Method issueOAuthCodeWithNewAgent

internal/agent/oauth_handlers.go:993–1033

(ctx context.Context, w http.ResponseWriter, r *http.Request, ar fosite.AuthorizeRequester, userID, agentEmail, scope string)

}

func (a *API) issueOAuthCodeWithNewAgent(ctx context.Context, w http.ResponseWriter, r *http.Request, ar fosite.AuthorizeRequester, userID, agentEmail, scope string) error {
	pool := a.oauthStorage.Pool()
	tx, err := pool.BeginTx(ctx, pgx.TxOptions{})
	if err != nil {
		return fmt.Errorf("begin tx: %w", err)
	}
	// Safe to defer unconditionally: Rollback is a no-op after Commit
	// in pgx v5.
	defer func() { _ = tx.Rollback(ctx) }()
	txCtx := oauth.WithTx(ctx, tx)

	// Agent insert via the identity package — same tx, same context.
	if _, err := a.store.CreateAgentTx(txCtx, tx, agentEmail, a.sharedDomain, "", "", "", userID); err != nil {
		if isUniqueViolation(err) {
			http.Error(w, "that slug is already taken; pick another", http.StatusConflict)
			return nil
		}
		return fmt.Errorf("create agent: %w", err)
	}

	// Code issue via fosite. Storage.db(txCtx) finds the tx on the
	// context, so the INSERT into oauth_auth_codes runs in the same tx.
	sess := &oauth.Session{
		UserID:     userID,
		AgentEmail: agentEmail,
		Subject:    userID,
	}
	ar.SetSession(sess)
	grantConsentedScope(ar, scope)
	resp, err := a.oauthProvider.NewAuthorizeResponse(txCtx, ar, sess)
	if err != nil {
		return err
	}

	if err := tx.Commit(ctx); err != nil {
		return fmt.Errorf("commit tx: %w", err)
	}

	a.writeAuthorizeRedirect(w, r, ar, resp)
	return nil
}

// writeAuthorizeRedirect emits the 303 redirect to the client's
// redirect_uri with fosite's parameters + the RFC 9207 issuer. We