fix: make sure refresh logic works with unified provider name

lib/galaxy/authnz/managers.py

@@ -335,19 +335,24 @@ class AuthnzManager:
         Refresh expiring OIDC tokens for all providers associated with a user.
 
         Returns:
-            str | None: The provider name if refresh fails and require_refresh is enabled, otherwise None
+            str | None: The provider name if refresh fails and require_session_refresh is enabled, otherwise None
         """
         user = trans.user or user
         if not isinstance(user, model.User):
             return None
         for auth in user.social_auth or []:
             result = self.refresh_expiring_oidc_tokens_for_provider(trans, auth)
-            config = self.oidc_backends_config.get(auth.provider, None)
+            if auth.provider is None:
+                continue
+            provider = self._unify_provider_name(auth.provider)
+            if provider is None:
+                continue
+            config = self.oidc_backends_config.get(provider, None)
             if config is None:
                 continue
-            # Redirect to OIDC login if refresh fails and require_refresh is enabled
+            # Redirect to OIDC login if refresh fails and require_session_refresh is enabled
             if config.get("require_session_refresh") and result["reauthentication_required"]:
-                return auth.provider
+                return provider
         return None
 
     def authenticate(

test/unit/authnz/test_authnz.py

@@ -361,6 +361,19 @@ def test_refresh_expiring_oidc_tokens_returns_none_on_optional_terminal_refresh_
     assert reauth_provider is None
 
 
+def test_refresh_expiring_oidc_tokens_uses_unified_provider_for_refresh_config(mock_app):
+    user = _make_user_with_social_auth(provider="google-openidconnect")
+    trans = _make_mock_trans_with_user(user)
+    manager = _make_authnz_manager(trans.app, provider_name="google", require_session_refresh="true")
+    FakeRefreshBackend.refresh_result = False
+    FakeRefreshBackend.refresh_exception = AuthTokenError(backend=FAKE_SOCIAL_AUTH_BACKEND)
+
+    with patch.object(AuthnzManager, "_get_identity_provider_factory", return_value=FakeRefreshBackend):
+        reauth_provider = manager.refresh_expiring_oidc_tokens(cast(Any, trans))
+
+    assert reauth_provider == "google"
+
+
 def test_refresh_expiring_oidc_tokens_returns_none_on_unexpected_refresh_failure(mock_app):
     user = _make_user_with_social_auth()
     trans = _make_mock_trans_with_user(user)