Method GenerateAccessToken

internal/service/oidc_service.go:470–517

(c *gin.Context, client config.OIDCClientConfig, codeEntry repository.OidcCode)

}

func (service *OIDCService) GenerateAccessToken(c *gin.Context, client config.OIDCClientConfig, codeEntry repository.OidcCode) (TokenResponse, error) {
	user, err := service.GetUserinfo(c, codeEntry.Sub)

	if err != nil {
		return TokenResponse{}, err
	}

	idToken, err := service.generateIDToken(client, user, codeEntry.Scope, codeEntry.Nonce)

	if err != nil {
		return TokenResponse{}, err
	}

	accessToken := utils.GenerateString(32)
	refreshToken := utils.GenerateString(32)

	tokenExpiresAt := time.Now().Add(time.Duration(service.config.SessionExpiry) * time.Second).Unix()

	// Refresh token lives double the time of an access token but can't be used to access userinfo
	refrshTokenExpiresAt := time.Now().Add(time.Duration(service.config.SessionExpiry*2) * time.Second).Unix()

	tokenResponse := TokenResponse{
		AccessToken:  accessToken,
		RefreshToken: refreshToken,
		TokenType:    "Bearer",
		ExpiresIn:    int64(service.config.SessionExpiry),
		IDToken:      idToken,
		Scope:        strings.ReplaceAll(codeEntry.Scope, ",", " "),
	}

	_, err = service.queries.CreateOidcToken(c, repository.CreateOidcTokenParams{
		Sub:                   codeEntry.Sub,
		AccessTokenHash:       service.Hash(accessToken),
		RefreshTokenHash:      service.Hash(refreshToken),
		ClientID:              client.ClientID,
		Scope:                 codeEntry.Scope,
		TokenExpiresAt:        tokenExpiresAt,
		RefreshTokenExpiresAt: refrshTokenExpiresAt,
		Nonce:                 codeEntry.Nonce,
		CodeHash:              codeEntry.CodeHash,
	})

	if err != nil {
		return TokenResponse{}, err
	}

	return tokenResponse, nil
}

func (service *OIDCService) RefreshAccessToken(c *gin.Context, refreshToken string, reqClientId string) (TokenResponse, error) {
	entry, err := service.queries.GetOidcTokenByRefreshToken(c, service.Hash(refreshToken))