actually do some OAuth

auth/auth.go

@@ -1,18 +1,59 @@
 package auth
 
 import (
+	"crypto/rand"
+	"encoding/base64"
 	"fmt"
+	"net/http"
 
 	"astraltech.xyz/calendar/v2/webserver"
+	"golang.org/x/oauth2"
 )
 
+func generateState() (string, error) {
+	b := make([]byte, 32)
+	if _, err := rand.Read(b); err != nil {
+		return "", err
+	}
+	return base64.RawURLEncoding.EncodeToString(b), nil
+}
+
 func HandlePasswordAuth(authData webserver.PasswordAuthData) bool {
 	fmt.Printf("%s, %s\n", authData.Username, authData.Password)
 	return false
 }
 
 func HandleOAuth(authData webserver.OAuthAuthData) bool {
-	fmt.Printf("doing an OAuth")
+	state, err := generateState()
+	if err != nil {
+		http.Error(*authData.ResponseWriter, "Failed to generate state", http.StatusInternalServerError)
+		return false
+	}
+	verifier := oauth2.GenerateVerifier()
+
+	http.SetCookie(*authData.ResponseWriter, &http.Cookie{
+		Name:     "oauth_state",
+		Value:    state,
+		Path:     "/",
+		MaxAge:   300,
+		HttpOnly: true,
+		SameSite: http.SameSiteLaxMode,
+	})
+
+	http.SetCookie(*authData.ResponseWriter, &http.Cookie{
+		Name:     "pkce_verifier",
+		Value:    verifier,
+		Path:     "/",
+		HttpOnly: true,
+		SameSite: http.SameSiteLaxMode,
+	})
+
+	url := OAuthConfigs[0].AuthCodeURL(
+		state,
+		oauth2.S256ChallengeOption(verifier),
+	)
+	http.Redirect(*authData.ResponseWriter, authData.Request, url, http.StatusFound)
+
 	return false
 }
 

auth/oauth.go

@@ -1,22 +1,31 @@
 package auth
 
 import (
+	"context"
+
+	"github.com/coreos/go-oidc/v3/oidc"
 	"golang.org/x/oauth2"
 )
 
-var oauthConfigs []oauth2.Config
+var OAuthConfigs []oauth2.Config
 
 func CreateTestOAuth() {
-	oauthEndpoint := oauth2.Endpoint{
-		AuthURL:  "https://account.astraltech.xyz/application/o/authorize/",
-		TokenURL: "https://account.astraltech.xyz/application/o/token/",
+	ctx := context.Background()
+
+	provider, err := oidc.NewProvider(ctx, "https://account.astraltech.xyz/application/o/stalwart/")
+	if err != nil {
+		panic(err)
 	}
 
 	oauthConfig := oauth2.Config{
 		ClientID:    "stalwart-webui",
-		Scopes:      []string{"openid", "profile", "email"},
-		Endpoint:    oauthEndpoint,
 		RedirectURL: "http://localhost:8080/callback",
+		Endpoint:    provider.Endpoint(),
+		Scopes: []string{
+			oidc.ScopeOpenID,
+			"profile",
+			"email",
+		},
 	}
-	oauthConfigs = append(oauthConfigs, oauthConfig)
+	OAuthConfigs = append(OAuthConfigs, oauthConfig)
 }

auth/oauth_callback.go

@@ -1,8 +1,11 @@
 package auth
 
-import "net/http"
+import (
+	"fmt"
+	"net/http"
+)
 
 // this is usually served at /callback
 func OAuthCallback(w http.ResponseWriter, r *http.Request) {
-
+	fmt.Printf("Getting my OAuth callback")
 }