[AkshayShah03]

Link to Issue or Description of Change

1. Link to an existing issue (if applicable):

• Closes: OAuth2: expired token without a refresh token crashes the tool with AttributeError (always for client credentials) #7728

Problem:
OAuth2CredentialRefresher.refresh calls client.refresh_token(..., refresh_token=None) when the expired token has no refresh token. authlib then raises AttributeError: 'NoneType' object has no attribute 'get', which is not caught, so the tool call fails. This happens every time a client-credentials token expires (that grant has no refresh token), and for user tokens from providers that don't issue one.

Solution:

• OAuth2CredentialRefresher.refresh: when there is no refresh token, log a warning and return the original credential, the same as for a failed refresh (and as the docstring says).
• CredentialManager._refresh_credential: for the client credentials flow, when the stored token has expired and has no refresh token, run the exchange again on a copy of the raw client credentials to get a new token. If that exchange fails, the stored credential is returned and not re-saved. The shared raw_auth_credential is not mutated.

Other flows keep the current behaviour after a refresh that can't happen: the stale token is returned, so the tool's 401 handling (for example RestApiTool) asks the user to authorize again.

Testing Plan

Unit Tests:

• I have added or updated unit tests for my change.
• All unit tests pass locally.

Added:

• test_refresh_without_refresh_token_returns_original_and_logs in tests/unittests/auth/refresher/test_oauth2_credential_refresher.py. It uses a real authlib session; on main it fails with the AttributeError.
• test_get_auth_credential_refetches_expired_client_credentials_token in tests/unittests/auth/test_credential_manager.py, for an OAuth2 client-credentials scheme and an OIDC scheme with client_credentials in grant_types_supported. A stored, expired client-credentials token is replaced by a newly fetched one and saved; refresh_token() is not called, and the shared raw credential is unchanged. On main both cases fail because refresh_token() is called without a refresh token.
• test_get_auth_credential_refreshes_client_credentials_token_with_refresh_token: a client-credentials token that does have a refresh token is still refreshed (not re-fetched). This passes on main too; it guards the existing path.

$ pytest tests/unittests/auth
344 passed

$ pytest -n auto tests/unittests/auth tests/unittests/tools tests/unittests/a2a tests/unittests/integrations
6097 passed, 60 skipped, 1 failed

The one failure, integrations/vmaas/test_agent_engine_environment.py::test_reading_directory_raises, also fails on main without this change.

pyink and isort report no changes.

Manual End-to-End (E2E) Tests:

Ran CredentialManager.get_auth_credential with a stored expired token (no refresh token), with OAuth2Session.request patched to a fake token endpoint:

• on main: both the authorization-code and client-credentials schemes raise AttributeError: 'NoneType' object has no attribute 'get', with no HTTP request made.
• with this change: authorization code returns the stored token with a warning; client credentials makes one grant_type=client_credentials request and returns the new token.

The snippet in #7728 prints AttributeError on main and returned: expired with this change.

Also ran CredentialManager.get_auth_credential against a real IdP: a local Keycloak 26.0.7 (realm with a confidential client and a user). Each stored token was marked expired, and the new token was checked with Keycloak's introspection endpoint. Keycloak's client-credentials grant returns no refresh_token, as expected.

Case	main	This PR
OAuth2 client credentials, expired, no refresh token	AttributeError	new token, active
OIDC (client_credentials in grant_types_supported), expired, no refresh token	AttributeError	new token, active
Authorization code, expired, with refresh token	refreshed, active	refreshed, active (unchanged)
Authorization code, expired, no refresh token	AttributeError	stored token returned
Authorization code, refresh token revoked (invalid_grant)	stored token returned	stored token returned (unchanged; that's #7730)

Checklist

• I have read the CONTRIBUTING.md document.
• I have performed a self-review of my own code.
• I have commented my code, particularly in hard-to-understand areas.
• I have added tests that prove my fix is effective or that my feature works.
• New and existing unit tests pass locally with my changes.
• I have manually tested my changes end-to-end.
• Any dependent changes have been merged and published in downstream modules.