geniusrabbit / blaze-api / 35361913195

4%

main: 4%

Pull #8

github

Fix OAuth token exchange duplicate key error on request_id

During authorization_code grant flow, CreateAccessTokenSession was
INSERTing a new row with the same request_id from the authorize step,
violating the UNIQUE constraint idx_auth_session_uniq_request_id.

Root cause: Fosite reuses the same request.GetID() across the authorize
and token exchange steps, so both CreateAuthorizeCodeSession and
CreateAccessTokenSession were trying to create separate rows with the
same request_id.

Fix: CreateAccessTokenSession now:
1. Looks up the existing session by request_id (from authorize step)
2. Updates it with the new access token signature and session data
3. Only INSERTs if no existing session is found (edge case)

This matches the approach used in CreatePKCERequestSession (PR #6) and
aligns with how fosite manages OAuth sessions - a single session row
evolves through the authorize → token exchange lifecycle.

Added TestAuthorizationCodeToAccessTokenFlow to verify the full flow:
CreateAuthorizeCodeSession → CreateAccessTokenSession correctly updates
the existing session instead of creating a duplicate.

Co-authored-by: Dmitry <demdxx@gmail.com>

39 of 48 new or added lines in 1 file covered. (81.25%)

1116 of 27482 relevant lines covered (4.06%)

0.04 hits per line