Method GetOAuth2Client

backend/store/oauth2_client.go:58–87

GetOAuth2Client looks up a client by client_id (the table's primary key). Workspace is no longer a lookup key — clients are workspace-agnostic since DCR runs unauthenticated.

(ctx context.Context, clientID string)

// Workspace is no longer a lookup key — clients are workspace-agnostic since
// DCR runs unauthenticated.
func (s *Store) GetOAuth2Client(ctx context.Context, clientID string) (*OAuth2ClientMessage, error) {
	q := qb.Q().Space(`
		SELECT client_id, workspace, client_secret_hash, config, last_active_at
		FROM oauth2_client
		WHERE client_id = ?
	`, clientID)

	query, args, err := q.ToSQL()
	if err != nil {
		return nil, err
	}

	client := &OAuth2ClientMessage{}
	var workspace sql.NullString
	var configBytes []byte
	if err := s.GetDB().QueryRowContext(ctx, query, args...).Scan( // NOSONAR: query is parameterized via qb.Query
		&client.ClientID, &workspace, &client.ClientSecretHash, &configBytes, &client.LastActiveAt,
	); err != nil {
		if errors.Is(err, sql.ErrNoRows) {
			return nil, nil
		}
		return nil, errors.Wrap(err, "failed to query OAuth2 client")
	}
	client.Workspace = workspace.String
	client.Config = &storepb.OAuth2ClientConfig{}
	if err := common.ProtojsonUnmarshaler.Unmarshal(configBytes, client.Config); err != nil {
		return nil, errors.Wrap(err, "failed to unmarshal config")
	}
	return client, nil
}

func (s *Store) UpdateOAuth2ClientLastActiveAt(ctx context.Context, clientID string) error {
	q := qb.Q().Space(`