Method AccessToken

internal/oauth/manager.go:95–123

AccessToken returns a currently valid access token, refreshing it if needed, or "" if the session is not authorized (or a refresh has failed and re-authorization is required). It is cheap to call repeatedly: the underlying token source caches and only refreshes when the token has expired.

()

// re-authorization is required). It is cheap to call repeatedly: the underlying
// token source caches and only refreshes when the token has expired.
func (m *Manager) AccessToken() string {
	m.mu.Lock()
	src := m.source
	m.mu.Unlock()
	if src == nil {
		return ""
	}
	// Refresh (if needed) happens here, off the lock, because ReuseTokenSource may
	// make a blocking network call and holding m.mu would serialize every tool call.
	tok, err := src.Token()
	if err != nil {
		// A refresh failure (expired GitHub App refresh token, revoked grant, or a
		// network blip) leaves the session unauthorized and forces a re-login.
		// Surface it once, otherwise it only manifests as a surprise re-authorization
		// prompt. The oauth2 error carries the token endpoint's response, not the
		// access or refresh token.
		m.mu.Lock()
		if !m.refreshErrLogged {
			m.refreshErrLogged = true
			m.logger.Warn("OAuth token refresh failed; re-authorization required", "error", err)
		}
		m.mu.Unlock()
		return ""
	}
	if !tok.Valid() {
		return ""
	}
	return tok.AccessToken
}

// HasToken reports whether a valid token is currently available.
func (m *Manager) HasToken() bool {