PKCE flow

[nzoschke]

• Add FlowType option to SignInWithProvider
• If unspecified or Implicit, maintain current behavior
• If PKCE, generate a PKCE code and verifier, add PCKE params to authorize URL, and return verifier
• Add ExchangeCode function to exchange code and verifier for auth token and user
• Add Provider tokens to AuthenticatedDetails

Fixes #13

[nzoschke]

This is working for me with an echo app like the following:

func main() {
    err := godotenv.Load()
    if err != nil {
        log.Fatal("Error loading .env file")
    }

    supabase := supa.CreateClient(os.Getenv("SUPABASE_PUBLIC_URL"), os.Getenv("SUPABASE_PUBLIC_ANON_KEY"))

    e := echo.New()
    e.Use(session.Middleware(sessions.NewCookieStore([]byte(os.Getenv("SESSION_SECRET")))))

    e.GET("/auth/login/spotify", func(c echo.Context) error {
        out, err := supabase.Auth.SignInWithProvider(supa.ProviderSignInOptions{
            Provider:   "spotify",
            RedirectTo: "http://localhost:1323/api/auth/callback",
            Scopes:     []string{"user-read-email", "user-read-private"},
            FlowType:   supa.PKCE,
        })
        if err != nil {
            return xerrors.Errorf(": %w", err)
        }

        // save verifier to session to get back on callback
        sess, err := session.Get("session", c)
        if err != nil {
            return xerrors.Errorf(": %w", err)
        }

        sess.Values["code_verifier"] = out.CodeVerifier
        if err := sess.Save(c.Request(), c.Response()); err != nil {
            return xerrors.Errorf(": %w", err)
        }

        return c.Redirect(http.StatusTemporaryRedirect, out.URL)
    })

    e.GET("/auth/callback", func(c echo.Context) error {
        code := c.Request().URL.Query().Get("code")
        if code == "" {
            return xerrors.New("missing code")
        }

        // get verifier from session to exchange with code for token
        sess, err := session.Get("session", c)
        if err != nil {
            return xerrors.Errorf(": %w", err)
        }

        res, err := supabase.Auth.ExchangeCode(c.Request().Context(), supa.ExchangeCodeOpts{
            AuthCode:     code,
            CodeVerifier: fmt.Sprint(sess.Values["code_verifier"]),
        })
        if err != nil {
            return xerrors.Errorf(": %w", err)
        }

        return c.JSON(http.StatusOK, res)
    })

    e.Logger.Fatal(e.Start(":1323"))
}

This returns a token and user like:

{
  "access_token": "<REDACTED>",
  "token_type": "bearer",
  "expires_in": 3600,
  "refresh_token": "<REDACTED>",
  "user": {
    "id": "<REDACTED>",
    "aud": "authenticated",
    "role": "authenticated",
    "email": "<REDACTED>@example.com",
    "invited_at": "0001-01-01T00:00:00Z",
    "confirmed_at": "2023-05-13T14:38:47.898965Z",
    "confirmation_sent_at": "0001-01-01T00:00:00Z",
    "app_metadata": {},
    "user_metadata": {
      "avatar_url": "https://scontent-atl3-1.xx.fbcdn.net/<REDACTED>",
      "email": "<REDACTED>@example.com",
      "email_verified": true,
      "full_name": "<REDACTED>",
      "iss": "https://api.spotify.com/v1",
      "name": "<REDACTED>",
      "picture": "https://scontent-atl3-1.xx.fbcdn.net/<REDACTED>",
      "provider_id": "<REDACTED>",
      "sub": "<REDACTED>"
    },
    "created_at": "2023-05-13T14:38:47.870791Z",
    "updated_at": "2023-05-14T01:36:43.057753Z"
  }
}