Method UpdateExternalAuthLinkRefreshToken

enterprise/dbcrypt/dbcrypt.go:265–311

(ctx context.Context, params database.UpdateExternalAuthLinkRefreshTokenParams)

}

func (db *dbCrypt) UpdateExternalAuthLinkRefreshToken(ctx context.Context, params database.UpdateExternalAuthLinkRefreshTokenParams) error {
	// The SQL query uses an optimistic lock:
	//   WHERE oauth_refresh_token = @old_oauth_refresh_token
	// The caller supplies the plaintext old token (since dbcrypt
	// decrypts on read), but the DB stores the encrypted value.
	// Because AES-GCM is non-deterministic, we cannot simply
	// re-encrypt the old token — the ciphertext would differ.
	// Instead, read the current row from the inner (raw) store
	// and use the actual encrypted value for the WHERE clause.
	if params.OldOauthRefreshToken != "" && db.ciphers != nil && db.primaryCipherDigest != "" {
		raw, err := db.Store.GetExternalAuthLink(ctx, database.GetExternalAuthLinkParams{
			ProviderID: params.ProviderID,
			UserID:     params.UserID,
		})
		if err != nil {
			return err
		}
		// Decrypt the stored token so we can compare with the
		// caller-supplied plaintext.
		decrypted := raw.OAuthRefreshToken
		if err := db.decryptField(&decrypted, raw.OAuthRefreshTokenKeyID); err != nil {
			return err
		}
		if decrypted != params.OldOauthRefreshToken {
			// The token has changed since the caller read it;
			// the optimistic lock should fail (no rows updated).
			// Return nil to match the :exec semantics of the SQL
			// query, which silently updates zero rows.
			return nil
		}
		// Use the raw encrypted value so the WHERE clause matches.
		params.OldOauthRefreshToken = raw.OAuthRefreshToken
	}

	// We would normally use a sql.NullString here, but sqlc does not want to make
	// a params struct with a nullable string.
	var digest sql.NullString
	if params.OAuthRefreshTokenKeyID != "" {
		digest.String = params.OAuthRefreshTokenKeyID
		digest.Valid = true
	}
	if err := db.encryptField(&params.OAuthRefreshToken, &digest); err != nil {
		return err
	}

	return db.Store.UpdateExternalAuthLinkRefreshToken(ctx, params)
}

func (db *dbCrypt) GetCryptoKeys(ctx context.Context) ([]database.CryptoKey, error) {
	keys, err := db.Store.GetCryptoKeys(ctx)