Function newCallbackServer

internal/oauth/callback.go:61–77

newCallbackServer starts a callback server on listener that validates state and reports the result on a buffered channel. The redirect URI always uses localhost so it matches the value registered on the OAuth/GitHub App.

(listener net.Listener, expectedState string)

// and reports the result on a buffered channel. The redirect URI always uses
// localhost so it matches the value registered on the OAuth/GitHub App.
func newCallbackServer(listener net.Listener, expectedState string) *callbackServer {
	cs := &callbackServer{
		server:   &http.Server{ReadHeaderTimeout: 10 * time.Second}, // ReadHeaderTimeout guards against Slowloris.
		listener: listener,
		redirect: fmt.Sprintf("http://localhost:%d/callback", listener.Addr().(*net.TCPAddr).Port),
		results:  make(chan callbackResult, 1),
	}
	cs.server.Handler = cs.handler(expectedState)

	go func() {
		if err := cs.server.Serve(listener); err != nil && err != http.ErrServerClosed {
			cs.report(callbackResult{err: fmt.Errorf("callback server: %w", err)})
		}
	}()

	return cs
}

// handler renders the callback endpoint. It reports the outcome exactly once and
// always shows the user a friendly page.