Gateway exposes POST /auth/refresh that accepts a refresh_token, exchanges with Authentik via grant_type=refresh_token, returns new JWT + refresh token.
Why
Access tokens expire (default 1h). Users need a way to renew without re-entering password. Refresh tokens are long-lived and single-use (rotated on each exchange).
Acceptance Criteria
POST /auth/refresh accepts {"refresh_token":"..."}
Proxies to Authentik token endpoint with grant_type=refresh_token
Returns new {"access_token":"...","refresh_token":"...","expires_in":...}
Returns 401 on expired/revoked refresh token
No JWT validation on this endpoint
Unit tests
Implementation
Add to internal/proxy/auth_endpoints.go (same file as P3.1)
Old refresh token invalidated by Authentik on use (verify this is default behavior)
## Summary
Gateway exposes `POST /auth/refresh` that accepts a refresh_token, exchanges with Authentik via `grant_type=refresh_token`, returns new JWT + refresh token.
## Why
Access tokens expire (default 1h). Users need a way to renew without re-entering password. Refresh tokens are long-lived and single-use (rotated on each exchange).
## Acceptance Criteria
- [ ] `POST /auth/refresh` accepts `{"refresh_token":"..."}`
- [ ] Proxies to Authentik token endpoint with `grant_type=refresh_token`
- [ ] Returns new `{"access_token":"...","refresh_token":"...","expires_in":...}`
- [ ] Returns 401 on expired/revoked refresh token
- [ ] No JWT validation on this endpoint
- [ ] Unit tests
## Implementation
- Add to `internal/proxy/auth_endpoints.go` (same file as P3.1)
- Wire in `proxy.go` ServeHTTP
## Depends on
- P3.1 (same config: tokenUrl, clientId, clientSecret)
## Review checklist
- [ ] Refresh token not logged
- [ ] Old refresh token invalidated by Authentik on use (verify this is default behavior)
rock
added this to the Phase 3: OAuth2 Token Exchange & Identity Propagation milestone 2026-09-08 03:55:17 +00:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Summary
Gateway exposes
POST /auth/refreshthat accepts a refresh_token, exchanges with Authentik viagrant_type=refresh_token, returns new JWT + refresh token.Why
Access tokens expire (default 1h). Users need a way to renew without re-entering password. Refresh tokens are long-lived and single-use (rotated on each exchange).
Acceptance Criteria
POST /auth/refreshaccepts{"refresh_token":"..."}grant_type=refresh_token{"access_token":"...","refresh_token":"...","expires_in":...}Implementation
internal/proxy/auth_endpoints.go(same file as P3.1)proxy.goServeHTTPDepends on
Review checklist