perf(oidc): optimize token creation (#7822)

* implement code exchange

* port tokenexchange to v2 tokens

* implement refresh token

* implement client credentials

* implement jwt profile

* implement device token

* cleanup unused code

* fix current unit tests

* add user agent unit test

* unit test domain package

* need refresh token as argument

* test commands create oidc session

* test commands device auth

* fix device auth build error

* implicit for oidc session API

* implement authorize callback handler for legacy implicit mode

* upgrade oidc module to working draft

* add missing auth methods and time

* handle all errors in defer

* do not fail auth request on error

the oauth2 Go client automagically retries on any error. If we fail the auth request on the first error, the next attempt will always fail with the Errors.AuthRequest.NoCode, because the auth request state is already set to failed.
The original error is then already lost and the oauth2 library does not return the original error.

Therefore we should not fail the auth request.

Might be worth discussing and perhaps send a bug report to Oauth2?

* fix code flow tests by explicitly setting code exchanged

* fix unit tests in command package

* return allowed scope from client credential client

* add device auth done reducer

* carry nonce thru session into ID token

* fix token exchange integration tests

* allow project role scope prefix in client credentials client

* gci formatting

* do not return refresh token in client credentials and jwt profile

* check org scope

* solve linting issue on authorize callback error

* end session based on v2 session ID

* use preferred language and user agent ID for v2 access tokens

* pin oidc v3.23.2

* add integration test for jwt profile and client credentials with org scopes

* refresh token v1 to v2

* add user token v2 audit event

* add activity trigger

* cleanup and set panics for unused methods

* use the encrypted code for v1 auth request get by code

* add missing event translation

* fix pipeline errors (hopefully)

* fix another test

* revert pointer usage of preferred language

* solve browser info panic in device auth

* remove duplicate entries in AMRToAuthMethodTypes to prevent future `mfa` claim

* revoke v1 refresh token to prevent reuse

* fix terminate oidc session

* always return a new refresh toke in refresh token grant

---------

Co-authored-by: Livio Spring <livio.a@gmail.com>

internal/static/i18n/bg.yaml

@@ -631,6 +631,7 @@ EventTypes:
         failed: Проверката на инициализацията е неуспешна
     token:
       added: Токенът за достъп е създаден
+      v2.added: Токенът за достъп е създаден
       removed: Токенът за достъп е премахнат
     impersonated: Имитиран потребител
     username:

internal/static/i18n/cs.yaml

@@ -612,6 +612,7 @@ EventTypes:
         failed: Kontrola inicializace selhala
     token:
       added: Přístupový token vytvořen
+      v2.added: Přístupový token vytvořen
       removed: Přístupový token odstraněn
     impersonated: Usuario suplantado
     username:

internal/static/i18n/de.yaml

@@ -614,6 +614,7 @@ EventTypes:
         failed: Benutzerinitialisierung fehlgeschlagen
     token:
       added: Access Token ausgestellt
+      v2.added: Access Token ausgestellt
       removed: Access Token gelöscht
     impersonated: Benutzer hat sich als Benutzer ausgegeben
     username:

internal/static/i18n/en.yaml

@@ -614,6 +614,7 @@ EventTypes:
         failed: Initialization check failed
     token:
       added: Access Token created
+      v2.added: Access Token created
       removed: Access Token removed
     impersonated: User impersonated
     username:

internal/static/i18n/es.yaml

@@ -614,6 +614,7 @@ EventTypes:
         failed: La comprobación de inicialización falló
     token:
       added: Token de acceso creado
+      v2.added: Token de acceso creado
       removed: Token de acceso eliminado
     impersonated: Usuario suplantado
     username:

internal/static/i18n/fr.yaml

@@ -614,6 +614,7 @@ EventTypes:
         failed: La vérification de l'initialisation a échoué
     token:
       added: Jeton d'accès créé
+      v2.added: Jeton d'accès créé
     impersonated: Utilisateur usurpé l'identité
     username:
       reserved: Nom d'utilisateur réservé

internal/static/i18n/it.yaml

@@ -614,6 +614,7 @@ EventTypes:
         failed: Controllo dell'inizializzazione fallito
     token:
       added: Access Token creato
+      v2.added: Access Token creato
     impersonated: Utente impersonificato
     username:
       reserved: Nome utente riservato

internal/static/i18n/ja.yaml

@@ -603,6 +603,7 @@ EventTypes:
         failed: 初期化チェックの失敗
     token:
       added: アクセストークンの作成
+      v2.added: アクセストークンの作成
       removed: アクセストークンの削除
     impersonated: ユーザーがなりすました
     username:

internal/static/i18n/mk.yaml

@@ -613,6 +613,7 @@ EventTypes:
         failed: Проверката на иницијализацијата е неуспешна
     token:
       added: Креиран е токен за пристап
+      v2.added: Креиран е токен за пристап
       removed: Токенот за пристап е отстранет
     impersonated: Корисникот имитиран
     username:

internal/static/i18n/nl.yaml

@@ -613,6 +613,7 @@ EventTypes:
         failed: Initialisatiecontrole mislukt
     token:
       added: Toegangstoken aangemaakt
+      v2.added: Toegangstoken aangemaakt
       removed: Toegangstoken verwijderd
     impersonated: Gebruiker nagebootst
     username:

internal/static/i18n/pl.yaml

@@ -614,6 +614,7 @@ EventTypes:
         failed: Sprawdzenie inicjujące nie powiodło się
     token:
       added: Token dostępu utworzony
+      v2.added: Token dostępu utworzony
       removed: Token dostępu usunięty
     impersonated: Użytkownik podszywał się pod użytkownika
     username:

internal/static/i18n/pt.yaml

@@ -609,6 +609,7 @@ EventTypes:
         failed: Verificação de inicialização falhou
     token:
       added: Token de acesso criado
+      v2.added: Token de acesso criado
       removed: Token de acesso removido
     impersonated: Usuário personificado
     username:

internal/static/i18n/ru.yaml

@@ -603,6 +603,7 @@ EventTypes:
         failed: Проверка инициализации не удалась
     token:
       added: Токен доступа создан
+      v2.added: Токен доступа создан
       removed: Токен доступа удалён
     impersonated: Пользователь олицетворяет себя
     username:

internal/static/i18n/zh.yaml

@@ -614,6 +614,7 @@ EventTypes:
         failed: 初始化检查失败
     token:
       added: 已创建访问令牌
+      v2.added: 已创建访问令牌
     impersonated: 用户冒充
     username:
       reserved: 保留用户名