Skip to content

Commit 9dfcc8a

Browse files
ThomasK33ThomasK33
committed
chore: add OAuth2 device flow test scripts
Change-Id: Ic232851727e683ab3d8b7ce970c505588da2f827 Signed-off-by: Thomas Kosiewski <tk@coder.com>
1 parent 51cb62a commit 9dfcc8a

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

43 files changed

+1271
-723
lines changed

‎.claude/scripts/format.sh

Lines changed: 16 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -101,30 +101,36 @@ fi
101101
# Get the file extension to determine the appropriate formatter
102102
file_ext="${file_path##*.}"
103103

104+
# Helper function to run formatter and handle errors
105+
run_formatter() {
106+
local target="$1"
107+
local file_type="$2"
108+
109+
if ! make FILE="$file_path" "$target"; then
110+
echo "Error: Failed to format $file_type file: $file_path" >&2
111+
exit 2
112+
fi
113+
echo "✓ Formatted $file_type file: $file_path"
114+
}
104115
# Change to the project root directory (where the Makefile is located)
105116
cd "$(dirname "$0")/../.."
106117

107118
# Call the appropriate Makefile target based on file extension
108119
case "$file_ext" in
109120
go)
110-
make fmt/go FILE="$file_path"
111-
echo "✓ Formatted Go file: $file_path"
121+
run_formatter "fmt/go" "Go"
112122
;;
113123
js | jsx | ts | tsx)
114-
make fmt/ts FILE="$file_path"
115-
echo "✓ Formatted TypeScript/JavaScript file: $file_path"
124+
run_formatter "fmt/ts" "TypeScript/JavaScript"
116125
;;
117126
tf | tfvars)
118-
make fmt/terraform FILE="$file_path"
119-
echo "✓ Formatted Terraform file: $file_path"
127+
run_formatter "fmt/terraform" "Terraform"
120128
;;
121129
sh)
122-
make fmt/shfmt FILE="$file_path"
123-
echo "✓ Formatted shell script: $file_path"
130+
run_formatter "fmt/shfmt" "shell script"
124131
;;
125132
md)
126-
make fmt/markdown FILE="$file_path"
127-
echo "✓ Formatted Markdown file: $file_path"
133+
run_formatter "fmt/markdown" "Markdown"
128134
;;
129135
*)
130136
echo "No formatter available for file extension: $file_ext"

‎coderd/apidoc/docs.go

Lines changed: 2 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎coderd/apidoc/swagger.json

Lines changed: 2 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎coderd/audit/diff.go

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,7 @@ type Auditable interface {
2424
database.NotificationsSettings |
2525
database.OAuth2ProviderApp |
2626
database.OAuth2ProviderAppSecret |
27+
database.OAuth2ProviderDeviceCode |
2728
database.PrebuildsSettings |
2829
database.CustomRole |
2930
database.AuditableOrganizationMember |

‎coderd/audit/request.go

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -117,6 +117,8 @@ func ResourceTarget[T Auditable](tgt T) string {
117117
return typed.Name
118118
case database.OAuth2ProviderAppSecret:
119119
return typed.DisplaySecret
120+
case database.OAuth2ProviderDeviceCode:
121+
return typed.UserCode
120122
case database.CustomRole:
121123
return typed.Name
122124
case database.AuditableOrganizationMember:
@@ -179,6 +181,8 @@ func ResourceID[T Auditable](tgt T) uuid.UUID {
179181
return typed.ID
180182
case database.OAuth2ProviderAppSecret:
181183
return typed.ID
184+
case database.OAuth2ProviderDeviceCode:
185+
return typed.ID
182186
case database.CustomRole:
183187
return typed.ID
184188
case database.AuditableOrganizationMember:
@@ -232,6 +236,8 @@ func ResourceType[T Auditable](tgt T) database.ResourceType {
232236
return database.ResourceTypeOauth2ProviderApp
233237
case database.OAuth2ProviderAppSecret:
234238
return database.ResourceTypeOauth2ProviderAppSecret
239+
case database.OAuth2ProviderDeviceCode:
240+
return database.ResourceTypeOauth2ProviderDeviceCode
235241
case database.CustomRole:
236242
return database.ResourceTypeCustomRole
237243
case database.AuditableOrganizationMember:
@@ -288,6 +294,8 @@ func ResourceRequiresOrgID[T Auditable]() bool {
288294
return false
289295
case database.OAuth2ProviderAppSecret:
290296
return false
297+
case database.OAuth2ProviderDeviceCode:
298+
return false
291299
case database.CustomRole:
292300
return true
293301
case database.AuditableOrganizationMember:

‎coderd/coderd.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -993,7 +993,7 @@ func New(options *Options) *API {
993993
r.Route("/device", func(r chi.Router) {
994994
r.Post("/", api.postOAuth2DeviceAuthorization()) // RFC 8628 compliant endpoint
995995
r.Route("/verify", func(r chi.Router) {
996-
r.Use(apiKeyMiddleware)
996+
r.Use(apiKeyMiddlewareRedirect)
997997
r.Get("/", api.getOAuth2DeviceVerification())
998998
r.Post("/", api.postOAuth2DeviceVerification())
999999
})

‎coderd/database/dbauthz/dbauthz.go

Lines changed: 32 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -417,6 +417,7 @@ var (
417417
rbac.ResourceProvisionerJobs.Type: {policy.ActionRead, policy.ActionUpdate, policy.ActionCreate},
418418
rbac.ResourceOauth2App.Type: {policy.ActionCreate, policy.ActionRead, policy.ActionUpdate, policy.ActionDelete},
419419
rbac.ResourceOauth2AppSecret.Type: {policy.ActionCreate, policy.ActionRead, policy.ActionUpdate, policy.ActionDelete},
420+
rbac.ResourceOauth2AppCodeToken.Type: {policy.ActionCreate, policy.ActionRead, policy.ActionUpdate, policy.ActionDelete},
420421
}),
421422
Org: map[string][]rbac.Permission{},
422423
User: []rbac.Permission{},
@@ -1346,6 +1347,14 @@ func (q *querier) CleanTailnetTunnels(ctx context.Context) error {
13461347
return q.db.CleanTailnetTunnels(ctx)
13471348
}
13481349

1350+
func (q *querier) ConsumeOAuth2ProviderAppCodeByPrefix(ctx context.Context, secretPrefix []byte) (database.OAuth2ProviderAppCode, error) {
1351+
return updateWithReturn(q.log, q.auth, q.db.GetOAuth2ProviderAppCodeByPrefix, q.db.ConsumeOAuth2ProviderAppCodeByPrefix)(ctx, secretPrefix)
1352+
}
1353+
1354+
func (q *querier) ConsumeOAuth2ProviderDeviceCodeByPrefix(ctx context.Context, deviceCodePrefix string) (database.OAuth2ProviderDeviceCode, error) {
1355+
return updateWithReturn(q.log, q.auth, q.db.GetOAuth2ProviderDeviceCodeByPrefix, q.db.ConsumeOAuth2ProviderDeviceCodeByPrefix)(ctx, deviceCodePrefix)
1356+
}
1357+
13491358
func (q *querier) CountAuditLogs(ctx context.Context, arg database.CountAuditLogsParams) (int64, error) {
13501359
// Shortcut if the user is an owner. The SQL filter is noticeable,
13511360
// and this is an easy win for owners. Which is the common case.
@@ -1560,27 +1569,30 @@ func (q *querier) DeleteOAuth2ProviderAppTokensByAppAndUserID(ctx context.Contex
15601569
return q.db.DeleteOAuth2ProviderAppTokensByAppAndUserID(ctx, arg)
15611570
}
15621571

1563-
func (q *querier) DeleteOldAuditLogConnectionEvents(ctx context.Context, threshold database.DeleteOldAuditLogConnectionEventsParams) error {
1564-
// `ResourceSystem` is deprecated, but it doesn't make sense to add
1565-
// `policy.ActionDelete` to `ResourceAuditLog`, since this is the one and
1566-
// only time we'll be deleting from the audit log.
1567-
if err := q.authorizeContext(ctx, policy.ActionDelete, rbac.ResourceSystem); err != nil {
1568-
return err
1569-
}
1570-
return q.db.DeleteOldAuditLogConnectionEvents(ctx, threshold)
1571-
}
1572-
15731572
func (q *querier) DeleteOAuth2ProviderDeviceCodeByID(ctx context.Context, id uuid.UUID) error {
15741573
// Fetch the device code first to check authorization
15751574
deviceCode, err := q.db.GetOAuth2ProviderDeviceCodeByID(ctx, id)
15761575
if err != nil {
1577-
return err
1576+
return xerrors.Errorf("get oauth2 provider device code: %w", err)
15781577
}
15791578
if err := q.authorizeContext(ctx, policy.ActionDelete, deviceCode); err != nil {
1580-
return err
1579+
return xerrors.Errorf("authorize oauth2 provider device code deletion: %w", err)
15811580
}
15821581

1583-
return q.db.DeleteOAuth2ProviderDeviceCodeByID(ctx, id)
1582+
if err := q.db.DeleteOAuth2ProviderDeviceCodeByID(ctx, id); err != nil {
1583+
return xerrors.Errorf("delete oauth2 provider device code: %w", err)
1584+
}
1585+
return nil
1586+
}
1587+
1588+
func (q *querier) DeleteOldAuditLogConnectionEvents(ctx context.Context, threshold database.DeleteOldAuditLogConnectionEventsParams) error {
1589+
// `ResourceSystem` is deprecated, but it doesn't make sense to add
1590+
// `policy.ActionDelete` to `ResourceAuditLog`, since this is the one and
1591+
// only time we'll be deleting from the audit log.
1592+
if err := q.authorizeContext(ctx, policy.ActionDelete, rbac.ResourceSystem); err != nil {
1593+
return err
1594+
}
1595+
return q.db.DeleteOldAuditLogConnectionEvents(ctx, threshold)
15841596
}
15851597

15861598
func (q *querier) DeleteOldNotificationMessages(ctx context.Context) error {
@@ -2367,8 +2379,8 @@ func (q *querier) GetOAuth2ProviderDeviceCodeByUserCode(ctx context.Context, use
23672379
}
23682380

23692381
func (q *querier) GetOAuth2ProviderDeviceCodesByClientID(ctx context.Context, clientID uuid.UUID) ([]database.OAuth2ProviderDeviceCode, error) {
2370-
// This requires access to read the OAuth2 app
2371-
if err := q.authorizeContext(ctx, policy.ActionRead, rbac.ResourceOauth2App); err != nil {
2382+
// This requires access to read OAuth2 app code tokens
2383+
if err := q.authorizeContext(ctx, policy.ActionRead, rbac.ResourceOauth2AppCodeToken); err != nil {
23722384
return []database.OAuth2ProviderDeviceCode{}, err
23732385
}
23742386
return q.db.GetOAuth2ProviderDeviceCodesByClientID(ctx, clientID)
@@ -3810,8 +3822,8 @@ func (q *querier) InsertOAuth2ProviderAppToken(ctx context.Context, arg database
38103822
}
38113823

38123824
func (q *querier) InsertOAuth2ProviderDeviceCode(ctx context.Context, arg database.InsertOAuth2ProviderDeviceCodeParams) (database.OAuth2ProviderDeviceCode, error) {
3813-
// Creating device codes requires OAuth2 app access
3814-
if err := q.authorizeContext(ctx, policy.ActionCreate, rbac.ResourceOauth2App); err != nil {
3825+
// Creating device codes requires OAuth2 app code token creation access
3826+
if err := q.authorizeContext(ctx, policy.ActionCreate, rbac.ResourceOauth2AppCodeToken); err != nil {
38153827
return database.OAuth2ProviderDeviceCode{}, err
38163828
}
38173829
return q.db.InsertOAuth2ProviderDeviceCode(ctx, arg)
@@ -4490,13 +4502,10 @@ func (q *querier) UpdateOAuth2ProviderAppSecretByID(ctx context.Context, arg dat
44904502
}
44914503

44924504
func (q *querier) UpdateOAuth2ProviderDeviceCodeAuthorization(ctx context.Context, arg database.UpdateOAuth2ProviderDeviceCodeAuthorizationParams) (database.OAuth2ProviderDeviceCode, error) {
4493-
// Verify the user is authenticated for device code authorization
4494-
_, ok := ActorFromContext(ctx)
4495-
if !ok {
4496-
return database.OAuth2ProviderDeviceCode{}, ErrNoActor
4505+
fetch := func(ctx context.Context, arg database.UpdateOAuth2ProviderDeviceCodeAuthorizationParams) (database.OAuth2ProviderDeviceCode, error) {
4506+
return q.db.GetOAuth2ProviderDeviceCodeByID(ctx, arg.ID)
44974507
}
4498-
4499-
return q.db.UpdateOAuth2ProviderDeviceCodeAuthorization(ctx, arg)
4508+
return updateWithReturn(q.log, q.auth, fetch, q.db.UpdateOAuth2ProviderDeviceCodeAuthorization)(ctx, arg)
45004509
}
45014510

45024511
func (q *querier) UpdateOrganization(ctx context.Context, arg database.UpdateOrganizationParams) (database.Organization, error) {

‎coderd/database/dbauthz/dbauthz_test.go

Lines changed: 122 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5537,6 +5537,19 @@ func (s *MethodTestSuite) TestOAuth2ProviderAppCodes() {
55375537
UserID: user.ID,
55385538
}).Asserts(rbac.ResourceOauth2AppCodeToken.WithOwner(user.ID.String()), policy.ActionDelete)
55395539
}))
5540+
s.Run("ConsumeOAuth2ProviderAppCodeByPrefix", s.Subtest(func(db database.Store, check *expects) {
5541+
user := dbgen.User(s.T(), db, database.User{})
5542+
app := dbgen.OAuth2ProviderApp(s.T(), db, database.OAuth2ProviderApp{})
5543+
// Use unique prefix to avoid test isolation issues
5544+
uniquePrefix := fmt.Sprintf("prefix-%s-%d", s.T().Name(), time.Now().UnixNano())
5545+
code := dbgen.OAuth2ProviderAppCode(s.T(), db, database.OAuth2ProviderAppCode{
5546+
SecretPrefix: []byte(uniquePrefix),
5547+
UserID: user.ID,
5548+
AppID: app.ID,
5549+
ExpiresAt: time.Now().Add(24 * time.Hour), // Extended expiry for test stability
5550+
})
5551+
check.Args(code.SecretPrefix).Asserts(code, policy.ActionUpdate).Returns(code)
5552+
}))
55405553
}
55415554

55425555
func (s *MethodTestSuite) TestOAuth2ProviderAppTokens() {
@@ -5612,6 +5625,115 @@ func (s *MethodTestSuite) TestOAuth2ProviderAppTokens() {
56125625
}))
56135626
}
56145627

5628+
func (s *MethodTestSuite) TestOAuth2ProviderDeviceCodes() {
5629+
s.Run("InsertOAuth2ProviderDeviceCode", s.Subtest(func(db database.Store, check *expects) {
5630+
app := dbgen.OAuth2ProviderApp(s.T(), db, database.OAuth2ProviderApp{})
5631+
check.Args(database.InsertOAuth2ProviderDeviceCodeParams{
5632+
ClientID: app.ID,
5633+
DeviceCodePrefix: "testpref",
5634+
DeviceCodeHash: []byte("hash"),
5635+
UserCode: "TEST1234",
5636+
VerificationUri: "http://example.com/device",
5637+
}).Asserts(rbac.ResourceOauth2AppCodeToken, policy.ActionCreate)
5638+
}))
5639+
s.Run("GetOAuth2ProviderDeviceCodeByID", s.Subtest(func(db database.Store, check *expects) {
5640+
app := dbgen.OAuth2ProviderApp(s.T(), db, database.OAuth2ProviderApp{})
5641+
deviceCode, err := db.InsertOAuth2ProviderDeviceCode(context.Background(), database.InsertOAuth2ProviderDeviceCodeParams{
5642+
ClientID: app.ID,
5643+
DeviceCodePrefix: "testpref",
5644+
UserCode: "TEST1234",
5645+
VerificationUri: "http://example.com/device",
5646+
})
5647+
require.NoError(s.T(), err)
5648+
check.Args(deviceCode.ID).Asserts(deviceCode, policy.ActionRead).Returns(deviceCode)
5649+
}))
5650+
s.Run("GetOAuth2ProviderDeviceCodeByPrefix", s.Subtest(func(db database.Store, check *expects) {
5651+
app := dbgen.OAuth2ProviderApp(s.T(), db, database.OAuth2ProviderApp{})
5652+
deviceCode, err := db.InsertOAuth2ProviderDeviceCode(context.Background(), database.InsertOAuth2ProviderDeviceCodeParams{
5653+
ClientID: app.ID,
5654+
DeviceCodePrefix: "testpref",
5655+
UserCode: "TEST1234",
5656+
VerificationUri: "http://example.com/device",
5657+
})
5658+
require.NoError(s.T(), err)
5659+
check.Args(deviceCode.DeviceCodePrefix).Asserts(deviceCode, policy.ActionRead).Returns(deviceCode)
5660+
}))
5661+
s.Run("GetOAuth2ProviderDeviceCodeByUserCode", s.Subtest(func(db database.Store, check *expects) {
5662+
app := dbgen.OAuth2ProviderApp(s.T(), db, database.OAuth2ProviderApp{})
5663+
deviceCode, err := db.InsertOAuth2ProviderDeviceCode(context.Background(), database.InsertOAuth2ProviderDeviceCodeParams{
5664+
ClientID: app.ID,
5665+
DeviceCodePrefix: "testpref",
5666+
UserCode: "TEST1234",
5667+
VerificationUri: "http://example.com/device",
5668+
})
5669+
require.NoError(s.T(), err)
5670+
check.Args(deviceCode.UserCode).Asserts(deviceCode, policy.ActionRead).Returns(deviceCode)
5671+
}))
5672+
s.Run("GetOAuth2ProviderDeviceCodesByClientID", s.Subtest(func(db database.Store, check *expects) {
5673+
app := dbgen.OAuth2ProviderApp(s.T(), db, database.OAuth2ProviderApp{})
5674+
deviceCode, err := db.InsertOAuth2ProviderDeviceCode(context.Background(), database.InsertOAuth2ProviderDeviceCodeParams{
5675+
ClientID: app.ID,
5676+
DeviceCodePrefix: "testpref",
5677+
UserCode: "TEST1234",
5678+
VerificationUri: "http://example.com/device",
5679+
})
5680+
require.NoError(s.T(), err)
5681+
check.Args(app.ID).Asserts(rbac.ResourceOauth2AppCodeToken, policy.ActionRead).Returns([]database.OAuth2ProviderDeviceCode{deviceCode})
5682+
}))
5683+
s.Run("ConsumeOAuth2ProviderDeviceCodeByPrefix", s.Subtest(func(db database.Store, check *expects) {
5684+
app := dbgen.OAuth2ProviderApp(s.T(), db, database.OAuth2ProviderApp{})
5685+
user := dbgen.User(s.T(), db, database.User{})
5686+
// Use unique identifiers to avoid test isolation issues
5687+
// Device code prefix must be exactly 8 characters
5688+
uniquePrefix := fmt.Sprintf("t%07d", time.Now().UnixNano()%10000000)
5689+
uniqueUserCode := fmt.Sprintf("USER%04d", time.Now().UnixNano()%10000)
5690+
// Create device code using dbgen (now available!)
5691+
deviceCode := dbgen.OAuth2ProviderDeviceCode(s.T(), db, database.OAuth2ProviderDeviceCode{
5692+
DeviceCodePrefix: uniquePrefix,
5693+
UserCode: uniqueUserCode,
5694+
ClientID: app.ID,
5695+
ExpiresAt: time.Now().Add(24 * time.Hour), // Extended expiry for test stability
5696+
})
5697+
// Authorize the device code so it can be consumed
5698+
deviceCode, err := db.UpdateOAuth2ProviderDeviceCodeAuthorization(s.T().Context(), database.UpdateOAuth2ProviderDeviceCodeAuthorizationParams{
5699+
ID: deviceCode.ID,
5700+
UserID: uuid.NullUUID{UUID: user.ID, Valid: true},
5701+
Status: database.OAuth2DeviceStatusAuthorized,
5702+
})
5703+
require.NoError(s.T(), err)
5704+
require.Equal(s.T(), database.OAuth2DeviceStatusAuthorized, deviceCode.Status)
5705+
check.Args(uniquePrefix).Asserts(deviceCode, policy.ActionUpdate).Returns(deviceCode)
5706+
}))
5707+
s.Run("UpdateOAuth2ProviderDeviceCodeAuthorization", s.Subtest(func(db database.Store, check *expects) {
5708+
app := dbgen.OAuth2ProviderApp(s.T(), db, database.OAuth2ProviderApp{})
5709+
user := dbgen.User(s.T(), db, database.User{})
5710+
// Create device code using dbgen
5711+
deviceCode := dbgen.OAuth2ProviderDeviceCode(s.T(), db, database.OAuth2ProviderDeviceCode{
5712+
ClientID: app.ID,
5713+
})
5714+
require.Equal(s.T(), database.OAuth2DeviceStatusPending, deviceCode.Status)
5715+
check.Args(database.UpdateOAuth2ProviderDeviceCodeAuthorizationParams{
5716+
ID: deviceCode.ID,
5717+
UserID: uuid.NullUUID{UUID: user.ID, Valid: true},
5718+
Status: database.OAuth2DeviceStatusAuthorized,
5719+
}).Asserts(deviceCode, policy.ActionUpdate)
5720+
}))
5721+
s.Run("DeleteOAuth2ProviderDeviceCodeByID", s.Subtest(func(db database.Store, check *expects) {
5722+
app := dbgen.OAuth2ProviderApp(s.T(), db, database.OAuth2ProviderApp{})
5723+
deviceCode, err := db.InsertOAuth2ProviderDeviceCode(context.Background(), database.InsertOAuth2ProviderDeviceCodeParams{
5724+
ClientID: app.ID,
5725+
DeviceCodePrefix: "testpref",
5726+
UserCode: "TEST1234",
5727+
VerificationUri: "http://example.com/device",
5728+
})
5729+
require.NoError(s.T(), err)
5730+
check.Args(deviceCode.ID).Asserts(deviceCode, policy.ActionDelete)
5731+
}))
5732+
s.Run("DeleteExpiredOAuth2ProviderDeviceCodes", s.Subtest(func(db database.Store, check *expects) {
5733+
check.Args().Asserts(rbac.ResourceSystem, policy.ActionDelete)
5734+
}))
5735+
}
5736+
56155737
func (s *MethodTestSuite) TestResourcesMonitor() {
56165738
createAgent := func(t *testing.T, db database.Store) (database.WorkspaceAgent, database.WorkspaceTable) {
56175739
t.Helper()

0 commit comments

Comments
 (0)