Skip to content

Commit d10afa7

Browse files
ThomasK33ThomasK33
committed
chore: add OAuth2 device flow test scripts
Change-Id: Ic232851727e683ab3d8b7ce970c505588da2f827 Signed-off-by: Thomas Kosiewski <tk@coder.com>
1 parent de28364 commit d10afa7

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

45 files changed

+1358
-798
lines changed

‎.claude/scripts/format.sh

Lines changed: 16 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -101,30 +101,36 @@ fi
101101
# Get the file extension to determine the appropriate formatter
102102
file_ext="${file_path##*.}"
103103

104+
# Helper function to run formatter and handle errors
105+
run_formatter() {
106+
local target="$1"
107+
local file_type="$2"
108+
109+
if ! make FILE="$file_path" "$target"; then
110+
echo "Error: Failed to format $file_type file: $file_path" >&2
111+
exit 2
112+
fi
113+
echo "✓ Formatted $file_type file: $file_path"
114+
}
104115
# Change to the project root directory (where the Makefile is located)
105116
cd "$(dirname "$0")/../.."
106117

107118
# Call the appropriate Makefile target based on file extension
108119
case "$file_ext" in
109120
go)
110-
make fmt/go FILE="$file_path"
111-
echo "✓ Formatted Go file: $file_path"
121+
run_formatter "fmt/go" "Go"
112122
;;
113123
js | jsx | ts | tsx)
114-
make fmt/ts FILE="$file_path"
115-
echo "✓ Formatted TypeScript/JavaScript file: $file_path"
124+
run_formatter "fmt/ts" "TypeScript/JavaScript"
116125
;;
117126
tf | tfvars)
118-
make fmt/terraform FILE="$file_path"
119-
echo "✓ Formatted Terraform file: $file_path"
127+
run_formatter "fmt/terraform" "Terraform"
120128
;;
121129
sh)
122-
make fmt/shfmt FILE="$file_path"
123-
echo "✓ Formatted shell script: $file_path"
130+
run_formatter "fmt/shfmt" "shell script"
124131
;;
125132
md)
126-
make fmt/markdown FILE="$file_path"
127-
echo "✓ Formatted Markdown file: $file_path"
133+
run_formatter "fmt/markdown" "Markdown"
128134
;;
129135
*)
130136
echo "No formatter available for file extension: $file_ext"

‎coderd/apidoc/docs.go

Lines changed: 2 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎coderd/apidoc/swagger.json

Lines changed: 2 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎coderd/audit/diff.go

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,7 @@ type Auditable interface {
2424
database.NotificationsSettings |
2525
database.OAuth2ProviderApp |
2626
database.OAuth2ProviderAppSecret |
27+
database.OAuth2ProviderDeviceCode |
2728
database.PrebuildsSettings |
2829
database.CustomRole |
2930
database.AuditableOrganizationMember |

‎coderd/audit/request.go

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -117,6 +117,8 @@ func ResourceTarget[T Auditable](tgt T) string {
117117
return typed.Name
118118
case database.OAuth2ProviderAppSecret:
119119
return typed.DisplaySecret
120+
case database.OAuth2ProviderDeviceCode:
121+
return typed.UserCode
120122
case database.CustomRole:
121123
return typed.Name
122124
case database.AuditableOrganizationMember:
@@ -179,6 +181,8 @@ func ResourceID[T Auditable](tgt T) uuid.UUID {
179181
return typed.ID
180182
case database.OAuth2ProviderAppSecret:
181183
return typed.ID
184+
case database.OAuth2ProviderDeviceCode:
185+
return typed.ID
182186
case database.CustomRole:
183187
return typed.ID
184188
case database.AuditableOrganizationMember:
@@ -232,6 +236,8 @@ func ResourceType[T Auditable](tgt T) database.ResourceType {
232236
return database.ResourceTypeOauth2ProviderApp
233237
case database.OAuth2ProviderAppSecret:
234238
return database.ResourceTypeOauth2ProviderAppSecret
239+
case database.OAuth2ProviderDeviceCode:
240+
return database.ResourceTypeOauth2ProviderDeviceCode
235241
case database.CustomRole:
236242
return database.ResourceTypeCustomRole
237243
case database.AuditableOrganizationMember:
@@ -288,6 +294,8 @@ func ResourceRequiresOrgID[T Auditable]() bool {
288294
return false
289295
case database.OAuth2ProviderAppSecret:
290296
return false
297+
case database.OAuth2ProviderDeviceCode:
298+
return false
291299
case database.CustomRole:
292300
return true
293301
case database.AuditableOrganizationMember:

‎coderd/coderd.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -993,7 +993,7 @@ func New(options *Options) *API {
993993
r.Route("/device", func(r chi.Router) {
994994
r.Post("/", api.postOAuth2DeviceAuthorization()) // RFC 8628 compliant endpoint
995995
r.Route("/verify", func(r chi.Router) {
996-
r.Use(apiKeyMiddleware)
996+
r.Use(apiKeyMiddlewareRedirect)
997997
r.Get("/", api.getOAuth2DeviceVerification())
998998
r.Post("/", api.postOAuth2DeviceVerification())
999999
})

‎coderd/database/dbauthz/dbauthz.go

Lines changed: 76 additions & 32 deletions
Original file line numberDiff line numberDiff line change
@@ -417,6 +417,35 @@ var (
417417
rbac.ResourceProvisionerJobs.Type: {policy.ActionRead, policy.ActionUpdate, policy.ActionCreate},
418418
rbac.ResourceOauth2App.Type: {policy.ActionCreate, policy.ActionRead, policy.ActionUpdate, policy.ActionDelete},
419419
rbac.ResourceOauth2AppSecret.Type: {policy.ActionCreate, policy.ActionRead, policy.ActionUpdate, policy.ActionDelete},
420+
rbac.ResourceOauth2AppCodeToken.Type: {policy.ActionCreate, policy.ActionRead, policy.ActionUpdate, policy.ActionDelete},
421+
}),
422+
Org: map[string][]rbac.Permission{},
423+
User: []rbac.Permission{},
424+
},
425+
}),
426+
Scope: rbac.ScopeAll,
427+
}.WithCachedASTValue()
428+
429+
subjectSystemOAuth2 = rbac.Subject{
430+
Type: rbac.SubjectTypeSystemRestricted,
431+
FriendlyName: "System OAuth2",
432+
ID: uuid.Nil.String(),
433+
Roles: rbac.Roles([]rbac.Role{
434+
{
435+
Identifier: rbac.RoleIdentifier{Name: "system-oauth2"},
436+
DisplayName: "System OAuth2",
437+
Site: rbac.Permissions(map[string][]policy.Action{
438+
// OAuth2 resources - full CRUD permissions
439+
rbac.ResourceOauth2App.Type: rbac.ResourceOauth2App.AvailableActions(),
440+
rbac.ResourceOauth2AppSecret.Type: rbac.ResourceOauth2AppSecret.AvailableActions(),
441+
rbac.ResourceOauth2AppCodeToken.Type: rbac.ResourceOauth2AppCodeToken.AvailableActions(),
442+
443+
// API key permissions needed for OAuth2 token revocation
444+
rbac.ResourceApiKey.Type: {policy.ActionRead, policy.ActionDelete},
445+
446+
// Minimal read permissions that might be needed for OAuth2 operations
447+
rbac.ResourceUser.Type: {policy.ActionRead},
448+
rbac.ResourceOrganization.Type: {policy.ActionRead},
420449
}),
421450
Org: map[string][]rbac.Permission{},
422451
User: []rbac.Permission{},
@@ -567,6 +596,12 @@ func AsSystemRestricted(ctx context.Context) context.Context {
567596
return As(ctx, subjectSystemRestricted)
568597
}
569598

599+
// AsSystemOAuth2 returns a context with an actor that has permissions
600+
// required for OAuth2 provider operations (token revocation, device codes, registration).
601+
func AsSystemOAuth2(ctx context.Context) context.Context {
602+
return As(ctx, subjectSystemOAuth2)
603+
}
604+
570605
// AsSystemReadProvisionerDaemons returns a context with an actor that has permissions
571606
// to read provisioner daemons.
572607
func AsSystemReadProvisionerDaemons(ctx context.Context) context.Context {
@@ -1346,6 +1381,14 @@ func (q *querier) CleanTailnetTunnels(ctx context.Context) error {
13461381
return q.db.CleanTailnetTunnels(ctx)
13471382
}
13481383

1384+
func (q *querier) ConsumeOAuth2ProviderAppCodeByPrefix(ctx context.Context, secretPrefix []byte) (database.OAuth2ProviderAppCode, error) {
1385+
return updateWithReturn(q.log, q.auth, q.db.GetOAuth2ProviderAppCodeByPrefix, q.db.ConsumeOAuth2ProviderAppCodeByPrefix)(ctx, secretPrefix)
1386+
}
1387+
1388+
func (q *querier) ConsumeOAuth2ProviderDeviceCodeByPrefix(ctx context.Context, deviceCodePrefix string) (database.OAuth2ProviderDeviceCode, error) {
1389+
return updateWithReturn(q.log, q.auth, q.db.GetOAuth2ProviderDeviceCodeByPrefix, q.db.ConsumeOAuth2ProviderDeviceCodeByPrefix)(ctx, deviceCodePrefix)
1390+
}
1391+
13491392
func (q *querier) CountAuditLogs(ctx context.Context, arg database.CountAuditLogsParams) (int64, error) {
13501393
// Shortcut if the user is an owner. The SQL filter is noticeable,
13511394
// and this is an easy win for owners. Which is the common case.
@@ -1481,7 +1524,7 @@ func (q *querier) DeleteExpiredOAuth2ProviderDeviceCodes(ctx context.Context) er
14811524
func (q *querier) DeleteExternalAuthLink(ctx context.Context, arg database.DeleteExternalAuthLinkParams) error {
14821525
return fetchAndExec(q.log, q.auth, policy.ActionUpdatePersonal, func(ctx context.Context, arg database.DeleteExternalAuthLinkParams) (database.ExternalAuthLink, error) {
14831526
//nolint:gosimple
1484-
return q.db.GetExternalAuthLink(ctx, database.GetExternalAuthLinkParams{UserID: arg.UserID, ProviderID: arg.ProviderID})
1527+
return q.db.GetExternalAuthLink(ctx, database.GetExternalAuthLinkParams(arg))
14851528
}, q.db.DeleteExternalAuthLink)(ctx, arg)
14861529
}
14871530

@@ -1560,27 +1603,30 @@ func (q *querier) DeleteOAuth2ProviderAppTokensByAppAndUserID(ctx context.Contex
15601603
return q.db.DeleteOAuth2ProviderAppTokensByAppAndUserID(ctx, arg)
15611604
}
15621605

1563-
func (q *querier) DeleteOldAuditLogConnectionEvents(ctx context.Context, threshold database.DeleteOldAuditLogConnectionEventsParams) error {
1564-
// `ResourceSystem` is deprecated, but it doesn't make sense to add
1565-
// `policy.ActionDelete` to `ResourceAuditLog`, since this is the one and
1566-
// only time we'll be deleting from the audit log.
1567-
if err := q.authorizeContext(ctx, policy.ActionDelete, rbac.ResourceSystem); err != nil {
1568-
return err
1569-
}
1570-
return q.db.DeleteOldAuditLogConnectionEvents(ctx, threshold)
1571-
}
1572-
15731606
func (q *querier) DeleteOAuth2ProviderDeviceCodeByID(ctx context.Context, id uuid.UUID) error {
15741607
// Fetch the device code first to check authorization
15751608
deviceCode, err := q.db.GetOAuth2ProviderDeviceCodeByID(ctx, id)
15761609
if err != nil {
1577-
return err
1610+
return xerrors.Errorf("get oauth2 provider device code: %w", err)
15781611
}
15791612
if err := q.authorizeContext(ctx, policy.ActionDelete, deviceCode); err != nil {
1580-
return err
1613+
return xerrors.Errorf("authorize oauth2 provider device code deletion: %w", err)
15811614
}
15821615

1583-
return q.db.DeleteOAuth2ProviderDeviceCodeByID(ctx, id)
1616+
if err := q.db.DeleteOAuth2ProviderDeviceCodeByID(ctx, id); err != nil {
1617+
return xerrors.Errorf("delete oauth2 provider device code: %w", err)
1618+
}
1619+
return nil
1620+
}
1621+
1622+
func (q *querier) DeleteOldAuditLogConnectionEvents(ctx context.Context, threshold database.DeleteOldAuditLogConnectionEventsParams) error {
1623+
// `ResourceSystem` is deprecated, but it doesn't make sense to add
1624+
// `policy.ActionDelete` to `ResourceAuditLog`, since this is the one and
1625+
// only time we'll be deleting from the audit log.
1626+
if err := q.authorizeContext(ctx, policy.ActionDelete, rbac.ResourceSystem); err != nil {
1627+
return err
1628+
}
1629+
return q.db.DeleteOldAuditLogConnectionEvents(ctx, threshold)
15841630
}
15851631

15861632
func (q *querier) DeleteOldNotificationMessages(ctx context.Context) error {
@@ -1612,7 +1658,7 @@ func (q *querier) DeleteOldWorkspaceAgentStats(ctx context.Context) error {
16121658
}
16131659

16141660
func (q *querier) DeleteOrganizationMember(ctx context.Context, arg database.DeleteOrganizationMemberParams) error {
1615-
return deleteQ[database.OrganizationMember](q.log, q.auth, func(ctx context.Context, arg database.DeleteOrganizationMemberParams) (database.OrganizationMember, error) {
1661+
return deleteQ(q.log, q.auth, func(ctx context.Context, arg database.DeleteOrganizationMemberParams) (database.OrganizationMember, error) {
16161662
member, err := database.ExpectOne(q.OrganizationMembers(ctx, database.OrganizationMembersParams{
16171663
OrganizationID: arg.OrganizationID,
16181664
UserID: arg.UserID,
@@ -2203,7 +2249,7 @@ func (q *querier) GetLicenseByID(ctx context.Context, id int32) (database.Licens
22032249
}
22042250

22052251
func (q *querier) GetLicenses(ctx context.Context) ([]database.License, error) {
2206-
fetch := func(ctx context.Context, _ interface{}) ([]database.License, error) {
2252+
fetch := func(ctx context.Context, _ any) ([]database.License, error) {
22072253
return q.db.GetLicenses(ctx)
22082254
}
22092255
return fetchWithPostFilter(q.auth, policy.ActionRead, fetch)(ctx, nil)
@@ -2367,8 +2413,8 @@ func (q *querier) GetOAuth2ProviderDeviceCodeByUserCode(ctx context.Context, use
23672413
}
23682414

23692415
func (q *querier) GetOAuth2ProviderDeviceCodesByClientID(ctx context.Context, clientID uuid.UUID) ([]database.OAuth2ProviderDeviceCode, error) {
2370-
// This requires access to read the OAuth2 app
2371-
if err := q.authorizeContext(ctx, policy.ActionRead, rbac.ResourceOauth2App); err != nil {
2416+
// This requires access to read OAuth2 app code tokens
2417+
if err := q.authorizeContext(ctx, policy.ActionRead, rbac.ResourceOauth2AppCodeToken); err != nil {
23722418
return []database.OAuth2ProviderDeviceCode{}, err
23732419
}
23742420
return q.db.GetOAuth2ProviderDeviceCodesByClientID(ctx, clientID)
@@ -2425,7 +2471,7 @@ func (q *querier) GetOrganizationResourceCountByID(ctx context.Context, organiza
24252471
}
24262472

24272473
func (q *querier) GetOrganizations(ctx context.Context, args database.GetOrganizationsParams) ([]database.Organization, error) {
2428-
fetch := func(ctx context.Context, _ interface{}) ([]database.Organization, error) {
2474+
fetch := func(ctx context.Context, _ any) ([]database.Organization, error) {
24292475
return q.db.GetOrganizations(ctx, args)
24302476
}
24312477
return fetchWithPostFilter(q.auth, policy.ActionRead, fetch)(ctx, nil)
@@ -2553,7 +2599,7 @@ func (q *querier) GetPreviousTemplateVersion(ctx context.Context, arg database.G
25532599
}
25542600

25552601
func (q *querier) GetProvisionerDaemons(ctx context.Context) ([]database.ProvisionerDaemon, error) {
2556-
fetch := func(ctx context.Context, _ interface{}) ([]database.ProvisionerDaemon, error) {
2602+
fetch := func(ctx context.Context, _ any) ([]database.ProvisionerDaemon, error) {
25572603
return q.db.GetProvisionerDaemons(ctx)
25582604
}
25592605
return fetchWithPostFilter(q.auth, policy.ActionRead, fetch)(ctx, nil)
@@ -3511,7 +3557,7 @@ func (q *querier) GetWorkspaceModulesCreatedAfter(ctx context.Context, createdAt
35113557
}
35123558

35133559
func (q *querier) GetWorkspaceProxies(ctx context.Context) ([]database.WorkspaceProxy, error) {
3514-
return fetchWithPostFilter(q.auth, policy.ActionRead, func(ctx context.Context, _ interface{}) ([]database.WorkspaceProxy, error) {
3560+
return fetchWithPostFilter(q.auth, policy.ActionRead, func(ctx context.Context, _ any) ([]database.WorkspaceProxy, error) {
35153561
return q.db.GetWorkspaceProxies(ctx)
35163562
})(ctx, nil)
35173563
}
@@ -3810,8 +3856,8 @@ func (q *querier) InsertOAuth2ProviderAppToken(ctx context.Context, arg database
38103856
}
38113857

38123858
func (q *querier) InsertOAuth2ProviderDeviceCode(ctx context.Context, arg database.InsertOAuth2ProviderDeviceCodeParams) (database.OAuth2ProviderDeviceCode, error) {
3813-
// Creating device codes requires OAuth2 app access
3814-
if err := q.authorizeContext(ctx, policy.ActionCreate, rbac.ResourceOauth2App); err != nil {
3859+
// Creating device codes requires OAuth2 app code token creation access
3860+
if err := q.authorizeContext(ctx, policy.ActionCreate, rbac.ResourceOauth2AppCodeToken); err != nil {
38153861
return database.OAuth2ProviderDeviceCode{}, err
38163862
}
38173863
return q.db.InsertOAuth2ProviderDeviceCode(ctx, arg)
@@ -4118,10 +4164,11 @@ func (q *querier) InsertWorkspaceBuild(ctx context.Context, arg database.InsertW
41184164
return xerrors.Errorf("get workspace by id: %w", err)
41194165
}
41204166

4121-
var action policy.Action = policy.ActionWorkspaceStart
4122-
if arg.Transition == database.WorkspaceTransitionDelete {
4167+
action := policy.ActionWorkspaceStart
4168+
switch arg.Transition {
4169+
case database.WorkspaceTransitionDelete:
41234170
action = policy.ActionDelete
4124-
} else if arg.Transition == database.WorkspaceTransitionStop {
4171+
case database.WorkspaceTransitionStop:
41254172
action = policy.ActionWorkspaceStop
41264173
}
41274174

@@ -4490,13 +4537,10 @@ func (q *querier) UpdateOAuth2ProviderAppSecretByID(ctx context.Context, arg dat
44904537
}
44914538

44924539
func (q *querier) UpdateOAuth2ProviderDeviceCodeAuthorization(ctx context.Context, arg database.UpdateOAuth2ProviderDeviceCodeAuthorizationParams) (database.OAuth2ProviderDeviceCode, error) {
4493-
// Verify the user is authenticated for device code authorization
4494-
_, ok := ActorFromContext(ctx)
4495-
if !ok {
4496-
return database.OAuth2ProviderDeviceCode{}, ErrNoActor
4540+
fetch := func(ctx context.Context, arg database.UpdateOAuth2ProviderDeviceCodeAuthorizationParams) (database.OAuth2ProviderDeviceCode, error) {
4541+
return q.db.GetOAuth2ProviderDeviceCodeByID(ctx, arg.ID)
44974542
}
4498-
4499-
return q.db.UpdateOAuth2ProviderDeviceCodeAuthorization(ctx, arg)
4543+
return updateWithReturn(q.log, q.auth, fetch, q.db.UpdateOAuth2ProviderDeviceCodeAuthorization)(ctx, arg)
45004544
}
45014545

45024546
func (q *querier) UpdateOrganization(ctx context.Context, arg database.UpdateOrganizationParams) (database.Organization, error) {

0 commit comments

Comments
 (0)