Function validateOAuth2ProviderAppTokenAudience

coderd/httpmw/apikey.go:704–731

validateOAuth2ProviderAppTokenAudience validates that an OAuth2 provider app token is being used with the correct audience/resource server (RFC 8707).

(ctx context.Context, db database.Store, key database.APIKey, accessURL *url.URL, r *http.Request)

// validateOAuth2ProviderAppTokenAudience validates that an OAuth2 provider app token
// is being used with the correct audience/resource server (RFC 8707).
func validateOAuth2ProviderAppTokenAudience(ctx context.Context, db database.Store, key database.APIKey, accessURL *url.URL, r *http.Request) error {
	// Get the OAuth2 provider app token to check its audience
	//nolint:gocritic // OAuth2 system context — audience validation for provider app tokens
	token, err := db.GetOAuth2ProviderAppTokenByAPIKeyID(dbauthz.AsSystemOAuth2(ctx), key.ID)
	if err != nil {
		return xerrors.Errorf("failed to get OAuth2 token: %w", err)
	}

	// If no audience is set, allow the request (for backward compatibility)
	if !token.Audience.Valid || token.Audience.String == "" {
		return nil
	}

	// Extract the expected audience from the access URL
	expectedAudience := extractExpectedAudience(accessURL, r)

	// Normalize both audience values for RFC 3986 compliant comparison
	normalizedTokenAudience := normalizeAudienceURI(token.Audience.String)
	normalizedExpectedAudience := normalizeAudienceURI(expectedAudience)

	// Validate that the token's audience matches the expected audience
	if normalizedTokenAudience != normalizedExpectedAudience {
		return xerrors.Errorf("token audience %q does not match expected audience %q",
			token.Audience.String, expectedAudience)
	}

	return nil
}

// normalizeAudienceURI implements RFC 3986 URI normalization for OAuth2 audience comparison.
// This ensures consistent audience matching between authorization and token validation.