mirror of
https://github.com/coder/coder.git
synced 2026-09-24 15:04:27 +08:00
Bobby Ho
663f41ffa9
Adds an OAuth2 client type (public vs confidential, RFC 7591 §2) derived from the requested auth method instead of hardcoded confidential. The type is stored and guarded here, but no endpoint enforces on it yet; public behavior at the token endpoint follows in the next PR in the stack. - Client type is derived once and reused by both registration and redirect URI validation, so they can't disagree - IsPublic() fails closed: an unrecognized or missing value reads as confidential - RFC 7592 update (PUT) now rejects moving a client between public and confidential (400) instead of silently flipping it when the auth method is omitted - Discovery still doesn't advertise "none"; follows once the token endpoint honors it ### Behavior by client shape `client_type` is derived from `token_endpoint_auth_method` at POST and pinned at PUT. RFC 7592 GET/PUT authenticate with the registration access token, not the client secret, so neither endpoint reads a secret. | Registered with | Stored `client_type` / method | GET reports | PUT that flips the method | |------------------------------------|---------------------------------------|-----------------------|-----------------------------------------| | omitted, or `client_secret_basic` | `confidential` / `client_secret_basic` | `client_secret_basic` | `none` → 400 `invalid_client_metadata` | | `none` (new) | `public` / `none` | `none` | `client_secret_*` → 400 `invalid_client_metadata` | | `none` (before this PR) | `confidential` / `none` | `none` | either → 200, type stays `confidential` | - PUT still replaces every other RFC 7591 field. `client_type` is the only pinned one; the method may move within a type (`client_secret_basic` ↔ `client_secret_post`). - Row 3 is the only shape where the two columns disagree. The guard fires only on a method change that crosses the type line, so those clients keep managing themselves instead of being locked out of their own configuration endpoint. - The token endpoint does not consult `client_type` yet, so every client still authenticates with a secret and registration still issues one. Split out of #27873, second in the stack (on top of #28041). Refs https://linear.app/codercom/issue/ENG-3029/oauth2-support-public-client
33 lines
1.4 KiB
Go
33 lines
1.4 KiB
Go
package database
|
|
|
|
import (
|
|
"github.com/google/uuid"
|
|
|
|
"github.com/coder/coder/v2/codersdk"
|
|
)
|
|
|
|
// PrebuildsSystemUserID mirrors codersdk.PrebuildsSystemUserID, parsed
|
|
// for use as a uuid.UUID. Both must agree; tests pin the value to the
|
|
// codersdk constant so the two cannot drift.
|
|
var PrebuildsSystemUserID = uuid.MustParse(codersdk.PrebuildsSystemUserID)
|
|
|
|
// Values stored in oauth2_provider_apps.client_type, as plain strings for
|
|
// comparison against the sqlc-generated string column.
|
|
//
|
|
// Converted from the codersdk constants rather than redeclared, so the value
|
|
// registration writes and the value OAuth2ProviderApp.IsPublic reads back
|
|
// cannot disagree. That divergence would fail closed anyway (the app would read
|
|
// as confidential and demand a secret it was never issued), but it would fail
|
|
// visibly to a client rather than here.
|
|
//
|
|
// What this does not protect against is the two constants colliding on the same
|
|
// value, which would make IsPublic true for confidential apps. Nothing in the
|
|
// type system can catch that; the tests that pin these spellings to the wire
|
|
// values do, so do not delete them as redundant:
|
|
// TestOAuth2ClientRegistrationRequest_DetermineClientType (codersdk) and
|
|
// TestOAuth2ProviderAppIsPublic (coderd/database).
|
|
const (
|
|
OAuth2ProviderAppClientTypeConfidential = string(codersdk.OAuth2ClientTypeConfidential)
|
|
OAuth2ProviderAppClientTypePublic = string(codersdk.OAuth2ClientTypePublic)
|
|
)
|