Awx: OAuth2 manage commands don't delete all tokens

[rooftopcellist]

ISSUE TYPE

• Bug Report

COMPONENT NAME

• API

SUMMARY

Refresh tokens aren't being cleaned up by the cleartokens command after being revoked.

The awx-manage cleartokens command does not delete revoked refresh_tokens, letting them pile up in the database.

Possible Solutions
A. Get a patch in for DOT 1.1.3 and see if they can release a patch release. (this is fixed in 1.2.0, but that requires => django 2.0)
B. Monkey-patch the clear_expired() method in DOT, which is called by cleartokens

ENVIRONMENT

• AWX version: devel

STEPS TO REPRODUCE

1. Create an Application
2. Create an Application token (api/v2/applications/1/tokens/)
3. run awx-manage revoke_oauth2_tokens (deletes access_token)
4. run awx-manage revoke_oauth2_tokens --all (deletes refresh_token)
5. run `awx-manage cleartokens

EXPECTED RESULTS

expired access_tokens and expired refresh_tokens should be deleted.

ACTUAL RESULTS

revoked refresh_tokens are not actually deleted. (they are in DOT 1.2.0, but not in 1.1.3, which we use)

[awithrow9]

@rooftopcellist was this actually seen in production?

[rooftopcellist]

@awithrow9 This was seen by @gamuniz on a tower install.

[wenottingham]

Rephrase: was the fact that they are not deleted an issue that is causing pain, or just something we noticed in passing?

[gamuniz]

@rooftopcellist @awithrow9 they reported issues with token but i dont think this needs to be worked on now

[wenottingham]

punting to later where we can do django2.2LTS+django-oauth-toolkit-whatever and it magically(?) works?

[gamuniz]

wfm

[fosterseth]

related to issue #4710

this is how to fix it https://github.com/ansible/awx/issues/4710#issuecomment-537233492

[ryanpetrello]

Would a change like this make sense?

https://github.com/ansible/awx/issues/4710#issuecomment-537504340

[ryanpetrello]

@rooftopcellist @fosterseth is this ready for state:needs_test ?

[kdelee]

• Create an Application
• Create an Application token (api/v2/applications/1/tokens/)
• run awx-manage revoke_oauth2_tokens (deletes access_token)
• run awx-manage revoke_oauth2_tokens --all (deletes refresh_token)
• run `awx-manage cleartokens

Did above steps and saw that all tokens were revoked and then cleaned up. Closing as fixed.