v0.28.0

OAuth2: tokens without a refresh token

Some APIs issue a short-lived token from stored credentials and expect the client to ask again when it expires, with no refresh token. Datto RMM is one: its tokens last 100 hours, so a connector set up with the authorization-code flow stopped working after 100 hours (#1075).

• Password grant. OAuth2 connectors can now use the password grant (RFC 6749 §4.3). The connector asks the token URL with the stored username and password on its first call, again shortly before the token expires, and again when the API answers 401.
• Grant type in the forms. The connector forms have a Grant type field: Authorization code (sign in at the provider), Client credentials, or Password. With the last two there is nothing to authorize, so the Authorization URL, PKCE and "Authorize with Provider" are hidden.
• Retry after a 401. REST and GraphQL connectors now also get a new token after a 401 when the grant can get one by itself. Before, this needed a refresh token, so client-credentials connectors never retried either.
• API. PATCH /api/connectors/:id/oauth-config accepts grant, username and password. GET returns the grant and only whether a username and password are set.

Datto RMM: Grant type Password, username = API key, password = API secret, client ID public-client, client secret public, token URL https://<zone>-api.centrastage.net/auth/oauth/token, token endpoint authentication HTTP Basic. See docs/connectors/rest.md.

Other

• The backend writes a Node diagnostic report when it dies of a fatal V8 error, so a crash leaves something to look at (#1072).
• More accurate TeamSystem and Zucchetti FAQs in the satellite repositories (#1073).