feat: implement Instagram-specific OAuth2 refresh token logic

Author: YueTwo

backend/aci/server/oauth2_manager.py

@@ -202,6 +202,7 @@ async def fetch_token(
                         f"Missing access_token in Instagram OAuth response, app={self.app_name}"
                     )
                     raise OAuth2Error("Missing access_token in Instagram OAuth response")
+
             # return the token response with long-lived access token
             return token
         except Exception as e:
@@ -210,15 +211,28 @@ async def fetch_token(
 
     async def refresh_token(
         self,
+        access_token: str,
         refresh_token: str,
     ) -> dict[str, Any]:
         try:
-            token = cast(
-                dict[str, Any],
-                await self.oauth2_client.refresh_token(
-                    self.refresh_token_url, refresh_token=refresh_token
-                ),
-            )
+            if self.app_name == "INSTAGRAM":
+                response = await self.oauth2_client.get(
+                    self.refresh_token_url,
+                    params={
+                        "grant_type": "ig_refresh_token",
+                        "access_token": access_token,
+                    },
+                    timeout=30.0,
+                )
+                response.raise_for_status()
+                token = cast(dict[str, Any], response.json())
+            else:
+                token = cast(
+                    dict[str, Any],
+                    await self.oauth2_client.refresh_token(
+                        self.refresh_token_url, refresh_token=refresh_token
+                    ),
+                )
             return token
         except Exception as e:
             logger.error(f"Failed to refresh access token, app_name={self.app_name}, error={e}")
@@ -253,7 +267,11 @@ async def parse_fetch_token_response(self, token: dict) -> OAuth2SchemeCredentia
         if "expires_at" in data:
             expires_at = int(data["expires_at"])
         elif "expires_in" in data:
-            expires_at = int(time.time()) + int(data["expires_in"])
+            if self.app_name == "INSTAGRAM":
+                # Reduce expiration time by 1 day (86400 seconds) for safety margin
+                expires_at = int(time.time()) + max(0, int(data["expires_in"]) - 86400)
+            else:
+                expires_at = int(time.time()) + int(data["expires_in"])
 
         # TODO: if scope is present, check if it matches the scope in the App Configuration
 

backend/aci/server/security_credentials_manager.py

@@ -97,6 +97,7 @@ async def _get_oauth2_credentials(
         linked_account.security_credentials
     )
     if _access_token_is_expired(oauth2_scheme_credentials):
+        # Instagram's access token only could be refreshed with a valid access token, so we need to re-authorize
         if app.name == "INSTAGRAM":
             logger.error(
                 f"Access token expired, please re-authorize, linked_account_id={linked_account.id}, "
@@ -120,7 +121,11 @@ async def _get_oauth2_credentials(
         if "expires_at" in token_response:
             expires_at = int(token_response["expires_at"])
         elif "expires_in" in token_response:
-            expires_at = int(time.time()) + int(token_response["expires_in"])
+            if app.name == "INSTAGRAM":
+                # Reduce expiration time by 1 day (86400 seconds) for safety margin
+                expires_at = int(time.time()) + max(0, int(token_response["expires_in"]) - 86400)
+            else:
+                expires_at = int(time.time()) + int(token_response["expires_in"])
 
         if not token_response.get("access_token") or not expires_at:
             logger.error(
@@ -155,6 +160,8 @@ async def _refresh_oauth2_access_token(
     app_name: str, oauth2_scheme: OAuth2Scheme, oauth2_scheme_credentials: OAuth2SchemeCredentials
 ) -> dict:
     refresh_token = oauth2_scheme_credentials.refresh_token
+    access_token = oauth2_scheme_credentials.access_token
+
     if not refresh_token:
         raise OAuth2Error("no refresh token found")
 
@@ -172,7 +179,7 @@ async def _refresh_oauth2_access_token(
         custom_data=oauth2_scheme.custom_data,
     )
 
-    return await oauth2_manager.refresh_token(refresh_token)
+    return await oauth2_manager.refresh_token(refresh_token, access_token)
 
 
 def _get_api_key_credentials(