Function ensureFreshAccountToken

packages/backend/src/ee/tokenRefresh.ts:63–145

(
    account: Account,
    db: PrismaClient,
)

 *   the calling job fails with a clear error.
 */
export const ensureFreshAccountToken = async (
    account: Account,
    db: PrismaClient,
): Promise<string> => {
    if (!account.access_token) {
        throw new Error(`Account ${account.id} (${account.providerId}) has no access token.`);
    }

    if (!isSupportedProvider(account.providerType)) {
        // Non-refreshable provider — just decrypt and return whatever is stored.
        const token = decryptOAuthToken(account.access_token);
        if (!token) {
            throw new Error(`Failed to decrypt access token for account ${account.id}.`);
        }
        return token;
    }

    const now = Math.floor(Date.now() / 1000);
    const isExpiredOrNearExpiry =
        account.expires_at !== null &&
        account.expires_at > 0 &&
        now >= account.expires_at - EXPIRY_BUFFER_S;

    if (!isExpiredOrNearExpiry) {
        const token = decryptOAuthToken(account.access_token);
        if (!token) {
            throw new Error(`Failed to decrypt access token for account ${account.id}.`);
        }
        return token;
    }

    if (!account.refresh_token) {
        const message = `Account ${account.id} (${account.providerId}) token is expired and has no refresh token.`;
        logger.error(message);
        await setTokenRefreshError(account.id, message, db);
        throw new Error(message);
    }

    const refreshToken = decryptOAuthToken(account.refresh_token);
    if (!refreshToken) {
        const message = `Failed to decrypt refresh token for account ${account.id} (${account.providerId}).`;
        logger.error(message);
        await setTokenRefreshError(account.id, message, db);
        throw new Error(message);
    }

    logger.debug(`Refreshing OAuth token for account ${account.id} (${account.providerId})...`);

    const refreshResponse = await refreshOAuthToken(
        account.providerId,
        account.providerType,
        refreshToken
    );

    if (!refreshResponse) {
        const message = `OAuth token refresh failed for account ${account.id} (${account.providerId}).`;
        logger.error(message);
        await setTokenRefreshError(account.id, message, db);