[SOU-123] Fix GitLab token refresh with redirect_uri parameter

CHANGELOG.md

@@ -17,6 +17,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Fixed
 - Fixed issue where a file would fail to load when opening it from the /search view and it matched multiple branches. [#797](https://github.com/sourcebot-dev/sourcebot/pull/797)
+- [EE] Fixed GitLab OAuth token refresh failures by including the required `redirect_uri` parameter. [#798](https://github.com/sourcebot-dev/sourcebot/pull/798)
 
 ## [4.10.17] - 2026-01-23
 

packages/web/src/ee/features/permissionSyncing/tokenRefresh.ts

@@ -119,18 +119,27 @@ export async function refreshOAuthToken(
                     continue;
                 }
 
+                // Build request body parameters
+                const bodyParams: Record<string, string> = {
+                    client_id: clientId,
+                    client_secret: clientSecret,
+                    grant_type: 'refresh_token',
+                    refresh_token: refreshToken,
+                };
+
+                // GitLab requires redirect_uri to match the original authorization request
+                // even when refreshing tokens. Use URL constructor to handle trailing slashes.
+                if (provider === 'gitlab') {
+                    bodyParams.redirect_uri = new URL('/api/auth/callback/gitlab', env.AUTH_URL).toString();
+                }
+
                 const response = await fetch(url, {
                     method: 'POST',
                     headers: {
                         'Content-Type': 'application/x-www-form-urlencoded',
                         'Accept': 'application/json',
                     },
-                    body: new URLSearchParams({
-                        client_id: clientId,
-                        client_secret: clientSecret,
-                        grant_type: 'refresh_token',
-                        refresh_token: refreshToken,
-                    }),
+                    body: new URLSearchParams(bodyParams),
                 });
 
                 if (!response.ok) {