Add OAuth2/OpenID Connect authorization server

Implement a full OAuth2 2.0 and OpenID Connect 1.0 authorization
server with support for authorization code flow (with PKCE),
refresh token rotation, device authorization grant, dynamic
client registration, token introspection, and token revocation.

Includes database schema, coredata layer, service logic, HTTP
handlers, OIDC discovery endpoint, and JWKS publishing.

Signed-off-by: Bryan Frimin <bryan@getprobo.com>

pkg/server/api/connect/v1/oauth2_resolvers.go

@@ -0,0 +1,126 @@
+package connect_v1
+
+// This file will be automatically regenerated based on the schema, any resolver
+// implementations
+// will be copied through when generating and any unknown code will be moved to the end.
+// Code generated by github.com/99designs/gqlgen version v0.17.87
+
+import (
+	"context"
+	"errors"
+	"net/url"
+	"strings"
+
+	"go.gearno.de/kit/log"
+	"go.probo.inc/probo/pkg/iam/oauth2server"
+	"go.probo.inc/probo/pkg/server/api/authn"
+	"go.probo.inc/probo/pkg/server/api/connect/v1/schema"
+	"go.probo.inc/probo/pkg/server/api/connect/v1/types"
+	"go.probo.inc/probo/pkg/server/gqlutils"
+)
+
+// Application is the resolver for the application field.
+func (r *consentResolver) Application(ctx context.Context, obj *types.Consent) (*types.Application, error) {
+	client, err := r.iam.OAuth2ServerService.GetClientByID(ctx, obj.Application.ID)
+	if err != nil {
+		r.logger.ErrorCtx(ctx, "cannot load oauth2 client", log.Error(err))
+		return nil, gqlutils.Internal(ctx)
+	}
+
+	return types.NewApplication(client), nil
+}
+
+// AuthorizeDevice is the resolver for the authorizeDevice field.
+func (r *mutationResolver) AuthorizeDevice(ctx context.Context, input types.AuthorizeDeviceInput) (*types.AuthorizeDevicePayload, error) {
+	identity := authn.IdentityFromContext(ctx)
+	session := authn.SessionFromContext(ctx)
+
+	userCode := strings.ToUpper(strings.TrimSpace(strings.ReplaceAll(input.UserCode, "-", "")))
+
+	err := r.iam.OAuth2ServerService.AuthorizeDevice(ctx, identity.ID, session.ID, userCode)
+	if err != nil {
+		if consentErr, ok := errors.AsType[*oauth2server.ConsentRequiredError](err); ok {
+			return &types.AuthorizeDevicePayload{
+				ConsentID: &consentErr.ConsentID,
+			}, nil
+		}
+
+		if oauthErr, ok := errors.AsType[*oauth2server.OAuth2Error](err); ok {
+			return nil, gqlutils.Invalidf(ctx, "%s", oauthErr.Description())
+		}
+
+		r.logger.ErrorCtx(ctx, "cannot authorize device", log.Error(err))
+		return nil, gqlutils.Internal(ctx)
+	}
+
+	return &types.AuthorizeDevicePayload{
+		Success: true,
+	}, nil
+}
+
+// ApproveConsent is the resolver for the approveConsent field.
+func (r *mutationResolver) ApproveConsent(ctx context.Context, input types.ApproveConsentInput) (*types.ApproveConsentPayload, error) {
+	identity := authn.IdentityFromContext(ctx)
+	session := authn.SessionFromContext(ctx)
+
+	result, err := r.iam.OAuth2ServerService.ApproveConsent(
+		ctx,
+		&oauth2server.ConsentApprovalRequest{
+			ConsentID:  input.ConsentID,
+			IdentityID: identity.ID,
+			SessionID:  session.ID,
+			Approved:   input.Approved,
+			AuthTime:   session.CreatedAt,
+		},
+	)
+	if err != nil {
+		r.logger.ErrorCtx(ctx, "cannot approve oauth2 consent", log.Error(err))
+		return nil, gqlutils.Internal(ctx)
+	}
+
+	if result.Denied {
+		if result.IsDeviceFlow {
+			return &types.ApproveConsentPayload{
+				DeviceAuthorized: new(false),
+			}, nil
+		}
+
+		u, _ := url.Parse(result.RedirectURI)
+		q := u.Query()
+		q.Set("error", "access_denied")
+		q.Set("error_description", "user denied the request")
+		if result.State != "" {
+			q.Set("state", result.State)
+		}
+		u.RawQuery = q.Encode()
+
+		redirectURL := u.String()
+		return &types.ApproveConsentPayload{
+			RedirectURL: &redirectURL,
+		}, nil
+	}
+
+	if result.IsDeviceFlow {
+		return &types.ApproveConsentPayload{
+			DeviceAuthorized: new(true),
+		}, nil
+	}
+
+	u, _ := url.Parse(result.RedirectURI)
+	q := u.Query()
+	q.Set("code", result.Code)
+	if result.State != "" {
+		q.Set("state", result.State)
+	}
+	u.RawQuery = q.Encode()
+
+	redirectURL := u.String()
+	return &types.ApproveConsentPayload{
+		RedirectURL: &redirectURL,
+	}, nil
+}
+
+// Consent returns schema.ConsentResolver implementation.
+func (r *Resolver) Consent() schema.ConsentResolver { return &consentResolver{r} }
+
+type consentResolver struct{ *Resolver }