Method DoDeviceAuthorization

command/oauth/cmd.go:863–952

DoDeviceAuthorization gets a token from the IDP using the OAuth 2.0 Device Authorization Grant. https://datatracker.ietf.org/doc/html/rfc8628

()

// DoDeviceAuthorization gets a token from the IDP using the OAuth 2.0
// Device Authorization Grant. https://datatracker.ietf.org/doc/html/rfc8628
func (o *oauth) DoDeviceAuthorization() (*token, error) {
	// Identify the Device
	data := url.Values{}
	data.Set("client_id", o.clientID)
	data.Set("client_secret", o.clientSecret)
	data.Set("scope", o.scope)

	resp, err := postForm(o.deviceAuthzEndpoint, data)
	if err != nil {
		return nil, errors.Wrap(err, "http failure to identify device")
	}
	defer resp.Body.Close()
	b, err := io.ReadAll(resp.Body)
	if err != nil {
		return nil, err
	}

	if resp.StatusCode >= 400 {
		var e struct {
			Error string
		}
		if err := json.NewDecoder(bytes.NewReader(b)).Decode(&e); err != nil {
			return nil, errors.Wrapf(err, "could not parse http body: %s", string(b))
		}
	}

	var idr identifyDeviceResponse
	if err := json.NewDecoder(bytes.NewReader(b)).Decode(&idr); err != nil {
		return nil, errors.Wrap(err, "failure decoding device authz response to JSON")
	}

	shouldPrintCode := true
	switch {
	case idr.VerificationURIComplete != "":
		// Prefer VerificationURIComplete if present for user convenience
		idr.VerificationURI = idr.VerificationURIComplete
		shouldPrintCode = false
	case idr.VerificationURI != "":
		// do nothing
	case idr.VerificationURL != "":
		// NOTE this is a hack for Google, because their API returns the attribute
		// 'verification_url` rather than `verification_uri`.
		idr.VerificationURI = idr.VerificationURL
	default:
		return nil, errors.Errorf("device code response from server missing 'verification_uri' parameter. http body response: %s", string(b))
	}

	if idr.Interval <= 0 {
		idr.Interval = defaultDeviceAuthzInterval
	}

	if shouldPrintCode {
		fmt.Fprintf(os.Stderr, "Visit %s and enter the code:\n", idr.VerificationURI)
		fmt.Fprintln(os.Stderr, idr.UserCode)
	} else {
		fmt.Fprintf(os.Stderr, "Visit %s:\n", idr.VerificationURI)
	}