Feature: Refresh access token before it times out

[nicokaiser]

Every few minutes there are log entries on the server:

{"level":"error","service":"proxy","error":"failed to verify access token: token has invalid claims: token is expired","authenticator":"oidc","path":"/graph/v1.0/me/drives","user_agent":"Mozilla/5.0 (Macintosh) mirall/3.0.3.2073 (OpenCloud, macos-25.1.0 ClientArchitecture: arm64 OsArchitecture: arm64)","client.address":"2001:0db8:...","network.peer.address":"","network.peer.port":"","time":"2025-12-15T20:50:29Z","message":"failed to authenticate the request"}

This is basically a mirror of opencloud-eu/opencloud#919 – but since this probably needs to also be addressed in the desktop client, I'll create this issue.

Like discussed in opencloud-eu/opencloud#919 (comment) the client knows the expiration time of the token at all times (except when tokens are revoked), so requests with an expired token can be avoided.

I do not know the architecture of the apps; however with JS OAuth clients, the token's expiration time (which is always sent along with the token as expires_in) can be checked whenever the token is used, and if necessary the token must be refreshed (the desktop and mobile app request offline_access scope and thus should have a refresh token) and the new token must be used instead. (Note: avoid race conditions where the token might be requested multiple times while it is being refreshed, these need to be synchronized and queued)

[TheOneRing]

If not needed, I'd rather not change the client behaviour.
And if the only problem is a long message...

[nicokaiser]

My problem is not the log messages but rather many many unnecessary requests. And since the client already knows if a token is valid or not, it can refresh it right away instead of doing it after a 401.

[TheOneRing]

Just increase the access token lifetime ;)

I don't think the 401 request have a major impact. Changes to the authentication code often have unintended side effects.

[nicokaiser]

I consider this to be a very questionable approach: I am aware that the expires_in date is optional in OAuth, but IMO if it is there, it should be tried to consider. Spamming the server (and logs) with unnecessary 401 requests is not very sustainable and makes finding real errors much harder.

I am also aware that any changes to critical components like the auth code are risky... But on the other hand I'd really like to help fixing some obvious authentication problems in OpenCloud like this one, #767, and also issues like opencloud-eu/opencloud#1595 (and related) which cause usability problems.