mirror of
https://github.com/coder/coder.git
synced 2026-06-07 15:08:20 +00:00
Thomas Kosiewski
05537c1894
<!-- If you have used AI to produce some or all of this PR, please ensure you have read our [AI Contribution guidelines](https://coder.com/docs/about/contributing/AI_CONTRIBUTING) before submitting. --> Publish supported OAuth2 scopes from RBAC external scope names This PR updates the OAuth2 metadata endpoints to publish the supported scopes from the RBAC external scope names. Previously, the `ScopesSupported` field was empty with a TODO to implement a scope system. Now, both the authorization server metadata and protected resource metadata endpoints return the list of scopes from `rbac.ExternalScopeNames()`. The tests have been updated to verify that the correct scopes are being returned in the metadata responses.
45 lines
1.9 KiB
Go
45 lines
1.9 KiB
Go
package oauth2provider
|
|
|
|
import (
|
|
"net/http"
|
|
"net/url"
|
|
|
|
"github.com/coder/coder/v2/coderd/httpapi"
|
|
"github.com/coder/coder/v2/coderd/rbac"
|
|
"github.com/coder/coder/v2/codersdk"
|
|
)
|
|
|
|
// GetAuthorizationServerMetadata returns an http.HandlerFunc that handles GET /.well-known/oauth-authorization-server
|
|
func GetAuthorizationServerMetadata(accessURL *url.URL) http.HandlerFunc {
|
|
return func(rw http.ResponseWriter, r *http.Request) {
|
|
ctx := r.Context()
|
|
metadata := codersdk.OAuth2AuthorizationServerMetadata{
|
|
Issuer: accessURL.String(),
|
|
AuthorizationEndpoint: accessURL.JoinPath("/oauth2/authorize").String(),
|
|
TokenEndpoint: accessURL.JoinPath("/oauth2/tokens").String(),
|
|
RegistrationEndpoint: accessURL.JoinPath("/oauth2/register").String(), // RFC 7591
|
|
ResponseTypesSupported: []string{"code"},
|
|
GrantTypesSupported: []string{"authorization_code", "refresh_token"},
|
|
CodeChallengeMethodsSupported: []string{"S256"},
|
|
ScopesSupported: rbac.ExternalScopeNames(),
|
|
TokenEndpointAuthMethodsSupported: []string{"client_secret_post"},
|
|
}
|
|
httpapi.Write(ctx, rw, http.StatusOK, metadata)
|
|
}
|
|
}
|
|
|
|
// GetProtectedResourceMetadata returns an http.HandlerFunc that handles GET /.well-known/oauth-protected-resource
|
|
func GetProtectedResourceMetadata(accessURL *url.URL) http.HandlerFunc {
|
|
return func(rw http.ResponseWriter, r *http.Request) {
|
|
ctx := r.Context()
|
|
metadata := codersdk.OAuth2ProtectedResourceMetadata{
|
|
Resource: accessURL.String(),
|
|
AuthorizationServers: []string{accessURL.String()},
|
|
ScopesSupported: rbac.ExternalScopeNames(),
|
|
// RFC 6750 Bearer Token methods supported as fallback methods in api key middleware
|
|
BearerMethodsSupported: []string{"header", "query"},
|
|
}
|
|
httpapi.Write(ctx, rw, http.StatusOK, metadata)
|
|
}
|
|
}
|