### Begin of the insertion

###End of the insertion Steps to reproduce

Hard to reproduce. It happens on community instance.

### What is the buggy behavior?

* Some users lose connection to Nexcloud, because OAuth tokens are removed suddenly.


### What is the expected behavior?

1. Nextcloud OAuth tokens live longer life.

2. And users do not need complete OAuth grant flow too often.


### Environment information

**OpenProject installation type**

* [x] Hosted cloud edition 

### Diagram showing concurrent request issue.

It shows that optimistic locking is not enough. <img class="op-uc-image op-uc-image_inline" Begin of the insertionsrc="/api/v3/attachments/198142/content">End of the insertion Begin of the deletion src="/api/v3/attachments/198023/content">End of the deletion

Mermaid diagram source code.

```mermaid
sequenceDiagram
participant OP1 as OpenProject Process 1
participant OP2 as OpenProject Process 2
participant OPDB as OpenProject DB
participant NC as Nextcloud

OP1->>OPDB: Get Token
OPDB->>OP1: Return Token! Begin of the insertion

End of the insertion Begin of the deletion
End of the deletion OP2->>OPDB: Get Token
OPDB->>OP2: Return Token! Begin of the insertion

End of the insertion Begin of the deletion
End of the deletion OP1->>NC: FileInfo Req
Begin of the deletion # Note over NC,OP1: A typical interaction
End of the deletion NC->>OP1: FileInfo Resp Auth Failed
OP1->>NC: RefreshToken Req
NC->>OP1: RefreshToken Resp Success Begin of the insertion
OP1->>NC:End of the insertion Begin of the deletion

OP2->>NC:End of the deletion FileInfo Req
Begin of the deletion #End of the deletion Note over Begin of the insertionOP1,NC: Success because token is new.End of the insertion Begin of the deletion NC,OP1: A typical interactionEnd of the deletion
Begin of the insertionNC->>OP1: FileInfo Resp Auth Success
OP2->>NC: FileInfo Req

End of the insertion NC->>OP2: FileInfo Resp Auth Failed Begin of the insertion
End of the insertion Begin of the deletion

End of the deletion OP2->>NC: RefreshToken Req
NC->>OP2: RefreshToken Resp Failed

OP2->>OPDB: Destroy Token
OPDB->>OP2: Destroy Token Success
Note over OP2,OPDB: Success due to nothing to prevent that. <br>Optimistic lock does not help.

OP1->>OPDB: Update Token
OPDB->>OP1: Update Token Failure
Note over OP1,OPDB: Failure because token has been destroyed. <br> ActiveRecord::StaleObject if optimistic locking is on.

OP2->>OP2: Return unauthorized response
OP1->>OP1: Return 409 Conflict response
``` Begin of the insertion

### AppSignal logs links

[https://appsignal.com/openproject-gmbh/sites/66b224a4d30d867bed8a1772/logs?sourceIds=66b224a5d30d867bed8a1777&amp;query=OAuthClientToken&amp;timeframe=R7D&amp;from=2024-09-10T09%3A53%3A00.000Z&amp;to=2024-09-10T11%3A53%3A00.000Z](https://appsignal.com/openproject-gmbh/sites/66b224a4d30d867bed8a1772/logs?sourceIds=66b224a5d30d867bed8a1777&query=OAuthClientToken&timeframe=R7D&from=2024-09-10T09%3A53%3A00.000Z&to=2024-09-10T11%3A53%3A00.000Z)

https://appsignal.com/openproject-gmbh/sites/66b224a4d30d867bed8a1772/logs?sourceIds=66b224a5d30d867bed8a1777&amp;query=Error%20while%20refreshing%20OAuth%20token.&amp;timeframe=R7D&amp;from=2024-09-10T09%3A53%3A00.000Z&amp;to=2024-09-10T11%3A53%3A00.000ZEnd of the insertion