Check user code expiry and invalidity

[antoinelauzon-bell]

It ensures that a user code is neither expired nor invalidated during the verification step. See gh-1894 and gh-1977 for more details.

Notes:

• invalidat_grant appears to be the expected error code (see  RFC 6749, Section 5.2). It might be useful to distinguish these exceptions though (e.g. by using subclasses of OAuth2AuthenticationException).
• A small gap remains where a user could verify a user code in the final seconds before it expires, leasing to an expired device code on the next poll from the initial device. This scenario would require very unlucky timing.

[OrangeDog]

Would it not be better to just check isActive()? Not only is it less code, but it also covers cases you have missed.

[colin-riddell]

Is it worth providing more context on the error..

Suggested change

	throw new OAuth2AuthenticationException(OAuth2ErrorCodes.INVALID_GRANT);
	OAuth2Error error = new OAuth2Error(OAuth2ErrorCodes.INVALID_GRANT, "User code is expired.", null);
	throw new OAuth2AuthenticationException(error);

[colin-riddell]

Is it worth providing more context on the error..

Suggested change

	throw new OAuth2AuthenticationException(OAuth2ErrorCodes.INVALID_GRANT);
	OAuth2Error error = new OAuth2Error(OAuth2ErrorCodes.INVALID_GRANT, "User code is invalidated.", null);
	throw new OAuth2AuthenticationException(error);

[jgrandja]

@antoinelauzon-bell Apologies for the late response but I've been busy preparing for the 1.5 release this Tuesday. I will likely review this next week.

[jgrandja]

Thanks for this fix @antoinelauzon-bell. Please see review comment.

Also, please update copyright year for all files and rebase off of 1.3.x.

Thanks.

[jgrandja]

Please combine the 2 checks as follows:

if (!userCode.isActive()) {
	if (!userCode.isInvalidated()) {
		// Invalidate the user code
		authorization = OAuth2Authorization.from(authorization).invalidate(userCode.getToken()).build();
		this.authorizationService.save(authorization);
	}
	throw new OAuth2AuthenticationException(OAuth2ErrorCodes.INVALID_GRANT);
}

And adjust the tests as necessary.

[antoinelauzon-bell]

Thanks for the review, see last commit with the changes. A log might be relevant (see @colin-riddell's comment above). Let me know what you think.

[jgrandja]

Thanks for the updates @antoinelauzon-bell. This is now merged.