Method newFixOIDCLinksCommand

cli/server_fix_oidc_links.go:22–156

()

)

func (r *RootCmd) newFixOIDCLinksCommand() *serpent.Command {
	var (
		pgURL     string
		pgAuth    string
		issuerURL string
		dryRun    bool
	)
	fixOIDCLinksCmd := &serpent.Command{
		Use:   "fix-oidc-links",
		Short: "Reset OIDC linked IDs that do not match the expected issuer, allowing users to re-authenticate.",
		Handler: func(inv *serpent.Invocation) error {
			var (
				ctx, cancel = inv.SignalNotifyContext(inv.Context(), StopSignals...)
				logger      = inv.Logger.AppendSinks(sloghuman.Sink(inv.Stderr))
			)
			if r.verbose {
				logger = logger.Leveled(slog.LevelDebug)
			}
			defer cancel()

			issuerURL = strings.TrimSpace(issuerURL)
			if issuerURL == "" {
				return xerrors.Errorf("the --%s flag is required, set it to the OIDC issuer URL (e.g. https://accounts.google.com)", "issuer-url")
			}
			// Resolve the canonical issuer from OIDC discovery.
			cliui.Infof(inv.Stdout, "Resolving OIDC issuer from %q...", issuerURL)
			// TODO: The default client might not be configured with the right certs to make this request.
			issuer, err := authlink.ResolveIssuer(ctx, http.DefaultClient, issuerURL)
			if err != nil {
				return xerrors.Errorf("resolve issuer: %w", err)
			}
			_, _ = fmt.Fprintf(inv.Stdout, "Resolved OIDC issuer: %q\n\n", issuer)

			// Connect to the database.
			if pgURL == "" {
				return xerrors.New("the --postgres-url flag is required")
			}

			sqlDriver := "postgres"
			if codersdk.PostgresAuth(pgAuth) == codersdk.PostgresAuthAWSIAMRDS {
				sqlDriver, err = awsiamrds.Register(inv.Context(), sqlDriver)
				if err != nil {
					return xerrors.Errorf("register aws rds iam auth: %w", err)
				}
			}

			sqlDB, err := ConnectToPostgres(ctx, logger, sqlDriver, pgURL, nil)
			if err != nil {
				return xerrors.Errorf("connect to postgres: %w", err)
			}
			defer func() {
				_ = sqlDB.Close()
			}()
			db := database.New(sqlDB)

			// Run analysis.
			analysis, err := authlink.AnalyzeOIDCLinks(ctx, db, issuer)
			if err != nil {