fix(refresh): datetime handling in tests

Author: palkerecsenyi

CHANGES.rst

@@ -10,6 +10,10 @@
 Changes
 =======
 
+Version v5.4.0 (released 2025-XX-XX)
+
+- feat: support for refresh tokens
+
 Version v5.3.1 (released 2025-10-21)
 
 - i18n: pulled translations

invenio_oauthclient/__init__.py

@@ -14,7 +14,7 @@
 from .oauth import oauth_link_external_id, oauth_unlink_external_id
 from .proxies import current_oauthclient
 
-__version__ = "5.3.1"
+__version__ = "5.4.0"
 
 __all__ = (
     "__version__",

invenio_oauthclient/config.py

@@ -357,3 +357,9 @@ class CustomOAuthRemoteApp(OAuthRemoteApp):
 login is disabled), the login view function will automatically redirect to
 that external authentication service.
 """
+
+OAUTHCLIENT_TOKEN_EXPIRES_LEEWAY = 10
+"""The number of seconds before the actual expiration of an access token from which it is considered expired.
+
+This ensures that it won't cause issues if some time passes between the check for whether the token is expired and any requests that the token is then used in.
+"""

invenio_oauthclient/models.py

@@ -148,7 +148,12 @@ def is_expired(self):
             return False
 
         leeway = current_app.config.get("OAUTHCLIENT_TOKEN_EXPIRES_LEEWAY", 10)
-        expiration_with_leeway = self.expires_at - timedelta(seconds=leeway)
+        expiration_with_leeway = (self.expires_at - timedelta(seconds=leeway)).replace(
+            # see https://docs.sqlalchemy.org/en/13/core/type_basics.html#sqlalchemy.types.DateTime
+            # We store datetimes in the DB as UTC but without timezone metadata. So to make comparison
+            # possible, we need to mark this as UTC.
+            tzinfo=timezone.utc
+        )
         return expiration_with_leeway < datetime.now(tz=timezone.utc)
 
     def __repr__(self):

tests/test_refresh.py

@@ -8,7 +8,7 @@
 
 """Test handlers."""
 import json
-from datetime import datetime
+from datetime import datetime, timezone
 
 from helpers import mock_remote_http_request
 
@@ -27,7 +27,7 @@ def test_refresh(models_fixture, app):
         "mytoken",
         "mysecret",
         refresh_token="myrefreshtoken",
-        expires_at=datetime.utcnow(),
+        expires_at=datetime.now(tz=timezone.utc),
     )
     assert rt.is_expired is True