Method RotateRefreshToken

internal/oauth/storage.go:444–461

RotateRefreshToken marks the refresh row inactive (via CAS) and ALSO revokes every access token for the same request_id. Without the cascade, an attacker who captured the pre-refresh access token could continue using it for up to its remaining lifetime (~1h) after the legitimate client rotated. The

(ctx context.Context, requestID, refreshTokenSignature string)

// Runs through db(ctx) so when fosite wraps this call in
// MaybeBeginTx the two UPDATEs land in the same transaction.
func (s *Storage) RotateRefreshToken(ctx context.Context, requestID, refreshTokenSignature string) error {
	db := s.db(ctx)
	tag, err := db.Exec(ctx,
		`UPDATE oauth_refresh_tokens SET active = FALSE WHERE signature = $1 AND active = TRUE`,
		refreshTokenSignature,
	)
	if err != nil {
		return err
	}
	if tag.RowsAffected() == 0 {
		return fosite.ErrInactiveToken
	}
	_, err = db.Exec(ctx,
		`UPDATE oauth_access_tokens SET revoked_at = NOW() WHERE request_id = $1 AND revoked_at IS NULL`,
		requestID,
	)
	return err
}

// ───────────────────────── TokenRevocationStorage ─────────────────────────