[server] add vscode(-insiders) ouath2 clients

components/server/src/oauth-server/db.ts

@@ -17,7 +17,7 @@ export interface InMemory {
 }
 
 // Scopes
-const scopes: OAuthScope[] = [
+const localAppScopes: OAuthScope[] = [
   { name: "function:getGitpodTokenScopes" },
   { name: "function:getWorkspace" },
   { name: "function:getWorkspaces" },
@@ -35,16 +35,39 @@ const localClient: OAuthClient = {
   // NOTE: these need to be kept in sync with the port range in the local app
   redirectUris: Array.from({ length: 10 }, (_, i) => 'http://127.0.0.1:' + (63110 + i)),
   allowedGrants: ['authorization_code'],
-  scopes,
+  scopes: localAppScopes,
 }
 
+function createVSCodeClient(protocol: 'vscode' | 'vscode-insiders'): OAuthClient {
+  return {
+    id: protocol + '-' + 'gitpod',
+    name: `VS Code${protocol === 'vscode-insiders' ? ' Insiders' : ''}: Gitpod`,
+    redirectUris: [protocol + '://gitpod.gitpod-desktop/complete-gitpod-auth'],
+    allowedGrants: ['authorization_code'],
+    scopes: [
+      { name: "function:getGitpodTokenScopes" },
+      { name: "function:getLoggedInUser" },
+      { name: "function:accessCodeSyncStorage" },
+      { name: "resource:default" }
+    ],
+  }
+}
+
+const vscode = createVSCodeClient('vscode');
+const vscodeInsiders = createVSCodeClient('vscode-insiders');
+
 export const inMemoryDatabase: InMemory = {
   clients: {
     [localClient.id]: localClient,
+    [vscode.id]: vscode,
+    [vscodeInsiders.id]: vscodeInsiders
   },
   tokens: {},
   scopes: {},
 };
-for (const scope of scopes) {
-  inMemoryDatabase.scopes[scope.name] = scope;
+for (const clientId in inMemoryDatabase.clients) {
+  const client = inMemoryDatabase.clients[clientId];
+  for (const scope of client.scopes) {
+    inMemoryDatabase.scopes[scope.name] = scope;
+  }
 }

components/server/src/oauth-server/oauth-controller.ts

@@ -11,6 +11,7 @@ import { log } from '@gitpod/gitpod-protocol/lib/util/logging';
 import { OAuthException, OAuthRequest, OAuthResponse } from "@jmondi/oauth2-server";
 import * as express from 'express';
 import { inject, injectable } from "inversify";
+import { URL } from 'url';
 import { Config } from '../config';
 import { clientRepository, createAuthorizationServer } from './oauth-authorization-server';
 
@@ -50,8 +51,10 @@ export class OAuthController {
             }
 
             // Let the local app know they rejected the approval
-            const rt = req.query.redirect_uri;
-            if (!rt || !rt.startsWith("http://127.0.0.1:")) {
+            const rt: string = req.query.redirect_uri;
+            const redirectURLObject = new URL(rt);
+
+            if (!rt || !rt.startsWith("http://127.0.0.1:") || !(['vscode:', 'vscode-insiders:'].includes(redirectURLObject.protocol) && redirectURLObject.pathname !== '//gitpod.gitpod-desktop/complete-gitpod-auth')) {
                 log.error(`/oauth/authorize: invalid returnTo URL: "${rt}"`)
                 res.sendStatus(400);
                 return false;