Function workspaceResolutionError

backend/api/oauth2/token.go:231–237

workspaceResolutionError maps the typed errors from resolveBoundWorkspace onto RFC 6749 OAuth2 error responses. Membership failure is invalid_grant (400); everything else is an internal failure surfaced as server_error (500) with the wrapped detail logged server-side, not leaked to the client.

(c *echo.Context, err error)

// (400); everything else is an internal failure surfaced as server_error
// (500) with the wrapped detail logged server-side, not leaked to the client.
func workspaceResolutionError(c *echo.Context, err error) error {
	if errors.Is(err, errWorkspaceNotMember) {
		return oauth2Error(c, http.StatusBadRequest, "invalid_grant", "user is no longer a member of the workspace")
	}
	slog.Error("OAuth2 workspace resolution failed", log.BBError(err))
	return oauth2Error(c, http.StatusInternalServerError, "server_error", "failed to resolve workspace")
}

// errWorkspaceNotMember signals that the user has been removed from the
// workspace their OAuth grant was issued for. Mapped to RFC 6749 `invalid_grant`