From d4709d817eb15b79ddd4df4ae3d2d77d342c073b Mon Sep 17 00:00:00 2001
From: Artur Neumann <artur@jankaritech.com>
Date: Mon, 25 Sep 2023 14:29:03 +0545
Subject: [PATCH] MDL-79487 oauth2: do not delete refresh token

when `log_out` is called from `\core\oauth2\client` it will delete the refresh token,
what it actually needs to use it to get a new access token
actually logging out is not needed here, the only thing we need to make sure is,
the invalid access token is removed from the session
that is done by storing `null`
---
 lib/oauthlib.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/oauthlib.php b/lib/oauthlib.php
index 8fe9edd3a99..00950048581 100644
--- a/lib/oauthlib.php
+++ b/lib/oauthlib.php
@@ -462,7 +462,7 @@ abstract class oauth2_client extends curl {
     public function is_logged_in() {
         // Has the token expired?
         if (isset($this->accesstoken->expires) && time() >= $this->accesstoken->expires) {
-            $this->log_out();
+            $this->store_token(null);
             return false;
         }