Take into account expiration time when comparing tokens.

common/auth/internal/common.go

 // Copyright 2015 The LUCI Authors. All rights reserved.
 // Use of this source code is governed under the Apache License, Version 2.0
 // that can be found in the LICENSE file.
 
 // Package internal contains code used internally by common/auth.
 package internal
 
 import (
         "bytes"
         "reflect"
@@ skipping 179 matching lines @@
         }
         if t.Expiry.After(deadline.Add(expiryRandInterval)) {
                 // Definitely expires much later than 'lifetime', no need to involve RNG.
                 return false
         }
         // Semi-randomly declare it as expired.
         rnd := time.Duration(mathrand.Int63n(ctx, int64(expiryRandInterval)))
         return t.Expiry.Before(deadline.Add(rnd))
 }
 
-// EqualTokens returns true if both token object have same access token.
+// EqualTokens returns true if tokens are equal.
 //
 // 'nil' token corresponds to an empty access token.
 func EqualTokens(a, b *oauth2.Token) bool {
         if a == b {
                 return true
         }
-        aTok := ""
-        if a != nil {
-                aTok = a.AccessToken
+        if a == nil {
+                a = &oauth2.Token{}
         }
-        bTok := ""
-        if b != nil {
-                bTok = b.AccessToken
+        if b == nil {
+                b = &oauth2.Token{}
         }
-        return aTok == bTok
+        return a.AccessToken == b.AccessToken && a.Expiry.Equal(b.Expiry)
 }
 
 // isBadTokenError sniffs out HTTP 400/401 from token source errors.
 func isBadTokenError(err error) bool {
         // See https://github.com/golang/oauth2/blob/master/internal/token.go.
         // Unfortunately, fmt.Errorf is used there, so there's no other way to
         // differentiate between bad tokens/creds and transient errors.
         // Note that mis-categorization is not a big deal: we'll unnecessarily retry
         // fatal error a bunch of times, thinking it is transient.
         if err == nil {
@@ skipping 30 matching lines @@
                 // errors, HTTP 500 responses, etc). It is difficult to categorize them,
                 // since oauth2 library uses fmt.Errorf(...) for errors. Retrying a fatal
                 // error a bunch of times is not very bad, so pick safer approach and assume
                 // any error is transient. Revoked refresh token or bad credentials (most
                 // common source of fatal errors) is already handled above.
                 return nil, errors.WrapTransient(err)
         default:
                 return tok, nil
         }
 }