[SOU-123] Fix GitLab token refresh with redirect_uri parameter

docker-compose-niteshift.yml

@@ -0,0 +1,24 @@
+version: '3.8'
+
+services:
+  redis:
+    image: redis:7-alpine
+    container_name: sourcebot-redis
+    ports:
+      - "6379:6379"
+    volumes:
+      - /root/.niteshift/data/redis:/data
+    restart: unless-stopped
+
+  postgres:
+    image: postgres:16-alpine
+    container_name: sourcebot-postgres
+    ports:
+      - "5432:5432"
+    environment:
+      POSTGRES_DB: postgres
+      POSTGRES_USER: postgres
+      POSTGRES_PASSWORD: postgres
+    volumes:
+      - /root/.niteshift/data/postgres:/var/lib/postgresql/data
+    restart: unless-stopped

packages/web/src/ee/features/permissionSyncing/tokenRefresh.ts

@@ -119,18 +119,27 @@ export async function refreshOAuthToken(
                     continue;
                 }
 
+                // Build request body parameters
+                const bodyParams: Record<string, string> = {
+                    client_id: clientId,
+                    client_secret: clientSecret,
+                    grant_type: 'refresh_token',
+                    refresh_token: refreshToken,
+                };
+
+                // GitLab requires redirect_uri to match the original authorization request
+                // even when refreshing tokens
+                if (provider === 'gitlab') {
+                    bodyParams.redirect_uri = `${env.AUTH_URL}/api/auth/callback/gitlab`;
+                }
+
                 const response = await fetch(url, {
                     method: 'POST',
                     headers: {
                         'Content-Type': 'application/x-www-form-urlencoded',
                         'Accept': 'application/json',
                     },
-                    body: new URLSearchParams({
-                        client_id: clientId,
-                        client_secret: clientSecret,
-                        grant_type: 'refresh_token',
-                        refresh_token: refreshToken,
-                    }),
+                    body: new URLSearchParams(bodyParams),
                 });
 
                 if (!response.ok) {