Dropbox: Retrieves & uses refresh token to obtain new access token

.github/workflows/test-and-lint.yml

@@ -24,7 +24,7 @@ jobs:
       - name: Run jaribu tests   # These must be replaced before we can use Node v18 in CI
         run: npm test
       - name: Run mocha tests
-        run: npm run test:mocha
+        run: npm run test:mocha -- --exit
       - name: Run linter
         run: npm run lint:quiet
       - name: Run webpack

doc/contributing/internals/discovery-bootstrap.rst

@@ -28,4 +28,9 @@ the user to that URL. When the dance comes back, the library will detect
 the ``access_token`` from the window location during the page load, and
 from that point onwards, the remote is connected.
 
+If the OAuth flow is PKCE, the window location will contain a ``code``
+parameter instead of ``access_token``. RS then makes a fetch to
+remote.TOKEN_URL with the code, to retrieve the access token, and possibly
+a refresh token as well.
+
 .. _storage-first section: https://tools.ietf.org/html/draft-dejong-remotestorage-09#section-11

doc/getting-started/dropbox-and-google-drive.rst

@@ -37,10 +37,15 @@ Dropbox
 An app key can be obtained by `registering your app
 <https://www.dropbox.com/developers/apps>`_.
 
-* Create a new app for the "Dropbox API", with "Full Dropbox access"
+* Create a new "scoped" app for the "Dropbox API", with these scopes:
+    * account_info.read
+    * files.metadata.read
+    * files.metadata.write
+    * files.content.read
+    * files.content.write
 * You need to set one or more OAuth2 redirect URIs for all routes a user can
-  connect from, for example ``http://localhost:8000/`` for an app you are
-  developing locally.
+  connect from, for example ``http://localhost:8000`` for an app you are
+  developing locally.  If the path is '/', remoteStorage drops it.
 
 Known issues
 ^^^^^^^^^^^^