We have a managed package that uses oauth both online and offline to interact with the Salesforce APIs on behalf of a user. When the user launches the managed package, they authorize the app. From there, we generate and use a JWT bearer token (https://help.salesforce.com/articleView?id=remoteaccess_oauth_jwt_flow.htm&language=en_US&type=0) to hit the API on behalf of the user (including when the user is offline).
This works fine, until the managed package is upgraded. What happens then is that Salesforce still shows in "Connected Apps Oauth Usage" that the app is authorized to make oauth calls on behalf of the user, but any calls that we make fail ("user has not approved this consumer"). We've found that if we manually revoke the oauth grant and then re-launch the managed package to go through authorization again that the grant is recreated and valid. This doesn't work with our workflow though.
Questions: has anybody seen this before? This seems like a bug in Salesforce. Am I missing something?
Is there a workaround that we should try? Ideally, an admin should be able to upgrade the package and then do nothing else, and the previously-granted oauth grant should keep on working.