Method Refresh

backend/api/v1/auth_service.go:428–519

Refresh exchanges a refresh token for new access and refresh tokens.

(ctx context.Context, req *connect.Request[v1pb.RefreshRequest])

// Refresh exchanges a refresh token for new access and refresh tokens.
func (s *AuthService) Refresh(ctx context.Context, req *connect.Request[v1pb.RefreshRequest]) (*connect.Response[v1pb.RefreshResponse], error) {
	// 1. Extract refresh token from cookie
	refreshToken := auth.GetRefreshTokenFromCookie(req.Header())
	if refreshToken == "" {
		return nil, connect.NewError(connect.CodeUnauthenticated, errors.New("refresh token not found"))
	}

	// 2. Look up and delete atomically
	tokenHash := auth.HashToken(refreshToken)
	stored, err := s.store.GetAndDeleteWebRefreshToken(ctx, tokenHash)
	if err != nil {
		return nil, connect.NewError(connect.CodeInternal, errors.Wrap(err, "failed to get refresh token"))
	}
	if stored == nil {
		return nil, connect.NewError(connect.CodeUnauthenticated, errors.New("invalid refresh token"))
	}

	// 3. Check expiration
	if time.Now().After(stored.ExpiresAt) {
		return nil, connect.NewError(connect.CodeUnauthenticated, errors.New("refresh token expired"))
	}

	// 4. Get user
	user, err := s.store.GetUserByEmail(ctx, stored.UserEmail)
	if err != nil {
		return nil, connect.NewError(connect.CodeInternal, errors.Wrap(err, "failed to get user"))
	}
	if user == nil || user.MemberDeleted {
		return nil, connect.NewError(connect.CodeUnauthenticated, errors.New("user not found"))
	}

	// 5. Extract workspace from the access token cookie (still present because cookie
	// outlives the JWT by 30 seconds). This ensures per-session workspace isolation.
	// Also verify the token's subject matches the refresh token's user to prevent
	// pairing a refresh token with an access token from a different session.
	accessTokenStr, err := auth.GetTokenFromHeaders(req.Header())
	if err != nil {
		return nil, connect.NewError(connect.CodeUnauthenticated, errors.Wrap(err, "invalid access token header"))
	}
	if accessTokenStr == "" {
		return nil, connect.NewError(connect.CodeUnauthenticated, errors.New("access token cookie required for refresh"))
	}
	tokenClaims, err := auth.ExtractClaimsFromExpiredToken(accessTokenStr, s.secret)
	if err != nil || tokenClaims.WorkspaceID == "" {
		return nil, connect.NewError(connect.CodeUnauthenticated, errors.New("failed to extract workspace from access token"))
	}
	if tokenClaims.Subject != stored.UserEmail {
		return nil, connect.NewError(connect.CodeUnauthenticated, errors.New("access token does not match refresh token"))
	}
	workspaceID := tokenClaims.WorkspaceID

	// Verify the user is still a member of the workspace.
	ws, err := s.store.FindWorkspace(ctx, &store.FindWorkspaceMessage{
		WorkspaceID:    &workspaceID,
		Email:          user.Email,
		IncludeAllUser: !s.profile.SaaS,
	})
	if err != nil {