Function findUserWithRefreshToken

internal/models/user.go:653–694

(tx *storage.Connection, dbEncryption conf.DatabaseEncryptionConfiguration, token string, forUpdate bool)

}

func findUserWithRefreshToken(tx *storage.Connection, dbEncryption conf.DatabaseEncryptionConfiguration, token string, forUpdate bool) (*User, *crypto.RefreshToken, *Session, error) {
	refreshToken, err := crypto.ParseRefreshToken(token)
	if err != nil {
		// refresh token is not valid
		return nil, nil, nil, SessionNotFoundError{}
	}

	session, err := FindSessionByID(tx, refreshToken.SessionID, forUpdate)
	if err != nil {
		return nil, nil, nil, err
	}

	if session.RefreshTokenHmacKey == nil || session.RefreshTokenCounter == nil {
		// if the session is not set up to support these encoded refresh tokens it's as if it doesn't exist
		// meaning someone is hand-crafting tokens for uuids that exist
		return nil, nil, nil, SessionNotFoundError{}
	}

	key, shouldReEncrypt, err := session.GetRefreshTokenHmacKey(dbEncryption)
	if err != nil {
		return nil, nil, nil, err
	}

	if !refreshToken.CheckSignature(key) {
		// refresh token signature is not valid for this session
		return nil, nil, nil, SessionNotFoundError{}
	}

	if shouldReEncrypt && forUpdate {
		err := session.ReEncryptRefreshTokenHmacKey(tx, dbEncryption)
		if err != nil {
			return nil, nil, nil, err
		}
	}

	user, err := FindUserByID(tx, session.UserID)
	if err != nil {
		return nil, nil, nil, err
	}

	return user, refreshToken, session, nil
}

func findUserWithLegacyRefreshToken(tx *storage.Connection, token string, forUpdate bool) (*User, any, *Session, error) {
	refreshToken := &RefreshToken{}