Method InvalidateAuthorizeCodeSession

internal/oauth/storage.go:286–296

InvalidateAuthorizeCodeSession marks the code consumed via a CAS `WHERE signature = $1 AND active = TRUE`. The CAS is load-bearing: without it, two concurrent token exchanges at READ COMMITTED can each pass GetAuthorizeCodeSession (both see active=TRUE before either UPDATE lands) and both Invalidate

(ctx context.Context, code string)

// ErrInvalidatedAuthorizeCode triggers fosite's deferred rollback in
// flow_authorize_code_token.go.
func (s *Storage) InvalidateAuthorizeCodeSession(ctx context.Context, code string) error {
	tag, err := s.db(ctx).Exec(ctx,
		`UPDATE oauth_auth_codes SET active = FALSE WHERE signature = $1 AND active = TRUE`, code)
	if err != nil {
		return err
	}
	if tag.RowsAffected() == 0 {
		return fosite.ErrInvalidatedAuthorizeCode
	}
	return nil
}

// ───────────────────────── AccessTokenStorage ─────────────────────────