- Notifications
You must be signed in to change notification settings - Fork948
feat: standardize OAuth2 endpoints and implement token revocation#18809
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to ourterms of service andprivacy statement. We’ll occasionally send you account related emails.
Already on GitHub?Sign in to your account
base:main
Are you sure you want to change the base?
feat: standardize OAuth2 endpoints and implement token revocation#18809
Conversation
ThomasK33 commentedJul 9, 2025 • edited
Loading Uh oh!
There was an error while loading.Please reload this page.
edited
Uh oh!
There was an error while loading.Please reload this page.
bc44107 toab73979Compareab73979 tob89c367Compareb89c367 tob73b71dCompare514f744 to386d77dCompare01f48f3 to9393060Compare9393060 to2c31819CompareThere was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others.Learn more.
I don't think we need to duplicate the styles and svg in each html file like this. we could just put a css file next to them in the static folder and reference it, and we already have icons in there.
Uh oh!
There was an error while loading.Please reload this page.
Uh oh!
There was an error while loading.Please reload this page.
Uh oh!
There was an error while loading.Please reload this page.
- Change /oauth2/tokens → /oauth2/token per RFC 6749 - Move token deletion to POST /oauth2/revoke per RFC 7009 - Update all endpoint URLs and documentation - Maintain backward compatibility in client librariesfeat: implement OAuth2 Device Authorization Grant (RFC 8628) - Add device authorization endpoint /oauth2/device/authorize - Add device verification UI at /oauth2/device - Support device_code grant type in token endpoint - Add database table for device codes with expiration - Implement polling interval and user authorization flow - Add comprehensive test coverage for device flowChange-Id: I7a7eebeb23a4f28718ebed2994d01dc21b49315bSigned-off-by: Thomas Kosiewski <tk@coder.com>
2c31819 to212e8ebCompareChange-Id: Ic232851727e683ab3d8b7ce970c505588da2f827Signed-off-by: Thomas Kosiewski <tk@coder.com>
212e8eb to165e7dcCompare| // Fetch the device code first to check authorization | ||
| deviceCode,err:=q.db.GetOAuth2ProviderDeviceCodeByID(ctx,id) | ||
| iferr!=nil { | ||
| returnerr |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others.Learn more.
Wrap these errs please.
| @@ -1275,6 +1275,25 @@ func OAuth2ProviderAppToken(t testing.TB, db database.Store, seed database.OAuth | |||
| returntoken | |||
| } | |||
| funcOAuth2ProviderDeviceCode(t testing.TB,db database.Store,seed database.OAuth2ProviderDeviceCode) database.OAuth2ProviderDeviceCode { | |||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others.Learn more.
Should probably be marked as at.Helper(), no?
| ResourceUri:seed.ResourceUri, | ||
| PollingInterval:takeFirst(seed.PollingInterval,5), | ||
| }) | ||
| require.NoError(t,err,"insert oauth2 device code") |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others.Learn more.
Probably safer as anassert in case this is called from a goroutine.
BTW both comments here could apply to the other helper funcs in this file, so my suggestions are optional if consistency is what we want, but the others are likely wrong.
| device_code_hashbyteaNOT NULL UNIQUE, | ||
| device_code_prefixtextNOT NULL UNIQUECHECK (length(device_code_prefix)=8), | ||
| -- User code (human-readable, 6-8 chars) |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others.Learn more.
Do we need aCHECK for this?
Can we documentwhy these lengths are specified?
| @@ -129,6 +129,11 @@ SELECT * FROM oauth2_provider_app_codes WHERE id = $1; | |||
| -- name: GetOAuth2ProviderAppCodeByPrefix :one | |||
| SELECT*FROM oauth2_provider_app_codesWHERE secret_prefix= $1; | |||
| -- name: ConsumeOAuth2ProviderAppCodeByPrefix :one | |||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others.Learn more.
Since you're only expecting one row back, you should add aLIMIT 1 just to be safe.
| // Verify ownership | ||
| // nolint:gocritic // Using AsSystemRestricted is necessary for OAuth2 public token revocation endpoint | ||
| appSecret,err:=db.GetOAuth2ProviderAppSecretByID(dbauthz.AsSystemRestricted(ctx),dbToken.AppSecretID) |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others.Learn more.
Really feels like we need a new role instead of overloading the system one.
| // nolint:gocritic // Using AsSystemRestricted is necessary for OAuth2 public token revocation endpoint | ||
| err=db.DeleteAPIKeyByID(dbauthz.AsSystemRestricted(ctx),dbToken.APIKeyID) | ||
| iferr!=nil&&!errors.Is(err,sql.ErrNoRows) { | ||
| returnerr |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others.Learn more.
Wrap errors please.
| funcrevokeAPIKey(ctx context.Context,db database.Store,tokenstring,appID uuid.UUID)error { | ||
| // Parse the API key ID from the token (format: <id>-<secret>) | ||
| parts:=strings.SplitN(token,"-",2) |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others.Learn more.
Nit: I'd prefer a key encoder/decoder pattern.
| errBadDeviceCode=xerrors.New("Invalid device code") | ||
| // errAuthorizationPending means the user hasn't authorized the device yet. | ||
| errAuthorizationPending=xerrors.New("authorization pending") |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others.Learn more.
Nit: use consistent capitalisation.
| @@ -0,0 +1,44 @@ | |||
| #!/bin/bash | |||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others.Learn more.
👏👏👏👏
Uh oh!
There was an error while loading.Please reload this page.
feat: standardize OAuth2 endpoints and add token revocation
feat: implement OAuth2 Device Authorization Grant (RFC 8628)
chore: add OAuth2 device flow test scripts
Change-Id: Ic232851727e683ab3d8b7ce970c505588da2f827
Change-Id: I7a7eebeb23a4f28718ebed2994d01dc21b49315b
Signed-off-by: Thomas Kosiewskitk@coder.com