refresh id token periodically, same as access token

[tomholub]

for #955 we will need a way to retain id_token and refresh it periodically

Currently, we retrieve it during setup and then use it to authenticate with EKM, then forget it.

I'd like it instead be remembered, same like access token

This is a preparation for #955 where soon, we'll have to be calling FlowCrypt Enterprise Server (FES) and authenticate ourselves while doing that.

[sosnovsky]

@tomholub I found that we can fetch user's idToken at any time by using GoogleUserService(currentUserEmail: "CURRENT_EMAIL", appDelegateGoogleSessionContainer: nil).idToken (like here https://github.com/FlowCrypt/flowcrypt-ios/blob/master/FlowCrypt/Functionality/Services/Remote%20Private%20Key%20Services/EmailKeyManagerApi.swift#L59)

It's already stored in GTMAppAuthFetcherAuthorization, probably it should be enough for our needs or we need to store it in another place too?

[tomholub]

That would be good news. On other platforms we always had to re-authenticate.

Does it always give you a fresh new idToken when you use GoogleUserService(currentUserEmail: "CURRENT_EMAIL", appDelegateGoogleSessionContainer: nil).idToken ? Or it gives you the cached one, and then re-fetches a new one when it expires?

GTMAppAuthFetcherAuthorization caches it automatically? For how long and where (memory / storage)

[sosnovsky]

Value is cached only in memory, but it doesn't automatically re-fetched - I just tested it:

• idToken is valid for 1 hour
• but even when it's expired GTMAppAuthFetcherAuthorization still returns cached value
• old value is returned even after app restart

So we'll need to implement manual idToken refresh on expiration, currently working on it

[tomholub]

So we'll need to implement manual idToken refresh on expiration, currently working on it

This will be using GoogleUserService(currentUserEmail: "CURRENT_EMAIL", appDelegateGoogleSessionContainer: nil).idToken which doesn't require any interaction from the user? If yes, could you find out which Google API is it using?

[sosnovsky]

Yes, I'll try to find which API we can use to make this process invisible for users

[tomholub]

When doing this on browser extension, I didn't find any API that allows that - it was necessary to re-authenticate. But if you can find it, it would be great - we could reuse it on browser extension too.