regular API requests so that a
+            // caller-supplied HttpClient is honored here too. Otherwise the
+            // token-refresh path leaks connections from the default client,
+            // causing port exhaustion in high-traffic scenarios (issue #324).
+            var response = await this.GetHttpClient(HostType.Api).PostAsync(url, bodyContent).ConfigureAwait(false);
 
             // if response is an invalid grant, we want to throw this exception rather than the one thrown in
             // response.EnsureSuccessStatusCode();