feat: support multiple client IDs

hf · hf · commit 38482db21f3d · 2023-05-26T20:04:10.000+02:00
diff --git a/internal/api/external_apple_test.go b/internal/api/external_apple_test.go
@@ -17,7 +17,7 @@ func (ts *ExternalTestSuite) TestSignupExternalApple() {
 	ts.Require().NoError(err, "redirect url parse failed")
 	q := u.Query()
 	ts.Equal(ts.Config.External.Apple.RedirectURI, q.Get("redirect_uri"))
-	ts.Equal(ts.Config.External.Apple.ClientID, q.Get("client_id"))
+	ts.Equal(ts.Config.External.Apple.ClientID, []string{q.Get("client_id")})
 	ts.Equal("code", q.Get("response_type"))
 	ts.Equal("email name", q.Get("scope"))
 
diff --git a/internal/api/external_azure_test.go b/internal/api/external_azure_test.go
@@ -23,7 +23,7 @@ func (ts *ExternalTestSuite) TestSignupExternalAzure() {
 	ts.Require().NoError(err, "redirect url parse failed")
 	q := u.Query()
 	ts.Equal(ts.Config.External.Azure.RedirectURI, q.Get("redirect_uri"))
-	ts.Equal(ts.Config.External.Azure.ClientID, q.Get("client_id"))
+	ts.Equal(ts.Config.External.Azure.ClientID, []string{q.Get("client_id")})
 	ts.Equal("code", q.Get("response_type"))
 	ts.Equal("openid", q.Get("scope"))
 
diff --git a/internal/api/external_bitbucket_test.go b/internal/api/external_bitbucket_test.go
@@ -22,7 +22,7 @@ func (ts *ExternalTestSuite) TestSignupExternalBitbucket() {
 	ts.Require().NoError(err, "redirect url parse failed")
 	q := u.Query()
 	ts.Equal(ts.Config.External.Bitbucket.RedirectURI, q.Get("redirect_uri"))
-	ts.Equal(ts.Config.External.Bitbucket.ClientID, q.Get("client_id"))
+	ts.Equal(ts.Config.External.Bitbucket.ClientID, []string{q.Get("client_id")})
 	ts.Equal("code", q.Get("response_type"))
 	ts.Equal("account email", q.Get("scope"))
 
diff --git a/internal/api/external_discord_test.go b/internal/api/external_discord_test.go
@@ -24,7 +24,7 @@ func (ts *ExternalTestSuite) TestSignupExternalDiscord() {
 	ts.Require().NoError(err, "redirect url parse failed")
 	q := u.Query()
 	ts.Equal(ts.Config.External.Discord.RedirectURI, q.Get("redirect_uri"))
-	ts.Equal(ts.Config.External.Discord.ClientID, q.Get("client_id"))
+	ts.Equal(ts.Config.External.Discord.ClientID, []string{q.Get("client_id")})
 	ts.Equal("code", q.Get("response_type"))
 	ts.Equal("email identify", q.Get("scope"))
 
diff --git a/internal/api/external_facebook_test.go b/internal/api/external_facebook_test.go
@@ -24,7 +24,7 @@ func (ts *ExternalTestSuite) TestSignupExternalFacebook() {
 	ts.Require().NoError(err, "redirect url parse failed")
 	q := u.Query()
 	ts.Equal(ts.Config.External.Facebook.RedirectURI, q.Get("redirect_uri"))
-	ts.Equal(ts.Config.External.Facebook.ClientID, q.Get("client_id"))
+	ts.Equal(ts.Config.External.Facebook.ClientID, []string{q.Get("client_id")})
 	ts.Equal("code", q.Get("response_type"))
 	ts.Equal("email", q.Get("scope"))
 
diff --git a/internal/api/external_github_test.go b/internal/api/external_github_test.go
@@ -25,7 +25,7 @@ func (ts *ExternalTestSuite) TestSignupExternalGithub() {
 	ts.Require().NoError(err, "redirect url parse failed")
 	q := u.Query()
 	ts.Equal(ts.Config.External.Github.RedirectURI, q.Get("redirect_uri"))
-	ts.Equal(ts.Config.External.Github.ClientID, q.Get("client_id"))
+	ts.Equal(ts.Config.External.Github.ClientID, []string{q.Get("client_id")})
 	ts.Equal("code", q.Get("response_type"))
 	ts.Equal("user:email", q.Get("scope"))
 
diff --git a/internal/api/external_gitlab_test.go b/internal/api/external_gitlab_test.go
@@ -24,7 +24,7 @@ func (ts *ExternalTestSuite) TestSignupExternalGitlab() {
 	ts.Require().NoError(err, "redirect url parse failed")
 	q := u.Query()
 	ts.Equal(ts.Config.External.Gitlab.RedirectURI, q.Get("redirect_uri"))
-	ts.Equal(ts.Config.External.Gitlab.ClientID, q.Get("client_id"))
+	ts.Equal(ts.Config.External.Gitlab.ClientID, []string{q.Get("client_id")})
 	ts.Equal("code", q.Get("response_type"))
 	ts.Equal("read_user", q.Get("scope"))
 
diff --git a/internal/api/external_google_test.go b/internal/api/external_google_test.go
@@ -29,7 +29,7 @@ func (ts *ExternalTestSuite) TestSignupExternalGoogle() {
 	ts.Require().NoError(err, "redirect url parse failed")
 	q := u.Query()
 	ts.Equal(ts.Config.External.Google.RedirectURI, q.Get("redirect_uri"))
-	ts.Equal(ts.Config.External.Google.ClientID, q.Get("client_id"))
+	ts.Equal(ts.Config.External.Google.ClientID, []string{q.Get("client_id")})
 	ts.Equal("code", q.Get("response_type"))
 	ts.Equal("email profile", q.Get("scope"))
 
diff --git a/internal/api/external_kakao_test.go b/internal/api/external_kakao_test.go
@@ -23,7 +23,7 @@ func (ts *ExternalTestSuite) TestSignupExternalKakao() {
 	ts.Require().NoError(err, "redirect url parse failed")
 	q := u.Query()
 	ts.Equal(ts.Config.External.Kakao.RedirectURI, q.Get("redirect_uri"))
-	ts.Equal(ts.Config.External.Kakao.ClientID, q.Get("client_id"))
+	ts.Equal(ts.Config.External.Kakao.ClientID, []string{q.Get("client_id")})
 	ts.Equal("code", q.Get("response_type"))
 
 	claims := ExternalProviderClaims{}
diff --git a/internal/api/external_keycloak_test.go b/internal/api/external_keycloak_test.go
@@ -23,7 +23,7 @@ func (ts *ExternalTestSuite) TestSignupExternalKeycloak() {
 	ts.Require().NoError(err, "redirect url parse failed")
 	q := u.Query()
 	ts.Equal(ts.Config.External.Keycloak.RedirectURI, q.Get("redirect_uri"))
-	ts.Equal(ts.Config.External.Keycloak.ClientID, q.Get("client_id"))
+	ts.Equal(ts.Config.External.Keycloak.ClientID, []string{q.Get("client_id")})
 	ts.Equal("code", q.Get("response_type"))
 	ts.Equal("profile email", q.Get("scope"))
 
diff --git a/internal/api/external_linkedin_test.go b/internal/api/external_linkedin_test.go
@@ -25,7 +25,7 @@ func (ts *ExternalTestSuite) TestSignupExternalLinkedin() {
 	ts.Require().NoError(err, "redirect url parse failed")
 	q := u.Query()
 	ts.Equal(ts.Config.External.Linkedin.RedirectURI, q.Get("redirect_uri"))
-	ts.Equal(ts.Config.External.Linkedin.ClientID, q.Get("client_id"))
+	ts.Equal(ts.Config.External.Linkedin.ClientID, []string{q.Get("client_id")})
 	ts.Equal("code", q.Get("response_type"))
 	ts.Equal("r_emailaddress r_liteprofile", q.Get("scope"))
 
diff --git a/internal/api/external_notion_test.go b/internal/api/external_notion_test.go
@@ -24,7 +24,7 @@ func (ts *ExternalTestSuite) TestSignupExternalNotion() {
 	ts.Require().NoError(err, "redirect url parse failed")
 	q := u.Query()
 	ts.Equal(ts.Config.External.Notion.RedirectURI, q.Get("redirect_uri"))
-	ts.Equal(ts.Config.External.Notion.ClientID, q.Get("client_id"))
+	ts.Equal(ts.Config.External.Notion.ClientID, []string{q.Get("client_id")})
 	ts.Equal("code", q.Get("response_type"))
 
 	claims := ExternalProviderClaims{}
diff --git a/internal/api/external_twitch_test.go b/internal/api/external_twitch_test.go
@@ -23,7 +23,7 @@ func (ts *ExternalTestSuite) TestSignupExternalTwitch() {
 	ts.Require().NoError(err, "redirect url parse failed")
 	q := u.Query()
 	ts.Equal(ts.Config.External.Twitch.RedirectURI, q.Get("redirect_uri"))
-	ts.Equal(ts.Config.External.Twitch.ClientID, q.Get("client_id"))
+	ts.Equal(ts.Config.External.Twitch.ClientID, []string{q.Get("client_id")})
 	ts.Equal("code", q.Get("response_type"))
 	ts.Equal("user:read:email", q.Get("scope"))
 
diff --git a/internal/api/external_workos_test.go b/internal/api/external_workos_test.go
@@ -25,7 +25,7 @@ func (ts *ExternalTestSuite) TestSignupExternalWorkOSWithConnection() {
 	ts.Require().NoError(err, "redirect url parse failed")
 	q := u.Query()
 	ts.Equal(ts.Config.External.WorkOS.RedirectURI, q.Get("redirect_uri"))
-	ts.Equal(ts.Config.External.WorkOS.ClientID, q.Get("client_id"))
+	ts.Equal(ts.Config.External.WorkOS.ClientID, []string{q.Get("client_id")})
 	ts.Equal("code", q.Get("response_type"))
 	ts.Equal("", q.Get("scope"))
 	ts.Equal(connection, q.Get("connection"))
@@ -51,7 +51,7 @@ func (ts *ExternalTestSuite) TestSignupExternalWorkOSWithOrganization() {
 	ts.Require().NoError(err, "redirect url parse failed")
 	q := u.Query()
 	ts.Equal(ts.Config.External.WorkOS.RedirectURI, q.Get("redirect_uri"))
-	ts.Equal(ts.Config.External.WorkOS.ClientID, q.Get("client_id"))
+	ts.Equal(ts.Config.External.WorkOS.ClientID, []string{q.Get("client_id")})
 	ts.Equal("code", q.Get("response_type"))
 	ts.Equal("", q.Get("scope"))
 	ts.Equal(organization, q.Get("organization"))
@@ -77,7 +77,7 @@ func (ts *ExternalTestSuite) TestSignupExternalWorkOSWithProvider() {
 	ts.Require().NoError(err, "redirect url parse failed")
 	q := u.Query()
 	ts.Equal(ts.Config.External.WorkOS.RedirectURI, q.Get("redirect_uri"))
-	ts.Equal(ts.Config.External.WorkOS.ClientID, q.Get("client_id"))
+	ts.Equal(ts.Config.External.WorkOS.ClientID, []string{q.Get("client_id")})
 	ts.Equal("code", q.Get("response_type"))
 	ts.Equal("", q.Get("scope"))
 	ts.Equal(provider, q.Get("provider"))
diff --git a/internal/api/external_zoom_test.go b/internal/api/external_zoom_test.go
@@ -24,7 +24,7 @@ func (ts *ExternalTestSuite) TestSignupExternalZoom() {
 	ts.Require().NoError(err, "redirect url parse failed")
 	q := u.Query()
 	ts.Equal(ts.Config.External.Zoom.RedirectURI, q.Get("redirect_uri"))
-	ts.Equal(ts.Config.External.Zoom.ClientID, q.Get("client_id"))
+	ts.Equal(ts.Config.External.Zoom.ClientID, []string{q.Get("client_id")})
 	ts.Equal("code", q.Get("response_type"))
 
 	claims := ExternalProviderClaims{}
diff --git a/internal/api/provider/apple.go b/internal/api/provider/apple.go
@@ -33,7 +33,7 @@ type appleUser struct {
 
 // NewAppleProvider creates a Apple account provider.
 func NewAppleProvider(ctx context.Context, ext conf.OAuthProviderConfiguration) (OAuthProvider, error) {
-	if err := ext.Validate(); err != nil {
+	if err := ext.ValidateOAuth(); err != nil {
 		return nil, err
 	}
 
@@ -48,7 +48,7 @@ func NewAppleProvider(ctx context.Context, ext conf.OAuthProviderConfiguration)
 
 	return &AppleProvider{
 		Config: &oauth2.Config{
-			ClientID:     ext.ClientID,
+			ClientID:     ext.ClientID[0],
 			ClientSecret: ext.Secret,
 			Endpoint:     oidcProvider.Endpoint(),
 			Scopes: []string{
diff --git a/internal/api/provider/azure.go b/internal/api/provider/azure.go
@@ -29,7 +29,7 @@ type azureUser struct {
 
 // NewAzureProvider creates a Azure account provider.
 func NewAzureProvider(ext conf.OAuthProviderConfiguration, scopes string) (OAuthProvider, error) {
-	if err := ext.Validate(); err != nil {
+	if err := ext.ValidateOAuth(); err != nil {
 		return nil, err
 	}
 
@@ -44,7 +44,7 @@ func NewAzureProvider(ext conf.OAuthProviderConfiguration, scopes string) (OAuth
 
 	return &azureProvider{
 		Config: &oauth2.Config{
-			ClientID:     ext.ClientID,
+			ClientID:     ext.ClientID[0],
 			ClientSecret: ext.Secret,
 			Endpoint: oauth2.Endpoint{
 				AuthURL:  authHost + "/oauth2/v2.0/authorize",
diff --git a/internal/api/provider/bitbucket.go b/internal/api/provider/bitbucket.go
@@ -38,7 +38,7 @@ type bitbucketEmails struct {
 
 // NewBitbucketProvider creates a Bitbucket account provider.
 func NewBitbucketProvider(ext conf.OAuthProviderConfiguration) (OAuthProvider, error) {
-	if err := ext.Validate(); err != nil {
+	if err := ext.ValidateOAuth(); err != nil {
 		return nil, err
 	}
 
@@ -47,7 +47,7 @@ func NewBitbucketProvider(ext conf.OAuthProviderConfiguration) (OAuthProvider, e
 
 	return &bitbucketProvider{
 		Config: &oauth2.Config{
-			ClientID:     ext.ClientID,
+			ClientID:     ext.ClientID[0],
 			ClientSecret: ext.Secret,
 			Endpoint: oauth2.Endpoint{
 				AuthURL:  authHost + "/site/oauth2/authorize",
diff --git a/internal/api/provider/discord.go b/internal/api/provider/discord.go
@@ -31,7 +31,7 @@ type discordUser struct {
 
 // NewDiscordProvider creates a Discord account provider.
 func NewDiscordProvider(ext conf.OAuthProviderConfiguration, scopes string) (OAuthProvider, error) {
-	if err := ext.Validate(); err != nil {
+	if err := ext.ValidateOAuth(); err != nil {
 		return nil, err
 	}
 
@@ -48,7 +48,7 @@ func NewDiscordProvider(ext conf.OAuthProviderConfiguration, scopes string) (OAu
 
 	return &discordProvider{
 		Config: &oauth2.Config{
-			ClientID:     ext.ClientID,
+			ClientID:     ext.ClientID[0],
 			ClientSecret: ext.Secret,
 			Endpoint: oauth2.Endpoint{
 				AuthURL:  apiPath + "/oauth2/authorize",
diff --git a/internal/api/provider/facebook.go b/internal/api/provider/facebook.go
@@ -40,7 +40,7 @@ type facebookUser struct {
 
 // NewFacebookProvider creates a Facebook account provider.
 func NewFacebookProvider(ext conf.OAuthProviderConfiguration, scopes string) (OAuthProvider, error) {
-	if err := ext.Validate(); err != nil {
+	if err := ext.ValidateOAuth(); err != nil {
 		return nil, err
 	}
 
@@ -58,7 +58,7 @@ func NewFacebookProvider(ext conf.OAuthProviderConfiguration, scopes string) (OA
 
 	return &facebookProvider{
 		Config: &oauth2.Config{
-			ClientID:     ext.ClientID,
+			ClientID:     ext.ClientID[0],
 			ClientSecret: ext.Secret,
 			RedirectURL:  ext.RedirectURI,
 			Endpoint: oauth2.Endpoint{
diff --git a/internal/api/provider/github.go b/internal/api/provider/github.go
@@ -38,7 +38,7 @@ type githubUserEmail struct {
 
 // NewGithubProvider creates a Github account provider.
 func NewGithubProvider(ext conf.OAuthProviderConfiguration, scopes string) (OAuthProvider, error) {
-	if err := ext.Validate(); err != nil {
+	if err := ext.ValidateOAuth(); err != nil {
 		return nil, err
 	}
 
@@ -58,7 +58,7 @@ func NewGithubProvider(ext conf.OAuthProviderConfiguration, scopes string) (OAut
 
 	return &githubProvider{
 		Config: &oauth2.Config{
-			ClientID:     ext.ClientID,
+			ClientID:     ext.ClientID[0],
 			ClientSecret: ext.Secret,
 			Endpoint: oauth2.Endpoint{
 				AuthURL:  authHost + "/login/oauth/authorize",
diff --git a/internal/api/provider/gitlab.go b/internal/api/provider/gitlab.go
@@ -34,7 +34,7 @@ type gitlabUserEmail struct {
 
 // NewGitlabProvider creates a Gitlab account provider.
 func NewGitlabProvider(ext conf.OAuthProviderConfiguration, scopes string) (OAuthProvider, error) {
-	if err := ext.Validate(); err != nil {
+	if err := ext.ValidateOAuth(); err != nil {
 		return nil, err
 	}
 
@@ -49,7 +49,7 @@ func NewGitlabProvider(ext conf.OAuthProviderConfiguration, scopes string) (OAut
 	host := chooseHost(ext.URL, defaultGitLabAuthBase)
 	return &gitlabProvider{
 		Config: &oauth2.Config{
-			ClientID:     ext.ClientID,
+			ClientID:     ext.ClientID[0],
 			ClientSecret: ext.Secret,
 			Endpoint: oauth2.Endpoint{
 				AuthURL:  host + "/oauth/authorize",
diff --git a/internal/api/provider/google.go b/internal/api/provider/google.go
@@ -3,7 +3,6 @@ package provider
 import (
 	"context"
 	"errors"
-	"fmt"
 	"strings"
 
 	"github.com/coreos/go-oidc/v3/oidc"
@@ -40,7 +39,7 @@ type googleProvider struct {
 
 // NewGoogleProvider creates a Google OAuth2 identity provider.
 func NewGoogleProvider(ctx context.Context, ext conf.OAuthProviderConfiguration, scopes string) (OAuthProvider, error) {
-	if err := ext.Validate(); err != nil {
+	if err := ext.ValidateOAuth(); err != nil {
 		return nil, err
 	}
 
@@ -64,7 +63,7 @@ func NewGoogleProvider(ctx context.Context, ext conf.OAuthProviderConfiguration,
 
 	return &googleProvider{
 		Config: &oauth2.Config{
-			ClientID:     ext.ClientID,
+			ClientID:     ext.ClientID[0],
 			ClientSecret: ext.Secret,
 			Endpoint:     oidcProvider.Endpoint(),
 			Scopes:       oauthScopes,
@@ -84,26 +83,16 @@ var internalUserInfoEndpointGoogle = UserInfoEndpointGoogle
 
 func (g googleProvider) GetUserData(ctx context.Context, tok *oauth2.Token) (*UserProvidedData, error) {
 	if idToken := tok.Extra("id_token"); idToken != nil {
-		token, data, err := ParseIDToken(ctx, g.oidc, nil, idToken.(string), ParseIDTokenOptions{
+		_, data, err := ParseIDToken(ctx, g.oidc, &oidc.Config{
+			ClientID: g.Config.ClientID,
+		}, idToken.(string), ParseIDTokenOptions{
 			AccessToken: tok.AccessToken,
 		})
 		if err != nil {
 			return nil, err
 		}
 
-		matchesAudience := false
-		for _, aud := range token.Audience {
-			if g.Config.ClientID == aud {
-				matchesAudience = true
-				break
-			}
-		}
-
-		if !matchesAudience {
-			return nil, fmt.Errorf("provider: Google ID token issued for audience(s) %q but expected %q", strings.Join(token.Audience, ", "), g.Config.ClientID)
-		}
-
-		return data, err
+		return data, nil
 	}
 
 	// This whole section offers legacy support in case the Google OAuth2
diff --git a/internal/api/provider/kakao.go b/internal/api/provider/kakao.go
@@ -71,7 +71,7 @@ func (p kakaoProvider) GetUserData(ctx context.Context, tok *oauth2.Token) (*Use
 }
 
 func NewKakaoProvider(ext conf.OAuthProviderConfiguration, scopes string) (OAuthProvider, error) {
-	if err := ext.Validate(); err != nil {
+	if err := ext.ValidateOAuth(); err != nil {
 		return nil, err
 	}
 
@@ -90,7 +90,7 @@ func NewKakaoProvider(ext conf.OAuthProviderConfiguration, scopes string) (OAuth
 
 	return &kakaoProvider{
 		Config: &oauth2.Config{
-			ClientID:     ext.ClientID,
+			ClientID:     ext.ClientID[0],
 			ClientSecret: ext.Secret,
 			Endpoint: oauth2.Endpoint{
 				AuthStyle: oauth2.AuthStyleInParams,
diff --git a/internal/api/provider/keycloak.go b/internal/api/provider/keycloak.go
@@ -24,7 +24,7 @@ type keycloakUser struct {
 
 // NewKeycloakProvider creates a Keycloak account provider.
 func NewKeycloakProvider(ext conf.OAuthProviderConfiguration, scopes string) (OAuthProvider, error) {
-	if err := ext.Validate(); err != nil {
+	if err := ext.ValidateOAuth(); err != nil {
 		return nil, err
 	}
 
@@ -48,7 +48,7 @@ func NewKeycloakProvider(ext conf.OAuthProviderConfiguration, scopes string) (OA
 
 	return &keycloakProvider{
 		Config: &oauth2.Config{
-			ClientID:     ext.ClientID,
+			ClientID:     ext.ClientID[0],
 			ClientSecret: ext.Secret,
 			Endpoint: oauth2.Endpoint{
 				AuthURL:  ext.URL + "/protocol/openid-connect/auth",
diff --git a/internal/api/provider/linkedin.go b/internal/api/provider/linkedin.go
@@ -68,7 +68,7 @@ type linkedinElements struct {
 
 // NewLinkedinProvider creates a Linkedin account provider.
 func NewLinkedinProvider(ext conf.OAuthProviderConfiguration, scopes string) (OAuthProvider, error) {
-	if err := ext.Validate(); err != nil {
+	if err := ext.ValidateOAuth(); err != nil {
 		return nil, err
 	}
 
@@ -85,7 +85,7 @@ func NewLinkedinProvider(ext conf.OAuthProviderConfiguration, scopes string) (OA
 
 	return &linkedinProvider{
 		Config: &oauth2.Config{
-			ClientID:     ext.ClientID,
+			ClientID:     ext.ClientID[0],
 			ClientSecret: ext.Secret,
 			Endpoint: oauth2.Endpoint{
 				AuthURL:  apiPath + "/oauth/v2/authorization",
diff --git a/internal/api/provider/notion.go b/internal/api/provider/notion.go
diff --git a/internal/api/provider/slack.go b/internal/api/provider/slack.go
diff --git a/internal/api/provider/spotify.go b/internal/api/provider/spotify.go
diff --git a/internal/api/provider/twitch.go b/internal/api/provider/twitch.go
diff --git a/internal/api/provider/twitter.go b/internal/api/provider/twitter.go
diff --git a/internal/api/provider/workos.go b/internal/api/provider/workos.go
diff --git a/internal/api/provider/zoom.go b/internal/api/provider/zoom.go
diff --git a/internal/api/token_oidc.go b/internal/api/token_oidc.go
diff --git a/internal/conf/configuration.go b/internal/conf/configuration.go
