go run ./scripts/oauth2/oauth2-test-server.go

Tests the OAuth2 Device Authorization Flow (RFC 8628) using the golang.org/x/oauth2 library. This flow is designed for devices that either lack a web browser or have limited input capabilities.

Usage:

./scripts/oauth2/test-device-flow.sh

Features:

- Implements the complete device authorization flow

- Uses the`/x/oauth2` library for OAuth2 operations

- Displays user code and verification URL

- Automatically polls for token completion

- Tests the access token with an API call

- Colored output for better readability

A Go program that implements the OAuth2 device authorization flow. Used internally by`test-device-flow.sh` but can also be run standalone:

export CLIENT_ID="your-client-id"

export CLIENT_SECRET="your-client-secret"

go run ./scripts/oauth2/oauth2-device-flow.go

1.**Run automated tests:**

./scripts/oauth2/cleanup-test-app.sh

3.**Generate PKCE for custom testing:**

3.**Device authorization flow testing:**

./scripts/oauth2/test-device-flow.sh

./scripts/oauth2/cleanup-test-app.sh

4.**Generate PKCE for custom testing:**

./scripts/oauth2/generate-pkce.sh

- Metadata:`GET /.well-known/oauth-authorization-server`

- Authorization:`GET/POST /oauth2/authorize`

- Token:`POST /oauth2/token`

- Device Authorization:`POST /oauth2/device`

- Apps API:`/api/v2/oauth2-provider/apps`

package main

import (

)

const (

)

typeDeviceCodeResponsestruct {

}

typeTokenResponsestruct {

}

typeErrorResponsestruct {

}

typeConfigstruct {

}

funcmain() {

config:=&Config{

ClientID:os.Getenv("CLIENT_ID"),

ClientSecret:os.Getenv("CLIENT_SECRET"),

BaseURL:getEnvOrDefault("BASE_URL","http://localhost:3000"),

}

ifconfig.ClientID==""||config.ClientSecret=="" {

log.Fatal("CLIENT_ID and CLIENT_SECRET must be set. Run: eval $(./setup-test-app.sh) first")

}

ctx:=context.Background()

_,_=fmt.Printf("%s=== Step 1: Device Code Request ===%s\n",colorBlue,colorReset)

deviceResp,err:=requestDeviceCode(ctx,config)

iferr!=nil {

log.Fatalf("Failed to get device code: %v",err)

}

_,_=fmt.Printf("%sDevice Code Response:%s\n",colorGreen,colorReset)

prettyJSON,_:=json.MarshalIndent(deviceResp,""," ")

_,_=fmt.Printf("%s\n",prettyJSON)

_,_=fmt.Println()

_,_=fmt.Printf("%s=== Step 2: User Authorization ===%s\n",colorYellow,colorReset)

_,_=fmt.Printf("Please visit: %s%s%s\n",colorCyan,deviceResp.VerificationURI,colorReset)

_,_=fmt.Printf("Enter code: %s%s%s\n",colorPurple,deviceResp.UserCode,colorReset)

_,_=fmt.Println()

ifdeviceResp.VerificationURIComplete!="" {

_,_=fmt.Printf("Or visit the complete URL: %s%s%s\n",colorCyan,deviceResp.VerificationURIComplete,colorReset)

_,_=fmt.Println()

}

_,_=fmt.Printf("Waiting for authorization (expires in %d seconds)...\n",deviceResp.ExpiresIn)

_,_=fmt.Printf("Polling every %d seconds...\n",deviceResp.Interval)

_,_=fmt.Println()

_,_=fmt.Printf("%s=== Step 3: Token Polling ===%s\n",colorBlue,colorReset)

tokenResp,err:=pollForToken(ctx,config,deviceResp)

iferr!=nil {

log.Fatalf("Failed to get access token: %v",err)

}

_,_=fmt.Printf("%s=== Authorization Successful! ===%s\n",colorGreen,colorReset)

_,_=fmt.Printf("%sAccess Token Response:%s\n",colorGreen,colorReset)

prettyTokenJSON,_:=json.MarshalIndent(tokenResp,""," ")

_,_=fmt.Printf("%s\n",prettyTokenJSON)

_,_=fmt.Println()

_,_=fmt.Printf("%s=== Step 4: Testing Access Token ===%s\n",colorBlue,colorReset)

iferr:=testAccessToken(ctx,config,tokenResp.AccessToken);err!=nil {

log.Printf("%sWarning: Failed to test access token: %v%s",colorYellow,err,colorReset)

}else {

_,_=fmt.Printf("%sAccess token is valid and working!%s\n",colorGreen,colorReset)

}

_,_=fmt.Println()

_,_=fmt.Printf("%sDevice authorization flow completed successfully!%s\n",colorGreen,colorReset)

_,_=fmt.Printf("You can now use the access token to make authenticated API requests.\n")

}

funcrequestDeviceCode(ctx context.Context,config*Config) (*DeviceCodeResponse,error) {

data:= url.Values{}

data.Set("client_id",config.ClientID)

req,err:=http.NewRequestWithContext(ctx,"POST",config.BaseURL+"/oauth2/device",strings.NewReader(data.Encode()))

iferr!=nil {

returnnil,xerrors.Errorf("creating request: %w",err)

}

req.SetBasicAuth(config.ClientID,config.ClientSecret)

req.Header.Set("Content-Type","application/x-www-form-urlencoded")

client:=&http.Client{Timeout:30*time.Second}

resp,err:=client.Do(req)

iferr!=nil {

returnnil,xerrors.Errorf("making request: %w",err)

}

deferfunc() {_=resp.Body.Close() }()

ifresp.StatusCode!=http.StatusOK {

iferr:=json.NewDecoder(resp.Body).Decode(&errResp);err==nil {

returnnil,xerrors.Errorf("device code request failed: %s - %s",errResp.Error,errResp.ErrorDescription)

}

returnnil,xerrors.Errorf("device code request failed with status %d",resp.StatusCode)

}

iferr:=json.NewDecoder(resp.Body).Decode(&deviceResp);err!=nil {

returnnil,xerrors.Errorf("decoding response: %w",err)

}

return&deviceResp,nil

}

funcpollForToken(ctx context.Context,config*Config,deviceResp*DeviceCodeResponse) (*TokenResponse,error) {

oauth2Config:=&oauth2.Config{

ClientID:config.ClientID,

ClientSecret:config.ClientSecret,

Endpoint: oauth2.Endpoint{

TokenURL:config.BaseURL+"/oauth2/token",

},

}

interval:=time.Duration(deviceResp.Interval)*time.Second

ifinterval<5*time.Second {

interval=5*time.Second// Minimum polling interval

}

deadline:=time.Now().Add(time.Duration(deviceResp.ExpiresIn)*time.Second)

ticker:=time.NewTicker(interval)

deferticker.Stop()

for {

select {

case<-ctx.Done():

returnnil,ctx.Err()

case<-ticker.C:

iftime.Now().After(deadline) {

returnnil,xerrors.New("device code expired")

}

_,_=fmt.Printf("Polling for token...\n")

data:= url.Values{}

data.Set("grant_type","urn:ietf:params:oauth:grant-type:device_code")

data.Set("device_code",deviceResp.DeviceCode)

data.Set("client_id",config.ClientID)

req,err:=http.NewRequestWithContext(ctx,"POST",oauth2Config.Endpoint.TokenURL,strings.NewReader(data.Encode()))

iferr!=nil {

returnnil,xerrors.Errorf("creating token request: %w",err)

}

req.SetBasicAuth(config.ClientID,config.ClientSecret)

req.Header.Set("Content-Type","application/x-www-form-urlencoded")

client:=&http.Client{Timeout:30*time.Second}

resp,err:=client.Do(req)

iferr!=nil {

_,_=fmt.Printf("Request error: %v\n",err)

}

varresultmap[string]interface{}

iferr:=json.NewDecoder(resp.Body).Decode(&result);err!=nil {

_=resp.Body.Close()

_,_=fmt.Printf("Decode error: %v\n",err)

}

_=resp.Body.Close()

iferrorCode,ok:=result["error"].(string);ok {

switcherrorCode {

case"authorization_pending":

_,_=fmt.Printf("Authorization pending... continuing to poll\n")

case"slow_down":

_,_=fmt.Printf("Slow down request - increasing polling interval by 5 seconds\n")

interval+=5*time.Second

ticker.Reset(interval)

case"access_denied":

returnnil,xerrors.New("access denied by user")

case"expired_token":

returnnil,xerrors.New("device code expired")

default:

iferrorDesc,ok:=result["error_description"].(string);ok {

}

returnnil,xerrors.Errorf("token error: %s%s",errorCode,desc)

}

}

ifaccessToken,ok:=result["access_token"].(string);ok {

tokenResp.AccessToken=accessToken

}

iftokenType,ok:=result["token_type"].(string);ok {

tokenResp.TokenType=tokenType

}

ifexpiresIn,ok:=result["expires_in"].(float64);ok {

tokenResp.ExpiresIn=int(expiresIn)

}

ifrefreshToken,ok:=result["refresh_token"].(string);ok {

tokenResp.RefreshToken=refreshToken

}

ifscope,ok:=result["scope"].(string);ok {

tokenResp.Scope=scope

}

iftokenResp.AccessToken=="" {

returnnil,xerrors.New("no access token in response")

}

return&tokenResp,nil

}

}

}

functestAccessToken(ctx context.Context,config*Config,accessTokenstring)error {

req,err:=http.NewRequestWithContext(ctx,"GET",config.BaseURL+"/api/v2/users/me",nil)

iferr!=nil {

returnxerrors.Errorf("creating request: %w",err)

}

req.Header.Set("Coder-Session-Token",accessToken)

client:=&http.Client{Timeout:10*time.Second}

resp,err:=client.Do(req)

iferr!=nil {

returnxerrors.Errorf("making request: %w",err)

}

deferfunc() {_=resp.Body.Close() }()

ifresp.StatusCode!=http.StatusOK {

returnxerrors.Errorf("API request failed with status %d",resp.StatusCode)

}

varuserInfomap[string]interface{}

iferr:=json.NewDecoder(resp.Body).Decode(&userInfo);err!=nil {

returnxerrors.Errorf("decoding response: %w",err)

}

_,_=fmt.Printf("%sAPI Test Response:%s\n",colorGreen,colorReset)

prettyJSON,_:=json.MarshalIndent(userInfo,""," ")

_,_=fmt.Printf("%s\n",prettyJSON)

}

funcgetEnvOrDefault(key,defaultValuestring)string {

ifvalue:=os.Getenv(key);value!="" {

}

}