package codersdk

import (

"context"

"crypto/sha256"

"encoding/json"

"fmt"

"net/http"

"net/url"

"strings"

"time"

"github.com/google/uuid"

)

type OAuth2ProviderApp struct {

ID uuid.UUID `json:"id" format:"uuid"`

Name string `json:"name"`

CallbackURL string `json:"callback_url"`

Icon string `json:"icon"`

// Endpoints are included in the app response for easier discovery. The OAuth2

// spec does not have a defined place to find these (for comparison, OIDC has

// a '/.well-known/openid-configuration' endpoint).

Endpoints OAuth2AppEndpoints `json:"endpoints"`

}

type OAuth2AppEndpoints struct {

Authorization string `json:"authorization"`

Token string `json:"token"`

TokenRevoke string `json:"token_revoke"`

// DeviceAuth is optional.

DeviceAuth string `json:"device_authorization"`

}

type OAuth2ProviderAppFilter struct {

UserID uuid.UUID `json:"user_id,omitempty" format:"uuid"`

}

// OAuth2ProviderApps returns the applications configured to authenticate using

// Coder as an OAuth2 provider.

func (c *Client) OAuth2ProviderApps(ctx context.Context, filter OAuth2ProviderAppFilter) ([]OAuth2ProviderApp, error) {

res, err := c.Request(ctx, http.MethodGet, "/api/v2/oauth2-provider/apps", nil,

func(r *http.Request) {

if filter.UserID != uuid.Nil {

q := r.URL.Query()

q.Set("user_id", filter.UserID.String())

r.URL.RawQuery = q.Encode()

}

})

if err != nil {

return []OAuth2ProviderApp{}, err

}

defer res.Body.Close()

if res.StatusCode != http.StatusOK {

return []OAuth2ProviderApp{}, ReadBodyAsError(res)

}

var apps []OAuth2ProviderApp

return apps, json.NewDecoder(res.Body).Decode(&apps)

}

// OAuth2ProviderApp returns an application configured to authenticate using

// Coder as an OAuth2 provider.

func (c *Client) OAuth2ProviderApp(ctx context.Context, id uuid.UUID) (OAuth2ProviderApp, error) {

res, err := c.Request(ctx, http.MethodGet, fmt.Sprintf("/api/v2/oauth2-provider/apps/%s", id), nil)

if err != nil {

return OAuth2ProviderApp{}, err

}

defer res.Body.Close()

if res.StatusCode != http.StatusOK {

return OAuth2ProviderApp{}, ReadBodyAsError(res)

}

var apps OAuth2ProviderApp

return apps, json.NewDecoder(res.Body).Decode(&apps)

}

type PostOAuth2ProviderAppRequest struct {

Name string `json:"name" validate:"required,oauth2_app_name"`

CallbackURL string `json:"callback_url" validate:"required,http_url"`

Icon string `json:"icon" validate:"omitempty"`

}

// PostOAuth2ProviderApp adds an application that can authenticate using Coder

// as an OAuth2 provider.

func (c *Client) PostOAuth2ProviderApp(ctx context.Context, app PostOAuth2ProviderAppRequest) (OAuth2ProviderApp, error) {

res, err := c.Request(ctx, http.MethodPost, "/api/v2/oauth2-provider/apps", app)

if err != nil {

return OAuth2ProviderApp{}, err

}

defer res.Body.Close()

if res.StatusCode != http.StatusCreated {

return OAuth2ProviderApp{}, ReadBodyAsError(res)

}

var resp OAuth2ProviderApp

return resp, json.NewDecoder(res.Body).Decode(&resp)

}

type PutOAuth2ProviderAppRequest struct {

Name string `json:"name" validate:"required,oauth2_app_name"`

CallbackURL string `json:"callback_url" validate:"required,http_url"`

Icon string `json:"icon" validate:"omitempty"`

}

// PutOAuth2ProviderApp updates an application that can authenticate using Coder

// as an OAuth2 provider.

func (c *Client) PutOAuth2ProviderApp(ctx context.Context, id uuid.UUID, app PutOAuth2ProviderAppRequest) (OAuth2ProviderApp, error) {

res, err := c.Request(ctx, http.MethodPut, fmt.Sprintf("/api/v2/oauth2-provider/apps/%s", id), app)

if err != nil {

return OAuth2ProviderApp{}, err

}

defer res.Body.Close()

if res.StatusCode != http.StatusOK {

return OAuth2ProviderApp{}, ReadBodyAsError(res)

}

var resp OAuth2ProviderApp

return resp, json.NewDecoder(res.Body).Decode(&resp)

}

// DeleteOAuth2ProviderApp deletes an application, also invalidating any tokens

// that were generated from it.

func (c *Client) DeleteOAuth2ProviderApp(ctx context.Context, id uuid.UUID) error {

res, err := c.Request(ctx, http.MethodDelete, fmt.Sprintf("/api/v2/oauth2-provider/apps/%s", id), nil)

if err != nil {

return err

}

defer res.Body.Close()

if res.StatusCode != http.StatusNoContent {

return ReadBodyAsError(res)

}

return nil

}

type OAuth2ProviderAppSecretFull struct {

ID uuid.UUID `json:"id" format:"uuid"`

ClientSecretFull string `json:"client_secret_full"`

}

type OAuth2ProviderAppSecret struct {

ID uuid.UUID `json:"id" format:"uuid"`

LastUsedAt NullTime `json:"last_used_at"`

ClientSecretTruncated string `json:"client_secret_truncated"`

}

// OAuth2ProviderAppSecrets returns the truncated secrets for an OAuth2

// application.

func (c *Client) OAuth2ProviderAppSecrets(ctx context.Context, appID uuid.UUID) ([]OAuth2ProviderAppSecret, error) {

res, err := c.Request(ctx, http.MethodGet, fmt.Sprintf("/api/v2/oauth2-provider/apps/%s/secrets", appID), nil)

if err != nil {

return []OAuth2ProviderAppSecret{}, err

}

defer res.Body.Close()

if res.StatusCode != http.StatusOK {

return []OAuth2ProviderAppSecret{}, ReadBodyAsError(res)

}

var resp []OAuth2ProviderAppSecret

return resp, json.NewDecoder(res.Body).Decode(&resp)

}

// PostOAuth2ProviderAppSecret creates a new secret for an OAuth2 application.

// This is the only time the full secret will be revealed.

func (c *Client) PostOAuth2ProviderAppSecret(ctx context.Context, appID uuid.UUID) (OAuth2ProviderAppSecretFull, error) {

res, err := c.Request(ctx, http.MethodPost, fmt.Sprintf("/api/v2/oauth2-provider/apps/%s/secrets", appID), nil)

if err != nil {

return OAuth2ProviderAppSecretFull{}, err

}

defer res.Body.Close()

if res.StatusCode != http.StatusCreated {

return OAuth2ProviderAppSecretFull{}, ReadBodyAsError(res)

}

var resp OAuth2ProviderAppSecretFull

return resp, json.NewDecoder(res.Body).Decode(&resp)

}

// DeleteOAuth2ProviderAppSecret deletes a secret from an OAuth2 application,

// also invalidating any tokens that generated from it.

func (c *Client) DeleteOAuth2ProviderAppSecret(ctx context.Context, appID uuid.UUID, secretID uuid.UUID) error {

res, err := c.Request(ctx, http.MethodDelete, fmt.Sprintf("/api/v2/oauth2-provider/apps/%s/secrets/%s", appID, secretID), nil)

if err != nil {

return err

}

defer res.Body.Close()

if res.StatusCode != http.StatusNoContent {

return ReadBodyAsError(res)

}

return nil

}

type OAuth2ProviderGrantType string

// OAuth2ProviderGrantType values (RFC 6749).

const (

OAuth2ProviderGrantTypeAuthorizationCode OAuth2ProviderGrantType = "authorization_code"

OAuth2ProviderGrantTypeRefreshToken OAuth2ProviderGrantType = "refresh_token"

OAuth2ProviderGrantTypePassword OAuth2ProviderGrantType = "password"

OAuth2ProviderGrantTypeClientCredentials OAuth2ProviderGrantType = "client_credentials"

OAuth2ProviderGrantTypeImplicit OAuth2ProviderGrantType = "implicit"

)

func (e OAuth2ProviderGrantType) Valid() bool {

switch e {

case OAuth2ProviderGrantTypeAuthorizationCode,

OAuth2ProviderGrantTypeRefreshToken,

OAuth2ProviderGrantTypePassword,

OAuth2ProviderGrantTypeClientCredentials,

OAuth2ProviderGrantTypeImplicit:

return true

}

return false

}

type OAuth2ProviderResponseType string

// OAuth2ProviderResponseType values (RFC 6749).

const (

OAuth2ProviderResponseTypeCode OAuth2ProviderResponseType = "code"

OAuth2ProviderResponseTypeToken OAuth2ProviderResponseType = "token"

)

func (e OAuth2ProviderResponseType) Valid() bool {

return e == OAuth2ProviderResponseTypeCode || e == OAuth2ProviderResponseTypeToken

}

type OAuth2TokenEndpointAuthMethod string

const (

OAuth2TokenEndpointAuthMethodClientSecretBasic OAuth2TokenEndpointAuthMethod = "client_secret_basic"

OAuth2TokenEndpointAuthMethodClientSecretPost OAuth2TokenEndpointAuthMethod = "client_secret_post"

OAuth2TokenEndpointAuthMethodNone OAuth2TokenEndpointAuthMethod = "none"

)

func (m OAuth2TokenEndpointAuthMethod) Valid() bool {

switch m {

case OAuth2TokenEndpointAuthMethodClientSecretBasic,

OAuth2TokenEndpointAuthMethodClientSecretPost,

OAuth2TokenEndpointAuthMethodNone:

return true

}

return false

}

type OAuth2PKCECodeChallengeMethod string

// OAuth2PKCECodeChallengeMethod values (RFC 7636).

const (

OAuth2PKCECodeChallengeMethodS256 OAuth2PKCECodeChallengeMethod = "S256"

OAuth2PKCECodeChallengeMethodPlain OAuth2PKCECodeChallengeMethod = "plain"

)

func (m OAuth2PKCECodeChallengeMethod) Valid() bool {

switch m {

case OAuth2PKCECodeChallengeMethodS256, OAuth2PKCECodeChallengeMethodPlain:

return true

}

return false

}

type OAuth2TokenType string

// OAuth2TokenType values (RFC 6749, RFC 9449).

const (

OAuth2TokenTypeBearer OAuth2TokenType = "Bearer"

OAuth2TokenTypeDPoP OAuth2TokenType = "DPoP"

)

func (t OAuth2TokenType) Valid() bool {

switch t {

case OAuth2TokenTypeBearer, OAuth2TokenTypeDPoP:

return true

}

return false

}

type OAuth2RevocationTokenTypeHint string

const (

OAuth2RevocationTokenTypeHintAccessToken OAuth2RevocationTokenTypeHint = "access_token"

OAuth2RevocationTokenTypeHintRefreshToken OAuth2RevocationTokenTypeHint = "refresh_token"

)

func (h OAuth2RevocationTokenTypeHint) Valid() bool {

switch h {

case OAuth2RevocationTokenTypeHintAccessToken, OAuth2RevocationTokenTypeHintRefreshToken:

return true

}

return false

}

type OAuth2ErrorCode string

// OAuth2 error codes per RFC 6749, RFC 7009, RFC 8707.

// This is not comprehensive; it includes only codes relevant to this implementation.

const (

// RFC 6749 - Token endpoint errors.

OAuth2ErrorCodeInvalidRequest OAuth2ErrorCode = "invalid_request"

OAuth2ErrorCodeInvalidClient OAuth2ErrorCode = "invalid_client"

OAuth2ErrorCodeInvalidGrant OAuth2ErrorCode = "invalid_grant"

OAuth2ErrorCodeUnauthorizedClient OAuth2ErrorCode = "unauthorized_client"

OAuth2ErrorCodeUnsupportedGrantType OAuth2ErrorCode = "unsupported_grant_type"

OAuth2ErrorCodeInvalidScope OAuth2ErrorCode = "invalid_scope"

// RFC 6749 - Authorization endpoint errors.

OAuth2ErrorCodeAccessDenied OAuth2ErrorCode = "access_denied"

OAuth2ErrorCodeUnsupportedResponseType OAuth2ErrorCode = "unsupported_response_type"

OAuth2ErrorCodeServerError OAuth2ErrorCode = "server_error"

OAuth2ErrorCodeTemporarilyUnavailable OAuth2ErrorCode = "temporarily_unavailable"

// RFC 7009 - Token revocation errors.

OAuth2ErrorCodeUnsupportedTokenType OAuth2ErrorCode = "unsupported_token_type"

// RFC 8707 - Resource indicator errors.

OAuth2ErrorCodeInvalidTarget OAuth2ErrorCode = "invalid_target"

)

func (c OAuth2ErrorCode) Valid() bool {

switch c {

case OAuth2ErrorCodeInvalidRequest,

OAuth2ErrorCodeInvalidClient,

OAuth2ErrorCodeInvalidGrant,

OAuth2ErrorCodeUnauthorizedClient,

OAuth2ErrorCodeUnsupportedGrantType,

OAuth2ErrorCodeInvalidScope,

OAuth2ErrorCodeAccessDenied,

OAuth2ErrorCodeUnsupportedResponseType,

OAuth2ErrorCodeServerError,

OAuth2ErrorCodeTemporarilyUnavailable,

OAuth2ErrorCodeUnsupportedTokenType,

OAuth2ErrorCodeInvalidTarget:

return true

}

return false

}

// OAuth2Error represents an OAuth2-compliant error response per RFC 6749.

type OAuth2Error struct {

Error OAuth2ErrorCode `json:"error"`

ErrorDescription string `json:"error_description,omitempty"`

ErrorURI string `json:"error_uri,omitempty"`

}

// OAuth2TokenRequest represents a token request per RFC 6749. The actual wire

// format is application/x-www-form-urlencoded; this struct is for SDK docs.

type OAuth2TokenRequest struct {

GrantType OAuth2ProviderGrantType `json:"grant_type"`

Code string `json:"code,omitempty"`

RedirectURI string `json:"redirect_uri,omitempty"`

ClientID string `json:"client_id,omitempty"`

ClientSecret string `json:"client_secret,omitempty"`

CodeVerifier string `json:"code_verifier,omitempty"`

RefreshToken string `json:"refresh_token,omitempty"`

Resource string `json:"resource,omitempty"`

Scope string `json:"scope,omitempty"`

}

// OAuth2TokenResponse represents a successful token response per RFC 6749.

type OAuth2TokenResponse struct {

AccessToken string `json:"access_token"`

TokenType OAuth2TokenType `json:"token_type"`

ExpiresIn int64 `json:"expires_in,omitempty"`

RefreshToken string `json:"refresh_token,omitempty"`

Scope string `json:"scope,omitempty"`

// Expiry is not part of RFC 6749 but is included for compatibility with

// golang.org/x/oauth2.Token and clients that expect a timestamp.

Expiry *time.Time `json:"expiry,omitempty" format:"date-time"`

}

// OAuth2TokenRevocationRequest represents a token revocation request per RFC 7009.

type OAuth2TokenRevocationRequest struct {

Token string `json:"token"`

TokenTypeHint OAuth2RevocationTokenTypeHint `json:"token_type_hint,omitempty"`

ClientID string `json:"client_id,omitempty"`

ClientSecret string `json:"client_secret,omitempty"`

}

// RevokeOAuth2Token revokes a specific OAuth2 token using RFC 7009 token revocation.

func (c *Client) RevokeOAuth2Token(ctx context.Context, clientID uuid.UUID, token string) error {

form := url.Values{}

form.Set("token", token)

// Client authentication is handled via the client_id in the app middleware

form.Set("client_id", clientID.String())

res, err := c.Request(ctx, http.MethodPost, "/oauth2/revoke", strings.NewReader(form.Encode()), func(r *http.Request) {

r.Header.Set("Content-Type", "application/x-www-form-urlencoded")

})

if err != nil {

return err

}

defer res.Body.Close()

if res.StatusCode != http.StatusOK {

return ReadBodyAsError(res)

}

return nil

}

// RevokeOAuth2ProviderApp completely revokes an app's access for the

// authenticated user.

func (c *Client) RevokeOAuth2ProviderApp(ctx context.Context, appID uuid.UUID) error {

res, err := c.Request(ctx, http.MethodDelete, "/oauth2/tokens", nil, func(r *http.Request) {

q := r.URL.Query()

q.Set("client_id", appID.String())

r.URL.RawQuery = q.Encode()

})

if err != nil {

return err

}

defer res.Body.Close()

if res.StatusCode != http.StatusNoContent {

return ReadBodyAsError(res)

}

return nil

}

type OAuth2DeviceFlowCallbackResponse struct {

RedirectURL string `json:"redirect_url"`

}

// OAuth2AuthorizationServerMetadata represents RFC 8414 OAuth 2.0 Authorization Server Metadata.

type OAuth2AuthorizationServerMetadata struct {

Issuer string `json:"issuer"`

AuthorizationEndpoint string `json:"authorization_endpoint"`

TokenEndpoint string `json:"token_endpoint"`

RegistrationEndpoint string `json:"registration_endpoint,omitempty"`

RevocationEndpoint string `json:"revocation_endpoint,omitempty"`

ResponseTypesSupported []OAuth2ProviderResponseType `json:"response_types_supported"`

GrantTypesSupported []OAuth2ProviderGrantType `json:"grant_types_supported,omitempty"`

CodeChallengeMethodsSupported []OAuth2PKCECodeChallengeMethod `json:"code_challenge_methods_supported,omitempty"`

ScopesSupported []string `json:"scopes_supported,omitempty"`

TokenEndpointAuthMethodsSupported []OAuth2TokenEndpointAuthMethod `json:"token_endpoint_auth_methods_supported,omitempty"`

}

// OAuth2ProtectedResourceMetadata represents RFC 9728 OAuth 2.0 Protected Resource Metadata

type OAuth2ProtectedResourceMetadata struct {

Resource string `json:"resource"`

AuthorizationServers []string `json:"authorization_servers"`

ScopesSupported []string `json:"scopes_supported,omitempty"`

BearerMethodsSupported []string `json:"bearer_methods_supported,omitempty"`

}

// OAuth2ClientRegistrationRequest represents RFC 7591 Dynamic Client Registration Request.

type OAuth2ClientRegistrationRequest struct {

RedirectURIs []string `json:"redirect_uris,omitempty"`

ClientName string `json:"client_name,omitempty"`

ClientURI string `json:"client_uri,omitempty"`

LogoURI string `json:"logo_uri,omitempty"`

TOSURI string `json:"tos_uri,omitempty"`

PolicyURI string `json:"policy_uri,omitempty"`

JWKSURI string `json:"jwks_uri,omitempty"`

JWKS json.RawMessage `json:"jwks,omitempty" swaggertype:"object"`

SoftwareID string `json:"software_id,omitempty"`

SoftwareVersion string `json:"software_version,omitempty"`

SoftwareStatement string `json:"software_statement,omitempty"`

GrantTypes []OAuth2ProviderGrantType `json:"grant_types,omitempty"`

ResponseTypes []OAuth2ProviderResponseType `json:"response_types,omitempty"`

TokenEndpointAuthMethod OAuth2TokenEndpointAuthMethod `json:"token_endpoint_auth_method,omitempty"`

Scope string `json:"scope,omitempty"`

Contacts []string `json:"contacts,omitempty"`

}

func (req OAuth2ClientRegistrationRequest) ApplyDefaults() OAuth2ClientRegistrationRequest {

// Apply grant type defaults.

if len(req.GrantTypes) == 0 {

req.GrantTypes = []OAuth2ProviderGrantType{

OAuth2ProviderGrantTypeAuthorizationCode,

OAuth2ProviderGrantTypeRefreshToken,

}

}

// Apply response type defaults.

if len(req.ResponseTypes) == 0 {

req.ResponseTypes = []OAuth2ProviderResponseType{

OAuth2ProviderResponseTypeCode,

}

}

// Apply token endpoint auth method default (RFC 7591 section 2).

if req.TokenEndpointAuthMethod == "" {

// Default according to RFC 7591: "client_secret_basic" for confidential clients.

// For public clients, should be explicitly set to "none".

req.TokenEndpointAuthMethod = OAuth2TokenEndpointAuthMethodClientSecretBasic

}

// Apply client name default if not provided.

if req.ClientName == "" {

req.ClientName = "Dynamically Registered Client"

}

return req

}

// DetermineClientType determines if client is public or confidential

func (*OAuth2ClientRegistrationRequest) DetermineClientType() string {

// For now, default to confidential

// In the future, we might detect based on:

// - token_endpoint_auth_method == "none" -> public

// - application_type == "native" -> might be public

// - Other heuristics

return "confidential"

}

// GenerateClientName generates a client name if not provided

func (req *OAuth2ClientRegistrationRequest) GenerateClientName() string {

if req.ClientName != "" {

// Ensure client name fits database constraint (varchar(64))

if len(req.ClientName) > 64 {

// Preserve uniqueness by including a hash of the original name

hash := fmt.Sprintf("%x", sha256.Sum256([]byte(req.ClientName)))[:8]

maxPrefix := 64 - 1 - len(hash) // 1 for separator

return req.ClientName[:maxPrefix] + "-" + hash

}

return req.ClientName

}

// Try to derive from client_uri

if req.ClientURI != "" {

if uri, err := url.Parse(req.ClientURI); err == nil && uri.Host != "" {

name := fmt.Sprintf("Client (%s)", uri.Host)

if len(name) > 64 {

return name[:64]

}

return name

}

}

// Try to derive from first redirect URI

if len(req.RedirectURIs) > 0 {

if uri, err := url.Parse(req.RedirectURIs[0]); err == nil && uri.Host != "" {

name := fmt.Sprintf("Client (%s)", uri.Host)

if len(name) > 64 {

return name[:64]

}

return name

}

}

return "Dynamically Registered Client"

}

// OAuth2ClientRegistrationResponse represents RFC 7591 Dynamic Client Registration Response.

type OAuth2ClientRegistrationResponse struct {

ClientID string `json:"client_id"`

ClientSecret string `json:"client_secret,omitempty"`

ClientIDIssuedAt int64 `json:"client_id_issued_at,omitempty"`

ClientSecretExpiresAt int64 `json:"client_secret_expires_at,omitempty"`

RedirectURIs []string `json:"redirect_uris,omitempty"`

ClientName string `json:"client_name,omitempty"`

ClientURI string `json:"client_uri,omitempty"`

LogoURI string `json:"logo_uri,omitempty"`

TOSURI string `json:"tos_uri,omitempty"`

PolicyURI string `json:"policy_uri,omitempty"`

JWKSURI string `json:"jwks_uri,omitempty"`

JWKS json.RawMessage `json:"jwks,omitempty" swaggertype:"object"`

SoftwareID string `json:"software_id,omitempty"`

SoftwareVersion string `json:"software_version,omitempty"`

GrantTypes []OAuth2ProviderGrantType `json:"grant_types"`

ResponseTypes []OAuth2ProviderResponseType `json:"response_types"`

TokenEndpointAuthMethod OAuth2TokenEndpointAuthMethod `json:"token_endpoint_auth_method"`

Scope string `json:"scope,omitempty"`

Contacts []string `json:"contacts,omitempty"`

RegistrationAccessToken string `json:"registration_access_token"`

RegistrationClientURI string `json:"registration_client_uri"`

}

// PostOAuth2ClientRegistration dynamically registers a new OAuth2 client (RFC 7591)

func (c *Client) PostOAuth2ClientRegistration(ctx context.Context, req OAuth2ClientRegistrationRequest) (OAuth2ClientRegistrationResponse, error) {

res, err := c.Request(ctx, http.MethodPost, "/oauth2/register", req)

if err != nil {

return OAuth2ClientRegistrationResponse{}, err

}

defer res.Body.Close()

if res.StatusCode != http.StatusCreated {

return OAuth2ClientRegistrationResponse{}, ReadBodyAsError(res)

}

var resp OAuth2ClientRegistrationResponse

return resp, json.NewDecoder(res.Body).Decode(&resp)

}

// GetOAuth2ClientConfiguration retrieves client configuration (RFC 7592)

func (c *Client) GetOAuth2ClientConfiguration(ctx context.Context, clientID string, registrationAccessToken string) (OAuth2ClientConfiguration, error) {

res, err := c.Request(ctx, http.MethodGet, fmt.Sprintf("/oauth2/clients/%s", clientID), nil,

func(r *http.Request) {

r.Header.Set("Authorization", "Bearer "+registrationAccessToken)

})

if err != nil {

return OAuth2ClientConfiguration{}, err

}

defer res.Body.Close()

if res.StatusCode != http.StatusOK {

return OAuth2ClientConfiguration{}, ReadBodyAsError(res)

}

var resp OAuth2ClientConfiguration

return resp, json.NewDecoder(res.Body).Decode(&resp)

}

// PutOAuth2ClientConfiguration updates client configuration (RFC 7592)

func (c *Client) PutOAuth2ClientConfiguration(ctx context.Context, clientID string, registrationAccessToken string, req OAuth2ClientRegistrationRequest) (OAuth2ClientConfiguration, error) {

res, err := c.Request(ctx, http.MethodPut, fmt.Sprintf("/oauth2/clients/%s", clientID), req,

func(r *http.Request) {

r.Header.Set("Authorization", "Bearer "+registrationAccessToken)

})

if err != nil {

return OAuth2ClientConfiguration{}, err

}

defer res.Body.Close()

if res.StatusCode != http.StatusOK {

return OAuth2ClientConfiguration{}, ReadBodyAsError(res)

}

var resp OAuth2ClientConfiguration

return resp, json.NewDecoder(res.Body).Decode(&resp)

}

// DeleteOAuth2ClientConfiguration deletes client registration (RFC 7592)

func (c *Client) DeleteOAuth2ClientConfiguration(ctx context.Context, clientID string, registrationAccessToken string) error {

res, err := c.Request(ctx, http.MethodDelete, fmt.Sprintf("/oauth2/clients/%s", clientID), nil,

func(r *http.Request) {

r.Header.Set("Authorization", "Bearer "+registrationAccessToken)

})

if err != nil {

return err

}

defer res.Body.Close()

if res.StatusCode != http.StatusNoContent {

return ReadBodyAsError(res)

}

return nil

}

// OAuth2ClientConfiguration represents RFC 7592 Client Read Response.

type OAuth2ClientConfiguration struct {

ClientID string `json:"client_id"`

ClientIDIssuedAt int64 `json:"client_id_issued_at"`

ClientSecretExpiresAt int64 `json:"client_secret_expires_at,omitempty"`

RedirectURIs []string `json:"redirect_uris,omitempty"`

ClientName string `json:"client_name,omitempty"`

ClientURI string `json:"client_uri,omitempty"`

LogoURI string `json:"logo_uri,omitempty"`

TOSURI string `json:"tos_uri,omitempty"`

PolicyURI string `json:"policy_uri,omitempty"`

JWKSURI string `json:"jwks_uri,omitempty"`

JWKS json.RawMessage `json:"jwks,omitempty" swaggertype:"object"`

SoftwareID string `json:"software_id,omitempty"`

SoftwareVersion string `json:"software_version,omitempty"`

GrantTypes []OAuth2ProviderGrantType `json:"grant_types"`

ResponseTypes []OAuth2ProviderResponseType `json:"response_types"`

TokenEndpointAuthMethod OAuth2TokenEndpointAuthMethod `json:"token_endpoint_auth_method"`

Scope string `json:"scope,omitempty"`

Contacts []string `json:"contacts,omitempty"`

RegistrationAccessToken string `json:"registration_access_token,omitempty"`

RegistrationClientURI string `json:"registration_client_uri"`

}