feat: Add OIDC authentication (#3314)

* feat: Add OIDC authentication

* Extract username into a separate package and add OIDC tests

* Add test case for invalid tokens

* Add test case for username as email

* Add OIDC to the frontend

* Improve comments from self-review

* Add authentication docs

* Add telemetry

* Update docs/install/auth.md

Co-authored-by: Ammar Bandukwala <ammar@ammar.io>

* Update docs/install/auth.md

Co-authored-by: Ammar Bandukwala <ammar@ammar.io>

* Remove username package

Co-authored-by: Ammar Bandukwala <ammar@ammar.io>

coderd/httpapi/httpapi.go

@@ -7,7 +7,6 @@ import (
 	"fmt"
 	"net/http"
 	"reflect"
-	"regexp"
 	"strings"
 
 	"github.com/go-playground/validator/v10"
@@ -16,8 +15,7 @@ import (
 )
 
 var (
-	validate      *validator.Validate
-	usernameRegex = regexp.MustCompile("^[a-zA-Z0-9]+(?:-[a-zA-Z0-9]+)*$")
+	validate *validator.Validate
 )
 
 // This init is used to create a validator and register validation-specific
@@ -39,13 +37,7 @@ func init() {
 		if !ok {
 			return false
 		}
-		if len(str) > 32 {
-			return false
-		}
-		if len(str) < 1 {
-			return false
-		}
-		return usernameRegex.MatchString(str)
+		return UsernameValid(str)
 	})
 	if err != nil {
 		panic(err)

coderd/httpapi/httpapi_test.go

@@ -81,71 +81,6 @@ func TestRead(t *testing.T) {
 	})
 }
 
-func TestReadUsername(t *testing.T) {
-	t.Parallel()
-	// Tests whether usernames are valid or not.
-	testCases := []struct {
-		Username string
-		Valid    bool
-	}{
-		{"1", true},
-		{"12", true},
-		{"123", true},
-		{"12345678901234567890", true},
-		{"123456789012345678901", true},
-		{"a", true},
-		{"a1", true},
-		{"a1b2", true},
-		{"a1b2c3d4e5f6g7h8i9j0", true},
-		{"a1b2c3d4e5f6g7h8i9j0k", true},
-		{"aa", true},
-		{"abc", true},
-		{"abcdefghijklmnopqrst", true},
-		{"abcdefghijklmnopqrstu", true},
-		{"wow-test", true},
-
-		{"", false},
-		{" ", false},
-		{" a", false},
-		{" a ", false},
-		{" 1", false},
-		{"1 ", false},
-		{" aa", false},
-		{"aa ", false},
-		{" 12", false},
-		{"12 ", false},
-		{" a1", false},
-		{"a1 ", false},
-		{" abcdefghijklmnopqrstu", false},
-		{"abcdefghijklmnopqrstu ", false},
-		{" 123456789012345678901", false},
-		{" a1b2c3d4e5f6g7h8i9j0k", false},
-		{"a1b2c3d4e5f6g7h8i9j0k ", false},
-		{"bananas_wow", false},
-		{"test--now", false},
-
-		{"123456789012345678901234567890123", false},
-		{"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", false},
-		{"123456789012345678901234567890123123456789012345678901234567890123", false},
-	}
-	type toValidate struct {
-		Username string `json:"username" validate:"username"`
-	}
-	for _, testCase := range testCases {
-		testCase := testCase
-		t.Run(testCase.Username, func(t *testing.T) {
-			t.Parallel()
-			rw := httptest.NewRecorder()
-			data, err := json.Marshal(toValidate{testCase.Username})
-			require.NoError(t, err)
-			r := httptest.NewRequest("POST", "/", bytes.NewBuffer(data))
-
-			var validate toValidate
-			require.Equal(t, testCase.Valid, httpapi.Read(rw, r, &validate))
-		})
-	}
-}
-
 func WebsocketCloseMsg(t *testing.T) {
 	t.Parallel()
 

coderd/httpapi/username.go

@@ -0,0 +1,45 @@
+package httpapi
+
+import (
+	"regexp"
+	"strings"
+
+	"github.com/moby/moby/pkg/namesgenerator"
+)
+
+var (
+	usernameValid   = regexp.MustCompile("^[a-zA-Z0-9]+(?:-[a-zA-Z0-9]+)*$")
+	usernameReplace = regexp.MustCompile("[^a-zA-Z0-9-]*")
+)
+
+// UsernameValid returns whether the input string is a valid username.
+func UsernameValid(str string) bool {
+	if len(str) > 32 {
+		return false
+	}
+	if len(str) < 1 {
+		return false
+	}
+	return usernameValid.MatchString(str)
+}
+
+// UsernameFrom returns a best-effort username from the provided string.
+//
+// It first attempts to validate the incoming string, which will
+// be returned if it is valid. It then will attempt to extract
+// the username from an email address. If no success happens during
+// these steps, a random username will be returned.
+func UsernameFrom(str string) string {
+	if UsernameValid(str) {
+		return str
+	}
+	emailAt := strings.LastIndex(str, "@")
+	if emailAt >= 0 {
+		str = str[:emailAt]
+	}
+	str = usernameReplace.ReplaceAllString(str, "")
+	if UsernameValid(str) {
+		return str
+	}
+	return strings.ReplaceAll(namesgenerator.GetRandomName(1), "_", "-")
+}

coderd/httpapi/username_test.go

@@ -0,0 +1,102 @@
+package httpapi_test
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/coder/coder/coderd/httpapi"
+)
+
+func TestValid(t *testing.T) {
+	t.Parallel()
+	// Tests whether usernames are valid or not.
+	testCases := []struct {
+		Username string
+		Valid    bool
+	}{
+		{"1", true},
+		{"12", true},
+		{"123", true},
+		{"12345678901234567890", true},
+		{"123456789012345678901", true},
+		{"a", true},
+		{"a1", true},
+		{"a1b2", true},
+		{"a1b2c3d4e5f6g7h8i9j0", true},
+		{"a1b2c3d4e5f6g7h8i9j0k", true},
+		{"aa", true},
+		{"abc", true},
+		{"abcdefghijklmnopqrst", true},
+		{"abcdefghijklmnopqrstu", true},
+		{"wow-test", true},
+
+		{"", false},
+		{" ", false},
+		{" a", false},
+		{" a ", false},
+		{" 1", false},
+		{"1 ", false},
+		{" aa", false},
+		{"aa ", false},
+		{" 12", false},
+		{"12 ", false},
+		{" a1", false},
+		{"a1 ", false},
+		{" abcdefghijklmnopqrstu", false},
+		{"abcdefghijklmnopqrstu ", false},
+		{" 123456789012345678901", false},
+		{" a1b2c3d4e5f6g7h8i9j0k", false},
+		{"a1b2c3d4e5f6g7h8i9j0k ", false},
+		{"bananas_wow", false},
+		{"test--now", false},
+
+		{"123456789012345678901234567890123", false},
+		{"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", false},
+		{"123456789012345678901234567890123123456789012345678901234567890123", false},
+	}
+	for _, testCase := range testCases {
+		testCase := testCase
+		t.Run(testCase.Username, func(t *testing.T) {
+			t.Parallel()
+			require.Equal(t, testCase.Valid, httpapi.UsernameValid(testCase.Username))
+		})
+	}
+}
+
+func TestFrom(t *testing.T) {
+	t.Parallel()
+	testCases := []struct {
+		From  string
+		Match string
+	}{
+		{"1", "1"},
+		{"kyle@kwc.io", "kyle"},
+		{"kyle+wow@kwc.io", "kylewow"},
+		{"kyle+testing", "kyletesting"},
+		{"kyle-testing", "kyle-testing"},
+		{"much.”more unusual”@example.com", "muchmoreunusual"},
+
+		// Cases where an invalid string is provided, and the result is a random name.
+		{"123456789012345678901234567890123", ""},
+		{"very.unusual.”@”.unusual.com@example.com", ""},
+		{"___@ok.com", ""},
+		{" something with spaces ", ""},
+		{"--test--", ""},
+		{"", ""},
+	}
+	for _, testCase := range testCases {
+		testCase := testCase
+		t.Run(testCase.From, func(t *testing.T) {
+			t.Parallel()
+			converted := httpapi.UsernameFrom(testCase.From)
+			t.Log(converted)
+			require.True(t, httpapi.UsernameValid(converted))
+			if testCase.Match == "" {
+				require.NotEqual(t, testCase.From, converted)
+			} else {
+				require.Equal(t, testCase.Match, converted)
+			}
+		})
+	}
+}