Hi Team, I'm trying to implement a impersonation process (without flows) using the server-side golang SDK, but having a rough time doing it, i'm trying to support multiple setups - session/refresh in body or cookie, rotate DSR, etc... Maybe you can point me to something obvious i'm missing: the

/impersonate

endpoint returns a new refresh JWT but the SDK doesn't have any way to 'refresh' the session jwt back to the user, currently the only reasonable way to do it is to call

RefreshSessionWithRequest

with a fake request:

newJWT, err := descopeCli.Management.JWT().Impersonate(ctx, impersonatorID, targetLoginID, false, nil, targetTenantID, 0)
if err != nil { panic(err)}

// build a fake request to extract refresh jwt
fakeJWTRequest, err := http.NewRequestWithContext(ctx, "POST", "<https://api.descope.com>", nil)
if err != nil {
	panic(err)
}
dsrCookie := &http.Cookie{
	Name:  descopeCli.Auth.GetRefreshCookieName()
	Value: newJWT,
}
fakeJWTRequest.Header.Add("Cookie", dsrCookie.String())
// if "rotate refresh token" is set, we just lost refreshToken forever
ok, newToken, err := descopeCli.Auth.RefreshSessionWithRequest(fakeJWTRequest, w)
if err != nil {
	panic(err)
}
// if not in cookie mode, the client-side SDK sets this one, so we need to clear it
http.SetCookie(w, &http.Cookie{
	Domain:   "localhost",
	Name:     descopeCli.Auth.GetSessionCookieName(),
	HttpOnly: true,
	Secure:   true,
	SameSite: http.SameSiteStrictMode,
	MaxAge:   -1,
})
...

if the SDK would have allow me to use the inner provate

refreshSession

method, and allow to return both session and refresh token, i think i'll be okish (although i still need to sync up all the project configs as the mgmt api doesn't offer any reasonable to query those settings)

@Bhagwanta Yeole @Aditya Arakal can you look into this one?

Yes, I'm checking

but then I lose all the cookie creation logic from JwtRespone object if needed (domain, setting, age, etc). also with this method also, the ask doesn't return the rotated refresh session

@Atharva Joshi @Amol Thite Can you please follow up here?

Sure @Eran Evenor we have passed this over internally. We'll get back as soon as we have an update

@Eran Evenor I looked at this request Doesnt this call does the magic for you? Is this what you are expecting:

func (auth *authenticationService) RefreshSessionWithTokenAndWriter(ctx context.Context, refreshToken string, w http.ResponseWriter) (bool, *descope.Token, error) {
	if refreshToken == "" {
		return false, nil, utils.NewInvalidArgumentError("refreshToken")
	}
	return auth.refreshSession(ctx, refreshToken, w)
}

?

this expects the DSR to be in the request as cookie, if i had the the an exposed

RefreshSession

it will probably do most of the heavy lifting