fix(cloud_federation_api): allow multiple access tokens per refresh token

A refresh token may back several concurrent access tokens. E.g. in a multi
protocol share for a webapp the webdav mount and the webapp launcher exchange
the same secret, so the exchange must not assume a single mapping.

Drop the revoke-previous step and the findByRefreshToken (findEntity) lookup, which threw
MultipleObjectsReturnedException once more than one access token existed.
Expiry and unshare cleanup revoke the tokens instead.

Assisted-by: ClaudeCode:claude-fable-5

Signed-off-by: Micke Nordin <kano@sunet.se>

Author: mickenordin

apps/cloud_federation_api/lib/Controller/TokenController.php

@@ -177,20 +177,10 @@ public function accessToken(string $grant_type = '', string $code = ''): DataRes
 				$this->tokenProvider->updateToken($token);
 			}
 
-			// Revoke the previous access token for this refresh token, if any.
-			$existingMapping = $this->ocmTokenMapMapper->findByRefreshToken($refreshToken);
-			if ($existingMapping !== null) {
-				try {
-					$this->tokenProvider->invalidateTokenById(
-						$token->getUID(),
-						$existingMapping->getAccessTokenId()
-					);
-				} catch (\Exception) {
-					// Token may already be gone; ignore.
-				}
-				$this->ocmTokenMapMapper->delete($existingMapping);
-			}
-
+			// A refresh token may back several concurrent access tokens (e.g. the
+			// webdav mount and the webapp launcher exchange the same secret), so
+			// each exchange issues a fresh one and leaves the others in place;
+			// expiry and unshare cleanup revoke them.
 			$share = $this->shareManager->getShareByToken($refreshToken);
 			// access_token TTL from the refresh-token scope; default 3600, clamped 300..86400.
 			$ttl = (int)($token->getScopeAsArray()['ocm_access_token_ttl'] ?? 3600);

apps/cloud_federation_api/lib/Db/OcmTokenMapMapper.php

@@ -33,22 +33,6 @@ public function getByAccessTokenId(int $accessTokenId): OcmTokenMap {
 		return $this->findEntity($qb);
 	}
 
-	/**
-	 * Find the current mapping for a given refresh token, if any.
-	 */
-	public function findByRefreshToken(string $refreshToken): ?OcmTokenMap {
-		$qb = $this->db->getQueryBuilder();
-		$qb->select('*')
-			->from($this->getTableName())
-			->where($qb->expr()->eq('refresh_token', $qb->createNamedParameter($refreshToken)));
-
-		try {
-			return $this->findEntity($qb);
-		} catch (DoesNotExistException) {
-			return null;
-		}
-	}
-
 	/**
 	 * All mappings for a refresh token. Unlike findByRefreshToken this
 	 * tolerates the duplicate rows a concurrent exchange can create.

apps/cloud_federation_api/tests/Controller/TokenControllerTest.php

@@ -116,10 +116,6 @@ private function configureHappyPath(
 			->with($refreshToken)
 			->willReturn($refreshTokenMock);
 
-		$this->ocmTokenMapMapper->method('findByRefreshToken')
-			->with($refreshToken)
-			->willReturn(null);
-
 		$share = $this->createMock(IShare::class);
 		$share->method('getShareOwner')->willReturn($shareOwner);
 		$share->method('getSharedWith')->willReturn($sharedWith);
@@ -182,6 +178,26 @@ public function testAccessTokenSuccess(): void {
 		$this->assertSame(1000000 + 3600, $decoded->exp);
 	}
 
+	public function testAccessTokenDoesNotRevokeExistingTokens(): void {
+		$signedRequest = $this->createMock(IIncomingSignedRequest::class);
+		$signedRequest->method('getOrigin')->willReturn('remote.example.com');
+		$this->signatureManager->method('getIncomingSignedRequest')
+			->with($this->signatoryManager)
+			->willReturn($signedRequest);
+
+		$this->configureHappyPath('valid-refresh-token', 123, 'testuser', 'owner', 'sharee@remote.example.com', 'fixedjtivalue00');
+
+		// A refresh token may back multiple concurrent access tokens, so an
+		// exchange only adds one and never revokes or deletes an existing one.
+		$this->tokenProvider->expects($this->never())->method('invalidateTokenById');
+		$this->ocmTokenMapMapper->expects($this->never())->method('delete');
+		$this->ocmTokenMapMapper->expects($this->once())->method('insert');
+
+		$result = $this->controller->accessToken('authorization_code', 'valid-refresh-token');
+
+		$this->assertEquals(Http::STATUS_OK, $result->getStatus());
+	}
+
 	public function testAccessTokenLocksRefreshTokenToExchangeOnly(): void {
 		$signedRequest = $this->createMock(IIncomingSignedRequest::class);
 		$signedRequest->method('getOrigin')->willReturn('remote.example.com');