handle inactive browser session in separate branch. new migration for index, edit old. cover all match cases for authorization grant lookup

crates/handlers/src/oauth2/token.rs

@@ -18,8 +18,8 @@ use mas_axum_utils::{
     record_error,
 };
 use mas_data_model::{
-    AuthorizationGrantStage, BoxClock, BoxRng, BrowserSession, Client, Clock, Device,
-    DeviceCodeGrantState, SiteConfig, TokenType,
+    AuthorizationGrantStage, BoxClock, BoxRng, Client, Clock, Device, DeviceCodeGrantState,
+    SiteConfig, TokenType,
 };
 use mas_i18n::DataLocale;
 use mas_keystore::{Encrypter, Keystore};
@@ -516,9 +516,12 @@ async fn authorization_code_grant(
         .browser_session()
         .lookup(browser_session_id)
         .await?
-        .filter(BrowserSession::active) // this treats inactive sessions as 'no such browser session' errors
         .ok_or(RouteError::NoSuchBrowserSession(browser_session_id))?;
 
+    if !browser_session.active() {
+        return Err(RouteError::InvalidGrant(authz_grant.id));
+    }
+
     let lang: DataLocale = authz_grant.locale.as_deref().unwrap_or("en").parse()?;
     let ctx = DeviceNameContext::new(client.clone(), user_agent.clone()).with_language(lang);
     let device_name = templates.render_device_name(&ctx)?;

crates/storage-pg/migrations/20260403000001_authz_grant_user_session_id.sql

@@ -6,6 +6,5 @@
 ALTER TABLE "oauth2_authorization_grants"
   ADD COLUMN "user_session_id" UUID
     CONSTRAINT "oauth2_authorization_grants_user_session_id_fkey"
-    REFERENCES "user_sessions" ("user_session_id");
-
-CREATE INDEX "oauth2_authorization_grants_user_session_id_idx" ON "oauth2_authorization_grants" (user_session_id);
+    REFERENCES "user_sessions" ("user_session_id")
+    ON DELETE SET NULL;

crates/storage-pg/migrations/20260720134722_idx_oauth2_authorization_grants_user_session_id.sql

@@ -0,0 +1,9 @@
+-- no-transaction
+
+-- Copyright 2026 Element Creations Ltd.
+-- SPDX-License-Identifier: AGPL-3.0-only OR LicenseRef-Element-Commercial
+-- Please see LICENSE files in the repository root for full details.
+
+CREATE INDEX CONCURRENTLY IF NOT EXISTS
+    "oauth2_authorization_grants_user_session_id_idx"
+    ON "oauth2_authorization_grants" (user_session_id);

crates/storage-pg/src/oauth2/authorization_grant.rs

@@ -88,7 +88,7 @@ impl TryFrom<GrantLookup> for AuthorizationGrant {
                     fulfilled_at,
                 }
             }
-            (Some(fulfilled_at), None, None, None, None) => {
+            (Some(fulfilled_at), None, None, None, Some(_)) => {
                 tracing::warn!(
                     grant.id = %id,
                     "Grant was fulfilled without a user_session_id, it will be treated as cancelled"
@@ -97,6 +97,9 @@ impl TryFrom<GrantLookup> for AuthorizationGrant {
                     cancelled_at: fulfilled_at,
                 }
             }
+            (Some(fulfilled_at), None, None, None, None) => AuthorizationGrantStage::Cancelled {
+                cancelled_at: fulfilled_at,
+            },
             (
                 Some(fulfilled_at),
                 Some(exchanged_at),