feat: support upstream token refresh

backend/app/services/scheduler.py

@@ -4,6 +4,7 @@ from __future__ import annotations
 import json
 import logging
 from datetime import datetime, timezone
+from typing import Any
 
 from apscheduler.executors.pool import ThreadPoolExecutor
 from apscheduler.schedulers.background import BackgroundScheduler
@@ -12,6 +13,7 @@ from sqlalchemy.orm import Session
 from app.database import SessionLocal
 from app.models.upstream import Upstream
 from app.models.snapshot import UpstreamRateSnapshot
+from app.services.auth_config import normalize_auth_config
 from app.services.upstream_client import UpstreamClient, build_snapshot
 from app.services.snapshot_service import diff_snapshots, prune_snapshots
 from app.services import webhook_service
@@ -27,6 +29,25 @@ def get_scheduler() -> BackgroundScheduler:
     return _scheduler
 
 
+def _persist_auth_config_update(upstream: Upstream, updated_config: dict[str, Any]) -> None:
+    config_json = json.dumps(
+        normalize_auth_config(upstream.auth_type, updated_config),
+        ensure_ascii=False,
+    )
+    updated_at = datetime.now(timezone.utc)
+    db = SessionLocal()
+    try:
+        row = db.query(Upstream).filter(Upstream.id == upstream.id).first()
+        if row:
+            row.auth_config_json = config_json
+            row.updated_at = updated_at
+            db.commit()
+            upstream.auth_config_json = row.auth_config_json
+            upstream.updated_at = updated_at
+    finally:
+        db.close()
+
+
 def _check_upstream(upstream_id: int) -> None:
     """Full upstream check executed by scheduler (runs in thread).
 
@@ -55,6 +76,7 @@ def _check_upstream(upstream_id: int) -> None:
             auth_type=upstream.auth_type,
             auth_config=auth_config,
             timeout=float(upstream.timeout_seconds),
+            on_auth_config_update=lambda updated: _persist_auth_config_update(upstream, updated),
         ) as client:
             try:
                 client.login()
@@ -235,6 +257,7 @@ def _sync_upstream_keys(upstream_id: int, snapshot: dict[str, Any], captured_at:
                     auth_type=upstream.auth_type,
                     auth_config=auth_config,
                     timeout=float(upstream.timeout_seconds),
+                    on_auth_config_update=lambda updated: _persist_auth_config_update(upstream, updated),
                 ) as client:
                     client.login()
                     remote_key_ids = website_sync._fetch_remote_managed_key_ids(db, client, upstream_id)