Function RefreshOAuth2Token

coderd/x/chatd/mcpclient/mcpclient.go:840–889

RefreshOAuth2Token checks whether the given MCP user token is expired (or within 10 seconds of expiry) and refreshes it using the OAuth2 credentials from the server config. If the token is still valid, no network call is made and Refreshed is false. The caller is responsible for persisting the resu

(
	ctx context.Context,
	cfg database.MCPServerConfig,
	tok database.MCPServerUserToken,
)

// The caller is responsible for persisting the result when
// Refreshed is true.
func RefreshOAuth2Token(
	ctx context.Context,
	cfg database.MCPServerConfig,
	tok database.MCPServerUserToken,
) (RefreshResult, error) {
	oauth2Cfg := &oauth2.Config{
		ClientID:     cfg.OAuth2ClientID,
		ClientSecret: cfg.OAuth2ClientSecret,
		Endpoint: oauth2.Endpoint{
			TokenURL: cfg.OAuth2TokenURL,
		},
	}

	oldToken := &oauth2.Token{
		AccessToken:  tok.AccessToken,
		RefreshToken: tok.RefreshToken,
		TokenType:    tok.TokenType,
	}
	if tok.Expiry.Valid {
		oldToken.Expiry = tok.Expiry.Time
	}

	// Cap the refresh HTTP call so a stalled token endpoint
	// cannot block the entire MCP connection phase. The timeout
	// matches connectTimeout used for MCP server connections.
	refreshCtx, cancel := context.WithTimeout(ctx, connectTimeout)
	defer cancel()

	// TokenSource automatically refreshes expired tokens. It
	// uses a 10-second expiry window, so tokens about to expire
	// are also refreshed proactively.
	newToken, err := oauth2Cfg.TokenSource(refreshCtx, oldToken).Token()
	if err != nil {
		return RefreshResult{}, xerrors.Errorf("refresh oauth2 token: %w", err)
	}

	refreshed := newToken.AccessToken != tok.AccessToken

	// Preserve the old refresh token when the provider doesn't
	// rotate (returns empty).
	refreshToken := cmp.Or(newToken.RefreshToken, tok.RefreshToken)

	return RefreshResult{
		AccessToken:  newToken.AccessToken,
		RefreshToken: refreshToken,
		TokenType:    newToken.TokenType,
		Expiry:       newToken.Expiry,
		Refreshed:    refreshed,
	}, nil
}