Mark access token as used when calling the userinfo endpoint

crates/axum-utils/src/user_authorization.rs

@@ -117,6 +117,11 @@ impl<F: Send> UserAuthorization<F> {
             return Err(AuthorizationVerificationError::InvalidToken);
         }
 
+        if !token.is_used() {
+            // Mark the token as used
+            repo.oauth2_access_token().mark_used(clock, token).await?;
+        }
+
         Ok(session)
     }
 }

crates/handlers/src/oauth2/userinfo.rs

@@ -142,6 +142,8 @@ pub async fn get(
         .await?
         .ok_or(RouteError::NoSuchClient)?;
 
+    repo.save().await?;
+
     if let Some(alg) = client.userinfo_signed_response_alg {
         let key = key_store
             .signing_key_for_algorithm(&alg)