Method CreateRefreshTokenSession

internal/oauth/storage.go:355–395

───────────────────────── RefreshTokenStorage ─────────────────────────

(ctx context.Context, signature, accessSignature string, request fosite.Requester)

// ───────────────────────── RefreshTokenStorage ─────────────────────────

func (s *Storage) CreateRefreshTokenSession(ctx context.Context, signature, accessSignature string, request fosite.Requester) error {
	// accessSignature is intentionally ignored — RotateRefreshToken
	// cascades via request_id (the fosite-managed grouping ID) which
	// is also what RevokeAccessToken keys on. Storing the paired
	// signature would just duplicate that linkage with no benefit.
	_ = accessSignature

	raw, err := marshalRequest(request)
	if err != nil {
		return err
	}
	sess, _ := request.GetSession().(*Session)
	userID := ""
	if sess != nil {
		userID = sess.UserID
	}
	// fosite signals "no expiry" by leaving the session ExpiresAt at
	// zero (the RefreshTokenLifespan=-1 config path). Persist NULL in
	// that case so the retention reaper — which must skip NULLs — keeps
	// the row forever as the operator asked. Otherwise use the session
	// value, which already reflects the configured lifetime.
	//
	// On configured-lifetime deployments, fosite's refresh strategy
	// always sets a non-zero session expiry before this method is
	// called; a zero value here is unambiguous opt-in.
	var expiresAt *time.Time
	if sess != nil {
		if t := sess.GetExpiresAt(fosite.RefreshToken); !t.IsZero() {
			expiresAt = &t
		}
	}
	_, err = s.db(ctx).Exec(ctx, `
		INSERT INTO oauth_refresh_tokens
		    (signature, request_id, client_id, user_id,
		     request, requested_at, expires_at, active)
		VALUES ($1, $2, $3, $4, $5, $6, $7, TRUE)
	`, signature, request.GetID(), request.GetClient().GetID(), userID,
		raw, request.GetRequestedAt(), expiresAt,
	)
	return err
}

func (s *Storage) GetRefreshTokenSession(ctx context.Context, signature string, session fosite.Session) (fosite.Requester, error) {
	var raw []byte