From 0c4dc597d7ed9d36451b038dce9ca67ed1523cb4 Mon Sep 17 00:00:00 2001
From: Artur Neumann <artur@jankaritech.com>
Date: Mon, 25 Sep 2023 14:29:03 +0545
Subject: [PATCH] MDL-79487 oauth2: do not delete refresh token

when `log_out` is called from `\core\oauth2\client` it will delete the refresh token,
what it actually needs to use it to get a new access token
actually logging out is not needed here, the only thing we need to make sure is,
the invalid access token is removed from the session
that is done by storing `null`
---
 lib/oauthlib.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/oauthlib.php b/lib/oauthlib.php
index 7a657eb7286..f2066644315 100644
--- a/lib/oauthlib.php
+++ b/lib/oauthlib.php
@@ -449,7 +449,7 @@ abstract class oauth2_client extends curl {
     public function is_logged_in() {
         // Has the token expired?
         if (isset($this->accesstoken->expires) && time() >= $this->accesstoken->expires) {
-            $this->log_out();
+            $this->store_token(null);
             return false;
         }