refactor(server): extract userinfo and introspection handlers (#4905)

Signed-off-by: maksim.nabokikh <max.nabokih@gmail.com>

Author: nabokihms

server/api.go

@@ -298,7 +298,7 @@ func (d dexAPI) GetVersion(ctx context.Context, req *api.VersionReq) (*api.Versi
 }
 
 func (d dexAPI) GetDiscovery(ctx context.Context, req *api.DiscoveryReq) (*api.DiscoveryResp, error) {
-	discoveryDoc := d.server.discovery.Construct(ctx)
+	discoveryDoc := d.server.constructDiscovery(ctx)
 	data, err := json.Marshal(discoveryDoc)
 	if err != nil {
 		return nil, fmt.Errorf("failed to marshal discovery data: %v", err)

server/approval.go

@@ -10,6 +10,7 @@ import (
 	"time"
 
 	"github.com/dexidp/dex/pkg/featureflags"
+	"github.com/dexidp/dex/server/oauth2"
 	"github.com/dexidp/dex/server/tokens"
 	"github.com/dexidp/dex/storage"
 )
@@ -151,7 +152,7 @@ func (s *Server) sendCodeResponse(w http.ResponseWriter, r *http.Request, authRe
 
 	for _, responseType := range authReq.ResponseTypes {
 		switch responseType {
-		case responseTypeCode:
+		case oauth2.ResponseTypeCode:
 			code = storage.AuthCode{
 				ID:            storage.NewID(),
 				ClientID:      authReq.ClientID,
@@ -173,13 +174,13 @@ func (s *Server) sendCodeResponse(w http.ResponseWriter, r *http.Request, authRe
 
 			// Implicit and hybrid flows that try to use the OOB redirect URI are
 			// rejected earlier. If we got here we're using the code flow.
-			if authReq.RedirectURI == redirectURIOOB {
+			if authReq.RedirectURI == oauth2.RedirectURIOOB {
 				if err := s.templates.OOB(r, w, code.ID); err != nil {
 					s.logger.ErrorContext(r.Context(), "server template error", "err", err)
 				}
 				return
 			}
-		case responseTypeToken:
+		case oauth2.ResponseTypeToken:
 			implicitOrHybrid = true
 			var err error
 
@@ -193,10 +194,10 @@ func (s *Server) sendCodeResponse(w http.ResponseWriter, r *http.Request, authRe
 			})
 			if err != nil {
 				s.logger.ErrorContext(r.Context(), "failed to create new access token", "err", err)
-				s.tokenErrHelper(w, errServerError, "", http.StatusInternalServerError)
+				s.tokenErrHelper(w, oauth2.ServerError, "", http.StatusInternalServerError)
 				return
 			}
-		case responseTypeIDToken:
+		case oauth2.ResponseTypeIDToken:
 			implicitOrHybrid = true
 			var err error
 
@@ -210,7 +211,7 @@ func (s *Server) sendCodeResponse(w http.ResponseWriter, r *http.Request, authRe
 			}, accessToken, code.ID)
 			if err != nil {
 				s.logger.ErrorContext(r.Context(), "failed to create ID token", "err", err)
-				s.tokenErrHelper(w, errServerError, "", http.StatusInternalServerError)
+				s.tokenErrHelper(w, oauth2.ServerError, "", http.StatusInternalServerError)
 				return
 			}
 		}

server/approval_test.go

@@ -13,6 +13,7 @@ import (
 
 	"github.com/stretchr/testify/require"
 
+	"github.com/dexidp/dex/server/oauth2"
 	"github.com/dexidp/dex/storage"
 )
 
@@ -106,7 +107,7 @@ func TestSkipApprovalWithExistingConsent(t *testing.T) {
 				ClientID:            tc.clientID,
 				RedirectURI:         "cb",
 				Expiry:              expiry,
-				ResponseTypes:       []string{responseTypeCode},
+				ResponseTypes:       []string{oauth2.ResponseTypeCode},
 				Scopes:              tc.scopes,
 				ForceApprovalPrompt: tc.forcePrompt,
 			}
@@ -149,7 +150,7 @@ func TestConsentPersistedOnApproval(t *testing.T) {
 		ID:            "approval-consent-test",
 		ClientID:      clientID,
 		ConnectorID:   connectorID,
-		ResponseTypes: []string{responseTypeCode},
+		ResponseTypes: []string{oauth2.ResponseTypeCode},
 		RedirectURI:   "https://client.example/callback",
 		Expiry:        time.Now().Add(time.Minute),
 		LoggedIn:      true,
@@ -355,7 +356,7 @@ func TestHandleApprovalDoubleSubmitPOST(t *testing.T) {
 	authReq := storage.AuthRequest{
 		ID:            "approval-double-submit",
 		ClientID:      "test",
-		ResponseTypes: []string{responseTypeCode},
+		ResponseTypes: []string{oauth2.ResponseTypeCode},
 		RedirectURI:   "https://client.example/callback",
 		Expiry:        time.Now().Add(time.Minute),
 		LoggedIn:      true,

server/authorize.go

@@ -10,23 +10,24 @@ import (
 	"net/url"
 	"strings"
 
+	"github.com/dexidp/dex/server/oauth2"
 	"github.com/dexidp/dex/server/templates"
 	"github.com/dexidp/dex/storage"
 )
 
 // grantTypeFromAuthRequest determines the grant type from the authorization request parameters.
 func (s *Server) grantTypeFromAuthRequest(r *http.Request) string {
 	redirectURI := r.Form.Get("redirect_uri")
-	if redirectURI == deviceCallbackURI || strings.HasSuffix(redirectURI, deviceCallbackURI) {
-		return grantTypeDeviceCode
+	if redirectURI == oauth2.DeviceCallbackURI || strings.HasSuffix(redirectURI, oauth2.DeviceCallbackURI) {
+		return oauth2.GrantTypeDeviceCode
 	}
 	responseType := r.Form.Get("response_type")
 	for _, rt := range strings.Fields(responseType) {
 		if rt == "token" || rt == "id_token" {
-			return grantTypeImplicit
+			return oauth2.GrantTypeImplicit
 		}
 	}
-	return grantTypeAuthorizationCode
+	return oauth2.GrantTypeAuthorizationCode
 }
 
 // handleAuthorization handles the OAuth2 auth endpoint.
@@ -117,7 +118,7 @@ func (s *Server) handleAuthorization(w http.ResponseWriter, r *http.Request) {
 		prompt, err := ParsePrompt(authReq.Prompt)
 		if err != nil {
 			// Server error because authReq was validated before saving it to database.
-			s.redirectWithError(w, r, authReq, errServerError, "Invalid authentication request")
+			s.redirectWithError(w, r, authReq, oauth2.ServerError, "Invalid authentication request")
 			return
 		}
 
@@ -137,7 +138,7 @@ func (s *Server) handleAuthorization(w http.ResponseWriter, r *http.Request) {
 		}
 		if prompt.None() {
 			// Cannot authenticate silently with prompt=none.
-			s.redirectWithError(w, r, authReq, errLoginRequired, "id_token_hint does not match authenticated user")
+			s.redirectWithError(w, r, authReq, oauth2.LoginRequired, "id_token_hint does not match authenticated user")
 			return
 		}
 	}

server/authorize_test.go

@@ -10,6 +10,7 @@ import (
 
 	"github.com/stretchr/testify/require"
 
+	"github.com/dexidp/dex/server/oauth2"
 	"github.com/dexidp/dex/storage"
 )
 
@@ -28,7 +29,7 @@ func TestHandleAuthorizationConnectorGrantTypeFiltering(t *testing.T) {
 		{
 			name: "one connector filtered, redirect to remaining",
 			connectorGrantTypes: map[string][]string{
-				"mock":  {grantTypeDeviceCode},
+				"mock":  {oauth2.GrantTypeDeviceCode},
 				"mock2": nil,
 			},
 			responseType:         "code",
@@ -38,8 +39,8 @@ func TestHandleAuthorizationConnectorGrantTypeFiltering(t *testing.T) {
 		{
 			name: "all connectors filtered",
 			connectorGrantTypes: map[string][]string{
-				"mock":  {grantTypeDeviceCode},
-				"mock2": {grantTypeDeviceCode},
+				"mock":  {oauth2.GrantTypeDeviceCode},
+				"mock2": {oauth2.GrantTypeDeviceCode},
 			},
 			responseType:     "code",
 			wantCode:         http.StatusBadRequest,
@@ -57,7 +58,7 @@ func TestHandleAuthorizationConnectorGrantTypeFiltering(t *testing.T) {
 		{
 			name: "implicit flow filters auth_code-only connector",
 			connectorGrantTypes: map[string][]string{
-				"mock":  {grantTypeAuthorizationCode},
+				"mock":  {oauth2.GrantTypeAuthorizationCode},
 				"mock2": nil,
 			},
 			responseType:         "token",

server/connectorauth.go

@@ -24,10 +24,28 @@ package server
 
 import (
 	"net/http"
+	"slices"
 
+	"github.com/dexidp/dex/server/oauth2"
 	"github.com/dexidp/dex/storage"
 )
 
+// ConnectorGrantTypes is the set of grant types that can be restricted per connector.
+var ConnectorGrantTypes = map[string]bool{
+	oauth2.GrantTypeAuthorizationCode: true,
+	oauth2.GrantTypeRefreshToken:      true,
+	oauth2.GrantTypeImplicit:          true,
+	oauth2.GrantTypePassword:          true,
+	oauth2.GrantTypeDeviceCode:        true,
+	oauth2.GrantTypeTokenExchange:     true,
+}
+
+// GrantTypeAllowed checks if the given grant type is allowed for this connector.
+// If no grant types are configured, all are allowed.
+func GrantTypeAllowed(configuredTypes []string, grantType string) bool {
+	return len(configuredTypes) == 0 || slices.Contains(configuredTypes, grantType)
+}
+
 // filterConnectors filters the list of connectors by the allowed connector IDs.
 // If allowedConnectors is empty, all connectors are returned (no filtering).
 func filterConnectors(connectors []storage.Connector, allowedConnectors []string) []storage.Connector {
@@ -77,6 +95,6 @@ func (s *Server) checkConnectorAllowed(w http.ResponseWriter, r *http.Request, c
 	}
 	s.logger.WarnContext(r.Context(), "connector not allowed for client",
 		"client_id", client.ID, "connector_id", connID)
-	s.tokenErrHelper(w, errInvalidGrant, "Connector not allowed for this client.", http.StatusBadRequest)
+	s.tokenErrHelper(w, oauth2.InvalidGrant, "Connector not allowed for this client.", http.StatusBadRequest)
 	return false
 }

server/device_authorize.go

@@ -15,6 +15,7 @@ import (
 	"strings"
 	"time"
 
+	"github.com/dexidp/dex/server/oauth2"
 	"github.com/dexidp/dex/storage"
 )
 
@@ -67,7 +68,7 @@ func (s *Server) handleDeviceCode(w http.ResponseWriter, r *http.Request) {
 		err := r.ParseForm()
 		if err != nil {
 			s.logger.ErrorContext(r.Context(), "could not parse Device Request body", "err", err)
-			s.tokenErrHelper(w, errInvalidRequest, "", http.StatusNotFound)
+			s.tokenErrHelper(w, oauth2.InvalidRequest, "", http.StatusNotFound)
 			return
 		}
 
@@ -83,7 +84,7 @@ func (s *Server) handleDeviceCode(w http.ResponseWriter, r *http.Request) {
 		}
 		if codeChallengeMethod != codeChallengeMethodS256 && codeChallengeMethod != codeChallengeMethodPlain {
 			description := fmt.Sprintf("Unsupported PKCE challenge method (%q).", codeChallengeMethod)
-			s.tokenErrHelper(w, errInvalidRequest, description, http.StatusBadRequest)
+			s.tokenErrHelper(w, oauth2.InvalidRequest, description, http.StatusBadRequest)
 			return
 		}
 
@@ -116,14 +117,14 @@ func (s *Server) handleDeviceCode(w http.ResponseWriter, r *http.Request) {
 
 		if err := s.storage.CreateDeviceRequest(ctx, deviceReq); err != nil {
 			s.logger.ErrorContext(r.Context(), "failed to store device request", "err", err)
-			s.tokenErrHelper(w, errInvalidRequest, "", http.StatusInternalServerError)
+			s.tokenErrHelper(w, oauth2.InvalidRequest, "", http.StatusInternalServerError)
 			return
 		}
 
 		// Store the device token
 		deviceToken := storage.DeviceToken{
 			DeviceCode:          deviceCode,
-			Status:              deviceTokenPending,
+			Status:              oauth2.DeviceTokenPending,
 			Expiry:              expireTime,
 			LastRequestTime:     s.now(),
 			PollIntervalSeconds: 0,
@@ -135,14 +136,14 @@ func (s *Server) handleDeviceCode(w http.ResponseWriter, r *http.Request) {
 
 		if err := s.storage.CreateDeviceToken(ctx, deviceToken); err != nil {
 			s.logger.ErrorContext(r.Context(), "failed to store device token", "err", err)
-			s.tokenErrHelper(w, errInvalidRequest, "", http.StatusInternalServerError)
+			s.tokenErrHelper(w, oauth2.InvalidRequest, "", http.StatusInternalServerError)
 			return
 		}
 
 		u, err := url.Parse(s.issuerURL.String())
 		if err != nil {
 			s.logger.ErrorContext(r.Context(), "could not parse issuer URL", "err", err)
-			s.tokenErrHelper(w, errInvalidRequest, "", http.StatusInternalServerError)
+			s.tokenErrHelper(w, oauth2.InvalidRequest, "", http.StatusInternalServerError)
 			return
 		}
 		u.Path = path.Join(u.Path, "device")
@@ -177,7 +178,7 @@ func (s *Server) handleDeviceCode(w http.ResponseWriter, r *http.Request) {
 
 	default:
 		s.renderError(r, w, http.StatusBadRequest, "Invalid device code request type")
-		s.tokenErrHelper(w, errInvalidRequest, "", http.StatusBadRequest)
+		s.tokenErrHelper(w, oauth2.InvalidRequest, "", http.StatusBadRequest)
 	}
 }
 
@@ -225,7 +226,7 @@ func (s *Server) verifyUserCode(w http.ResponseWriter, r *http.Request) {
 		q.Set("client_secret", deviceRequest.ClientSecret)
 		q.Set("state", deviceRequest.UserCode)
 		q.Set("response_type", "code")
-		q.Set("redirect_uri", s.absPath(deviceCallbackURI))
+		q.Set("redirect_uri", s.absPath(oauth2.DeviceCallbackURI))
 		q.Set("scope", strings.Join(deviceRequest.Scopes, " "))
 		u.RawQuery = q.Encode()
 

server/device_callback.go

@@ -9,6 +9,7 @@ import (
 	"errors"
 	"net/http"
 
+	"github.com/dexidp/dex/server/oauth2"
 	"github.com/dexidp/dex/storage"
 )
 
@@ -61,14 +62,14 @@ func (s *Server) handleDeviceCallback(w http.ResponseWriter, r *http.Request) {
 		if err != nil {
 			if err != storage.ErrNotFound {
 				s.logger.ErrorContext(r.Context(), "failed to get client", "err", err)
-				s.tokenErrHelper(w, errServerError, "", http.StatusInternalServerError)
+				s.tokenErrHelper(w, oauth2.ServerError, "", http.StatusInternalServerError)
 			} else {
-				s.tokenErrHelper(w, errInvalidClient, "Invalid client credentials.", http.StatusUnauthorized)
+				s.tokenErrHelper(w, oauth2.InvalidClient, "Invalid client credentials.", http.StatusUnauthorized)
 			}
 			return
 		}
 		if client.Secret != deviceReq.ClientSecret {
-			s.tokenErrHelper(w, errInvalidClient, "Invalid client credentials.", http.StatusUnauthorized)
+			s.tokenErrHelper(w, oauth2.InvalidClient, "Invalid client credentials.", http.StatusUnauthorized)
 			return
 		}
 
@@ -92,7 +93,7 @@ func (s *Server) handleDeviceCallback(w http.ResponseWriter, r *http.Request) {
 		}
 
 		updater := func(old storage.DeviceToken) (storage.DeviceToken, error) {
-			if old.Status == deviceTokenComplete {
+			if old.Status == oauth2.DeviceTokenComplete {
 				return old, errors.New("device token already complete")
 			}
 			respStr, err := json.MarshalIndent(resp, "", "  ")
@@ -103,7 +104,7 @@ func (s *Server) handleDeviceCallback(w http.ResponseWriter, r *http.Request) {
 			}
 
 			old.Token = string(respStr)
-			old.Status = deviceTokenComplete
+			old.Status = oauth2.DeviceTokenComplete
 			return old, nil
 		}