Function revokeRefreshTokenInTx

coderd/oauth2provider/revoke.go:119–161

(ctx context.Context, db database.Store, token string, appID uuid.UUID)

}

func revokeRefreshTokenInTx(ctx context.Context, db database.Store, token string, appID uuid.UUID) error {
	// Parse the refresh token using the existing function
	parsedToken, err := ParseFormattedSecret(token)
	if err != nil {
		return ErrInvalidTokenFormat
	}

	// Try to find refresh token by prefix
	//nolint:gocritic // Using AsSystemOAuth2 for OAuth2 public token revocation endpoint
	dbToken, err := db.GetOAuth2ProviderAppTokenByPrefix(dbauthz.AsSystemOAuth2(ctx), []byte(parsedToken.Prefix))
	if err != nil {
		if errors.Is(err, sql.ErrNoRows) {
			// Token not found - return success per RFC 7009 (don't reveal token existence)
			return nil
		}
		return xerrors.Errorf("get oauth2 provider app token by prefix: %w", err)
	}

	equal := apikey.ValidateHash(dbToken.RefreshHash, parsedToken.Secret)
	if !equal {
		return xerrors.Errorf("invalid refresh token")
	}

	// Verify ownership
	//nolint:gocritic // Using AsSystemOAuth2 for OAuth2 public token revocation endpoint
	appSecret, err := db.GetOAuth2ProviderAppSecretByID(dbauthz.AsSystemOAuth2(ctx), dbToken.AppSecretID)
	if err != nil {
		return xerrors.Errorf("get oauth2 provider app secret: %w", err)
	}
	if appSecret.AppID != appID {
		return ErrTokenNotBelongsToClient
	}

	// Delete the associated API key, which should cascade to remove the refresh token
	// According to RFC 7009, when a refresh token is revoked, associated access tokens should be invalidated
	//nolint:gocritic // Using AsSystemOAuth2 for OAuth2 public token revocation endpoint
	err = db.DeleteAPIKeyByID(dbauthz.AsSystemOAuth2(ctx), dbToken.APIKeyID)
	if err != nil && !errors.Is(err, sql.ErrNoRows) {
		return xerrors.Errorf("delete api key: %w", err)
	}

	return nil
}

func revokeAPIKeyInTx(ctx context.Context, db database.Store, token string, appID uuid.UUID) error {
	keyID, secret, err := httpmw.SplitAPIToken(token)