Revert revisit token revocation

hq_superset/models.py

@@ -1,3 +1,4 @@
+import time
 from dataclasses import dataclass
 from typing import Any
 
@@ -6,6 +7,7 @@
     OAuth2TokenMixin,
 )
 from cryptography.fernet import MultiFernet
+from sqlalchemy import update
 from superset import db
 
 from .const import OAUTH2_DATABASE_NAME
@@ -76,6 +78,17 @@ def set_client_secret(self, plaintext):
     def check_client_secret(self, plaintext):
         return self.get_client_secret() == plaintext
 
+    def revoke_tokens(self):
+        revoked_at = int(time.time())
+        stmt = (
+            update(OAuth2Token)
+            .where(OAuth2Token.client_id == self.client_id)
+            .where(OAuth2Token.access_token_revoked_at == 0)
+            .values(access_token_revoked_at=revoked_at)
+        )
+        db.session.execute(stmt)
+        db.session.commit()
+
 
 class OAuth2Token(db.Model, OAuth2TokenMixin):
     __bind_key__ = OAUTH2_DATABASE_NAME

hq_superset/oauth2_server.py

@@ -18,6 +18,7 @@
 
 def save_token(token: dict, request: FlaskOAuth2Request) -> None:
     client = request.client
+    client.revoke_tokens()
 
     token = OAuth2Token(
         client_id=client.client_id,

hq_superset/tasks.py

@@ -1,9 +1,10 @@
 import os
 
 from superset.extensions import celery_app
+from sqlalchemy import delete
 
 from .exceptions import TableMissing
-from .models import DataSetChange
+from .models import DataSetChange, OAuth2Token, db
 from .services import AsyncImportHelper, refresh_hq_datasource
 
 
@@ -26,3 +27,13 @@ def process_dataset_change(request_json):
         change.update_dataset()
     except TableMissing:
         pass
+
+
+# ToDo: schedule this to run once every week/day
+def delete_revoked_tokens():
+    stmt = (
+        delete(OAuth2Token)
+        .where(OAuth2Token.access_token_revoked_at != 0)
+    )
+    db.session.execute(stmt)
+    db.session.commit()