feat: complete OIDC support for Apple and Google providers

internal/api/external.go

@@ -514,7 +514,7 @@ func (a *API) Provider(ctx context.Context, name string, scopes string) (provide
 
 	switch name {
 	case "apple":
-		return provider.NewAppleProvider(config.External.Apple)
+		return provider.NewAppleProvider(ctx, config.External.Apple)
 	case "azure":
 		return provider.NewAzureProvider(config.External.Azure, scopes)
 	case "bitbucket":
@@ -526,7 +526,7 @@ func (a *API) Provider(ctx context.Context, name string, scopes string) (provide
 	case "gitlab":
 		return provider.NewGitlabProvider(config.External.Gitlab, scopes)
 	case "google":
-		return provider.NewGoogleProvider(config.External.Google, scopes)
+		return provider.NewGoogleProvider(ctx, config.External.Google, scopes)
 	case "kakao":
 		return provider.NewKakaoProvider(config.External.Kakao, scopes)
 	case "keycloak":

internal/api/external_apple_test.go

@@ -17,7 +17,7 @@ func (ts *ExternalTestSuite) TestSignupExternalApple() {
 	ts.Require().NoError(err, "redirect url parse failed")
 	q := u.Query()
 	ts.Equal(ts.Config.External.Apple.RedirectURI, q.Get("redirect_uri"))
-	ts.Equal(ts.Config.External.Apple.ClientID, q.Get("client_id"))
+	ts.Equal(ts.Config.External.Apple.ClientID, []string{q.Get("client_id")})
 	ts.Equal("code", q.Get("response_type"))
 	ts.Equal("email name", q.Get("scope"))
 

internal/api/external_azure_test.go

@@ -23,7 +23,7 @@ func (ts *ExternalTestSuite) TestSignupExternalAzure() {
 	ts.Require().NoError(err, "redirect url parse failed")
 	q := u.Query()
 	ts.Equal(ts.Config.External.Azure.RedirectURI, q.Get("redirect_uri"))
-	ts.Equal(ts.Config.External.Azure.ClientID, q.Get("client_id"))
+	ts.Equal(ts.Config.External.Azure.ClientID, []string{q.Get("client_id")})
 	ts.Equal("code", q.Get("response_type"))
 	ts.Equal("openid", q.Get("scope"))
 

internal/api/external_bitbucket_test.go

@@ -22,7 +22,7 @@ func (ts *ExternalTestSuite) TestSignupExternalBitbucket() {
 	ts.Require().NoError(err, "redirect url parse failed")
 	q := u.Query()
 	ts.Equal(ts.Config.External.Bitbucket.RedirectURI, q.Get("redirect_uri"))
-	ts.Equal(ts.Config.External.Bitbucket.ClientID, q.Get("client_id"))
+	ts.Equal(ts.Config.External.Bitbucket.ClientID, []string{q.Get("client_id")})
 	ts.Equal("code", q.Get("response_type"))
 	ts.Equal("account email", q.Get("scope"))
 

internal/api/external_discord_test.go

@@ -24,7 +24,7 @@ func (ts *ExternalTestSuite) TestSignupExternalDiscord() {
 	ts.Require().NoError(err, "redirect url parse failed")
 	q := u.Query()
 	ts.Equal(ts.Config.External.Discord.RedirectURI, q.Get("redirect_uri"))
-	ts.Equal(ts.Config.External.Discord.ClientID, q.Get("client_id"))
+	ts.Equal(ts.Config.External.Discord.ClientID, []string{q.Get("client_id")})
 	ts.Equal("code", q.Get("response_type"))
 	ts.Equal("email identify", q.Get("scope"))
 

internal/api/external_facebook_test.go

@@ -24,7 +24,7 @@ func (ts *ExternalTestSuite) TestSignupExternalFacebook() {
 	ts.Require().NoError(err, "redirect url parse failed")
 	q := u.Query()
 	ts.Equal(ts.Config.External.Facebook.RedirectURI, q.Get("redirect_uri"))
-	ts.Equal(ts.Config.External.Facebook.ClientID, q.Get("client_id"))
+	ts.Equal(ts.Config.External.Facebook.ClientID, []string{q.Get("client_id")})
 	ts.Equal("code", q.Get("response_type"))
 	ts.Equal("email", q.Get("scope"))
 

internal/api/external_github_test.go

@@ -25,7 +25,7 @@ func (ts *ExternalTestSuite) TestSignupExternalGithub() {
 	ts.Require().NoError(err, "redirect url parse failed")
 	q := u.Query()
 	ts.Equal(ts.Config.External.Github.RedirectURI, q.Get("redirect_uri"))
-	ts.Equal(ts.Config.External.Github.ClientID, q.Get("client_id"))
+	ts.Equal(ts.Config.External.Github.ClientID, []string{q.Get("client_id")})
 	ts.Equal("code", q.Get("response_type"))
 	ts.Equal("user:email", q.Get("scope"))
 

internal/api/external_gitlab_test.go

@@ -24,7 +24,7 @@ func (ts *ExternalTestSuite) TestSignupExternalGitlab() {
 	ts.Require().NoError(err, "redirect url parse failed")
 	q := u.Query()
 	ts.Equal(ts.Config.External.Gitlab.RedirectURI, q.Get("redirect_uri"))
-	ts.Equal(ts.Config.External.Gitlab.ClientID, q.Get("client_id"))
+	ts.Equal(ts.Config.External.Gitlab.ClientID, []string{q.Get("client_id")})
 	ts.Equal("code", q.Get("response_type"))
 	ts.Equal("read_user", q.Get("scope"))
 

internal/api/external_google_test.go

@@ -1,12 +1,15 @@
 package api
 
 import (
+	"encoding/json"
 	"fmt"
 	"net/http"
 	"net/http/httptest"
 	"net/url"
 
 	jwt "github.com/golang-jwt/jwt"
+	"github.com/stretchr/testify/require"
+	"github.com/supabase/gotrue/internal/api/provider"
 )
 
 const (
@@ -16,6 +19,8 @@ const (
 )
 
 func (ts *ExternalTestSuite) TestSignupExternalGoogle() {
+	provider.ResetGoogleProvider()
+
 	req := httptest.NewRequest(http.MethodGet, "http://localhost/authorize?provider=google", nil)
 	w := httptest.NewRecorder()
 	ts.API.handler.ServeHTTP(w, req)
@@ -24,7 +29,7 @@ func (ts *ExternalTestSuite) TestSignupExternalGoogle() {
 	ts.Require().NoError(err, "redirect url parse failed")
 	q := u.Query()
 	ts.Equal(ts.Config.External.Google.RedirectURI, q.Get("redirect_uri"))
-	ts.Equal(ts.Config.External.Google.ClientID, q.Get("client_id"))
+	ts.Equal(ts.Config.External.Google.ClientID, []string{q.Get("client_id")})
 	ts.Equal("code", q.Get("response_type"))
 	ts.Equal("email profile", q.Get("scope"))
 
@@ -40,8 +45,17 @@ func (ts *ExternalTestSuite) TestSignupExternalGoogle() {
 }
 
 func GoogleTestSignupSetup(ts *ExternalTestSuite, tokenCount *int, userCount *int, code string, user string) *httptest.Server {
-	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+	provider.ResetGoogleProvider()
+
+	var server *httptest.Server
+	server = httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		switch r.URL.Path {
+		case "/.well-known/openid-configuration":
+			w.Header().Add("Content-Type", "application/json")
+			require.NoError(ts.T(), json.NewEncoder(w).Encode(map[string]any{
+				"issuer":         server.URL,
+				"token_endpoint": server.URL + "/o/oauth2/token",
+			}))
 		case "/o/oauth2/token":
 			*tokenCount++
 			ts.Equal(code, r.FormValue("code"))
@@ -60,7 +74,7 @@ func GoogleTestSignupSetup(ts *ExternalTestSuite, tokenCount *int, userCount *in
 		}
 	}))
 
-	ts.Config.External.Google.URL = server.URL
+	provider.OverrideGoogleProvider(server.URL, server.URL+"/userinfo/v2/me")
 
 	return server
 }

internal/api/external_kakao_test.go

@@ -23,7 +23,7 @@ func (ts *ExternalTestSuite) TestSignupExternalKakao() {
 	ts.Require().NoError(err, "redirect url parse failed")
 	q := u.Query()
 	ts.Equal(ts.Config.External.Kakao.RedirectURI, q.Get("redirect_uri"))
-	ts.Equal(ts.Config.External.Kakao.ClientID, q.Get("client_id"))
+	ts.Equal(ts.Config.External.Kakao.ClientID, []string{q.Get("client_id")})
 	ts.Equal("code", q.Get("response_type"))
 
 	claims := ExternalProviderClaims{}

internal/api/external_keycloak_test.go

@@ -23,7 +23,7 @@ func (ts *ExternalTestSuite) TestSignupExternalKeycloak() {
 	ts.Require().NoError(err, "redirect url parse failed")
 	q := u.Query()
 	ts.Equal(ts.Config.External.Keycloak.RedirectURI, q.Get("redirect_uri"))
-	ts.Equal(ts.Config.External.Keycloak.ClientID, q.Get("client_id"))
+	ts.Equal(ts.Config.External.Keycloak.ClientID, []string{q.Get("client_id")})
 	ts.Equal("code", q.Get("response_type"))
 	ts.Equal("profile email", q.Get("scope"))
 

internal/api/external_linkedin_test.go

@@ -25,7 +25,7 @@ func (ts *ExternalTestSuite) TestSignupExternalLinkedin() {
 	ts.Require().NoError(err, "redirect url parse failed")
 	q := u.Query()
 	ts.Equal(ts.Config.External.Linkedin.RedirectURI, q.Get("redirect_uri"))
-	ts.Equal(ts.Config.External.Linkedin.ClientID, q.Get("client_id"))
+	ts.Equal(ts.Config.External.Linkedin.ClientID, []string{q.Get("client_id")})
 	ts.Equal("code", q.Get("response_type"))
 	ts.Equal("r_emailaddress r_liteprofile", q.Get("scope"))
 

internal/api/external_notion_test.go

@@ -24,7 +24,7 @@ func (ts *ExternalTestSuite) TestSignupExternalNotion() {
 	ts.Require().NoError(err, "redirect url parse failed")
 	q := u.Query()
 	ts.Equal(ts.Config.External.Notion.RedirectURI, q.Get("redirect_uri"))
-	ts.Equal(ts.Config.External.Notion.ClientID, q.Get("client_id"))
+	ts.Equal(ts.Config.External.Notion.ClientID, []string{q.Get("client_id")})
 	ts.Equal("code", q.Get("response_type"))
 
 	claims := ExternalProviderClaims{}

internal/api/external_twitch_test.go

@@ -23,7 +23,7 @@ func (ts *ExternalTestSuite) TestSignupExternalTwitch() {
 	ts.Require().NoError(err, "redirect url parse failed")
 	q := u.Query()
 	ts.Equal(ts.Config.External.Twitch.RedirectURI, q.Get("redirect_uri"))
-	ts.Equal(ts.Config.External.Twitch.ClientID, q.Get("client_id"))
+	ts.Equal(ts.Config.External.Twitch.ClientID, []string{q.Get("client_id")})
 	ts.Equal("code", q.Get("response_type"))
 	ts.Equal("user:read:email", q.Get("scope"))
 

internal/api/external_workos_test.go

@@ -25,7 +25,7 @@ func (ts *ExternalTestSuite) TestSignupExternalWorkOSWithConnection() {
 	ts.Require().NoError(err, "redirect url parse failed")
 	q := u.Query()
 	ts.Equal(ts.Config.External.WorkOS.RedirectURI, q.Get("redirect_uri"))
-	ts.Equal(ts.Config.External.WorkOS.ClientID, q.Get("client_id"))
+	ts.Equal(ts.Config.External.WorkOS.ClientID, []string{q.Get("client_id")})
 	ts.Equal("code", q.Get("response_type"))
 	ts.Equal("", q.Get("scope"))
 	ts.Equal(connection, q.Get("connection"))
@@ -51,7 +51,7 @@ func (ts *ExternalTestSuite) TestSignupExternalWorkOSWithOrganization() {
 	ts.Require().NoError(err, "redirect url parse failed")
 	q := u.Query()
 	ts.Equal(ts.Config.External.WorkOS.RedirectURI, q.Get("redirect_uri"))
-	ts.Equal(ts.Config.External.WorkOS.ClientID, q.Get("client_id"))
+	ts.Equal(ts.Config.External.WorkOS.ClientID, []string{q.Get("client_id")})
 	ts.Equal("code", q.Get("response_type"))
 	ts.Equal("", q.Get("scope"))
 	ts.Equal(organization, q.Get("organization"))
@@ -77,7 +77,7 @@ func (ts *ExternalTestSuite) TestSignupExternalWorkOSWithProvider() {
 	ts.Require().NoError(err, "redirect url parse failed")
 	q := u.Query()
 	ts.Equal(ts.Config.External.WorkOS.RedirectURI, q.Get("redirect_uri"))
-	ts.Equal(ts.Config.External.WorkOS.ClientID, q.Get("client_id"))
+	ts.Equal(ts.Config.External.WorkOS.ClientID, []string{q.Get("client_id")})
 	ts.Equal("code", q.Get("response_type"))
 	ts.Equal("", q.Get("scope"))
 	ts.Equal(provider, q.Get("provider"))

internal/api/external_zoom_test.go

@@ -24,7 +24,7 @@ func (ts *ExternalTestSuite) TestSignupExternalZoom() {
 	ts.Require().NoError(err, "redirect url parse failed")
 	q := u.Query()
 	ts.Equal(ts.Config.External.Zoom.RedirectURI, q.Get("redirect_uri"))
-	ts.Equal(ts.Config.External.Zoom.ClientID, q.Get("client_id"))
+	ts.Equal(ts.Config.External.Zoom.ClientID, []string{q.Get("client_id")})
 	ts.Equal("code", q.Get("response_type"))
 
 	claims := ExternalProviderClaims{}