Add OTP support to grant-type password

pkg/oidc/client/client.go

@@ -20,7 +20,7 @@
 	GetAuthCodeURL(in AuthCodeURLInput) string
 	ExchangeAuthCode(ctx context.Context, in ExchangeAuthCodeInput) (*oidc.TokenSet, error)
 	GetTokenByAuthCode(ctx context.Context, in GetTokenByAuthCodeInput, localServerReadyChan chan<- string) (*oidc.TokenSet, error)
-	GetTokenByROPC(ctx context.Context, username, password string) (*oidc.TokenSet, error)
+	GetTokenByROPC(ctx context.Context, username, password string, otp string) (*oidc.TokenSet, error)
 	GetDeviceAuthorization(ctx context.Context) (*oauth2dev.AuthorizationResponse, error)
 	ExchangeDeviceCode(ctx context.Context, authResponse *oauth2dev.AuthorizationResponse) (*oidc.TokenSet, error)
 	Refresh(ctx context.Context, refreshToken string) (*oidc.TokenSet, error)
@@ -147,9 +147,9 @@
 }
 
 // GetTokenByROPC performs the resource owner password credentials flow.
-func (c *client) GetTokenByROPC(ctx context.Context, username, password string) (*oidc.TokenSet, error) {
+func (c *client) GetTokenByROPC(ctx context.Context, username, password string, otp string) (*oidc.TokenSet, error) {
 	ctx = c.wrapContext(ctx)
-	token, err := c.oauth2Config.PasswordCredentialsToken(ctx, username, password)
+	token, err := c.oauth2Config.PasswordCredentialsToken(ctx, username, password, otp)
 	if err != nil {
 		return nil, fmt.Errorf("resource owner password credentials flow error: %w", err)
 	}

pkg/usecases/authentication/ropc/ropc.go

@@ -12,10 +12,12 @@ import (
 
 const usernamePrompt = "Username: "
 const passwordPrompt = "Password: "
+const OTPPrompt = "OTP (if set): "
 
 type Option struct {
 	Username string
 	Password string // If empty, read a password using Reader.ReadPassword()
+	OTP      string // If empty, read a password using Reader.ReadPassword()
 }
 
 // ROPC provides the resource owner password credentials flow.
@@ -40,7 +42,15 @@ func (u *ROPC) Do(ctx context.Context, in *Option, oidcClient client.Interface)
 			return nil, fmt.Errorf("could not read a password: %w", err)
 		}
 	}
-	tokenSet, err := oidcClient.GetTokenByROPC(ctx, in.Username, in.Password)
+	if in.OTP == "" {
+		var err error
+		in.OTP, err = u.Reader.ReadPassword(OTPPrompt)
+		if err != nil {
+			return nil, fmt.Errorf("could not read an OTP: %w", err)
+		}
+	}
+
+	tokenSet, err := oidcClient.GetTokenByROPC(ctx, in.Username, in.Password, in.OTP)
 	if err != nil {
 		return nil, fmt.Errorf("resource owner password credentials flow error: %w", err)
 	}