mirror of
https://github.com/coder/coder.git
synced 2025-07-03 16:13:58 +00:00
78f9f43c97
Once a token refresh fails, we remove the `oauth_refresh_token` from the database. This will prevent the token from hitting the IDP for subsequent refresh attempts. Without this change, a bad script can cause a failing token to hit a remote IDP repeatedly with each `git` operation. With this change, after the first hit, subsequent hits will fail locally, and never contact the IDP. The solution in both cases is to authenticate the external auth link. So the resolution is the same as before.
56 lines
1.4 KiB
SQL
56 lines
1.4 KiB
SQL
-- name: GetExternalAuthLink :one
|
|
SELECT * FROM external_auth_links WHERE provider_id = $1 AND user_id = $2;
|
|
|
|
-- name: DeleteExternalAuthLink :exec
|
|
DELETE FROM external_auth_links WHERE provider_id = $1 AND user_id = $2;
|
|
|
|
-- name: GetExternalAuthLinksByUserID :many
|
|
SELECT * FROM external_auth_links WHERE user_id = $1;
|
|
|
|
-- name: InsertExternalAuthLink :one
|
|
INSERT INTO external_auth_links (
|
|
provider_id,
|
|
user_id,
|
|
created_at,
|
|
updated_at,
|
|
oauth_access_token,
|
|
oauth_access_token_key_id,
|
|
oauth_refresh_token,
|
|
oauth_refresh_token_key_id,
|
|
oauth_expiry,
|
|
oauth_extra
|
|
) VALUES (
|
|
$1,
|
|
$2,
|
|
$3,
|
|
$4,
|
|
$5,
|
|
$6,
|
|
$7,
|
|
$8,
|
|
$9,
|
|
$10
|
|
) RETURNING *;
|
|
|
|
-- name: UpdateExternalAuthLink :one
|
|
UPDATE external_auth_links SET
|
|
updated_at = $3,
|
|
oauth_access_token = $4,
|
|
oauth_access_token_key_id = $5,
|
|
oauth_refresh_token = $6,
|
|
oauth_refresh_token_key_id = $7,
|
|
oauth_expiry = $8,
|
|
oauth_extra = $9
|
|
WHERE provider_id = $1 AND user_id = $2 RETURNING *;
|
|
|
|
-- name: RemoveRefreshToken :exec
|
|
-- Removing the refresh token disables the refresh behavior for a given
|
|
-- auth token. If a refresh token is marked invalid, it is better to remove it
|
|
-- then continually attempt to refresh the token.
|
|
UPDATE
|
|
external_auth_links
|
|
SET
|
|
oauth_refresh_token = '',
|
|
updated_at = @updated_at
|
|
WHERE provider_id = @provider_id AND user_id = @user_id;
|