Setting a value within a nested function

Been given this golang code, feel free critique is hard as my golang is rusty. Basic refresh token flow, however we are wrapping the functions in a TX function to allow rollback should something go wrong in the refresh flow.

We need to return the newToken value however it only hold the value we need during the refresh function when it return to refreshToken depending on if I pass it an object or pointer is returns new empty token or nil respectively.

package service
import (
"context"
"database/sql"
"errors"
"strings"
"github.com/api-oauth/pkg/models"
"github.com/api-oauth/pkg/repository"
"golang.org/x/oauth2"
)
const minParts = 2
type OAuthAPI interface {
Exchange(context.Context, string) (*oauth2.Token, error)
Refresh(context.Context, string) (*oauth2.Token, error)
}
type Service struct {
repo     repository.RepoInterface
oauthAPI OAuthAPI
}
func New(api OAuthAPI, repo repository.RepoInterface) *Service {
return &Service{repo: repo, oauthAPI: api}
}
var (
ErrNoRefreshTokenFound = errors.New("no refresh token found")
errNoScopesReturn      = errors.New("no scopes returned")
errNoProfileFound      = errors.New("no profile found")
)
func (s *Service) RefreshToken(ctx context.Context, clientID string, userID int64) (*oauth2.Token, error) {
var newToken *oauth2.Token
err := s.repo.InTx(s.refresh(ctx, clientID, userID, newToken))
if err != nil {
return nil, err
}
return newToken, nil
}
func (s *Service) refresh(ctx context.Context, clientID string, userID int64, newToken *oauth2.Token) func(repo repository.Auth) error {
return func(repo repository.Auth) error {
oldToken, err := repo.GetToken(ctx, userID, clientID)
if err != nil && err != sql.ErrNoRows {
return err
}
if oldToken == nil {
return ErrNoRefreshTokenFound
}
newToken, err = s.oauthAPI.Refresh(ctx, oldToken.Refresh)
if err != nil {
return err
}
rec := models.TokenRecord{
UserID:    userID,
ClientID:  clientID,
ProfileID: oldToken.ProfileID,
Access:    newToken.AccessToken,
Refresh:   newToken.RefreshToken,
Expiry:    newToken.Expiry,
}
err = repo.UpdateToken(ctx, &rec)
if err != nil {
return err
}
return nil
}
}

Trying to have RefreshToken return the updated token information

Pass address of newToken:

func (s *Service) RefreshToken(ctx context.Context, clientID string, userID int64) (*oauth2.Token, error) {
var newToken *oauth2.Token
err := s.repo.InTx(s.refresh(ctx, clientID, userID, &newToken))
...

And, change the refresh function to:

func (s *Service) refresh(ctx context.Context, clientID string, userID int64, newToken **oauth2.Token) func(repo repository.Auth) error {
...
*newToken, err=...