288
crates/como_auth/src/oauth.rs
Normal file
288
crates/como_auth/src/oauth.rs
Normal file
@@ -0,0 +1,288 @@
|
||||
use async_trait::async_trait;
|
||||
use oauth2::reqwest::async_http_client;
|
||||
use oauth2::url::Url;
|
||||
use oauth2::{basic::BasicClient, AuthUrl, ClientId, ClientSecret, RedirectUrl, TokenUrl};
|
||||
use oauth2::{AuthorizationCode, CsrfToken, Scope, TokenResponse};
|
||||
use std::ops::Deref;
|
||||
use std::sync::Arc;
|
||||
|
||||
use crate::ZitadelClap;
|
||||
|
||||
#[async_trait]
|
||||
pub trait OAuthClient {
|
||||
async fn get_token(&self) -> anyhow::Result<()>;
|
||||
async fn authorize_url(&self) -> anyhow::Result<Url>;
|
||||
async fn exchange(&self, code: &str) -> anyhow::Result<String>;
|
||||
}
|
||||
|
||||
pub struct OAuth(Arc<dyn OAuthClient + Send + Sync + 'static>);
|
||||
|
||||
impl OAuth {
|
||||
pub fn new_zitadel(config: ZitadelConfig) -> Self {
|
||||
Self(Arc::new(ZitadelOAuthClient::from(config)))
|
||||
}
|
||||
pub fn new_noop() -> Self {
|
||||
Self(Arc::new(NoopOAuthClient {}))
|
||||
}
|
||||
}
|
||||
|
||||
impl Deref for OAuth {
|
||||
type Target = Arc<dyn OAuthClient + Send + Sync + 'static>;
|
||||
|
||||
fn deref(&self) -> &Self::Target {
|
||||
&self.0
|
||||
}
|
||||
}
|
||||
|
||||
impl From<ZitadelConfig> for OAuth {
|
||||
fn from(value: ZitadelConfig) -> Self {
|
||||
Self::new_zitadel(value)
|
||||
}
|
||||
}
|
||||
|
||||
// -- Noop
|
||||
#[derive(clap::Args, Clone)]
|
||||
pub struct NoopOAuthClient;
|
||||
#[async_trait]
|
||||
impl OAuthClient for NoopOAuthClient {
|
||||
async fn get_token(&self) -> anyhow::Result<()> {
|
||||
Ok(())
|
||||
}
|
||||
async fn authorize_url(&self) -> anyhow::Result<Url> {
|
||||
Ok(Url::parse("http://localhost:3000/auth/zitadel").unwrap())
|
||||
}
|
||||
|
||||
async fn exchange(&self, _code: &str) -> anyhow::Result<String> {
|
||||
Ok(String::new())
|
||||
}
|
||||
}
|
||||
|
||||
// -- Zitadel
|
||||
|
||||
#[derive(Clone)]
|
||||
pub struct ZitadelConfig {
|
||||
auth_url: String,
|
||||
client_id: String,
|
||||
client_secret: String,
|
||||
redirect_url: String,
|
||||
token_url: String,
|
||||
authority_url: String,
|
||||
}
|
||||
|
||||
pub struct ZitadelOAuthClient {
|
||||
client: BasicClient,
|
||||
}
|
||||
|
||||
impl ZitadelOAuthClient {
|
||||
pub fn new(
|
||||
client_id: impl Into<String>,
|
||||
client_secret: impl Into<String>,
|
||||
redirect_url: impl Into<String>,
|
||||
auth_url: impl Into<String>,
|
||||
token_url: impl Into<String>,
|
||||
authority_url: impl Into<String>,
|
||||
) -> Self {
|
||||
Self {
|
||||
client: Self::oauth_client(ZitadelConfig {
|
||||
client_id: client_id.into(),
|
||||
client_secret: client_secret.into(),
|
||||
redirect_url: redirect_url.into(),
|
||||
auth_url: auth_url.into(),
|
||||
token_url: token_url.into(),
|
||||
authority_url: authority_url.into(),
|
||||
}),
|
||||
}
|
||||
}
|
||||
|
||||
fn oauth_client(config: ZitadelConfig) -> BasicClient {
|
||||
BasicClient::new(
|
||||
ClientId::new(config.client_id),
|
||||
Some(ClientSecret::new(config.client_secret)),
|
||||
AuthUrl::new(config.auth_url).unwrap(),
|
||||
Some(TokenUrl::new(config.token_url).unwrap()),
|
||||
)
|
||||
.set_redirect_uri(RedirectUrl::new(config.redirect_url).unwrap())
|
||||
}
|
||||
}
|
||||
|
||||
impl From<ZitadelConfig> for ZitadelOAuthClient {
|
||||
fn from(value: ZitadelConfig) -> Self {
|
||||
Self::new(
|
||||
value.client_id,
|
||||
value.client_secret,
|
||||
value.redirect_url,
|
||||
value.auth_url,
|
||||
value.token_url,
|
||||
value.authority_url,
|
||||
)
|
||||
}
|
||||
}
|
||||
|
||||
impl TryFrom<ZitadelClap> for ZitadelConfig {
|
||||
type Error = anyhow::Error;
|
||||
|
||||
fn try_from(value: ZitadelClap) -> Result<Self, Self::Error> {
|
||||
Ok(Self {
|
||||
auth_url: value
|
||||
.auth_url
|
||||
.ok_or(anyhow::anyhow!("auth_url was not set"))?,
|
||||
client_id: value
|
||||
.client_id
|
||||
.ok_or(anyhow::anyhow!("client_id was not set"))?,
|
||||
client_secret: value
|
||||
.client_secret
|
||||
.ok_or(anyhow::anyhow!("client_secret was not set"))?,
|
||||
redirect_url: value
|
||||
.redirect_url
|
||||
.ok_or(anyhow::anyhow!("redirect_url was not set"))?,
|
||||
token_url: value
|
||||
.token_url
|
||||
.ok_or(anyhow::anyhow!("token_url was not set"))?,
|
||||
authority_url: value
|
||||
.authority_url
|
||||
.ok_or(anyhow::anyhow!("authority_url was not set"))?,
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
#[async_trait]
|
||||
impl OAuthClient for ZitadelOAuthClient {
|
||||
async fn get_token(&self) -> anyhow::Result<()> {
|
||||
Ok(())
|
||||
}
|
||||
async fn authorize_url(&self) -> anyhow::Result<Url> {
|
||||
let (auth_url, _csrf_token) = self
|
||||
.client
|
||||
.authorize_url(CsrfToken::new_random)
|
||||
.add_scope(Scope::new("identify".to_string()))
|
||||
.add_scope(Scope::new("openid".to_string()))
|
||||
.url();
|
||||
|
||||
Ok(auth_url)
|
||||
}
|
||||
|
||||
async fn exchange(&self, code: &str) -> anyhow::Result<String> {
|
||||
let token = self
|
||||
.client
|
||||
.exchange_code(AuthorizationCode::new(code.to_string()))
|
||||
.request_async(async_http_client)
|
||||
.await?;
|
||||
|
||||
Ok(token.access_token().secret().clone())
|
||||
}
|
||||
}
|
||||
|
||||
#[cfg(test)]
|
||||
mod tests {
|
||||
use crate::ZitadelClap;
|
||||
use clap::Parser;
|
||||
use sealed_test::prelude::*;
|
||||
|
||||
#[derive(Parser)]
|
||||
#[command(author, version, about, long_about = None)]
|
||||
pub struct Cli {
|
||||
#[clap(flatten)]
|
||||
options: ZitadelClap,
|
||||
}
|
||||
|
||||
#[derive(Parser, Debug)]
|
||||
#[command(author, version, about, long_about = None)]
|
||||
pub struct CliSubCommand {
|
||||
#[command(subcommand)]
|
||||
command: Commands,
|
||||
}
|
||||
|
||||
#[derive(clap::Subcommand, Clone, Debug, Eq, PartialEq)]
|
||||
pub enum Commands {
|
||||
One {
|
||||
#[clap(flatten)]
|
||||
options: ZitadelClap,
|
||||
},
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn test_parse_clap_zitadel() {
|
||||
let cli: Cli = Cli::parse_from(&[
|
||||
"base",
|
||||
"--zitadel-client-id=something",
|
||||
"--zitadel-client-secret=something",
|
||||
"--zitadel-auth-url=https://something",
|
||||
"--zitadel-redirect-url=https://something",
|
||||
"--zitadel-token-url=https://something",
|
||||
"--zitadel-authority-url=https://something",
|
||||
]);
|
||||
println!("{:?}", cli.options);
|
||||
|
||||
pretty_assertions::assert_eq!(
|
||||
cli.options,
|
||||
ZitadelClap {
|
||||
auth_url: Some("https://something".into()),
|
||||
client_id: Some("something".into()),
|
||||
client_secret: Some("something".into()),
|
||||
redirect_url: Some("https://something".into()),
|
||||
token_url: Some("https://something".into()),
|
||||
authority_url: Some("https://something".into()),
|
||||
}
|
||||
);
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn test_parse_clap_zitadel_fails_require_all() {
|
||||
let cli = CliSubCommand::try_parse_from(&[
|
||||
"base",
|
||||
"one",
|
||||
// "--zitadel-client-id=something", // We want to trigger missing variable
|
||||
"--zitadel-client-secret=something",
|
||||
"--zitadel-auth-url=https://something",
|
||||
"--zitadel-redirect-url=https://something",
|
||||
"--zitadel-token-url=https://something",
|
||||
"--zitadel-authority-url=https://something",
|
||||
]);
|
||||
|
||||
pretty_assertions::assert_eq!(cli.is_err(), true);
|
||||
}
|
||||
|
||||
#[sealed_test]
|
||||
fn test_parse_clap_env_zitadel() {
|
||||
std::env::set_var("ZITADEL_CLIENT_ID", "something");
|
||||
std::env::set_var("ZITADEL_CLIENT_SECRET", "something");
|
||||
std::env::set_var("ZITADEL_AUTH_URL", "https://something");
|
||||
std::env::set_var("ZITADEL_REDIRECT_URL", "https://something");
|
||||
std::env::set_var("ZITADEL_TOKEN_URL", "https://something");
|
||||
std::env::set_var("ZITADEL_AUTHORITY_URL", "https://something");
|
||||
|
||||
let cli = CliSubCommand::parse_from(&["base", "one"]);
|
||||
|
||||
pretty_assertions::assert_eq!(
|
||||
cli.command,
|
||||
Commands::One {
|
||||
options: ZitadelClap {
|
||||
auth_url: Some("https://something".into()),
|
||||
client_id: Some("something".into()),
|
||||
client_secret: Some("something".into()),
|
||||
redirect_url: Some("https://something".into()),
|
||||
token_url: Some("https://something".into()),
|
||||
authority_url: Some("https://something".into()),
|
||||
}
|
||||
}
|
||||
);
|
||||
}
|
||||
#[test]
|
||||
fn test_parse_clap_defaults_to_noop() {
|
||||
let cli = CliSubCommand::parse_from(&["base", "one"]);
|
||||
|
||||
pretty_assertions::assert_eq!(
|
||||
cli.command,
|
||||
Commands::One {
|
||||
options: ZitadelClap {
|
||||
auth_url: None,
|
||||
client_id: None,
|
||||
client_secret: None,
|
||||
redirect_url: None,
|
||||
token_url: None,
|
||||
authority_url: None,
|
||||
},
|
||||
}
|
||||
);
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user