Repository: hwi/HWIOAuthBundle (php)

Issue:
Refreshed Token gets createdAt from expiredToken
| Q                 | A
| ------------------| ---
| Bug?              | yes
| New Feature?      | no
| Support question? | no|yes
| Version           | 1.4 / 2.x


#### Actual Behavior

I am using onKernelRequest Listener and refresh token after current token is expired (every 5 min).
And a new refreshed token gets in `createOAuthToken` function the createdAt date from the old expired token.
 
#### Expected Behavior

The new token must not take over the values from old token.

#### Steps to Reproduce

add kernel listener:
```php
public function onKernelRequest(RequestEvent $event): void
{
    if (false === $event->isMainRequest()) {
        return;
    }

    if (null === $token = $this->tokenStorage->getToken()) {
        return;
    }

    if (!$token instanceof OAuthToken) {
        return;
    }

    if (false === $token->isExpired()) {
        return;
    }

    $token->setAuthenticated(false);

    try {
        $newToken = $this->oAuthProvider->authenticate($token);
    } catch (AuthenticationException $e) {
        $newToken = null;
        if (!$event->getRequest()->isXmlHttpRequest()) {
            throw $e;
        }
    }

    $this->tokenStorage->setToken($newToken);
}
```

#### Possible Solutions

may be revert this class to v.1.3?


Pull request:
Don't re-use creation date from previous token if was already expired  in `OAuthProvider`
Fixes #1767.

Patch:
diff --git a/Security/Core/Authentication/Provider/OAuthProvider.php b/Security/Core/Authentication/Provider/OAuthProvider.php
index da6765b..5c2f22f 100644
--- a/Security/Core/Authentication/Provider/OAuthProvider.php
+++ b/Security/Core/Authentication/Provider/OAuthProvider.php
@@ -149,7 +149,7 @@ class OAuthProvider implements AuthenticationProviderInterface
         $token->setResourceOwnerName($oldToken->getResourceOwnerName());
         $token->setUser($user);
         $token->setAuthenticated(true);
-        $token->setCreatedAt($oldToken->getCreatedAt());
+        $token->setCreatedAt($oldToken->isExpired() ? time() : $oldToken->getCreatedAt());
 
         // Don't use old data if newer was already set
         if (!$token->getRefreshToken()) {


Test patch:
diff --git a/Tests/Security/Core/Authentication/Provider/OAuthProviderTest.php b/Tests/Security/Core/Authentication/Provider/OAuthProviderTest.php
index d367d0d..d1372f8 100644
--- a/Tests/Security/Core/Authentication/Provider/OAuthProviderTest.php
+++ b/Tests/Security/Core/Authentication/Provider/OAuthProviderTest.php
@@ -148,7 +148,7 @@ class OAuthProviderTest extends TestCase
         try {
             $oauthProvider->authenticate($oauthToken);
 
-            $this->assertTrue(false, 'Exception was not thrown.');
+            $this->fail('Exception was not thrown.');
         } catch (OAuthAwareException $e) {
             $this->assertTrue(true, 'Exception was thrown.');
             $this->assertInstanceOf(OAuthAwareExceptionInterface::class, $e);
@@ -176,7 +176,7 @@ class OAuthProviderTest extends TestCase
         $refreshedToken = [
             'access_token' => 'access_token_new',
             'refresh_token' => 'refresh_token',
-            'expires_in' => '666_new',
+            'expires_in' => '777',
             'oauth_token_secret' => 'secret_new',
         ];