Method userOIDCClaims

coderd/users.go:84–131

Returns the merged OIDC claims for the authenticated user. @Summary Get OIDC claims for the authenticated user @ID get-oidc-claims-for-the-authenticated-user @Security CoderSessionToken @Produce json @Tags Users @Success 200 {object} codersdk.OIDCClaimsResponse @Router /api/v2/users/oidc-claims [ge

(rw http.ResponseWriter, r *http.Request)

// @Success 200 {object} codersdk.OIDCClaimsResponse
// @Router /api/v2/users/oidc-claims [get]
func (api *API) userOIDCClaims(rw http.ResponseWriter, r *http.Request) {
	var (
		ctx    = r.Context()
		apiKey = httpmw.APIKey(r)
	)

	user, err := api.Database.GetUserByID(ctx, apiKey.UserID)
	if err != nil {
		httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{
			Message: "Failed to get user.",
			Detail:  err.Error(),
		})
		return
	}

	if user.LoginType != database.LoginTypeOIDC {
		httpapi.Write(ctx, rw, http.StatusBadRequest, codersdk.Response{
			Message: "User is not an OIDC user.",
		})
		return
	}

	//nolint:gocritic // GetUserLinkByUserIDLoginType requires reading
	// rbac.ResourceSystem. The endpoint is scoped to the authenticated
	// user's own identity via apiKey, so this is safe.
	link, err := api.Database.GetUserLinkByUserIDLoginType(
		dbauthz.AsSystemRestricted(ctx),
		database.GetUserLinkByUserIDLoginTypeParams{
			UserID:    user.ID,
			LoginType: database.LoginTypeOIDC,
		},
	)
	if err != nil {
		httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{
			Message: "Failed to get user link.",
			Detail:  err.Error(),
		})
		return
	}

	claims := link.Claims.MergedClaims
	if claims == nil {
		claims = map[string]interface{}{}
	}
	httpapi.Write(ctx, rw, http.StatusOK, codersdk.OIDCClaimsResponse{
		Claims: claims,
	})
}

// Returns whether the initial user has been created or not.
//