support refresh token

Author: WhammyLeaf

handlers.go

@@ -524,56 +524,80 @@ func (h *OAuth2Handler) HandleToken(w http.ResponseWriter, r *http.Request) {
 	// Extract parameters
 	grantType := r.FormValue("grant_type")
 	code := r.FormValue("code")
+	refreshToken := r.FormValue("refresh_token")
 	clientRedirectURI := r.FormValue("redirect_uri")
 	clientID := r.FormValue("client_id")
 	codeVerifier := r.FormValue("code_verifier")
 
 	h.logger.Info("OAuth2: Token request - grant_type: %s, client_id: %s, redirect_uri: %s, code: %s",
 		grantType, clientID, clientRedirectURI, truncateString(code, 10))
 
-	// Validate parameters
-	if code == "" {
-		h.logger.Error("OAuth2: Missing authorization code")
-		http.Error(w, "Missing authorization code", http.StatusBadRequest)
-		return
-	}
+	var token *oauth2.Token
+	var err error
 
-	if grantType != "authorization_code" {
-		h.logger.Error("OAuth2: Unsupported grant type: %s", grantType)
-		http.Error(w, "Unsupported grant type", http.StatusBadRequest)
-		return
-	}
+	switch grantType {
+	case "authorization_code":
+		// Validate parameters for authorization_code flow
+		if code == "" {
+			h.logger.Error("OAuth2: Missing authorization code")
+			http.Error(w, "Missing authorization code", http.StatusBadRequest)
+			return
+		}
 
-	// Set redirect URI for token exchange
-	redirectURI := clientRedirectURI
-	if h.config.RedirectURIs != "" && !strings.Contains(h.config.RedirectURIs, ",") {
-		redirectURI = strings.TrimSpace(h.config.RedirectURIs)
-		h.logger.Info("OAuth2: Token exchange using fixed redirect URI: %s", redirectURI)
-	}
+		// Set redirect URI for token exchange
+		redirectURI := clientRedirectURI
+		if h.config.RedirectURIs != "" && !strings.Contains(h.config.RedirectURIs, ",") {
+			redirectURI = strings.TrimSpace(h.config.RedirectURIs)
+			h.logger.Info("OAuth2: Token exchange using fixed redirect URI: %s", redirectURI)
+		}
 
-	h.oauth2Config.RedirectURL = redirectURI
+		h.oauth2Config.RedirectURL = redirectURI
 
-	// For PKCE, we need to manually add the code_verifier to the token exchange
-	// Since oauth2 library doesn't support PKCE directly, we'll use a custom approach
-	ctx := context.Background()
-
-	// Create custom HTTP client for token exchange with PKCE
-	if codeVerifier != "" {
-		// Create a custom client that adds code_verifier to the token request
-		customClient := &http.Client{
-			Transport: &pkceTransport{
-				base:         http.DefaultTransport,
-				codeVerifier: codeVerifier,
-			},
+		// For PKCE, we need to manually add the code_verifier to the token exchange
+		// Since oauth2 library doesn't support PKCE directly, we'll use a custom approach
+		ctx := context.Background()
+
+		// Create custom HTTP client for token exchange with PKCE
+		if codeVerifier != "" {
+			// Create a custom client that adds code_verifier to the token request
+			customClient := &http.Client{
+				Transport: &pkceTransport{
+					base:         http.DefaultTransport,
+					codeVerifier: codeVerifier,
+				},
+			}
+			ctx = context.WithValue(ctx, oauth2.HTTPClient, customClient)
 		}
-		ctx = context.WithValue(ctx, oauth2.HTTPClient, customClient)
-	}
 
-	// Exchange code for tokens
-	token, err := h.oauth2Config.Exchange(ctx, code)
-	if err != nil {
-		h.logger.Error("OAuth2: Token exchange failed: %v", err)
-		http.Error(w, "Token exchange failed", http.StatusInternalServerError)
+		// Exchange code for tokens
+		token, err = h.oauth2Config.Exchange(ctx, code)
+		if err != nil {
+			h.logger.Error("OAuth2: Token exchange failed: %v", err)
+			http.Error(w, "Token exchange failed", http.StatusInternalServerError)
+			return
+		}
+	case "refresh_token":
+		// Validate parameters for refresh_token flow
+		if refreshToken == "" {
+			h.logger.Error("OAuth2: Missing refresh token")
+			http.Error(w, "Missing refresh token", http.StatusBadRequest)
+			return
+		}
+
+		ctx := context.Background()
+		src := h.oauth2Config.TokenSource(ctx, &oauth2.Token{
+			RefreshToken: refreshToken,
+		})
+
+		token, err = src.Token()
+		if err != nil {
+			h.logger.Error("OAuth2: Refresh token exchange failed: %v", err)
+			http.Error(w, "Token refresh failed", http.StatusBadGateway)
+			return
+		}
+	default:
+		h.logger.Error("OAuth2: Unsupported grant type: %s", grantType)
+		http.Error(w, "Unsupported grant type", http.StatusBadRequest)
 		return
 	}