refactor(server): migrate password and token-exchange to the Grant abstraction

Turn the token endpoint into a fixed pipeline of shared control points so a grant
cannot skip a security-sensitive step. Dispatch always runs, in order:

  1. authenticate the client
  2. validate the requested scopes (cross-client trust included)
  3. resolve the connector and enforce the connector-authorization invariant
  4. Authorize — the grant proves the identity against the resolved connector
  5. mint the token response
  6. write the response or error

A Grant only fills the parts unique to it — a scope policy, its connector id, and
Authorize — while the Endpoint owns every shared phase. The cross-client trust
check and the connector-authorization invariant (client allows the connector,
connector allows the grant type) now run in the pipeline, not inside each grant
where one could be forgotten: a grant supplies its connector id and the endpoint
resolves and checks it. A grant that uses no connector, like client_credentials,
returns an empty id and the step is skipped.

Token minting is unified: tokens.Issuer.Issue is the single mint every standard
grant uses, now issuing an ID token exactly when the openid scope was requested,
which also covers client_credentials. A grant whose response is non-standard
implements Minter; token-exchange uses it to mint the single RFC 8693 token, the
only response shape the standard mint does not produce.

A grant never touches the ResponseWriter: it returns a tokens.Response or an
*oauth2.Error, and the Endpoint writes it.

checkConnectorAllowed stays in the server package for the refresh grant, which has
not moved yet.

Signed-off-by: maksim.nabokikh <max.nabokih@gmail.com>

Author: nabokihms

server/connectorauth.go

@@ -1,26 +1,25 @@
 package server
 
-// This file is the single home for connector authorization: deciding whether a
-// given client may use a given connector, and whether a connector permits a given
-// grant type.
+// This file handles connector authorization for the token grants that still live
+// in the server package: deciding whether a given client may use a given
+// connector, and whether a connector permits a given grant type.
 //
 // INVARIANT: every token grant that resolves a connector MUST enforce both
 // policies before issuing tokens:
-//   1. checkConnectorAllowed(client, connID) — the connector is in the client's
-//      AllowedConnectors.
-//   2. connectors.GrantTypeAllowed(conn.GrantTypes, grantType) — the connector permits this
-//      grant type.
+//   1. connectors.ConnectorAllowed(client.AllowedConnectors, connID) — the connector
+//      is in the client's AllowedConnectors.
+//   2. connectors.GrantTypeAllowed(conn.GrantTypes, grantType) — the connector permits
+//      this grant type.
 //
-// The password and token-exchange grants run #1 before resolving the connector
-// (so a disallowed connector is never instantiated) and #2 right after. The
-// refresh grant resolves the connector and runs #2 inside getRefreshTokenFromStorage
-// (shared with token introspection), then runs #1 in handleRefreshToken — a
-// different order, but both still gate token issuance.
+// Grants that have moved to the grants package enforce the invariant through
+// grants.Endpoint.resolveConnector, which runs both checks in one call. The
+// refresh grant, still here, resolves the connector and runs #2 inside
+// getRefreshTokenFromStorage (shared with token introspection), then runs #1 via
+// checkConnectorAllowed in handleRefreshToken — a different order, but both still
+// gate token issuance.
 //
-// Both checks live here / are referenced from here so a new grant handler can find
-// them in one place and not silently forget one — the omission that let the
-// password and refresh grants skip check #1. Browser/auth-code paths enforce the
-// same policies with their own HTML/redirect error surface (login.go, authorize.go).
+// Browser/auth-code paths enforce the same policies with their own HTML/redirect
+// error surface (login.go, authorize.go).
 
 import (
 	"net/http"

server/grant_password.go

@@ -12,7 +12,6 @@ import (
 
 	"github.com/stretchr/testify/require"
 
-	"github.com/dexidp/dex/server/grants"
 	"github.com/dexidp/dex/server/oauth2"
 	"github.com/dexidp/dex/server/tokens"
 	"github.com/dexidp/dex/storage"
@@ -108,7 +107,7 @@ func TestHandleTokenExchange(t *testing.T) {
 			req := httptest.NewRequest(http.MethodPost, httpServer.URL+"/token", strings.NewReader(vals.Encode()))
 			req.Header.Set("content-type", "application/x-www-form-urlencoded")
 
-			s.handleToken(rr, req, &grants.Endpoint{})
+			s.handleToken(rr, req, s.newTokenEndpoint())
 
 			require.Equal(t, tc.expectedCode, rr.Code, rr.Body.String())
 			require.Equal(t, "application/json", rr.Result().Header.Get("content-type"))
@@ -148,7 +147,7 @@ func TestHandleTokenExchangeLogsSuccess(t *testing.T) {
 	req := httptest.NewRequest(http.MethodPost, httpServer.URL+"/token", strings.NewReader(vals.Encode()))
 	req.Header.Set("content-type", "application/x-www-form-urlencoded")
 
-	s.handleToken(rr, req, &grants.Endpoint{})
+	s.handleToken(rr, req, s.newTokenEndpoint())
 	require.Equal(t, http.StatusOK, rr.Code, rr.Body.String())
 
 	var found map[string]any
@@ -205,7 +204,7 @@ func TestHandleTokenExchangeConnectorGrantTypeRestriction(t *testing.T) {
 	req := httptest.NewRequest(http.MethodPost, httpServer.URL+"/token", strings.NewReader(vals.Encode()))
 	req.Header.Set("content-type", "application/x-www-form-urlencoded")
 
-	s.handleToken(rr, req, &grants.Endpoint{})
+	s.handleToken(rr, req, s.newTokenEndpoint())
 
 	require.Equal(t, http.StatusBadRequest, rr.Code, rr.Body.String())
 }
@@ -264,7 +263,7 @@ func TestHandleTokenExchangeAllowedConnectors(t *testing.T) {
 			req := httptest.NewRequest(http.MethodPost, httpServer.URL+"/token", strings.NewReader(vals.Encode()))
 			req.Header.Set("content-type", "application/x-www-form-urlencoded")
 
-			s.handleToken(rr, req, &grants.Endpoint{})
+			s.handleToken(rr, req, s.newTokenEndpoint())
 
 			require.Equal(t, tc.expectedCode, rr.Code, rr.Body.String())
 			if tc.expectedCode == http.StatusBadRequest {