Test OAuth authentication against PostgreSQL 18

Author: Georg Traar

.github/workflows/oauth-integration.yml

@@ -0,0 +1,86 @@
+name: OAuth integration
+
+on:
+  pull_request:
+    paths:
+      - packages/pg/lib/client.js
+      - packages/pg/lib/connection-parameters.js
+      - packages/pg/lib/connection.js
+      - packages/pg/lib/crypto/sasl.js
+      - packages/pg-protocol/src/serializer.ts
+      - packages/pg/test/integration/client/oauth-tests.js
+      - packages/pg/test/oauth-postgres/**
+      - .github/workflows/oauth-integration.yml
+  push:
+    branches: [master]
+    paths:
+      - packages/pg/lib/client.js
+      - packages/pg/lib/connection-parameters.js
+      - packages/pg/lib/connection.js
+      - packages/pg/lib/crypto/sasl.js
+      - packages/pg-protocol/src/serializer.ts
+      - packages/pg/test/integration/client/oauth-tests.js
+      - packages/pg/test/oauth-postgres/**
+      - .github/workflows/oauth-integration.yml
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    env:
+      OAUTH_TEST_PGHOST: localhost
+      OAUTH_TEST_PGPORT: 55433
+      OAUTH_TEST_PGUSER: oauth_test
+      OAUTH_TEST_PGDATABASE: oauth_test
+      OAUTH_TEST_TOKEN: node-postgres-test-token
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+      - name: Setup node
+        uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: yarn
+      - run: yarn install --frozen-lockfile
+      - run: yarn build
+      - uses: docker/setup-buildx-action@v3
+      - name: Build OAuth PostgreSQL image
+        uses: docker/build-push-action@v6
+        with:
+          context: packages/pg/test/oauth-postgres
+          load: true
+          tags: node-postgres-oauth
+          cache-from: type=gha,scope=oauth-postgres
+          cache-to: type=gha,mode=max,scope=oauth-postgres
+      - name: Start OAuth PostgreSQL
+        run: |
+          docker run --detach --rm \
+            --name node-postgres-oauth \
+            --env POSTGRES_USER=postgres \
+            --env POSTGRES_PASSWORD=postgres \
+            --env POSTGRES_DB=oauth_test \
+            --env PGDATA=/var/lib/postgresql/data \
+            --publish 55433:5432 \
+            node-postgres-oauth
+      - name: Wait for PostgreSQL
+        run: |
+          for attempt in $(seq 1 30); do
+            if docker exec node-postgres-oauth pg_isready; then
+              exit 0
+            fi
+            sleep 1
+          done
+          exit 1
+      - name: Test OAuth authentication
+        run: node packages/pg/test/integration/client/oauth-tests.js
+      - name: Show PostgreSQL logs
+        if: failure()
+        run: docker logs node-postgres-oauth || true
+      - name: Stop PostgreSQL
+        if: always()
+        run: docker stop node-postgres-oauth || true

packages/pg/test/integration/client/oauth-tests.js

@@ -0,0 +1,55 @@
+'use strict'
+const helper = require('./../test-helper')
+const assert = require('assert')
+const suite = new helper.Suite()
+const { pg } = helper
+
+const token = process.env.OAUTH_TEST_TOKEN
+const config = {
+  host: process.env.OAUTH_TEST_PGHOST,
+  port: process.env.OAUTH_TEST_PGPORT,
+  user: process.env.OAUTH_TEST_PGUSER,
+  database: process.env.OAUTH_TEST_PGDATABASE,
+  ssl: { rejectUnauthorized: false },
+  connectionTimeoutMillis: 5000,
+}
+
+if (helper.args.native) {
+  suite.test('skipping OAuth tests (on native)', () => {})
+  return
+}
+
+if (!config.user || !token) {
+  suite.test('skipping OAuth tests (missing env)', () => {})
+  return
+}
+
+suite.test('can connect using an OAuth bearer token', async () => {
+  const client = new pg.Client({ ...config, oauthBearerToken: token })
+  await client.connect()
+  const result = await client.query('SELECT current_user')
+  assert.equal(result.rows[0].current_user, config.user)
+  await client.end()
+})
+
+suite.test('can connect using an async OAuth bearer token callback', async () => {
+  let callbackCalls = 0
+  const client = new pg.Client({
+    ...config,
+    oauthBearerToken: async (params) => {
+      callbackCalls++
+      assert.equal(params.user, config.user)
+      assert.equal(params.database, config.database)
+      return token
+    },
+  })
+
+  await client.connect()
+  assert.equal(callbackCalls, 1)
+  await client.end()
+})
+
+suite.test('rejects an invalid OAuth bearer token', async () => {
+  const client = new pg.Client({ ...config, oauthBearerToken: token + '-invalid' })
+  await assert.rejects(() => client.connect(), /invalid_token/)
+})

packages/pg/test/oauth-postgres/Dockerfile

@@ -0,0 +1,17 @@
+ARG POSTGRES_IMAGE=ghcr.io/railwayapp-templates/postgres-ssl:18@sha256:21c501ce65f9b7de4bc9e4b545a095c00894a10bbf299f37a86e6004a6f7b066
+
+FROM ${POSTGRES_IMAGE} AS builder
+
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends build-essential libkrb5-dev postgresql-server-dev-18 \
+    && rm -rf /var/lib/apt/lists/*
+
+COPY oauth_validator.c /usr/src/oauth-validator/oauth_validator.c
+COPY Makefile /usr/src/oauth-validator/Makefile
+
+RUN make -C /usr/src/oauth-validator install
+
+FROM ${POSTGRES_IMAGE}
+
+COPY --from=builder /usr/lib/postgresql/18/lib/oauth_validator.so /usr/lib/postgresql/18/lib/oauth_validator.so
+COPY init-oauth.sh /docker-entrypoint-initdb.d/10-init-oauth.sh

packages/pg/test/oauth-postgres/Makefile

@@ -0,0 +1,4 @@
+MODULES = oauth_validator
+PG_CONFIG = pg_config
+PGXS := $(shell $(PG_CONFIG) --pgxs)
+include $(PGXS)

packages/pg/test/oauth-postgres/init-oauth.sh

@@ -0,0 +1,15 @@
+#!/bin/sh
+set -eu
+
+cat >> "$PGDATA/postgresql.conf" <<'EOF'
+oauth_validator_libraries = 'oauth_validator'
+EOF
+
+cat > "$PGDATA/pg_hba.conf" <<'EOF'
+local all all trust
+hostssl all all all oauth issuer="https://issuer.example" scope="postgres"
+EOF
+
+psql --set ON_ERROR_STOP=1 --username "$POSTGRES_USER" --dbname "$POSTGRES_DB" <<'SQL'
+CREATE ROLE oauth_test LOGIN;
+SQL

packages/pg/test/oauth-postgres/oauth_validator.c

@@ -0,0 +1,26 @@
+#include "postgres.h"
+
+#include "fmgr.h"
+#include "libpq/oauth.h"
+
+PG_MODULE_MAGIC;
+
+static bool
+validate_token(const ValidatorModuleState *state, const char *token,
+               const char *role, ValidatorModuleResult *result)
+{
+    result->authorized = strcmp(token, "node-postgres-test-token") == 0;
+    result->authn_id = result->authorized ? pstrdup(role) : NULL;
+    return true;
+}
+
+static const OAuthValidatorCallbacks callbacks = {
+    PG_OAUTH_VALIDATOR_MAGIC,
+    .validate_cb = validate_token,
+};
+
+const OAuthValidatorCallbacks *
+_PG_oauth_validator_module_init(void)
+{
+    return &callbacks;
+}