githubauthorizationhandler.go

package cocopilot

import (
	"context"
	"fmt"
	"net"
	"net/http"
	"os"
	"time"

	"github.com/pkg/browser"
	"golang.org/x/oauth2/authhandler"
)

const (
	httpTimeout time.Duration = 30 * time.Second
)

var _ authhandler.AuthorizationHandler = (*GithubDeviceAuthGrantFlowHandler)(
	nil,
).AuthorizationHandler

type (
	// Code The authorization code generated by the authorization server.
	// See https://www.rfc-editor.org/rfc/rfc6749#section-4.1.2
	Code = string
	// State opaque value used by the client to maintain state between the request
	// and callback.
	// See https://www.rfc-editor.org/rfc/rfc6749#section-4.1.1
	State = string
)

// GithubDeviceAuthGrantFlowHandler implements an OAuth 2.0 Device Authorization
// Grant flow handler with GitHub-flavored specifics. It creates a listener and
// HTTP server to handle the callback.
//
//nolint:containedctx // unfortunately [authhandler.AuthorizationHandler] doesn't take a context
type GithubDeviceAuthGrantFlowHandler struct {
	context.Context
	result chan *AuthorizationResponse
}

// AuthorizationHandler initiates an authorization flow by running a HTTP server
// and waiting for a callback request.
func (handler *GithubDeviceAuthGrantFlowHandler) AuthorizationHandler(
	authCodeURL string,
) (Code, State, error) {
	listener, err := net.Listen("tcp4", "127.0.0.1:0")
	if err != nil {
		return "", "", fmt.Errorf("failed to create network listener: %w", err)
	}
	defer listener.Close()

	handler.result = make(chan *AuthorizationResponse, 1)

	server := http.Server{
		ReadTimeout:       httpTimeout,
		ReadHeaderTimeout: httpTimeout,
		BaseContext:       func(_ net.Listener) context.Context { return handler.Context },
		Handler:           http.HandlerFunc(handler.callbackHandler),
	}

	//nolint:errcheck // we don't care about server errors
	go server.Serve(listener)
	defer server.Close()

	err = browser.OpenURL(authCodeURL)
	if err != nil {
		return "", "", fmt.Errorf("failed to open browser: %w", err)
	}

	select {
	case <-handler.Done():
		return "", "", fmt.Errorf(
			"authorization handling halted: %w",
			context.Cause(handler.Context),
		)
	case res := <-handler.result:
		if err := res.Error(); err != nil {
			return "", "", fmt.Errorf("failed to authorize: %w", res.Error())
		}

		return res.Code, res.State, nil
	}
}

func (handler *GithubDeviceAuthGrantFlowHandler) callbackHandler(
	w http.ResponseWriter,
	req *http.Request,
) {
	res := &AuthorizationResponse{
		Code:             req.URL.Query().Get("code"),
		State:            req.URL.Query().Get("state"),
		ErrorCode:        req.URL.Query().Get("error"),
		ErrorDescription: req.URL.Query().Get("error_description"),
		ErrorURI:         req.URL.Query().Get("error_uri"),
	}

	// we play nice and give some status report to the user in their browser
	if err := res.Error(); err != nil {
		http.Error(w, res.Error().Error(), http.StatusInternalServerError)
	} else {
		_, err = w.Write([]byte("Authorized successfully. You can close this tab/window now."))
		if err != nil {
			fmt.Fprintf(os.Stderr, "failed to write callback response: %s", err)
		}
	}

	// flush if supported, otherwise the shutdown prevents a friendly response
	if flusher, ok := w.(http.Flusher); ok {
		flusher.Flush()
	}

	select {
	case <-handler.Done():
		return
	case handler.result <- res:
	}
}