ResetMismatchedOIDCLinks resets linked_id to empty for all OIDC links whose issuer prefix does not match expectedIssuer. Returns the number of rows affected.
(ctx context.Context, db database.Store, expectedIssuer string)
| 62 | // issuer prefix does not match expectedIssuer. Returns the number of rows |
| 63 | // affected. |
| 64 | func ResetMismatchedOIDCLinks(ctx context.Context, db database.Store, expectedIssuer string) (int64, error) { |
| 65 | prefix := expectedIssuer + "||" |
| 66 | count, err := db.UnlinkOIDCUsersByIssuerMismatch(ctx, prefix) |
| 67 | if err != nil { |
| 68 | return 0, xerrors.Errorf("unlink OIDC users by issuer mismatch: %w", err) |
| 69 | } |
| 70 | return count, nil |
| 71 | } |
| 72 | |
| 73 | // ResolveIssuer uses OIDC discovery to fetch the canonical issuer string |
| 74 | // from the provider's .well-known/openid-configuration endpoint. |