Function OAuth2GetCode

coderd/coderdtest/oidctest/helper.go:124–167

OAuth2GetCode emulates a user clicking "allow" on the IDP page. When doing unit tests, it's easier to skip this step sometimes. It does make an actual request to the IDP, so it should be equivalent to doing this "manually" with actual requests.

(rawAuthURL string, doRequest func(req *http.Request) (*http.Response, error))

// request to the IDP, so it should be equivalent to doing this "manually" with
// actual requests.
func OAuth2GetCode(rawAuthURL string, doRequest func(req *http.Request) (*http.Response, error)) (string, error) {
	authURL, err := url.Parse(rawAuthURL)
	if err != nil {
		return "", xerrors.Errorf("failed to parse auth URL: %w", err)
	}

	r, err := http.NewRequestWithContext(context.Background(), http.MethodGet, rawAuthURL, nil)
	if err != nil {
		return "", xerrors.Errorf("failed to create auth request: %w", err)
	}

	resp, err := doRequest(r)
	if err != nil {
		return "", xerrors.Errorf("request: %w", err)
	}
	defer resp.Body.Close()

	// Accept both 302 (Found) and 307 (Temporary Redirect) as valid OAuth2 redirects
	if resp.StatusCode != http.StatusFound && resp.StatusCode != http.StatusTemporaryRedirect {
		return "", codersdk.ReadBodyAsError(resp)
	}

	to := resp.Header.Get("Location")
	if to == "" {
		return "", xerrors.Errorf("expected redirect location")
	}

	toURL, err := url.Parse(to)
	if err != nil {
		return "", xerrors.Errorf("failed to parse redirect location: %w", err)
	}

	code := toURL.Query().Get("code")
	if code == "" {
		return "", xerrors.Errorf("expected code in redirect location")
	}

	state := authURL.Query().Get("state")
	newState := toURL.Query().Get("state")
	if newState != state {
		return "", xerrors.Errorf("expected state %q, got %q", state, newState)
	}
	return code, nil
}