rohit/probo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add OAuth2/OpenID Connect authorization server

Browse Source 
Implement a full OAuth2 2.0 and OpenID Connect 1.0 authorization
server with support for authorization code flow (with PKCE),
refresh token rotation, device authorization grant, dynamic
client registration, token introspection, and token revocation.

Includes database schema, coredata layer, service logic, HTTP
handlers, OIDC discovery endpoint, and JWKS publishing.

Signed-off-by: Bryan Frimin <bryan@getprobo.com>
This commit is contained in:
Bryan Frimin
2026-03-30 14:49:18 +02:00
parent e84094e62c
commit 11770b4058
155 changed files with 14483 additions and 223 deletions
Download Patch File Download Diff File Expand all files Collapse all files

61
e2e/internal/factory/factory.go
View File

@@ -17,6 +17,7 @@ package factory
import (
"fmt"
"maps"
"strings"
"github.com/brianvoe/gofakeit/v7"
@@ -1217,3 +1218,63 @@ func CreateApplicabilityStatement(c *testutil.Client, soaID, controlID string, a
return result.CreateApplicabilityStatement.ApplicabilityStatementEdge.Node.ID
}
type OAuth2ClientResult struct {
ClientID string
ClientSecret string
}
func CreateOAuth2Client(c *testutil.Client, attrs Attrs) OAuth2ClientResult {
input := map[string]any{
"organization_id": c.GetOrganizationID().String(),
"client_name": SafeName("OAuth2 Client"),
"visibility": "private",
"redirect_uris": []string{"http://localhost:9999/callback"},
"grant_types": []string{
"authorization_code",
"refresh_token",
},
"response_types": []string{"code"},
"token_endpoint_auth_method": "client_secret_basic",
"scopes": "openid email profile offline_access",
}
maps.Copy(input, attrs)
resp, raw, err := testutil.OAuth2RegisterClient(c, input)
require.NoError(c.T, err, "OAuth2 client registration failed")
require.NotNil(c.T, resp, "OAuth2 client registration returned nil (status=%d body=%s)", raw.StatusCode, string(raw.Body))
return OAuth2ClientResult{
ClientID: resp.ClientID,
ClientSecret: resp.ClientSecret,
}
}
func CreatePublicOAuth2Client(c *testutil.Client, attrs Attrs) OAuth2ClientResult {
input := map[string]any{
"organization_id": c.GetOrganizationID().String(),
"client_name": SafeName("Public OAuth2 Client"),
"visibility": "private",
"redirect_uris": []string{"http://localhost:9999/callback"},
"grant_types": []string{
"authorization_code",
"refresh_token",
"urn:ietf:params:oauth:grant-type:device_code",
},
"response_types": []string{"code"},
"token_endpoint_auth_method": "none",
"scopes": "openid email profile offline_access",
}
maps.Copy(input, attrs)
resp, raw, err := testutil.OAuth2RegisterClient(c, input)
require.NoError(c.T, err, "public OAuth2 client registration failed")
require.NotNil(c.T, resp, "public OAuth2 client registration returned nil (status=%d body=%s)", raw.StatusCode, string(raw.Body))
return OAuth2ClientResult{
ClientID: resp.ClientID,
ClientSecret: resp.ClientSecret,
}
}