From cd61f2e4598cfbaff948cbd07c2b7a8c9a881a84 Mon Sep 17 00:00:00 2001
From: Julien WITTOUCK <julien@codeka.io>
Date: Sun, 13 Sep 2026 11:20:09 +0200
Subject: [PATCH] =?UTF-8?q?=F0=9F=90=9B=20:=20correct=20refresh-token=20pr?=
 =?UTF-8?q?e-requisites?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

refresh token needed the authorized client to be loaded
---
 .../classrooms/gitlab/GitlabApiFactory.java   | 21 +++++++++++++------
 1 file changed, 15 insertions(+), 6 deletions(-)

diff --git a/src/main/java/fr/univ_lille/gitlab/classrooms/gitlab/GitlabApiFactory.java b/src/main/java/fr/univ_lille/gitlab/classrooms/gitlab/GitlabApiFactory.java
index 4c72fc6..b3297a7 100644
--- a/src/main/java/fr/univ_lille/gitlab/classrooms/gitlab/GitlabApiFactory.java
+++ b/src/main/java/fr/univ_lille/gitlab/classrooms/gitlab/GitlabApiFactory.java
@@ -8,6 +8,7 @@ import org.slf4j.LoggerFactory;
 import org.springframework.security.oauth2.client.ClientAuthorizationRequiredException;
 import org.springframework.security.oauth2.client.OAuth2AuthorizeRequest;
 import org.springframework.security.oauth2.client.OAuth2AuthorizedClientManager;
+import org.springframework.security.oauth2.client.OAuth2AuthorizedClientService;
 import org.springframework.stereotype.Component;
 
 @Component
@@ -17,11 +18,14 @@ class GitlabApiFactory {
 
     private final OAuth2AuthorizedClientManager oAuth2AuthorizedClientManager;
 
+    private OAuth2AuthorizedClientService oAuth2AuthorizedClientService;
+
     private static final Logger LOGGER = LoggerFactory.getLogger(GitlabApiFactory.class);
 
-    public GitlabApiFactory(GitlabProperties gitlabProperties, OAuth2AuthorizedClientManager oAuth2AuthorizedClientManager) {
+    public GitlabApiFactory(GitlabProperties gitlabProperties, OAuth2AuthorizedClientManager oAuth2AuthorizedClientManager, OAuth2AuthorizedClientService oAuth2AuthorizedClientService) {
         this.gitlabProperties = gitlabProperties;
         this.oAuth2AuthorizedClientManager = oAuth2AuthorizedClientManager;
+        this.oAuth2AuthorizedClientService = oAuth2AuthorizedClientService;
     }
 
     /**
@@ -31,17 +35,22 @@ class GitlabApiFactory {
      * @return
      */
     public GitLabApi userGitlabApi(ClassroomUser user) {
-        var oauth2AuthorizedRequest = OAuth2AuthorizeRequest
-                .withClientRegistrationId("gitlab")
-                .principal(user.getName())
-                .build();
+
         var client = new GitLabApi(gitlabProperties.url(), Constants.TokenType.OAUTH2_ACCESS, "");
         client.setAuthTokenSupplier(() -> {
             try {
+                // load authorized client from database
+                var authorizedClient = oAuth2AuthorizedClientService.loadAuthorizedClient("gitlab", user.getName());
+                var oauth2AuthorizedRequest = OAuth2AuthorizeRequest
+                        .withAuthorizedClient(authorizedClient)
+                        .principal(user.getName())
+                        .build();
+                // re-authenticate client (this may renew the token using refresh-token)
                 var oauth2Client = oAuth2AuthorizedClientManager.authorize(oauth2AuthorizedRequest);
+
                 LOGGER.debug("Access token for user '{}' is {}", user.getName(), oauth2Client.getAccessToken().getTokenValue());
                 return oauth2Client.getAccessToken().getTokenValue();
-            } catch (ClientAuthorizationRequiredException e) {
+            } catch (IllegalArgumentException | ClientAuthorizationRequiredException e) {
                 LOGGER.error("Unable to get an access token for user '{}'", user.getName());
                 throw new GitLabAuthenticationException("Unable to get an access token for user '%s'".formatted(user.getName()));
             }
-- 
2.51.2