Method clearSessionAndSetCookies

backend/api/v1/auth_service.go:416–425

clearSessionAndSetCookies deletes the refresh token and sets expired cookies on the response headers.

(ctx context.Context, reqHeaders http.Header, respHeaders http.Header, workspaceID string)

// clearSessionAndSetCookies deletes the refresh token and sets expired cookies on the response headers.
func (s *AuthService) clearSessionAndSetCookies(ctx context.Context, reqHeaders http.Header, respHeaders http.Header, workspaceID string) {
	if refreshToken := auth.GetRefreshTokenFromCookie(reqHeaders); refreshToken != "" {
		if err := s.store.DeleteWebRefreshToken(ctx, auth.HashToken(refreshToken)); err != nil {
			slog.Error("failed to delete refresh token", log.BBError(err))
		}
	}
	origin := reqHeaders.Get("Origin")
	respHeaders.Add("Set-Cookie", auth.GetTokenCookie(ctx, s.store, s.licenseService, workspaceID, origin, "").String())
	respHeaders.Add("Set-Cookie", auth.GetRefreshTokenCookie(origin, "", 0).String())
}

// Refresh exchanges a refresh token for new access and refresh tokens.
func (s *AuthService) Refresh(ctx context.Context, req *connect.Request[v1pb.RefreshRequest]) (*connect.Response[v1pb.RefreshResponse], error) {