Skip to content

feat(auth): support OAuth device authorization - #4962

Open
huanghongbo-hhb wants to merge 12 commits into
koderover:mainfrom
huanghongbo-hhb:feat/oauth-device-authorization
Open

feat(auth): support OAuth device authorization#4962
huanghongbo-hhb wants to merge 12 commits into
koderover:mainfrom
huanghongbo-hhb:feat/oauth-device-authorization

Conversation

@huanghongbo-hhb

@huanghongbo-hhb huanghongbo-hhb commented Sep 1, 2026

Copy link
Copy Markdown
Contributor

Summary

  • Add OAuth Device Authorization for Zadig CLI.

Main Changes

  • Add device authorization, token exchange/refresh, and revocation endpoints.
  • Issue short-lived CLI access tokens backed by revocable Redis sessions.
  • Revoke sessions on password, MFA, and user deletion security changes.
  • Keep OAuth credentials out of ext-authz request logs.

Compatibility

  • Existing Web and API Tokens are unchanged; only cli_access tokens use OAuth session validation.

Test


This change is Reviewable

Signed-off-by: huanghongbo-hhb <huanghongbo@koderover.com>
Signed-off-by: huanghongbo-hhb <huanghongbo@koderover.com>
Signed-off-by: huanghongbo-hhb <huanghongbo@koderover.com>
Signed-off-by: huanghongbo-hhb <huanghongbo@koderover.com>
Signed-off-by: huanghongbo-hhb <huanghongbo@koderover.com>
Signed-off-by: huanghongbo-hhb <huanghongbo@koderover.com>
Signed-off-by: huanghongbo-hhb <huanghongbo@koderover.com>
Signed-off-by: huanghongbo-hhb <huanghongbo@koderover.com>
Comment thread pkg/tool/cache/redis_cache.go Outdated
return c.redisClient.Get(context.TODO(), key).Result()
}

func (c *RedisCache) TakeString(key string) (string, error) {

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

这里用GetDelString就行

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

已经改好了

Comment thread pkg/tool/cache/redis_cache.go Outdated
return err
}

func (c *RedisCache) WriteIfNotExists(key, val string, ttl time.Duration) (bool, error) {

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

这上面不是有SETNX的函数吗?

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

已经改好了

)

func (s *engine) injectRouterGroup(router *gin.RouterGroup) {
new(handler.OAuthRouter).Inject(router)

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

这个最好应该跟下面的handler.Router放一起

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

已经改好了

Signed-off-by: huanghongbo-hhb <huanghongbo@koderover.com>
…uthorization

# Conflicts:
#	pkg/microservice/user/core/service/permission/authn.go
#	pkg/microservice/user/server/grpc/server.go
Signed-off-by: huanghongbo-hhb <huanghongbo@koderover.com>
@huanghongbo-hhb
huanghongbo-hhb force-pushed the feat/oauth-device-authorization branch from 11c0a02 to 1859b9d Compare September 10, 2026 01:59
Signed-off-by: huanghongbo-hhb <huanghongbo@koderover.com>
@huanghongbo-hhb
huanghongbo-hhb force-pushed the feat/oauth-device-authorization branch from 9b43da1 to 75c0fbb Compare September 11, 2026 06:46
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants