oauth: add downstream authorization code

pkg/api/oauth.go

···
 		q := u.Query()
 		q.Set("iss", "https://longos.iameli.link")
 		q.Set("state", upstreamSession.DownstreamPAR.State)
-		q.Set("code", "asdf")
+		q.Set("code", upstreamSession.DownstreamAuthorizationCode)
 		u.RawQuery = q.Encode()
 		http.Redirect(w, r, u.String(), http.StatusTemporaryRedirect)
 	}

pkg/atproto/oauth_downstream.go

···
 		return nil, fmt.Errorf("could not get oauth session: %w", err)
 	}
 
+	if session.DownstreamAuthorizationCode != tokenRequest.Code {
+		return nil, fmt.Errorf("invalid authorization code")
+	}
+
 	accessToken, err := generateJWT(cli, par.JKT, session.RepoDID)
 	if err != nil {
 		return nil, fmt.Errorf("could not generate access token: %w", err)
 	}
 
-	refreshToken, err := generateRefreshToken(cli)
+	refreshToken, err := generateRefreshToken()
 	if err != nil {
 		return nil, fmt.Errorf("could not generate refresh token: %w", err)
 	}
···
 	return tokenString, nil
 }
 
-func generateRefreshToken(cli *config.CLI) (string, error) {
+func generateRefreshToken() (string, error) {
 	uu, err := uuid.NewV7()
 	if err != nil {
 		return "", err
 	}
 	return fmt.Sprintf("refresh-%s", uu.String()), nil
 }
+
+func generateAuthorizationCode() (string, error) {
+	uu, err := uuid.NewV7()
+	if err != nil {
+		return "", err
+	}
+	return fmt.Sprintf("code-%s", uu.String()), nil
+}

pkg/atproto/oauth_upstream.go

···
 		return nil, fmt.Errorf("scope mismatch: %s != %s", itResp.Scope, meta.Scope)
 	}
 
+	downstreamCode, err := generateAuthorizationCode()
+	if err != nil {
+		return nil, fmt.Errorf("failed to generate downstream code: %w", err)
+	}
+
 	expiry := now.Add(time.Second * time.Duration(itResp.ExpiresIn)).UTC()
 	session.UpstreamAccessToken = itResp.AccessToken
 	session.UpstreamAccessTokenExp = expiry
 	session.UpstreamRefreshToken = itResp.RefreshToken
-
-	log.Log(ctx, "itResp", "itResp", itResp)
+	session.DownstreamAuthorizationCode = downstreamCode
 
 	authArgs := &oauth.XrpcAuthedRequestArgs{
 		Did:            session.RepoDID,

pkg/model/oauth_session.go

···
 
 // OAuthSession stores authentication data needed during the OAuth flow
 type OAuthSession struct {
-	ID                       string    `gorm:"primarykey"`
-	RepoDID                  string    `gorm:"column:repo_did;index"`
-	PDSUrl                   string    `gorm:"column:pds_url"`
-	UpstreamState            string    `gorm:"column:upstream_state;index"`
-	UpstreamAuthServerIssuer string    `gorm:"column:upstream_auth_server_issuer"`
-	UpstreamPKCEVerifier     string    `gorm:"column:upstream_pkce_verifier"`
-	UpstreamDPoPNonce        string    `gorm:"column:upstream_dpop_nonce"`
-	UpstreamDPoPPrivateJWK   []byte    `gorm:"column:upstream_dpop_private_jwk;type:text"`
-	UpstreamAccessToken      string    `gorm:"column:upstream_access_token"`
-	UpstreamAccessTokenExp   time.Time `gorm:"column:upstream_access_token_exp"`
-	UpstreamRefreshToken     string    `gorm:"column:upstream_refresh_token"`
-	DownstreamPARID          string    `gorm:"column:downstream_par_id;uniqueIndex"`
-	DownstreamPAR            *PAR      `gorm:"foreignKey:DownstreamPARID"`
-	DownstreamDPoPNonce      string    `gorm:"column:downstream_dpop_nonce"`
-	DownstreamDPoPJKT        string    `gorm:"column:downstream_dpop_jkt"`
-	DownstreamAccessToken    string    `gorm:"column:downstream_access_token;index"`
-	DownstreamRefreshToken   string    `gorm:"column:downstream_refresh_token;index"`
-	CreatedAt                time.Time
-	UpdatedAt                time.Time
-	DeletedAt                gorm.DeletedAt `gorm:"index"`
+	ID                          string    `gorm:"primarykey"`
+	RepoDID                     string    `gorm:"column:repo_did;index"`
+	PDSUrl                      string    `gorm:"column:pds_url"`
+	UpstreamState               string    `gorm:"column:upstream_state;index"`
+	UpstreamAuthServerIssuer    string    `gorm:"column:upstream_auth_server_issuer"`
+	UpstreamPKCEVerifier        string    `gorm:"column:upstream_pkce_verifier"`
+	UpstreamDPoPNonce           string    `gorm:"column:upstream_dpop_nonce"`
+	UpstreamDPoPPrivateJWK      []byte    `gorm:"column:upstream_dpop_private_jwk;type:text"`
+	UpstreamAccessToken         string    `gorm:"column:upstream_access_token"`
+	UpstreamAccessTokenExp      time.Time `gorm:"column:upstream_access_token_exp"`
+	UpstreamRefreshToken        string    `gorm:"column:upstream_refresh_token"`
+	DownstreamPARID             string    `gorm:"column:downstream_par_id;uniqueIndex"`
+	DownstreamPAR               *PAR      `gorm:"foreignKey:DownstreamPARID"`
+	DownstreamDPoPNonce         string    `gorm:"column:downstream_dpop_nonce"`
+	DownstreamDPoPJKT           string    `gorm:"column:downstream_dpop_jkt"`
+	DownstreamAccessToken       string    `gorm:"column:downstream_access_token;index"`
+	DownstreamRefreshToken      string    `gorm:"column:downstream_refresh_token;index"`
+	DownstreamAuthorizationCode string    `gorm:"column:downstream_authorization_code;index"`
+	CreatedAt                   time.Time
+	UpdatedAt                   time.Time
+	DeletedAt                   gorm.DeletedAt `gorm:"index"`
 }
 
 func (o *OAuthSession) TableName() string {