mirror of
https://github.com/coder/coder.git
synced 2026-09-23 22:20:22 +08:00
Bobby Ho
b169f4d8cb
Previously, \`ExternalAuthResponse\` contained no expiry information, so workspace agents and git credential helpers had no way to know when a cached token would stop being valid. Every git operation had to call back to coderd via \`GIT_ASKPASS\` to get a fresh token, adding 1-2 seconds of latency. This PR surfaces \`OAuthExpiry\` from the database as \`ExpiresAt\` in \`ExternalAuthResponse\`, allowing agents to cache tokens with correct eviction timing (compatible with \`git-credential-cache --timeout\` and \`password_expiry_utc\` introduced in git 2.34). \`ExpiresAt\` is normalized to UTC before JSON encoding to avoid sub-minute precision loss that occurs when the PostgreSQL driver applies historical Local Mean Time (LMT) timezone offsets to year-1 AD timestamps. The \`coder external-auth access-token\` CLI command gains \`--output json\` to print the full response including \`ExpiresAt\`, enabling scripts to consume the expiry without parsing heuristics. Closes https://github.com/coder/coder/issues/26036 ## Manual Test <details> <summary>Setup</summary> 1. Create a GitHub OAuth app at https://github.com/settings/developers with: - Homepage URL: `http://127.0.0.1:3000` - Authorization callback URL: `http://127.0.0.1:3000/external-auth/github/callback` 2. Start the dev server with the GitHub provider configured: ```sh CODER_EXTERNAL_AUTH_0_ID=github CODER_EXTERNAL_AUTH_0_TYPE=github CODER_EXTERNAL_AUTH_0_CLIENT_ID=<client-id> CODER_EXTERNAL_AUTH_0_CLIENT_SECRET=<client-secret> ./scripts/develop.sh ``` 3. Log in at `http://127.0.0.1:3000` (use `127.0.0.1`, not `localhost`, so the OAuth state cookie domain matches the callback URL). 4. Go to Account > External Authentication and click **Connect** next to GitHub. Complete the OAuth flow. 5. Create a workspace and SSH into it: ```sh coder create test-workspace coder ssh test-workspace ``` </details> <details> <summary>Flow 1: Token is valid — JSON output includes <code>expires_at</code></summary> Inside the workspace, run: ```sh coder external-auth access-token github --output json echo "Exit code: $?" ``` Expected output (GitHub tokens have no expiry, so \`expires_at\` is the zero value): ```json { "access_token": "<redacted>", "token_extra": null, "url": "", "type": "github", "expires_at": "0001-01-01T00:00:00Z", "username": "<redacted>", "password": "" } ``` ``` Exit code: 0 ``` </details> <details> <summary>Flow 2: Token missing — JSON output includes auth URL, exit code 1</summary> Disconnect GitHub in the Coder UI (Account > External Authentication > Disconnect), then inside the workspace run: ```sh coder external-auth access-token github --output json echo "Exit code: $?" ``` Expected output: ```json { "access_token": "", "token_extra": null, "url": "http://127.0.0.1:3000/external-auth/github", "type": "", "expires_at": "0001-01-01T00:00:00Z", "username": "", "password": "" } ``` ``` Exit code: 1 ``` </details>
102 lines
2.7 KiB
Markdown
Generated
102 lines
2.7 KiB
Markdown
Generated
<!-- DO NOT EDIT | GENERATED CONTENT -->
|
|
# external-auth access-token
|
|
|
|
Print auth for an external provider
|
|
|
|
## Usage
|
|
|
|
```console
|
|
coder external-auth access-token [flags] <provider>
|
|
```
|
|
|
|
## Description
|
|
|
|
```console
|
|
Print an access-token for an external auth provider. The access-token will be validated and sent to stdout with exit code 0. If a valid access-token cannot be obtained, the URL to authenticate will be sent to stdout with exit code 1
|
|
- Ensure that the user is authenticated with GitHub before cloning.:
|
|
|
|
$ #!/usr/bin/env sh
|
|
|
|
OUTPUT=$(coder external-auth access-token github)
|
|
if [ $? -eq 0 ]; then
|
|
echo "Authenticated with GitHub"
|
|
else
|
|
echo "Please authenticate with GitHub:"
|
|
echo $OUTPUT
|
|
fi
|
|
|
|
|
|
- Obtain an extra property of an access token for additional metadata.:
|
|
|
|
$ coder external-auth access-token slack --extra "authed_user.id"
|
|
|
|
- Print the full token response as JSON.:
|
|
|
|
$ coder external-auth access-token github --output json
|
|
```
|
|
|
|
## Options
|
|
|
|
### --extra
|
|
|
|
| | |
|
|
|------|---------------------|
|
|
| Type | <code>string</code> |
|
|
|
|
Extract a field from the "extra" properties of the OAuth token.
|
|
|
|
### --output
|
|
|
|
| | |
|
|
|---------|-------------------------|
|
|
| Type | <code>text\|json</code> |
|
|
| Default | <code>text</code> |
|
|
|
|
Output format. Available formats: text, json.
|
|
|
|
### --agent-token
|
|
|
|
| | |
|
|
|-------------|---------------------------------|
|
|
| Type | <code>string</code> |
|
|
| Environment | <code>$CODER_AGENT_TOKEN</code> |
|
|
|
|
An agent authentication token.
|
|
|
|
### --agent-token-file
|
|
|
|
| | |
|
|
|-------------|--------------------------------------|
|
|
| Type | <code>string</code> |
|
|
| Environment | <code>$CODER_AGENT_TOKEN_FILE</code> |
|
|
|
|
A file containing an agent authentication token.
|
|
|
|
### --agent-url
|
|
|
|
| | |
|
|
|-------------|-------------------------------|
|
|
| Type | <code>url</code> |
|
|
| Environment | <code>$CODER_AGENT_URL</code> |
|
|
|
|
URL for an agent to access your deployment.
|
|
|
|
### --auth
|
|
|
|
| | |
|
|
|-------------|--------------------------------|
|
|
| Type | <code>string</code> |
|
|
| Environment | <code>$CODER_AGENT_AUTH</code> |
|
|
| Default | <code>token</code> |
|
|
|
|
Specify the authentication type to use for the agent.
|
|
|
|
### --agent-name
|
|
|
|
| | |
|
|
|-------------|--------------------------------|
|
|
| Type | <code>string</code> |
|
|
| Environment | <code>$CODER_AGENT_NAME</code> |
|
|
|
|
The name of the agent to authenticate as (only applicable for instance identity).
|