alibi_api/plugins/oauth/providers/
tiktok.rs

1//! TikTok's client-key grants, comma-separated scopes and nested profile.
2use super::{
3    OAuthAuthorizationPolicy, OAuthProvider, OAuthTokenEndpointAuth, OAuthUserInfo,
4    OAuthUserInfoHandler, OAuthUserInfoRequest, OAuthUserInfoResponse,
5};
6use serde_json::Value;
7
8#[derive(Clone)]
9pub struct TikTokOptions {
10    pub client_key: String,
11    pub client_secret: String,
12    pub scope: Vec<String>,
13    pub disable_default_scope: bool,
14    pub redirect_uri: Option<String>,
15    /// Trusted transport override, preserving the published fields query.
16    pub user_info_endpoint: Option<String>,
17}
18impl TikTokOptions {
19    #[must_use]
20    pub fn new(client_key: impl Into<String>, client_secret: impl Into<String>) -> Self {
21        Self {
22            client_key: client_key.into(),
23            client_secret: client_secret.into(),
24            scope: Vec::new(),
25            disable_default_scope: false,
26            redirect_uri: None,
27            user_info_endpoint: None,
28        }
29    }
30}
31impl std::fmt::Debug for TikTokOptions {
32    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
33        f.debug_struct("TikTokOptions")
34            .field("client_key", &self.client_key)
35            .field("scope", &self.scope)
36            .finish_non_exhaustive()
37    }
38}
39impl OAuthProvider {
40    #[must_use]
41    pub fn tiktok(client_key: &str, client_secret: &str) -> Self {
42        Self::tiktok_with_options(TikTokOptions::new(client_key, client_secret))
43    }
44    #[must_use]
45    pub fn tiktok_with_options(options: TikTokOptions) -> Self {
46        let endpoint = options
47            .user_info_endpoint
48            .unwrap_or_else(|| "https://open.tiktokapis.com/v2/user/info/".into());
49        Self {
50            client_id: options.client_key,
51            client_secret: options.client_secret,
52            additional_client_ids: Vec::new(),
53            hosted_domain: None,
54            require_email_verification: false,
55            auth_url: "https://www.tiktok.com/v2/auth/authorize".into(),
56            token_url: "https://open.tiktokapis.com/v2/oauth/token/".into(),
57            user_info_url: Some(endpoint.clone()),
58            scopes: vec!["user.info.profile".into()],
59            authorization: Some(OAuthAuthorizationPolicy {
60                preserve_raw_profile_scalars: true,
61                source_profile_exceptions: true,
62                client_id_parameter: "client_key".into(),
63                scope_separator: ",".into(),
64                emit_empty_scope: true,
65                configured_scopes: options.scope,
66                disable_default_scopes: options.disable_default_scope,
67                redirect_uri: options.redirect_uri,
68                pkce: false,
69                authorization_code_pkce: Some(true),
70                login_hint: false,
71                token_endpoint_auth: Some(OAuthTokenEndpointAuth::ClientKeyPost),
72                allow_missing_access_token: true,
73                preserve_raw_email_errors: true,
74                supports_profile_mapper: false,
75                ..OAuthAuthorizationPolicy::default()
76            }),
77            authorization_params: Vec::new(),
78            account_subject: Some(subject),
79            map_user_info: None,
80            get_user_info: Some(std::sync::Arc::new(TikTokProfile { endpoint })),
81            refresh_access_token: None,
82            verify_id_token: None,
83            id_token: None,
84            disable_id_token_sign_in: false,
85            disable_implicit_sign_up: false,
86            disable_sign_up: false,
87            override_user_info_on_sign_in: false,
88        }
89    }
90}
91fn subject(profile: &Value) -> Result<String, String> {
92    super::remaining_profile::raw_subject(profile.pointer("/data/user/open_id"))
93}
94struct TikTokProfile {
95    endpoint: String,
96}
97#[async_trait::async_trait]
98impl OAuthUserInfoHandler for TikTokProfile {
99    fn errors_are_exceptions(&self) -> bool {
100        false
101    }
102
103    async fn get_user_info(
104        &self,
105        request: OAuthUserInfoRequest,
106    ) -> Result<OAuthUserInfoResponse, String> {
107        let profile: Value = reqwest::Client::new()
108            .get(&self.endpoint)
109            .query(&[("fields", "open_id,avatar_large_url,display_name,username")])
110            .bearer_auth(super::remaining_profile::bearer_access_token(&request)?)
111            .send()
112            .await
113            .map_err(|e| e.to_string())?
114            .error_for_status()
115            .map_err(|e| e.to_string())?
116            .json()
117            .await
118            .map_err(|e| e.to_string())?;
119        let data = profile
120            .pointer("/data/user")
121            .filter(|value| !value.is_null())
122            .ok_or_else(|| super::remaining_profile::profile_exception("Missing TikTok user"))?;
123        let raw_id = data
124            .get("open_id")
125            .map(super::remaining_profile::js_string)
126            .transpose()
127            .map_err(super::remaining_profile::profile_exception)?
128            .unwrap_or_else(|| "undefined".into());
129        let email = match data
130            .get("email")
131            .filter(|value| super::remaining_profile::truthy(value))
132        {
133            Some(email) => email.clone(),
134            None => {
135                let email = format!("{raw_id}@tiktok.placeholder.invalid");
136                if !crate::plugins::authentication_helpers::is_valid_email(&email) {
137                    return Err(super::remaining_profile::profile_exception(
138                        "Invalid TikTok placeholder email",
139                    ));
140                }
141                Value::String(email)
142            }
143        };
144        let name = data
145            .get("display_name")
146            .filter(|value| super::remaining_profile::truthy(value))
147            .or_else(|| {
148                data.get("username")
149                    .filter(|value| super::remaining_profile::truthy(value))
150            })
151            .cloned()
152            .unwrap_or_else(|| Value::String(String::new()));
153        let mut output = serde_json::Map::new();
154        drop(output.insert("name".into(), name.clone()));
155        drop(output.insert("email".into(), email.clone()));
156        drop(output.insert("emailVerified".into(), Value::Bool(false)));
157        if let Some(image) = data.get("avatar_large_url") {
158            drop(output.insert("image".into(), image.clone()));
159        }
160        let user = OAuthUserInfo {
161            additional_fields: Default::default(),
162            id: raw_id,
163            name: super::remaining_profile::scalar(Some(&name))?,
164            email: email.as_str().unwrap_or_default().into(),
165            image: super::remaining_profile::scalar(data.get("avatar_large_url"))?,
166            email_verified: false,
167        };
168        Ok(OAuthUserInfoResponse {
169            user_output: Some(output),
170            user,
171            data: profile,
172        })
173    }
174}
alibi_api/plugins/oauth/providers/tiktok.rs

alibi_api/plugins/oauth/providers/
tiktok.rs
