OAuth 2 refresh tokens are stored in MainStash. This is bad:
- it's a key-value store so there is no way to find all the valid refresh tokens a user has, which seems problematic e.g. for investigating security incidents
- mass invalidation can only be done in hacky ways
- MainStash doesn't really guarantee permanence. This will get a lot worse after T383327: Re-architecture mainstash (x2) to allow easier maintenance .
It needs to be moved to a more appropriate storage (probably a dedicated DB table?).