refactor(server): extract the device authorization endpoints into a package

Move the browser-facing side of the OAuth2 device flow (RFC 8628) out of the
god Server into a server/device package: the /device user-code page,
/device/code authorization request, /device/auth/verify_code verification, and
the /device/callback that completes the flow. The handler mounts its own routes
and holds only its dependencies (storage, templates, issuer URL, timing, logger)
plus the shared ExchangeAuthCode and a RenderError callback.

The device_code token grant stays with the token endpoint: it is a /token grant
like the others, dispatched from handleToken, so the token endpoint keeps
owning it rather than the server reaching into the device handler. The
deprecated /device/token endpoint stays alongside it.

The PKCE code-challenge method names move to the oauth2 package as
PKCEMethodPlain/PKCEMethodS256. No behaviour change.

Signed-off-by: maksim.nabokikh <max.nabokih@gmail.com>

Author: nabokihms

server/device/device.go

@@ -0,0 +1,16 @@
+package device
+
+import (
+	"net/url"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestGetDeviceVerificationURI(t *testing.T) {
+	u, err := url.Parse("https://dex.example.com/non-root-path")
+	require.NoError(t, err)
+
+	h := &Handler{IssuerURL: *u}
+	require.Equal(t, "/non-root-path/device/auth/verify_code", h.getDeviceVerificationURI())
+}

server/device/device_test.go

@@ -12,32 +12,10 @@ import (
 	"testing"
 	"time"
 
+	"github.com/dexidp/dex/server/device"
 	"github.com/dexidp/dex/storage"
 )
 
-func TestDeviceVerificationURI(t *testing.T) {
-	t0 := time.Now()
-
-	now := func() time.Time { return t0 }
-	// Setup a dex server.
-	httpServer, s := newTestServer(t, func(c *Config) {
-		c.Issuer += "/non-root-path"
-		c.Now = now
-	})
-	defer httpServer.Close()
-
-	u, err := url.Parse(s.issuerURL.String())
-	if err != nil {
-		t.Fatalf("Could not parse issuer URL %v", err)
-	}
-	u.Path = path.Join(u.Path, "/device/auth/verify_code")
-
-	uri := s.getDeviceVerificationURI()
-	if uri != u.Path {
-		t.Errorf("Invalid verification URI.  Expected %v got %v", u.Path, uri)
-	}
-}
-
 func TestHandleDeviceCode(t *testing.T) {
 	t0 := time.Now()
 
@@ -135,7 +113,7 @@ func TestHandleDeviceCode(t *testing.T) {
 				t.Errorf("Could read token response %v", err)
 			}
 			if tc.expectedResponseCode == http.StatusOK {
-				var resp deviceCodeResponse
+				var resp device.DeviceCodeResponse
 				if err := json.Unmarshal(body, &resp); err != nil {
 					t.Errorf("Unexpected Device Code Response Format %v", string(body))
 				}