This pull request implements RFC 8707, Resource Indicators for OAuth 2.0 (https://datatracker.ietf.org/doc/html/rfc8707), to enhance the security of our OAuth 2.0 provider.

This change enables proper audience validation and binds access tokens to their intended resource, which is crucial
for preventing token misuse in multi-tenant environments or deployments with multiple resource servers.

Key Changes:

• Resource Parameter Support: Adds support for the resource parameter in both the authorization (/oauth2/authorize) and token (/oauth2/token) endpoints, allowing clients to specify the intended resource server.
• Audience Validation: Implements server-side validation to ensure that the resource parameter provided during the token exchange matches the one from the authorization request.
• API Middleware Enforcement: Introduces a new validation step in the API authentication middleware (coderd/httpmw/apikey.go) to verify that the audience of the access token matches the resource server being accessed.
• Database Schema Updates:
  • Adds a resource_uri column to the oauth2_provider_app_codes table to store the resource requested during authorization.
  • Adds an audience column to the oauth2_provider_app_tokens table to bind the issued token to a specific audience.
• Enhanced PKCE: Includes a minor enhancement to the PKCE implementation to protect against timing attacks.
• Comprehensive Testing: Adds extensive new tests to coderd/oauth2_test.go to cover various RFC 8707 scenarios, including valid flows, mismatched resources, and refresh token validation.

How it Works:

1. An OAuth2 client specifies the target resource (e.g., https://coder.example.com) using the resource parameter in the authorization request.
2. The authorization server stores this resource URI with the authorization code.
3. During the token exchange, the server validates that the client provides the same resource parameter.
4. The server issues an access token with an audience claim set to the validated resource URI.
5. When the client uses the access token to call an API endpoint, the middleware verifies that the token's audience matches the URL of the Coder deployment, rejecting any tokens intended for a different resource.

This ensures that a token issued for one Coder deployment cannot be used to access another, significantly strengthening our authentication security.

Change-Id: I3924cb2139e837e3ac0b0bd40a5aeb59637ebc1b
Signed-off-by: Thomas Kosiewski [email protected]