Method oAuthCallback

internal/api/external_oauth.go:60–147

(ctx context.Context, r *http.Request, providerType string)

}

func (a *API) oAuthCallback(ctx context.Context, r *http.Request, providerType string) (*OAuthProviderData, error) {
	db := a.db.WithContext(ctx)

	var rq url.Values
	if err := r.ParseForm(); r.Method == http.MethodPost && err == nil {
		rq = r.Form
	} else {
		rq = r.URL.Query()
	}

	extError := rq.Get("error")
	if extError != "" {
		return nil, apierrors.NewOAuthError(extError, rq.Get("error_description"))
	}

	oauthCode := rq.Get("code")
	if oauthCode == "" {
		return nil, apierrors.NewBadRequestError(apierrors.ErrorCodeBadOAuthCallback, "OAuth callback with missing authorization code missing")
	}

	oauthProvider, _, err := a.OAuthProvider(ctx, providerType)
	if err != nil {
		return nil, apierrors.NewBadRequestError(apierrors.ErrorCodeOAuthProviderNotSupported, "Unsupported provider: %+v", err).WithInternalError(err)
	}

	log := observability.GetLogEntry(r).Entry

	var oauthClientState *models.OAuthClientState
	// if there's a non-empty OAuthClientStateID we perform PKCE Flow for the external provider
	if oauthClientStateID := getOAuthClientStateID(ctx); oauthClientStateID != uuid.Nil {
		oauthClientState, err = models.FindAndDeleteOAuthClientStateByID(db, oauthClientStateID)
		if models.IsNotFoundError(err) {
			return nil, apierrors.NewUnprocessableEntityError(apierrors.ErrorCodeOAuthClientStateNotFound, "OAuth state not found").WithInternalError(err)
		} else if err != nil {
			return nil, apierrors.NewInternalServerError("Failed to find OAuth state").WithInternalError(err)
		}

		if oauthClientState.ProviderType != providerType {
			return nil, apierrors.NewBadRequestError(apierrors.ErrorCodeOAuthInvalidState, "OAuth provider mismatch")
		}

		if oauthClientState.IsExpired() {
			return nil, apierrors.NewUnprocessableEntityError(apierrors.ErrorCodeOAuthClientStateExpired, "OAuth state expired")
		}
	}

	if oauthProvider.RequiresPKCE() && oauthClientState == nil {
		return nil, apierrors.NewBadRequestError(apierrors.ErrorCodeOAuthInvalidState, "OAuth PKCE code verifier missing")
	}

	log.WithFields(logrus.Fields{
		"provider": providerType,
		"code":     oauthCode,
	}).Debug("Exchanging OAuth code")

	var tokenOpts []oauth2.AuthCodeOption
	if oauthClientState != nil {
		tokenOpts = append(tokenOpts, oauth2.VerifierOption(*oauthClientState.CodeVerifier))