Refresh session tokens

[axelson]

Refreshes Application Session tokens after they expire in an hour

Fixes ex-aws#1100

AWS SSO has two different session concepts, Application Session tokens and a sign in session:
https://docs.aws.amazon.com/singlesignon/latest/userguide/authconcept.html#sessionsconcept

Depending on the configured expiration time for the aws sso login session can be valid for up to 90 days, while the "application session" token which is always only valid for 1 hour (I assume this is a security measure so the session can be revoked without waiting a full 90 days). While the sign in session is valid, the refresh token can be used to generate new application session tokens for up to the full 90 days.

So we can use the refresh token to retrieve another Application Session token with the CreateToken call: https://docs.aws.amazon.com/singlesignon/latest/OIDCAPIReference/API_CreateToken.html

Here's the base url: "https://oidc.#{region}.amazonaws.com/token"

And here's an example of the payload (where the sso_cache is from ~/.aws/sso/cache):

payload = %{
  "grantType" => "refresh_token",
  "clientId" => sso_cache["clientId"],
  "clientSecret" => sso_cache["clientSecret"],
  "refreshToken" => sso_cache["refreshToken"]
}

TODO:

• Clean up so it can be upstreamed (improve expiration detection)
• Should we be writing the updated token back into the cache?