Skip to content

Commit 9dfcc8a

Browse files
ThomasK33ThomasK33
committed
chore: add OAuth2 device flow test scripts
Change-Id: Ic232851727e683ab3d8b7ce970c505588da2f827 Signed-off-by: Thomas Kosiewski <tk@coder.com>
1 parent 51cb62a commit 9dfcc8a

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

43 files changed

+1271
-723
lines changed

‎.claude/scripts/format.sh

Lines changed: 16 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -101,30 +101,36 @@ fi
101101
# Get the file extension to determine the appropriate formatter
102102
file_ext="${file_path##*.}"
103103

104+
# Helper function to run formatter and handle errors
105+
run_formatter() {
106+
local target="$1"
107+
local file_type="$2"
108+
109+
if ! make FILE="$file_path" "$target"; then
110+
echo "Error: Failed to format $file_type file: $file_path" >&2
111+
exit 2
112+
fi
113+
echo "✓ Formatted $file_type file: $file_path"
114+
}
104115
# Change to the project root directory (where the Makefile is located)
105116
cd "$(dirname "$0")/../.."
106117

107118
# Call the appropriate Makefile target based on file extension
108119
case "$file_ext" in
109120
go)
110-
make fmt/go FILE="$file_path"
111-
echo "✓ Formatted Go file: $file_path"
121+
run_formatter "fmt/go" "Go"
112122
;;
113123
js | jsx | ts | tsx)
114-
make fmt/ts FILE="$file_path"
115-
echo "✓ Formatted TypeScript/JavaScript file: $file_path"
124+
run_formatter "fmt/ts" "TypeScript/JavaScript"
116125
;;
117126
tf | tfvars)
118-
make fmt/terraform FILE="$file_path"
119-
echo "✓ Formatted Terraform file: $file_path"
127+
run_formatter "fmt/terraform" "Terraform"
120128
;;
121129
sh)
122-
make fmt/shfmt FILE="$file_path"
123-
echo "✓ Formatted shell script: $file_path"
130+
run_formatter "fmt/shfmt" "shell script"
124131
;;
125132
md)
126-
make fmt/markdown FILE="$file_path"
127-
echo "✓ Formatted Markdown file: $file_path"
133+
run_formatter "fmt/markdown" "Markdown"
128134
;;
129135
*)
130136
echo "No formatter available for file extension: $file_ext"

‎coderd/apidoc/docs.go

Lines changed: 2 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎coderd/apidoc/swagger.json

Lines changed: 2 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎coderd/audit/diff.go

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,7 @@ type Auditable interface {
2424
database.NotificationsSettings |
2525
database.OAuth2ProviderApp |
2626
database.OAuth2ProviderAppSecret |
27+
database.OAuth2ProviderDeviceCode |
2728
database.PrebuildsSettings |
2829
database.CustomRole |
2930
database.AuditableOrganizationMember |

‎coderd/audit/request.go

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -117,6 +117,8 @@ func ResourceTarget[T Auditable](tgt T) string {
117117
return typed.Name
118118
case database.OAuth2ProviderAppSecret:
119119
return typed.DisplaySecret
120+
case database.OAuth2ProviderDeviceCode:
121+
return typed.UserCode
120122
case database.CustomRole:
121123
return typed.Name
122124
case database.AuditableOrganizationMember:
@@ -179,6 +181,8 @@ func ResourceID[T Auditable](tgt T) uuid.UUID {
179181
return typed.ID
180182
case database.OAuth2ProviderAppSecret:
181183
return typed.ID
184+
case database.OAuth2ProviderDeviceCode:
185+
return typed.ID
182186
case database.CustomRole:
183187
return typed.ID
184188
case database.AuditableOrganizationMember:
@@ -232,6 +236,8 @@ func ResourceType[T Auditable](tgt T) database.ResourceType {
232236
return database.ResourceTypeOauth2ProviderApp
233237
case database.OAuth2ProviderAppSecret:
234238
return database.ResourceTypeOauth2ProviderAppSecret
239+
case database.OAuth2ProviderDeviceCode:
240+
return database.ResourceTypeOauth2ProviderDeviceCode
235241
case database.CustomRole:
236242
return database.ResourceTypeCustomRole
237243
case database.AuditableOrganizationMember:
@@ -288,6 +294,8 @@ func ResourceRequiresOrgID[T Auditable]() bool {
288294
return false
289295
case database.OAuth2ProviderAppSecret:
290296
return false
297+
case database.OAuth2ProviderDeviceCode:
298+
return false
291299
case database.CustomRole:
292300
return true
293301
case database.AuditableOrganizationMember:

‎coderd/coderd.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -993,7 +993,7 @@ func New(options *Options) *API {
993993
r.Route("/device", func(r chi.Router) {
994994
r.Post("/", api.postOAuth2DeviceAuthorization()) // RFC 8628 compliant endpoint
995995
r.Route("/verify", func(r chi.Router) {
996-
r.Use(apiKeyMiddleware)
996+
r.Use(apiKeyMiddlewareRedirect)
997997
r.Get("/", api.getOAuth2DeviceVerification())
998998
r.Post("/", api.postOAuth2DeviceVerification())
999999
})

‎coderd/database/dbauthz/dbauthz.go

Lines changed: 32 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -417,6 +417,7 @@ var (
417417
rbac.ResourceProvisionerJobs.Type: {policy.ActionRead, policy.ActionUpdate, policy.ActionCreate},
418418
rbac.ResourceOauth2App.Type: {policy.ActionCreate, policy.ActionRead, policy.ActionUpdate, policy.ActionDelete},
419419
rbac.ResourceOauth2AppSecret.Type: {policy.ActionCreate, policy.ActionRead, policy.ActionUpdate, policy.ActionDelete},
420+
rbac.ResourceOauth2AppCodeToken.Type: {policy.ActionCreate, policy.ActionRead, policy.ActionUpdate, policy.ActionDelete},
420421
}),
421422
Org: map[string][]rbac.Permission{},
422423
User: []rbac.Permission{},
@@ -1346,6 +1347,14 @@ func (q *querier) CleanTailnetTunnels(ctx context.Context) error {
13461347
return q.db.CleanTailnetTunnels(ctx)
13471348
}
13481349

1350+
func (q *querier) ConsumeOAuth2ProviderAppCodeByPrefix(ctx context.Context, secretPrefix []byte) (database.OAuth2ProviderAppCode, error) {
1351+
return updateWithReturn(q.log, q.auth, q.db.GetOAuth2ProviderAppCodeByPrefix, q.db.ConsumeOAuth2ProviderAppCodeByPrefix)(ctx, secretPrefix)
1352+
}
1353+
1354+
func (q *querier) ConsumeOAuth2ProviderDeviceCodeByPrefix(ctx context.Context, deviceCodePrefix string) (database.OAuth2ProviderDeviceCode, error) {
1355+
return updateWithReturn(q.log, q.auth, q.db.GetOAuth2ProviderDeviceCodeByPrefix, q.db.ConsumeOAuth2ProviderDeviceCodeByPrefix)(ctx, deviceCodePrefix)
1356+
}
1357+
13491358
func (q *querier) CountAuditLogs(ctx context.Context, arg database.CountAuditLogsParams) (int64, error) {
13501359
// Shortcut if the user is an owner. The SQL filter is noticeable,
13511360
// and this is an easy win for owners. Which is the common case.
@@ -1560,27 +1569,30 @@ func (q *querier) DeleteOAuth2ProviderAppTokensByAppAndUserID(ctx context.Contex
15601569
return q.db.DeleteOAuth2ProviderAppTokensByAppAndUserID(ctx, arg)
15611570
}
15621571

1563-
func (q *querier) DeleteOldAuditLogConnectionEvents(ctx context.Context, threshold database.DeleteOldAuditLogConnectionEventsParams) error {
1564-
// `ResourceSystem` is deprecated, but it doesn't make sense to add
1565-
// `policy.ActionDelete` to `ResourceAuditLog`, since this is the one and
1566-
// only time we'll be deleting from the audit log.
1567-
if err := q.authorizeContext(ctx, policy.ActionDelete, rbac.ResourceSystem); err != nil {
1568-
return err
1569-
}
1570-
return q.db.DeleteOldAuditLogConnectionEvents(ctx, threshold)
1571-
}
1572-
15731572
func (q *querier) DeleteOAuth2ProviderDeviceCodeByID(ctx context.Context, id uuid.UUID) error {
15741573
// Fetch the device code first to check authorization
15751574
deviceCode, err := q.db.GetOAuth2ProviderDeviceCodeByID(ctx, id)
15761575
if err != nil {
1577-
return err
1576+
return xerrors.Errorf("get oauth2 provider device code: %w", err)
15781577
}
15791578
if err := q.authorizeContext(ctx, policy.ActionDelete, deviceCode); err != nil {
1580-
return err
1579+
return xerrors.Errorf("authorize oauth2 provider device code deletion: %w", err)
15811580
}
15821581

1583-
return q.db.DeleteOAuth2ProviderDeviceCodeByID(ctx, id)
1582+
if err := q.db.DeleteOAuth2ProviderDeviceCodeByID(ctx, id); err != nil {
1583+
return xerrors.Errorf("delete oauth2 provider device code: %w", err)
1584+
}
1585+
return nil
1586+
}
1587+
1588+
func (q *querier) DeleteOldAuditLogConnectionEvents(ctx context.Context, threshold database.DeleteOldAuditLogConnectionEventsParams) error {
1589+
// `ResourceSystem` is deprecated, but it doesn't make sense to add
1590+
// `policy.ActionDelete` to `ResourceAuditLog`, since this is the one and
1591+
// only time we'll be deleting from the audit log.
1592+
if err := q.authorizeContext(ctx, policy.ActionDelete, rbac.ResourceSystem); err != nil {
1593+
return err
1594+
}
1595+
return q.db.DeleteOldAuditLogConnectionEvents(ctx, threshold)
15841596
}
15851597

15861598
func (q *querier) DeleteOldNotificationMessages(ctx context.Context) error {
@@ -2367,8 +2379,8 @@ func (q *querier) GetOAuth2ProviderDeviceCodeByUserCode(ctx context.Context, use
23672379
}
23682380

23692381
func (q *querier) GetOAuth2ProviderDeviceCodesByClientID(ctx context.Context, clientID uuid.UUID) ([]database.OAuth2ProviderDeviceCode, error) {
2370-
// This requires access to read the OAuth2 app
2371-
if err := q.authorizeContext(ctx, policy.ActionRead, rbac.ResourceOauth2App); err != nil {
2382+
// This requires access to read OAuth2 app code tokens
2383+
if err := q.authorizeContext(ctx, policy.ActionRead, rbac.ResourceOauth2AppCodeToken); err != nil {
23722384
return []database.OAuth2ProviderDeviceCode{}, err
23732385
}
23742386
return q.db.GetOAuth2ProviderDeviceCodesByClientID(ctx, clientID)
@@ -3810,8 +3822,8 @@ func (q *querier) InsertOAuth2ProviderAppToken(ctx context.Context, arg database
38103822
}
38113823

38123824
func (q *querier) InsertOAuth2ProviderDeviceCode(ctx context.Context, arg database.InsertOAuth2ProviderDeviceCodeParams) (database.OAuth2ProviderDeviceCode, error) {
3813-
// Creating device codes requires OAuth2 app access
3814-
if err := q.authorizeContext(ctx, policy.ActionCreate, rbac.ResourceOauth2App); err != nil {
3825+
// Creating device codes requires OAuth2 app code token creation access
3826+
if err := q.authorizeContext(ctx, policy.ActionCreate, rbac.ResourceOauth2AppCodeToken); err != nil {
38153827
return database.OAuth2ProviderDeviceCode{}, err
38163828
}
38173829
return q.db.InsertOAuth2ProviderDeviceCode(ctx, arg)
@@ -4490,13 +4502,10 @@ func (q *querier) UpdateOAuth2ProviderAppSecretByID(ctx context.Context, arg dat
44904502
}
44914503

44924504
func (q *querier) UpdateOAuth2ProviderDeviceCodeAuthorization(ctx context.Context, arg database.UpdateOAuth2ProviderDeviceCodeAuthorizationParams) (database.OAuth2ProviderDeviceCode, error) {
4493-
// Verify the user is authenticated for device code authorization
4494-
_, ok := ActorFromContext(ctx)
4495-
if !ok {
4496-
return database.OAuth2ProviderDeviceCode{}, ErrNoActor
4505+
fetch := func(ctx context.Context, arg database.UpdateOAuth2ProviderDeviceCodeAuthorizationParams) (database.OAuth2ProviderDeviceCode, error) {
4506+
return q.db.GetOAuth2ProviderDeviceCodeByID(ctx, arg.ID)
44974507
}
4498-
4499-
return q.db.UpdateOAuth2ProviderDeviceCodeAuthorization(ctx, arg)
4508+
return updateWithReturn(q.log, q.auth, fetch, q.db.UpdateOAuth2ProviderDeviceCodeAuthorization)(ctx, arg)
45004509
}
45014510

45024511
func (q *querier) UpdateOrganization(ctx context.Context, arg database.UpdateOrganizationParams) (database.Organization, error) {

‎coderd/database/dbauthz/dbauthz_test.go

Lines changed: 122 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5537,6 +5537,19 @@ func (s *MethodTestSuite) TestOAuth2ProviderAppCodes() {
55375537
UserID: user.ID,
55385538
}).Asserts(rbac.ResourceOauth2AppCodeToken.WithOwner(user.ID.String()), policy.ActionDelete)
55395539
}))
5540+
s.Run("ConsumeOAuth2ProviderAppCodeByPrefix", s.Subtest(func(db database.Store, check *expects) {
5541+
user := dbgen.User(s.T(), db, database.User{})
5542+
app := dbgen.OAuth2ProviderApp(s.T(), db, database.OAuth2ProviderApp{})
5543+
// Use unique prefix to avoid test isolation issues
5544+
uniquePrefix := fmt.Sprintf("prefix-%s-%d", s.T().Name(), time.Now().UnixNano())
5545+
code := dbgen.OAuth2ProviderAppCode(s.T(), db, database.OAuth2ProviderAppCode{
5546+
SecretPrefix: []byte(uniquePrefix),
5547+
UserID: user.ID,
5548+
AppID: app.ID,
5549+
ExpiresAt: time.Now().Add(24 * time.Hour), // Extended expiry for test stability
5550+
})
5551+
check.Args(code.SecretPrefix).Asserts(code, policy.ActionUpdate).Returns(code)
5552+
}))
55405553
}
55415554

55425555
func (s *MethodTestSuite) TestOAuth2ProviderAppTokens() {
@@ -5612,6 +5625,115 @@ func (s *MethodTestSuite) TestOAuth2ProviderAppTokens() {
56125625
}))
56135626
}
56145627

5628+
func (s *MethodTestSuite) TestOAuth2ProviderDeviceCodes() {
5629+
s.Run("InsertOAuth2ProviderDeviceCode", s.Subtest(func(db database.Store, check *expects) {
5630+
app := dbgen.OAuth2ProviderApp(s.T(), db, database.OAuth2ProviderApp{})
5631+
check.Args(database.InsertOAuth2ProviderDeviceCodeParams{
5632+
ClientID: app.ID,
5633+
DeviceCodePrefix: "testpref",
5634+
DeviceCodeHash: []byte("hash"),
5635+
UserCode: "TEST1234",
5636+
VerificationUri: "http://example.com/device",
5637+
}).Asserts(rbac.ResourceOauth2AppCodeToken, policy.ActionCreate)
5638+
}))
5639+
s.Run("GetOAuth2ProviderDeviceCodeByID", s.Subtest(func(db database.Store, check *expects) {
5640+
app := dbgen.OAuth2ProviderApp(s.T(), db, database.OAuth2ProviderApp{})
5641+
deviceCode, err := db.InsertOAuth2ProviderDeviceCode(context.Background(), database.InsertOAuth2ProviderDeviceCodeParams{
5642+
ClientID: app.ID,
5643+
DeviceCodePrefix: "testpref",
5644+
UserCode: "TEST1234",
5645+
VerificationUri: "http://example.com/device",
5646+
})
5647+
require.NoError(s.T(), err)
5648+
check.Args(deviceCode.ID).Asserts(deviceCode, policy.ActionRead).Returns(deviceCode)
5649+
}))
5650+
s.Run("GetOAuth2ProviderDeviceCodeByPrefix", s.Subtest(func(db database.Store, check *expects) {
5651+
app := dbgen.OAuth2ProviderApp(s.T(), db, database.OAuth2ProviderApp{})
5652+
deviceCode, err := db.InsertOAuth2ProviderDeviceCode(context.Background(), database.InsertOAuth2ProviderDeviceCodeParams{
5653+
ClientID: app.ID,
5654+
DeviceCodePrefix: "testpref",
5655+
UserCode: "TEST1234",
5656+
VerificationUri: "http://example.com/device",
5657+
})
5658+
require.NoError(s.T(), err)
5659+
check.Args(deviceCode.DeviceCodePrefix).Asserts(deviceCode, policy.ActionRead).Returns(deviceCode)
5660+
}))
5661+
s.Run("GetOAuth2ProviderDeviceCodeByUserCode", s.Subtest(func(db database.Store, check *expects) {
5662+
app := dbgen.OAuth2ProviderApp(s.T(), db, database.OAuth2ProviderApp{})
5663+
deviceCode, err := db.InsertOAuth2ProviderDeviceCode(context.Background(), database.InsertOAuth2ProviderDeviceCodeParams{
5664+
ClientID: app.ID,
5665+
DeviceCodePrefix: "testpref",
5666+
UserCode: "TEST1234",
5667+
VerificationUri: "http://example.com/device",
5668+
})
5669+
require.NoError(s.T(), err)
5670+
check.Args(deviceCode.UserCode).Asserts(deviceCode, policy.ActionRead).Returns(deviceCode)
5671+
}))
5672+
s.Run("GetOAuth2ProviderDeviceCodesByClientID", s.Subtest(func(db database.Store, check *expects) {
5673+
app := dbgen.OAuth2ProviderApp(s.T(), db, database.OAuth2ProviderApp{})
5674+
deviceCode, err := db.InsertOAuth2ProviderDeviceCode(context.Background(), database.InsertOAuth2ProviderDeviceCodeParams{
5675+
ClientID: app.ID,
5676+
DeviceCodePrefix: "testpref",
5677+
UserCode: "TEST1234",
5678+
VerificationUri: "http://example.com/device",
5679+
})
5680+
require.NoError(s.T(), err)
5681+
check.Args(app.ID).Asserts(rbac.ResourceOauth2AppCodeToken, policy.ActionRead).Returns([]database.OAuth2ProviderDeviceCode{deviceCode})
5682+
}))
5683+
s.Run("ConsumeOAuth2ProviderDeviceCodeByPrefix", s.Subtest(func(db database.Store, check *expects) {
5684+
app := dbgen.OAuth2ProviderApp(s.T(), db, database.OAuth2ProviderApp{})
5685+
user := dbgen.User(s.T(), db, database.User{})
5686+
// Use unique identifiers to avoid test isolation issues
5687+
// Device code prefix must be exactly 8 characters
5688+
uniquePrefix := fmt.Sprintf("t%07d", time.Now().UnixNano()%10000000)
5689+
uniqueUserCode := fmt.Sprintf("USER%04d", time.Now().UnixNano()%10000)
5690+
// Create device code using dbgen (now available!)
5691+
deviceCode := dbgen.OAuth2ProviderDeviceCode(s.T(), db, database.OAuth2ProviderDeviceCode{
5692+
DeviceCodePrefix: uniquePrefix,
5693+
UserCode: uniqueUserCode,
5694+
ClientID: app.ID,
5695+
ExpiresAt: time.Now().Add(24 * time.Hour), // Extended expiry for test stability
5696+
})
5697+
// Authorize the device code so it can be consumed
5698+
deviceCode, err := db.UpdateOAuth2ProviderDeviceCodeAuthorization(s.T().Context(), database.UpdateOAuth2ProviderDeviceCodeAuthorizationParams{
5699+
ID: deviceCode.ID,
5700+
UserID: uuid.NullUUID{UUID: user.ID, Valid: true},
5701+
Status: database.OAuth2DeviceStatusAuthorized,
5702+
})
5703+
require.NoError(s.T(), err)
5704+
require.Equal(s.T(), database.OAuth2DeviceStatusAuthorized, deviceCode.Status)
5705+
check.Args(uniquePrefix).Asserts(deviceCode, policy.ActionUpdate).Returns(deviceCode)
5706+
}))
5707+
s.Run("UpdateOAuth2ProviderDeviceCodeAuthorization", s.Subtest(func(db database.Store, check *expects) {
5708+
app := dbgen.OAuth2ProviderApp(s.T(), db, database.OAuth2ProviderApp{})
5709+
user := dbgen.User(s.T(), db, database.User{})
5710+
// Create device code using dbgen
5711+
deviceCode := dbgen.OAuth2ProviderDeviceCode(s.T(), db, database.OAuth2ProviderDeviceCode{
5712+
ClientID: app.ID,
5713+
})
5714+
require.Equal(s.T(), database.OAuth2DeviceStatusPending, deviceCode.Status)
5715+
check.Args(database.UpdateOAuth2ProviderDeviceCodeAuthorizationParams{
5716+
ID: deviceCode.ID,
5717+
UserID: uuid.NullUUID{UUID: user.ID, Valid: true},
5718+
Status: database.OAuth2DeviceStatusAuthorized,
5719+
}).Asserts(deviceCode, policy.ActionUpdate)
5720+
}))
5721+
s.Run("DeleteOAuth2ProviderDeviceCodeByID", s.Subtest(func(db database.Store, check *expects) {
5722+
app := dbgen.OAuth2ProviderApp(s.T(), db, database.OAuth2ProviderApp{})
5723+
deviceCode, err := db.InsertOAuth2ProviderDeviceCode(context.Background(), database.InsertOAuth2ProviderDeviceCodeParams{
5724+
ClientID: app.ID,
5725+
DeviceCodePrefix: "testpref",
5726+
UserCode: "TEST1234",
5727+
VerificationUri: "http://example.com/device",
5728+
})
5729+
require.NoError(s.T(), err)
5730+
check.Args(deviceCode.ID).Asserts(deviceCode, policy.ActionDelete)
5731+
}))
5732+
s.Run("DeleteExpiredOAuth2ProviderDeviceCodes", s.Subtest(func(db database.Store, check *expects) {
5733+
check.Args().Asserts(rbac.ResourceSystem, policy.ActionDelete)
5734+
}))
5735+
}
5736+
56155737
func (s *MethodTestSuite) TestResourcesMonitor() {
56165738
createAgent := func(t *testing.T, db database.Store) (database.WorkspaceAgent, database.WorkspaceTable) {
56175739
t.Helper()

0 commit comments

Comments
 (0)
pFad - Phonifier reborn

Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.

Note: This service is not intended for secure transactions such as banking, social media, email, or purchasing. Use at your own risk. We assume no liability whatsoever for broken pages.


Alternative Proxies:

Alternative Proxy

pFad Proxy

pFad v3 Proxy

pFad v4 Proxy