feat: [sc-321393] support refresh token rotation

custom-recipes/api-connect/recipe.json

@@ -40,6 +40,7 @@
             "defaultValue": null,
             "selectChoices":[
                 {"value": "secure_oauth", "label": "SSO"},
+                {"value": "secure_oauth_refresh_token_rotation", "label": "SSO (token rotation)"},
                 {"value": "secure_basic", "label": "Secure username / password"},
                 {"value": null, "label": "Other"}
             ]
@@ -58,6 +59,13 @@
             "parameterSetId": "secure-oauth",
             "visibilityCondition": "model.auth_type == 'secure_oauth'"
         },
+        {
+            "name": "secure_oauth_refresh_token_rotation",
+            "label": "SSO preset (token rotation)",
+            "type": "PRESET",
+            "parameterSetId": "secure-oauth-refresh-token-rotation",
+            "visibilityCondition": "model.auth_type == 'secure_oauth_refresh_token_rotation'"
+        },
         {
             "name": "secure_basic",
             "label": "Credential preset",

parameter-sets/secure-oauth-refresh-token-rotation/parameter-set.json

@@ -0,0 +1,80 @@
+{
+    "meta" : {
+        "label": "Secure SSO with rotation",
+        "description": "With refresh token rotation",
+        "icon": "icon-puzzle-piece"
+    },
+    "defaultDefinableInline": false,
+    "defaultDefinableAtProjectLevel": false,
+    "pluginParams": [
+    ],
+
+    "params": [
+        {
+            "name": "secure_token",
+            "type": "CREDENTIAL_REQUEST",
+            "label": "Single Sign On",
+            "credentialRequestSettings": {
+                "type": "OAUTH2",
+                "authorizationEndpoint": " ",
+                "tokenEndpoint": " ",
+                "scope": " ",
+                "refreshTokenRotation": true
+            }
+        },
+        {
+            "name": "authorizationEndpoint",
+            "label": "Authorization endpoint",
+            "type": "STRING",
+            "description": "",
+            "mandatory": false
+        },
+        {
+            "name": "tokenEndpoint",
+            "label": "Token endpoint",
+            "type": "STRING",
+            "description": "",
+            "mandatory": false
+        },
+        {
+            "name": "scope",
+            "label": "Scope",
+            "type": "STRING",
+            "description": "",
+            "mandatory": false
+        },
+        {
+            "name": "secure_domain",
+            "label": "Domain",
+            "description": "",
+            "type": "STRING"
+        },
+        {
+            "name": "use_mtls",
+            "label": "Use mTLS",
+            "description": "",
+            "type": "BOOLEAN",
+            "defaultValue": false
+        },
+        {
+            "type": "SEPARATOR",
+            "label": "Warning",
+            "description": "1 - Restricting access to this presset will not restrict access to the certificate and key files. This has to be done by setting the appropriate access rights on these two files.\n2 - Because the OAuth flow is not controled by the plugin, mTLS cannot be used for the retrieving the access token itself.",
+            "visibilityCondition": "model.use_mtls==true"
+        },
+        {
+            "name": "mtls_certificate_path",
+            "label": "Path to certificate",
+            "description": "or full certificate starting with -----BEGIN and ending with END CERTIFICATE-----",
+            "type": "PASSWORD",
+            "visibilityCondition": "model.use_mtls==true"
+        },
+        {
+            "name": "mtls_key_path",
+            "label": "Path to key",
+            "description": "or full key starting with -----BEGIN and ending with END PRIVATE KEY-----",
+            "type": "PASSWORD",
+            "visibilityCondition": "model.use_mtls==true"
+        }
+    ]
+}

python-connectors/api-connect_dataset/connector.json

@@ -19,6 +19,7 @@
             "defaultValue": null,
             "selectChoices":[
                 {"value": "secure_oauth", "label": "SSO"},
+                {"value": "secure_oauth_refresh_token_rotation", "label": "SSO (token rotation)"},
                 {"value": "secure_basic", "label": "Secure username / password"},
                 {"value": null, "label": "Other"}
             ]
@@ -37,6 +38,13 @@
             "parameterSetId": "secure-oauth",
             "visibilityCondition": "model.auth_type == 'secure_oauth'"
         },
+        {
+            "name": "secure_oauth_refresh_token_rotation",
+            "label": "SSO preset (token rotation)",
+            "type": "PRESET",
+            "parameterSetId": "secure-oauth-refresh-token-rotation",
+            "visibilityCondition": "model.auth_type == 'secure_oauth_refresh_token_rotation'"
+        },
         {
             "name": "secure_basic",
             "label": "Credential preset",

python-lib/dku_utils.py

@@ -68,6 +68,12 @@ def get_secure_credentials(configuration):
         secure_oauth = configuration.get("secure_oauth", {})
         secure_credentials["token"] = secure_oauth.pop("secure_token")
         secure_credentials.update(secure_oauth)
+
+    if auth_type == "secure_oauth_refresh_token_rotation":
+        secure_credentials["login_type"] = "bearer_token"
+        secure_oauth = configuration.get("secure_oauth_refresh_token_rotation", {})
+        secure_credentials["token"] = secure_oauth.pop("secure_token")
+        secure_credentials.update(secure_oauth)
     return secure_credentials