rohit/probo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Pass OAuth2 scopes to connector at initiate time

Browse Source 
Add an InitiateOptions struct to the Connector interface so each
caller can declare the scopes it needs instead of having them baked
into the connector at registration. The HTTP handler reads repeated
?scope= query parameters from /connectors/initiate and forwards them.

Also restore GOOGLE_WORKSPACE and LINEAR provider definitions which
were silently dropped from the bootstrap config refactor.

Signed-off-by: Aurélien Sibiril <81782+aureliensibiril@users.noreply.github.com>
This commit is contained in:
Aurélien Sibiril
2026-04-07 14:53:09 +02:00
parent 4cc0e31214
commit e006f335b2
6 changed files with 111 additions and 20 deletions
Download Patch File Download Diff File Expand all files Collapse all files

22
pkg/connector/oauth2.go
View File

@@ -44,7 +44,6 @@ type (
ClientID string
ClientSecret string
RedirectURI string
Scopes []string
AuthURL string
TokenURL string
ExtraAuthParams map[string]string // Optional: extra params for auth URL (e.g., access_type=offline for Google)
@@ -98,7 +97,13 @@ func DecodeOAuth2StatePayload(tokenString string) (*statelesstoken.Payload[OAuth
return statelesstoken.DecodePayload[OAuth2State](tokenString)
}
func (c *OAuth2Connector) Initiate(ctx context.Context, provider string, organizationID gid.GID, r *http.Request) (string, error) {
func (c *OAuth2Connector) Initiate(
ctx context.Context,
provider string,
organizationID gid.GID,
opts InitiateOptions,
r *http.Request,
) (string, error) {
stateData := OAuth2State{
OrganizationID: organizationID.String(),
Provider: provider,
@@ -111,12 +116,17 @@ func (c *OAuth2Connector) Initiate(ctx context.Context, provider string, organiz
stateData.ConnectorID = connectorID
}
}
return c.InitiateWithState(ctx, stateData, r)
return c.InitiateWithState(ctx, stateData, opts, r)
}
// InitiateWithState generates an OAuth2 authorization URL with a custom state.
// This allows callers to include additional context (like SCIMBridgeID) in the state.
func (c *OAuth2Connector) InitiateWithState(ctx context.Context, stateData OAuth2State, r *http.Request) (string, error) {
func (c *OAuth2Connector) InitiateWithState(
ctx context.Context,
stateData OAuth2State,
opts InitiateOptions,
r *http.Request,
) (string, error) {
state, err := statelesstoken.NewToken(c.ClientSecret, OAuth2TokenType, OAuth2TokenTTL, stateData)
if err != nil {
return "", fmt.Errorf("cannot create state token: %w", err)
@@ -127,7 +137,9 @@ func (c *OAuth2Connector) InitiateWithState(ctx context.Context, stateData OAuth
authCodeQuery.Set("client_id", c.ClientID)
authCodeQuery.Set("redirect_uri", c.RedirectURI)
authCodeQuery.Set("response_type", "code")
authCodeQuery.Set("scope", strings.Join(c.Scopes, " "))
if len(opts.Scopes) > 0 {
authCodeQuery.Set("scope", strings.Join(opts.Scopes, " "))
}
// Add any extra auth params (e.g., access_type=offline, prompt=consent for Google)
for k, v := range c.ExtraAuthParams {