coder · pawbana · Sep 19, 2025 · Sep 11, 2025 · Sep 17, 2025 · Sep 17, 2025
diff --git a/cli/server.go b/cli/server.go
@@ -2692,6 +2692,8 @@ func parseExternalAuthProvidersFromEnv(prefix string, environ []string) ([]coder
 			provider.AuthURL = v.Value
 		case "TOKEN_URL":
 			provider.TokenURL = v.Value
+		case "REVOKE_URL":
+			provider.RevokeURL = v.Value
 		case "VALIDATE_URL":
 			provider.ValidateURL = v.Value
 		case "REGEX":

diff --git a/cli/server_test.go b/cli/server_test.go
@@ -76,6 +76,7 @@ func TestReadExternalAuthProvidersFromEnv(t *testing.T) {
 			"CODER_EXTERNAL_AUTH_1_CLIENT_SECRET=hunter12",
 			"CODER_EXTERNAL_AUTH_1_TOKEN_URL=google.com",
 			"CODER_EXTERNAL_AUTH_1_VALIDATE_URL=bing.com",
+			"CODER_EXTERNAL_AUTH_1_REVOKE_URL=revoke.url",
 			"CODER_EXTERNAL_AUTH_1_SCOPES=repo:read repo:write",
 			"CODER_EXTERNAL_AUTH_1_NO_REFRESH=true",
 			"CODER_EXTERNAL_AUTH_1_DISPLAY_NAME=Google",
@@ -87,13 +88,15 @@ func TestReadExternalAuthProvidersFromEnv(t *testing.T) {
 		// Validate the first provider.
 		assert.Equal(t, "1", providers[0].ID)
 		assert.Equal(t, "gitlab", providers[0].Type)
+		assert.Equal(t, "", providers[0].RevokeURL)

 		// Validate the second provider.
 		assert.Equal(t, "2", providers[1].ID)
 		assert.Equal(t, "sid", providers[1].ClientID)
 		assert.Equal(t, "hunter12", providers[1].ClientSecret)
 		assert.Equal(t, "google.com", providers[1].TokenURL)
 		assert.Equal(t, "bing.com", providers[1].ValidateURL)
+		assert.Equal(t, "revoke.url", providers[1].RevokeURL)
 		assert.Equal(t, []string{"repo:read", "repo:write"}, providers[1].Scopes)
 		assert.Equal(t, true, providers[1].NoRefresh)
 		assert.Equal(t, "Google", providers[1].DisplayName)

diff --git a/coderd/apidoc/docs.go b/coderd/apidoc/docs.go
diff --git a/coderd/apidoc/swagger.json b/coderd/apidoc/swagger.json
diff --git a/coderd/coderdtest/oidctest/idp.go b/coderd/coderdtest/oidctest/idp.go
@@ -46,6 +46,8 @@ import (
 	"github.com/coder/coder/v2/testutil"
 )

+type HookRevokeTokenFn func() (httpStatus int, err error)
+
 type token struct {
 	issued time.Time
 	email  string
@@ -196,9 +198,11 @@ type FakeIDP struct {
 	// hookValidRedirectURL can be used to reject a redirect url from the
 	// IDP -> Application. Almost all IDPs have the concept of
 	// "Authorized Redirect URLs". This can be used to emulate that.
-	hookValidRedirectURL func(redirectURL string) error
-	hookUserInfo         func(email string) (jwt.MapClaims, error)
-	hookAccessTokenJWT   func(email string, exp time.Time) jwt.MapClaims
+	hookValidRedirectURL    func(redirectURL string) error
+	hookUserInfo            func(email string) (jwt.MapClaims, error)
+	hookRevokeToken         HookRevokeTokenFn
+	revokeTokenGitHubFormat bool // GitHub doesn't follow token revocation RFC spec
+	hookAccessTokenJWT      func(email string, exp time.Time) jwt.MapClaims
 	// defaultIDClaims is if a new client connects and we didn't preset
 	// some claims.
 	defaultIDClaims jwt.MapClaims
@@ -327,6 +331,19 @@ func WithStaticUserInfo(info jwt.MapClaims) func(*FakeIDP) {
 	}
 }

+func WithRevokeTokenRFC(revokeFunc HookRevokeTokenFn) func(*FakeIDP) {
+	return func(f *FakeIDP) {
+		f.hookRevokeToken = revokeFunc
+	}
+}
+
+func WithRevokeTokenGitHub(revokeFunc HookRevokeTokenFn) func(*FakeIDP) {
+	return func(f *FakeIDP) {
+		f.hookRevokeToken = revokeFunc
+		f.revokeTokenGitHubFormat = true
+	}
+}
+
 func WithDefaultIDClaims(claims jwt.MapClaims) func(*FakeIDP) {
 	return func(f *FakeIDP) {
 		f.defaultIDClaims = claims
@@ -358,6 +375,7 @@ type With429Arguments struct {
 	AuthorizePath bool
 	KeysPath      bool
 	UserInfoPath  bool
+	RevokePath    bool
 	DeviceAuth    bool
 	DeviceVerify  bool
 }
@@ -387,6 +405,10 @@ func With429(params With429Arguments) func(*FakeIDP) {
 					http.Error(rw, "429, being manually blocked (userinfo)", http.StatusTooManyRequests)
 					return
 				}
+				if params.RevokePath && strings.Contains(r.URL.Path, revokeTokenPath) {
+					http.Error(rw, "429, being manually blocked (revoke)", http.StatusTooManyRequests)
+					return
+				}
 				if params.DeviceAuth && strings.Contains(r.URL.Path, deviceAuth) {
 					http.Error(rw, "429, being manually blocked (device-auth)", http.StatusTooManyRequests)
 					return
@@ -408,8 +430,10 @@ const (
 	authorizePath = "/oauth2/authorize"
 	keysPath      = "/oauth2/keys"
 	userInfoPath  = "/oauth2/userinfo"
-	deviceAuth    = "/login/device/code"
-	deviceVerify  = "/login/device"
+	// nolint:gosec // It also thinks this is a secret lol
+	revokeTokenPath = "/oauth2/revoke"
+	deviceAuth      = "/login/device/code"
+	deviceVerify    = "/login/device"
 )

 func NewFakeIDP(t testing.TB, opts ...FakeIDPOpt) *FakeIDP {
@@ -486,6 +510,7 @@ func (f *FakeIDP) updateIssuerURL(t testing.TB, issuer string) {
 		TokenURL:      u.ResolveReference(&url.URL{Path: tokenPath}).String(),
 		JWKSURL:       u.ResolveReference(&url.URL{Path: keysPath}).String(),
 		UserInfoURL:   u.ResolveReference(&url.URL{Path: userInfoPath}).String(),
+		RevokeURL:     u.ResolveReference(&url.URL{Path: revokeTokenPath}).String(),
 		DeviceCodeURL: u.ResolveReference(&url.URL{Path: deviceAuth}).String(),
 		Algorithms: []string{
 			"RS256",
@@ -756,6 +781,7 @@ type ProviderJSON struct {
 	TokenURL      string   `json:"token_endpoint"`
 	JWKSURL       string   `json:"jwks_uri"`
 	UserInfoURL   string   `json:"userinfo_endpoint"`
+	RevokeURL     string   `json:"revocation_endpoint"`
 	DeviceCodeURL string   `json:"device_authorization_endpoint"`
 	Algorithms    []string `json:"id_token_signing_alg_values_supported"`
 	// This is custom
@@ -1146,6 +1172,29 @@ func (f *FakeIDP) httpHandler(t testing.TB) http.Handler {
 		_ = json.NewEncoder(rw).Encode(claims)
 	}))

+	mux.Handle(revokeTokenPath, http.HandlerFunc(func(rw http.ResponseWriter, r *http.Request) {
+		if f.revokeTokenGitHubFormat {
+			u, p, ok := r.BasicAuth()
+			if !ok || !(u == f.clientID && p == f.clientSecret) {
+				httpError(rw, http.StatusForbidden, xerrors.Errorf("basic auth failed"))
+				return
+			}
+		} else {
+			_, ok := validateMW(rw, r)
+			if !ok {
+				httpError(rw, http.StatusForbidden, xerrors.Errorf("token validation failed"))
+				return
+			}
+		}
+
+		code, err := f.hookRevokeToken()
+		if err != nil {
+			httpError(rw, code, xerrors.Errorf("hook err: %w", err))
+			return
+		}
+		httpapi.Write(r.Context(), rw, code, "")
+	}))
+
 	// There is almost no difference between this and /userinfo.
 	// The main tweak is that this route is "mounted" vs "handle" because "/userinfo"
 	// should be strict, and this one needs to handle sub routes.
@@ -1474,12 +1523,16 @@ func (f *FakeIDP) ExternalAuthConfig(t testing.TB, id string, custom *ExternalAu
 		DisplayName:              id,
 		InstrumentedOAuth2Config: oauthCfg,
 		ID:                       id,
+		ClientID:                 f.clientID,
+		ClientSecret:             f.clientSecret,
 		// No defaults for these fields by omitting the type
 		Type:        "",
 		DisplayIcon: f.WellknownConfig().UserInfoURL,
 		// Omit the /user for the validate so we can easily append to it when modifying
 		// the cfg for advanced tests.
-		ValidateURL: f.locked.IssuerURL().ResolveReference(&url.URL{Path: "/external-auth-validate/"}).String(),
+		ValidateURL:   f.locked.IssuerURL().ResolveReference(&url.URL{Path: "/external-auth-validate/"}).String(),
+		RevokeURL:     f.locked.IssuerURL().ResolveReference(&url.URL{Path: revokeTokenPath}).String(),
+		RevokeTimeout: 1 * time.Second,
 		DeviceAuth: &externalauth.DeviceAuth{
 			Config:   oauthCfg,
 			ClientID: f.clientID,

diff --git a/coderd/externalauth.go b/coderd/externalauth.go
@@ -85,20 +85,37 @@ func (api *API) externalAuthByID(w http.ResponseWriter, r *http.Request) {
 // @ID delete-external-auth-user-link-by-id
 // @Security CoderSessionToken
 // @Tags Git
-// @Success 200
+// @Produce json
 // @Param externalauth path string true "Git Provider ID" format(string)
+// @Success 200 {object} codersdk.DeleteExternalAuthByIDResponse
 // @Router /external-auth/{externalauth} [delete]
 func (api *API) deleteExternalAuthByID(w http.ResponseWriter, r *http.Request) {
 	config := httpmw.ExternalAuthParam(r)
 	apiKey := httpmw.APIKey(r)
 	ctx := r.Context()

-	err := api.Database.DeleteExternalAuthLink(ctx, database.DeleteExternalAuthLinkParams{
+	link, err := api.Database.GetExternalAuthLink(ctx, database.GetExternalAuthLinkParams{
 		ProviderID: config.ID,
 		UserID:     apiKey.UserID,
 	})
 	if err != nil {
-		if !errors.Is(err, sql.ErrNoRows) {
+		if errors.Is(err, sql.ErrNoRows) {
+			httpapi.ResourceNotFound(w)
+			return
+		}
+		httpapi.Write(ctx, w, http.StatusInternalServerError, codersdk.Response{
+			Message: "Failed to get external auth link during deletion.",
+			Detail:  err.Error(),
+		})
+		return
+	}
+
+	err = api.Database.DeleteExternalAuthLink(ctx, database.DeleteExternalAuthLinkParams{
+		ProviderID: config.ID,
+		UserID:     apiKey.UserID,
+	})
+	if err != nil {
+		if errors.Is(err, sql.ErrNoRows) {
 			httpapi.ResourceNotFound(w)
 			return
 		}
@@ -109,7 +126,13 @@ func (api *API) deleteExternalAuthByID(w http.ResponseWriter, r *http.Request) {
 		return
 	}

-	httpapi.Write(ctx, w, http.StatusOK, "OK")
+	ok, err := config.RevokeToken(ctx, link)
+	resp := codersdk.DeleteExternalAuthByIDResponse{TokenRevoked: ok}
+
+	if err != nil {
+		resp.TokenRevocationError = err.Error()
+	}
+	httpapi.Write(ctx, w, http.StatusOK, resp)
 }

 // @Summary Post external auth device by ID
@@ -394,13 +417,14 @@ func ExternalAuthConfigs(auths []*externalauth.Config) []codersdk.ExternalAuthLi

 func ExternalAuthConfig(cfg *externalauth.Config) codersdk.ExternalAuthLinkProvider {
 	return codersdk.ExternalAuthLinkProvider{
-		ID:            cfg.ID,
-		Type:          cfg.Type,
-		Device:        cfg.DeviceAuth != nil,
-		DisplayName:   cfg.DisplayName,
-		DisplayIcon:   cfg.DisplayIcon,
-		AllowRefresh:  !cfg.NoRefresh,
-		AllowValidate: cfg.ValidateURL != "",
+		ID:                 cfg.ID,
+		Type:               cfg.Type,
+		Device:             cfg.DeviceAuth != nil,
+		DisplayName:        cfg.DisplayName,
+		DisplayIcon:        cfg.DisplayIcon,
+		AllowRefresh:       !cfg.NoRefresh,
+		AllowValidate:      cfg.ValidateURL != "",
+		SupportsRevocation: cfg.RevokeURL != "",
 	}
 }