synced/coder
1
0
Fork 0
mirror of https://github.com/coder/coder.git synced 2025-07-13 21:36:50 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat: add OAuth2 protected resource metadata endpoint for RFC 9728 (#18643)

Browse Source 
# Add OAuth2 Protected Resource Metadata Endpoint

This PR implements the OAuth2 Protected Resource Metadata endpoint according to RFC 9728. The endpoint is available at `/.well-known/oauth-protected-resource` and provides information about Coder as an OAuth2 protected resource.

Key changes:
- Added a new endpoint at `/.well-known/oauth-protected-resource` that returns metadata about Coder as an OAuth2 protected resource
- Created a new `OAuth2ProtectedResourceMetadata` struct in the SDK
- Added tests to verify the endpoint functionality
- Updated API documentation to include the new endpoint

The implementation currently returns basic metadata including the resource identifier and authorization server URL. The `scopes_supported` field is empty until a scope system based on RBAC permissions is implemented. The `bearer_methods_supported` field is omitted as Coder uses custom authentication methods rather than standard RFC 6750 bearer tokens.

A TODO has been added to implement RFC 6750 bearer token support in the future.
This commit is contained in:
Thomas Kosiewski
2025-07-02 18:58:41 +02:00
committed by GitHub
parent 1b73b1a12f
commit 33bbf18a4b
10 changed files with 236 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

37
docs/reference/api/enterprise.md generated
View File

@ -46,6 +46,43 @@ curl -X GET http://coder-server:8080/api/v2/.well-known/oauth-authorization-serv
|--------|---------------------------------------------------------|-------------|----------------------------------------------------------------------------------------------------|
| 200 | [OK](https://tools.ietf.org/html/rfc7231#section-6.3.1) | OK | [codersdk.OAuth2AuthorizationServerMetadata](schemas.md#codersdkoauth2authorizationservermetadata) |
## OAuth2 protected resource metadata
### Code samples
```shell
# Example request using curl
curl -X GET http://coder-server:8080/api/v2/.well-known/oauth-protected-resource \
-H 'Accept: application/json'
```
`GET /.well-known/oauth-protected-resource`
### Example responses
> 200 Response
```json
{
"authorization_servers": [
"string"
],
"bearer_methods_supported": [
"string"
],
"resource": "string",
"scopes_supported": [
"string"
]
}
```
### Responses
| Status | Meaning | Description | Schema |
|--------|---------------------------------------------------------|-------------|------------------------------------------------------------------------------------------------|
| 200 | [OK](https://tools.ietf.org/html/rfc7231#section-6.3.1) | OK | [codersdk.OAuth2ProtectedResourceMetadata](schemas.md#codersdkoauth2protectedresourcemetadata) |
## Get appearance
### Code samples

26
docs/reference/api/schemas.md generated
View File

@ -4287,6 +4287,32 @@ Git clone makes use of this by parsing the URL from: 'Username for "https://gith
| `device_flow` | boolean | false | | |
| `enterprise_base_url` | string | false | | |
## codersdk.OAuth2ProtectedResourceMetadata
```json
{
"authorization_servers": [
"string"
],
"bearer_methods_supported": [
"string"
],
"resource": "string",
"scopes_supported": [
"string"
]
}
```
### Properties
| Name | Type | Required | Restrictions | Description |
|----------------------------|-----------------|----------|--------------|-------------|
| `authorization_servers` | array of string | false | | |
| `bearer_methods_supported` | array of string | false | | |
| `resource` | string | false | | |
| `scopes_supported` | array of string | false | | |
## codersdk.OAuth2ProviderApp
```json