async def refresh_access_token(
        db: AsyncSession,
        integration_short_name: str,
        user: schemas.User,
        connection_id: UUID,
        decrypted_credential: dict,
        white_label: Optional[schemas.WhiteLabel] = None,
    ) -> OAuth2TokenResponse:
        """Refresh an access token using a refresh token.

        Rotates the refresh token if the integration is configured to do so.

        Args:
        ----
            db (AsyncSession): The database session.
            integration_short_name (str): The short name of the integration.
            user (schemas.User): The user for whom to refresh the token.
            connection_id (UUID): The ID of the connection to refresh the token for.
            decrypted_credential (dict): The token and optional config fields
            white_label (Optional[schemas.WhiteLabel]): White label configuration to use if
                available.

        Returns:
        -------
            OAuth2TokenResponse: The response containing the new access token and other details.

        Raises:
        ------
            TokenRefreshError: If token refresh fails
            NotFoundException: If the integration is not found

        """
        try:
            # Get and validate refresh token
            refresh_token = await OAuth2Service._get_refresh_token(decrypted_credential)

            # Get and validate integration config
            integration_config = await OAuth2Service._get_integration_config(integration_short_name)

            # Get client credentials
            # TODO: this is the only place we need to check the db for client credentials
            client_id, client_secret = await OAuth2Service._get_client_credentials(
                integration_config, None, decrypted_credential
            )

            # Override with white label credentials if available
            if white_label and white_label.source_short_name == integration_short_name:
                client_id = white_label.client_id
                client_secret = white_label.client_secret

            # Prepare request parameters
            headers, payload = OAuth2Service._prepare_token_request(
                integration_config, refresh_token, client_id, client_secret
            )

            # Make request and handle response
            response = await OAuth2Service._make_token_request(
                integration_config.backend_url, headers, payload
            )

            # Handle rotating refresh tokens if needed
            oauth2_token_response = await OAuth2Service._handle_token_response(
                db, response, integration_config, user, connection_id
            )

            return oauth2_token_response

        except Exception as e:
            oauth2_service_logger.error(
                f"Token refresh failed for user {user.email} and "
                f"integration {integration_short_name}: {str(e)}"
            )
            raise
Refresh an access token using a refresh token.

        Rotates the refresh token if the integration is configured to do so.

        Args:
        ----
            db (AsyncSession): The database session.
            integration_short_name (str): The short name of the integration.
            user (schemas.User): The user for whom to refresh the token.
            connection_id (UUID): The ID of the connection to refresh the token for.
            decrypted_credential (dict): The token and optional config fields
            white_label (Optional[schemas.WhiteLabel]): White label configuration to use if
                available.

        Returns:
        -------
            OAuth2TokenResponse: The response containing the new access token and other details.

        Raises:
        ------
            TokenRefreshError: If token refresh fails
            NotFoundException: If the integration is not found

        
backend/airweave/platform/auth/services.py