Method issueTokens

backend/api/oauth2/token.go:302–345

issueTokens issues a new OAuth2 access token (and refresh token, when the grant supports it) bound to the given workspace. The workspace is sourced from the authorization code or refresh token being exchanged, not from the client — clients are workspace-agnostic.

(c *echo.Context, client *store.OAuth2ClientMessage, userEmail, workspaceID string)

// from the authorization code or refresh token being exchanged, not from the
// client — clients are workspace-agnostic.
func (s *Service) issueTokens(c *echo.Context, client *store.OAuth2ClientMessage, userEmail, workspaceID string) error {
	ctx := c.Request().Context()

	// Generate access token (JWT) with the workspace_id claim that
	// downstream APIs (gRPC services, MCP middleware) use to scope requests.
	accessToken, err := auth.GenerateOAuth2AccessToken(userEmail, client.ClientID, workspaceID, s.secret, accessTokenExpiry)
	if err != nil {
		return oauth2Error(c, http.StatusInternalServerError, "server_error", fmt.Sprintf("failed to generate access token with error: %v", err))
	}

	now := time.Now()

	// Generate refresh token if allowed
	var refreshTokenStr string
	if slices.Contains(client.Config.GrantTypes, "refresh_token") {
		refreshTokenStr, err = generateRefreshToken()
		if err != nil {
			return oauth2Error(c, http.StatusInternalServerError, "server_error", "failed to generate refresh token")
		}

		// Store refresh token with the workspace binding preserved so a
		// subsequent /token refresh re-issues for the same workspace.
		if _, err := s.store.CreateOAuth2RefreshToken(ctx, &store.OAuth2RefreshTokenMessage{
			TokenHash: auth.HashToken(refreshTokenStr),
			ClientID:  client.ClientID,
			UserEmail: userEmail,
			Workspace: workspaceID,
			ExpiresAt: now.Add(refreshTokenExpiry),
		}); err != nil {
			return oauth2Error(c, http.StatusInternalServerError, "server_error", "failed to store refresh token")
		}
	}

	if err := s.store.UpdateOAuth2ClientLastActiveAt(ctx, client.ClientID); err != nil {
		slog.Warn("failed to update OAuth2 client last active", slog.String("clientID", client.ClientID), log.BBError(err))
	}

	return c.JSON(http.StatusOK, &tokenResponse{
		AccessToken:  accessToken,
		TokenType:    "Bearer",
		ExpiresIn:    int(accessTokenExpiry.Seconds()),
		RefreshToken: refreshTokenStr,
	})
}