Function GetClientConfiguration

coderd/oauth2provider/registration.go:172–232

GetClientConfiguration returns an http.HandlerFunc that handles GET /oauth2/clients/{client_id}

(db database.Store)

// GetClientConfiguration returns an http.HandlerFunc that handles GET /oauth2/clients/{client_id}
func GetClientConfiguration(db database.Store) http.HandlerFunc {
	return func(rw http.ResponseWriter, r *http.Request) {
		ctx := r.Context()

		// Extract client ID from URL path
		clientIDStr := chi.URLParam(r, "client_id")
		clientID, err := uuid.Parse(clientIDStr)
		if err != nil {
			writeOAuth2RegistrationError(ctx, rw, http.StatusBadRequest,
				"invalid_client_metadata", "Invalid client ID format")
			return
		}

		// Get app by client ID
		//nolint:gocritic // OAuth2 system context — RFC 7592 client configuration endpoint
		app, err := db.GetOAuth2ProviderAppByClientID(dbauthz.AsSystemOAuth2(ctx), clientID)
		if err != nil {
			if xerrors.Is(err, sql.ErrNoRows) {
				writeOAuth2RegistrationError(ctx, rw, http.StatusUnauthorized,
					"invalid_token", "Client not found")
			} else {
				writeOAuth2RegistrationError(ctx, rw, http.StatusInternalServerError,
					"server_error", "Failed to retrieve client")
			}
			return
		}

		// Check if client was dynamically registered
		if !app.DynamicallyRegistered.Bool {
			writeOAuth2RegistrationError(ctx, rw, http.StatusUnauthorized,
				"invalid_token", "Client was not dynamically registered")
			return
		}

		// Return client configuration (without client_secret for security)
		response := codersdk.OAuth2ClientConfiguration{
			ClientID:                app.ID.String(),
			ClientIDIssuedAt:        app.ClientIDIssuedAt.Time.Unix(),
			ClientSecretExpiresAt:   0, // No expiration for now
			RedirectURIs:            app.RedirectUris,
			ClientName:              app.Name,
			ClientURI:               app.ClientUri.String,
			LogoURI:                 app.LogoUri.String,
			TOSURI:                  app.TosUri.String,
			PolicyURI:               app.PolicyUri.String,
			JWKSURI:                 app.JwksUri.String,
			JWKS:                    app.Jwks.RawMessage,
			SoftwareID:              app.SoftwareID.String,
			SoftwareVersion:         app.SoftwareVersion.String,
			GrantTypes:              slice.StringEnums[codersdk.OAuth2ProviderGrantType](app.GrantTypes),
			ResponseTypes:           slice.StringEnums[codersdk.OAuth2ProviderResponseType](app.ResponseTypes),
			TokenEndpointAuthMethod: codersdk.OAuth2TokenEndpointAuthMethod(app.TokenEndpointAuthMethod.String),
			Scope:                   app.Scope.String,
			Contacts:                app.Contacts,
			RegistrationAccessToken: "", // RFC 7592: Not returned in GET responses for security
			RegistrationClientURI:   app.RegistrationClientUri.String,
		}