Method ExchangeToken

backend/api/v1/auth_service.go:1377–1432

ExchangeToken exchanges an external OIDC token for a Bytebase access token. Used by CI/CD pipelines with Workload Identity Federation.

(ctx context.Context, req *connect.Request[v1pb.ExchangeTokenRequest])

// ExchangeToken exchanges an external OIDC token for a Bytebase access token.
// Used by CI/CD pipelines with Workload Identity Federation.
func (s *AuthService) ExchangeToken(ctx context.Context, req *connect.Request[v1pb.ExchangeTokenRequest]) (*connect.Response[v1pb.ExchangeTokenResponse], error) {
	request := req.Msg

	if request.Token == "" {
		return nil, connect.NewError(connect.CodeInvalidArgument, errors.New("token is required"))
	}
	if request.Email == "" {
		return nil, connect.NewError(connect.CodeInvalidArgument, errors.New("email is required"))
	}

	if err := validateWorkloadIdentityEmail(request.Email); err != nil {
		return nil, connect.NewError(connect.CodeInvalidArgument,
			invalidAccountEmailError("workload identity", request.Email, err))
	}

	// Find workload identity by email (cross-workspace lookup since this is unauthenticated).
	wi, err := s.store.GetWorkloadIdentityByEmail(ctx, request.Email)
	if err != nil {
		return nil, connect.NewError(connect.CodeInternal, errors.Wrap(err, "failed to find workload identity"))
	}
	if wi == nil {
		return nil, connect.NewError(connect.CodeNotFound, errors.Errorf("workload identity %q not found", request.Email))
	}
	// Announce the workspace as soon as we know it (from the WI record) so
	// that a deactivated-WI attempt — which compliance wants to see — still
	// lands in the audit log.
	common.SetAuditWorkspaceID(ctx, wi.Workspace)
	if wi.MemberDeleted {
		return nil, connect.NewError(connect.CodeUnauthenticated,
			errors.New("workload identity has been deactivated"))
	}

	// Get workload identity config
	wicConfig := wi.Config
	if wicConfig == nil {
		return nil, connect.NewError(connect.CodeInternal,
			errors.New("workload identity config not found"))
	}

	// Validate OIDC token
	if _, err = wif.ValidateToken(ctx, request.Token, wicConfig); err != nil {
		return nil, connect.NewError(connect.CodeUnauthenticated,
			errors.Wrap(err, "token validation failed"))
	}

	// Generate Bytebase API token using workspace from the WI record.
	token, err := auth.GenerateAPIToken(wi.Email, wi.Workspace, s.secret)
	if err != nil {
		return nil, connect.NewError(connect.CodeInternal,
			errors.Wrap(err, "failed to generate access token"))
	}

	return connect.NewResponse(&v1pb.ExchangeTokenResponse{
		AccessToken: token,
	}), nil
}

func getAccountRestriction(