Function UpdateClientConfiguration

coderd/oauth2provider/registration.go:235–356

UpdateClientConfiguration returns an http.HandlerFunc that handles PUT /oauth2/clients/{client_id}

(db database.Store, auditor *audit.Auditor, logger slog.Logger)

// UpdateClientConfiguration returns an http.HandlerFunc that handles PUT /oauth2/clients/{client_id}
func UpdateClientConfiguration(db database.Store, auditor *audit.Auditor, logger slog.Logger) http.HandlerFunc {
	return func(rw http.ResponseWriter, r *http.Request) {
		ctx := r.Context()
		aReq, commitAudit := audit.InitRequest[database.OAuth2ProviderApp](rw, &audit.RequestParams{
			Audit:   *auditor,
			Log:     logger,
			Request: r,
			Action:  database.AuditActionWrite,
		})
		defer commitAudit()

		// Extract client ID from URL path
		clientIDStr := chi.URLParam(r, "client_id")
		clientID, err := uuid.Parse(clientIDStr)
		if err != nil {
			writeOAuth2RegistrationError(ctx, rw, http.StatusBadRequest,
				"invalid_client_metadata", "Invalid client ID format")
			return
		}

		// Parse request
		var req codersdk.OAuth2ClientRegistrationRequest
		if !httpapi.Read(ctx, rw, r, &req) {
			return
		}

		// Validate request
		if err := req.Validate(); err != nil {
			writeOAuth2RegistrationError(ctx, rw, http.StatusBadRequest,
				"invalid_client_metadata", err.Error())
			return
		}

		// Apply defaults
		req = req.ApplyDefaults()

		// Get existing app to verify it exists and is dynamically registered
		//nolint:gocritic // OAuth2 system context — RFC 7592 client configuration endpoint
		existingApp, err := db.GetOAuth2ProviderAppByClientID(dbauthz.AsSystemOAuth2(ctx), clientID)
		if err == nil {
			aReq.Old = existingApp
		}
		if err != nil {
			if xerrors.Is(err, sql.ErrNoRows) {
				writeOAuth2RegistrationError(ctx, rw, http.StatusUnauthorized,
					"invalid_token", "Client not found")
			} else {
				writeOAuth2RegistrationError(ctx, rw, http.StatusInternalServerError,
					"server_error", "Failed to retrieve client")
			}
			return
		}

		// Check if client was dynamically registered
		if !existingApp.DynamicallyRegistered.Bool {
			writeOAuth2RegistrationError(ctx, rw, http.StatusForbidden,
				"invalid_token", "Client was not dynamically registered")
			return