feat: add oauth2 token exchange (#12196)

Co-authored-by: Steven Masley <stevenmasley@gmail.com>

coderd/rbac/object.go

@@ -213,12 +213,20 @@ var (
 		Type: "oauth2_app",
 	}
 
-	// ResourceOAuth2ProviderAppSecrets CRUD.
+	// ResourceOAuth2ProviderAppSecret CRUD.
 	//	create/delete = Make or delete an OAuth2 app secret.
 	//	update = Update last used date.
 	//	read = Read OAuth2 app hashed or truncated secret.
 	ResourceOAuth2ProviderAppSecret = Object{
-		Type: "oauth2_app_secrets",
+		Type: "oauth2_app_secret",
+	}
+
+	// ResourceOAuth2ProviderAppCodeToken CRUD.
+	//	create/delete = Make or delete an OAuth2 app code or token.
+	//  update = None
+	//	read = Check if OAuth2 app code or token exists.
+	ResourceOAuth2ProviderAppCodeToken = Object{
+		Type: "oauth2_app_code_token",
 	}
 )
 

coderd/rbac/object_gen.go

@@ -12,6 +12,7 @@ func AllResources() []Object {
 		ResourceGroup,
 		ResourceLicense,
 		ResourceOAuth2ProviderApp,
+		ResourceOAuth2ProviderAppCodeToken,
 		ResourceOAuth2ProviderAppSecret,
 		ResourceOrgRoleAssignment,
 		ResourceOrganization,

coderd/rbac/roles.go

@@ -148,6 +148,8 @@ func ReloadBuiltinRoles(opts *RoleOptions) {
 			ResourceRoleAssignment.Type: {ActionRead},
 			// All users can see the provisioner daemons.
 			ResourceProvisionerDaemon.Type: {ActionRead},
+			// All users can see OAuth2 provider applications.
+			ResourceOAuth2ProviderApp.Type: {ActionRead},
 		}),
 		Org: map[string][]Permission{},
 		User: append(allPermsExcept(ResourceWorkspaceDormant, ResourceUser, ResourceOrganizationMember),