Function oidc_refresh_token

crates/openshell-cli/src/oidc_auth.rs:232–260

Refresh an OIDC token using the `refresh_token` grant. Preserves the existing refresh token if the server does not return a new one (per OAuth 2.0 spec, the refresh response may omit `refresh_token`).

(
    bundle: &OidcTokenBundle,
    insecure: bool,
)

/// Preserves the existing refresh token if the server does not return a new
/// one (per OAuth 2.0 spec, the refresh response may omit `refresh_token`).
pub async fn oidc_refresh_token(
    bundle: &OidcTokenBundle,
    insecure: bool,
) -> Result<OidcTokenBundle> {
    let refresh_token = bundle.refresh_token.as_deref().ok_or_else(|| {
        miette::miette!(
            "no refresh token available — re-authenticate with: openshell gateway login"
        )
    })?;

    let discovery = discover(&bundle.issuer, insecure).await?;

    let client = BasicClient::new(ClientId::new(bundle.client_id.clone()))
        .set_token_uri(TokenUrl::new(discovery.token_endpoint).into_diagnostic()?);

    let http = http_client(insecure);
    let token_response = client
        .exchange_refresh_token(&RefreshToken::new(refresh_token.to_string()))
        .request_async(&http)
        .await
        .map_err(|e| miette::miette!("token refresh failed: {e}"))?;

    let mut refreshed =
        bundle_from_oauth2_response(&token_response, &bundle.issuer, &bundle.client_id);
    if refreshed.refresh_token.is_none() {
        refreshed.refresh_token.clone_from(&bundle.refresh_token);
    }
    Ok(refreshed)
}

/// Ensure we have a valid OIDC token for the given gateway, refreshing if needed.
///