x/oauth2: confusing definition of DeviceAuthResponse

[andig]

https://go-review.googlesource.com/c/oauth2/+/450155 recently added oauth2.DeviceAuthResponse:

type DeviceAuthResponse struct {
	// DeviceCode
	DeviceCode string `json:"device_code"`
	// UserCode is the code the user should enter at the verification uri
	UserCode string `json:"user_code"`
	// VerificationURI is where user should enter the user code
	VerificationURI string `json:"verification_uri"`
	// VerificationURIComplete (if populated) includes the user code in the verification URI. This is typically shown to the user in non-textual form, such as a QR code.
	VerificationURIComplete string `json:"verification_uri_complete,omitempty"`
	// Expiry is when the device code and user code expire
	Expiry time.Time `json:"expires_in,omitempty"`
	// Interval is the duration in seconds that Poll should wait between requests
	Interval int64 `json:"interval,omitempty"`
}

According to https://datatracker.ietf.org/doc/html/rfc8628#section-3.2

expires_in: REQUIRED. The lifetime in seconds of the "device_code" and "user_code".

Since Expiry is a time.Time it should imho not marshal/unmarshal to expires_in. Also see #61417 for related discussion on how to serialise expires_in.

/cc @hickford

[hickford]

@andig Could you give an example of the problem comparing input, output and expected output?

The current behaviour (which ought to be better documented) is:

When encoding or decoding JSON, the following relation is used: Expiry = time.Now() + expires_in

See the tests for examples https://github.com/golang/oauth2/blob/master/deviceauth_test.go

[gopherbot]

Change https://go.dev/cl/535217 mentions this issue: oauth2: document JSON encoding of DeviceAuthResponse.Expiry

[andig]

@hickford I don't think the PR is a valid fix. Shall we follow with #61417 and then act accordingly?