Method oauthLogin

coderd/userauth.go:1720–2060

(r *http.Request, params *oauthLoginParams)

}

func (api *API) oauthLogin(r *http.Request, params *oauthLoginParams) ([]*http.Cookie, database.User, database.APIKey, error) {
	var (
		ctx                  = r.Context()
		user                 database.User
		cookies              []*http.Cookie
		logger               = api.Logger.Named(userAuthLoggerName)
		auditor              = *api.Auditor.Load()
		dormantConvertAudit  *audit.Request[database.User]
		initDormantAuditOnce = sync.OnceFunc(func() {
			dormantConvertAudit = params.initAuditRequest(&audit.RequestParams{
				Audit:            auditor,
				Log:              api.Logger,
				Request:          r,
				Action:           database.AuditActionWrite,
				OrganizationID:   uuid.Nil,
				AdditionalFields: audit.BackgroundTaskFields(audit.BackgroundSubsystemDormancy),
			})
		})
	)

	var isConvertLoginType bool
	err := api.Database.InTx(func(tx database.Store) error {
		var (
			link database.UserLink
			err  error
		)
		user = params.User
		link = params.Link

		// If you do a convert to OIDC and your email does not match, we need to
		// catch this and not make a new account.
		if isMergeStateString(params.State.StateString) {
			// Always clear this cookie. If it succeeds, we no longer need it.
			// If it fails, we no longer care about it.
			cookies = append(cookies, clearOAuthConvertCookie())
			user, err = api.convertUserToOauth(ctx, r, tx, params)
			if err != nil {
				return err
			}
			params.User = user
			isConvertLoginType = true
		}

		// nolint:gocritic // Getting user count is a system function.
		userCount, err := tx.GetUserCount(dbauthz.AsSystemRestricted(ctx), false)
		if err != nil {
			return xerrors.Errorf("unable to fetch user count: %w", err)
		}

		// Allow the first user to sign up with OIDC, regardless of
		// whether signups are enabled or not.
		allowSignup := userCount == 0 || params.AllowSignups

		if user.ID == uuid.Nil && !allowSignup {
			signupsDisabledText := "Please contact your Coder administrator to request access."
			if api.OIDCConfig != nil && api.OIDCConfig.SignupsDisabledText != "" {
				signupsDisabledText = render.HTMLFromMarkdown(api.OIDCConfig.SignupsDisabledText)
			}