mirror of
https://github.com/coder/coder.git
synced 2026-09-24 15:04:27 +08:00
Bobby Ho
663f41ffa9
Adds an OAuth2 client type (public vs confidential, RFC 7591 §2) derived from the requested auth method instead of hardcoded confidential. The type is stored and guarded here, but no endpoint enforces on it yet; public behavior at the token endpoint follows in the next PR in the stack. - Client type is derived once and reused by both registration and redirect URI validation, so they can't disagree - IsPublic() fails closed: an unrecognized or missing value reads as confidential - RFC 7592 update (PUT) now rejects moving a client between public and confidential (400) instead of silently flipping it when the auth method is omitted - Discovery still doesn't advertise "none"; follows once the token endpoint honors it ### Behavior by client shape `client_type` is derived from `token_endpoint_auth_method` at POST and pinned at PUT. RFC 7592 GET/PUT authenticate with the registration access token, not the client secret, so neither endpoint reads a secret. | Registered with | Stored `client_type` / method | GET reports | PUT that flips the method | |------------------------------------|---------------------------------------|-----------------------|-----------------------------------------| | omitted, or `client_secret_basic` | `confidential` / `client_secret_basic` | `client_secret_basic` | `none` → 400 `invalid_client_metadata` | | `none` (new) | `public` / `none` | `none` | `client_secret_*` → 400 `invalid_client_metadata` | | `none` (before this PR) | `confidential` / `none` | `none` | either → 200, type stays `confidential` | - PUT still replaces every other RFC 7591 field. `client_type` is the only pinned one; the method may move within a type (`client_secret_basic` ↔ `client_secret_post`). - Row 3 is the only shape where the two columns disagree. The guard fires only on a method change that crosses the type line, so those clients keep managing themselves instead of being locked out of their own configuration endpoint. - The token endpoint does not consult `client_type` yet, so every client still authenticates with a secret and registration still issues one. Split out of #27873, second in the stack (on top of #28041). Refs https://linear.app/codercom/issue/ENG-3029/oauth2-support-public-client
89 lines
3.1 KiB
Go
89 lines
3.1 KiB
Go
package codersdk_test
|
|
|
|
import (
|
|
"testing"
|
|
|
|
"github.com/stretchr/testify/require"
|
|
|
|
"github.com/coder/coder/v2/codersdk"
|
|
)
|
|
|
|
// TestOAuth2ClientRegistrationRequest_DetermineClientType verifies that the
|
|
// client type is derived from the requested token_endpoint_auth_method
|
|
// (RFC 7591 §2, OAuth 2.1 §2.1), not hardcoded to "confidential".
|
|
func TestOAuth2ClientRegistrationRequest_DetermineClientType(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
tests := []struct {
|
|
name string
|
|
authMethod codersdk.OAuth2TokenEndpointAuthMethod
|
|
// applyDefaults runs ApplyDefaults() before DetermineClientType(),
|
|
// matching the real request path where an omitted auth method is
|
|
// defaulted to "client_secret_basic" before this check ever runs.
|
|
applyDefaults bool
|
|
// wantAuthMethodAfterDefaults pins what ApplyDefaults() does to
|
|
// authMethod, so a case that runs applyDefaults also verifies
|
|
// ApplyDefaults left (or changed) the field as expected before
|
|
// DetermineClientType() reads it. Only checked when applyDefaults
|
|
// is true.
|
|
wantAuthMethodAfterDefaults codersdk.OAuth2TokenEndpointAuthMethod
|
|
expectedType string
|
|
}{
|
|
{
|
|
name: "NoneIsPublic",
|
|
authMethod: codersdk.OAuth2TokenEndpointAuthMethodNone,
|
|
expectedType: "public",
|
|
},
|
|
{
|
|
name: "ClientSecretBasicIsConfidential",
|
|
authMethod: codersdk.OAuth2TokenEndpointAuthMethodClientSecretBasic,
|
|
expectedType: "confidential",
|
|
},
|
|
{
|
|
name: "ClientSecretPostIsConfidential",
|
|
authMethod: codersdk.OAuth2TokenEndpointAuthMethodClientSecretPost,
|
|
expectedType: "confidential",
|
|
},
|
|
{
|
|
// ApplyDefaults only fills an empty auth method; it must not
|
|
// touch an explicit "none". If it ever grew a rule that did,
|
|
// the pre-defaults Validate() call and the post-defaults
|
|
// storage call would disagree about this client's type.
|
|
name: "NoneStaysPublicAfterApplyDefaults",
|
|
authMethod: codersdk.OAuth2TokenEndpointAuthMethodNone,
|
|
applyDefaults: true,
|
|
wantAuthMethodAfterDefaults: codersdk.OAuth2TokenEndpointAuthMethodNone,
|
|
expectedType: "public",
|
|
},
|
|
{
|
|
// An omitted auth method must not be read as public. Without
|
|
// ApplyDefaults the empty string also falls through to
|
|
// confidential, so this is safe in either order, but the real
|
|
// path always defaults first.
|
|
name: "OmittedDefaultsToConfidentialAfterApplyDefaults",
|
|
applyDefaults: true,
|
|
wantAuthMethodAfterDefaults: codersdk.OAuth2TokenEndpointAuthMethodClientSecretBasic,
|
|
expectedType: "confidential",
|
|
},
|
|
{
|
|
name: "OmittedIsConfidentialWithoutApplyDefaults",
|
|
expectedType: "confidential",
|
|
},
|
|
}
|
|
|
|
for _, tt := range tests {
|
|
t.Run(tt.name, func(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
req := codersdk.OAuth2ClientRegistrationRequest{
|
|
TokenEndpointAuthMethod: tt.authMethod,
|
|
}
|
|
if tt.applyDefaults {
|
|
req = req.ApplyDefaults()
|
|
require.Equal(t, tt.wantAuthMethodAfterDefaults, req.TokenEndpointAuthMethod)
|
|
}
|
|
require.Equal(t, tt.expectedType, string(req.DetermineClientType()))
|
|
})
|
|
}
|
|
}
|