feat: add oauth2 token exchange (#12196)

Co-authored-by: Steven Masley <stevenmasley@gmail.com>

coderd/coderdtest/oidctest/helper.go

@@ -1,14 +1,17 @@
 package oidctest
 
 import (
+	"context"
 	"database/sql"
 	"encoding/json"
 	"net/http"
+	"net/url"
 	"testing"
 	"time"
 
 	"github.com/golang-jwt/jwt/v4"
 	"github.com/stretchr/testify/require"
+	"golang.org/x/xerrors"
 
 	"github.com/coder/coder/v2/coderd/database"
 	"github.com/coder/coder/v2/coderd/database/dbauthz"
@@ -114,3 +117,52 @@ func (h *LoginHelper) ForceRefresh(t *testing.T, db database.Store, user *coders
 	_, err := user.User(testutil.Context(t, testutil.WaitShort), "me")
 	require.NoError(t, err, "user must be able to be fetched")
 }
+
+// OAuth2GetCode emulates a user clicking "allow" on the IDP page. When doing
+// unit tests, it's easier to skip this step sometimes. It does make an actual
+// request to the IDP, so it should be equivalent to doing this "manually" with
+// actual requests.
+func OAuth2GetCode(rawAuthURL string, doRequest func(req *http.Request) (*http.Response, error)) (string, error) {
+	authURL, err := url.Parse(rawAuthURL)
+	if err != nil {
+		return "", xerrors.Errorf("failed to parse auth URL: %w", err)
+	}
+
+	r, err := http.NewRequestWithContext(context.Background(), http.MethodGet, rawAuthURL, nil)
+	if err != nil {
+		return "", xerrors.Errorf("failed to create auth request: %w", err)
+	}
+
+	expCode := http.StatusTemporaryRedirect
+	resp, err := doRequest(r)
+	if err != nil {
+		return "", xerrors.Errorf("request: %w", err)
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode != expCode {
+		return "", codersdk.ReadBodyAsError(resp)
+	}
+
+	to := resp.Header.Get("Location")
+	if to == "" {
+		return "", xerrors.Errorf("expected redirect location")
+	}
+
+	toURL, err := url.Parse(to)
+	if err != nil {
+		return "", xerrors.Errorf("failed to parse redirect location: %w", err)
+	}
+
+	code := toURL.Query().Get("code")
+	if code == "" {
+		return "", xerrors.Errorf("expected code in redirect location")
+	}
+
+	state := authURL.Query().Get("state")
+	newState := toURL.Query().Get("state")
+	if newState != state {
+		return "", xerrors.Errorf("expected state %q, got %q", state, newState)
+	}
+	return code, nil
+}

coderd/coderdtest/oidctest/idp.go

@@ -534,37 +534,18 @@ func (*FakeIDP) DeviceLogin(t testing.TB, client *codersdk.Client, externalAuthI
 // unit tests, it's easier to skip this step sometimes. It does make an actual
 // request to the IDP, so it should be equivalent to doing this "manually" with
 // actual requests.
-func (f *FakeIDP) CreateAuthCode(t testing.TB, state string, opts ...func(r *http.Request)) string {
+func (f *FakeIDP) CreateAuthCode(t testing.TB, state string) string {
 	// We need to store some claims, because this is also an OIDC provider, and
 	// it expects some claims to be present.
 	f.stateToIDTokenClaims.Store(state, jwt.MapClaims{})
 
-	u := f.cfg.AuthCodeURL(state)
-	r, err := http.NewRequestWithContext(context.Background(), http.MethodPost, u, nil)
-	require.NoError(t, err, "failed to create auth request")
-
-	for _, opt := range opts {
-		opt(r)
-	}
-
-	rw := httptest.NewRecorder()
-	f.handler.ServeHTTP(rw, r)
-	resp := rw.Result()
-	defer resp.Body.Close()
-
-	require.Equal(t, http.StatusTemporaryRedirect, resp.StatusCode, "expected redirect")
-	to := resp.Header.Get("Location")
-	require.NotEmpty(t, to, "expected redirect location")
-
-	toURL, err := url.Parse(to)
-	require.NoError(t, err, "failed to parse redirect location")
-
-	code := toURL.Query().Get("code")
-	require.NotEmpty(t, code, "expected code in redirect location")
-
-	newState := toURL.Query().Get("state")
-	require.Equal(t, state, newState, "expected state to match")
-
+	code, err := OAuth2GetCode(f.cfg.AuthCodeURL(state), func(req *http.Request) (*http.Response, error) {
+		rw := httptest.NewRecorder()
+		f.handler.ServeHTTP(rw, req)
+		resp := rw.Result()
+		return resp, nil
+	})
+	require.NoError(t, err, "failed to get auth code")
 	return code
 }
 
@@ -1071,7 +1052,7 @@ func (f *FakeIDP) httpHandler(t testing.TB) http.Handler {
 		f.logger.Info(r.Context(), "http call device auth")
 
 		p := httpapi.NewQueryParamParser()
-		p.Required("client_id")
+		p.RequiredNotEmpty("client_id")
 		clientID := p.String(r.URL.Query(), "", "client_id")
 		_ = p.String(r.URL.Query(), "", "scopes")
 		if len(p.Errors) > 0 {