Merge branch 'master' into km/add-error-codes

supabase · Oct 30, 2024 · 78db48b · 78db48b
2 parents b29a8c6 + a7129df
commit 78db48b
Showing 1 changed file with 16 additions and 10 deletions.
diff --git a/internal/api/token_refresh.go b/internal/api/token_refresh.go
@@ -56,19 +56,25 @@ func (a *API) RefreshTokenGrant(ctx context.Context, w http.ResponseWriter, r *h
 			return badRequestError(ErrorCodeUserBanned, "Invalid Refresh Token: User Banned")
 		}
 
-		if session != nil {
-			result := session.CheckValidity(retryStart, &token.UpdatedAt, config.Sessions.Timebox, config.Sessions.InactivityTimeout)
+		if session == nil {
+			// a refresh token won't have a session if it's created prior to the sessions table introduced
+			if err := db.Destroy(token); err != nil {
+				return internalServerError("Error deleting refresh token with missing session").WithInternalError(err)
+			}
+			return badRequestError(ErrorCodeSessionNotFound, "Invalid Refresh Token: No Valid Session Found")
+		}
 
-			switch result {
-			case models.SessionValid:
-				// do nothing
+		result := session.CheckValidity(retryStart, &token.UpdatedAt, config.Sessions.Timebox, config.Sessions.InactivityTimeout)
 
-			case models.SessionTimedOut:
-				return badRequestError(ErrorCodeSessionExpired, "Invalid Refresh Token: Session Expired (Inactivity)")
+		switch result {
+		case models.SessionValid:
+			// do nothing
 
-			default:
-				return badRequestError(ErrorCodeSessionExpired, "Invalid Refresh Token: Session Expired")
-			}
+		case models.SessionTimedOut:
+			return badRequestError(ErrorCodeSessionExpired, "Invalid Refresh Token: Session Expired (Inactivity)")
+
+		default:
+			return badRequestError(ErrorCodeSessionExpired, "Invalid Refresh Token: Session Expired")
 		}
 
 		// Basic checks above passed, now we need to serialize access