alibi_api/plugins/oauth/providers/
atlassian.rs

1//! Atlassian's published scope, PKCE, fixed audience and stable account subject.
2use super::{OAuthAuthorizationPolicy, OAuthProvider, OAuthUserInfo};
3use serde_json::Value;
4
5/// Atlassian-specific configuration; callback and persistence policies remain
6/// configurable on the returned OAuth provider.
7#[derive(Clone)]
8pub struct AtlassianOptions {
9    pub client_id: String,
10    pub client_secret: String,
11    pub scope: Vec<String>,
12    pub disable_default_scope: bool,
13    pub prompt: Option<String>,
14    pub authorization_endpoint: Option<String>,
15    pub redirect_uri: Option<String>,
16    /// Trusted user-info transport endpoint, retaining the Atlassian mapping.
17    pub user_info_endpoint: Option<String>,
18    /// Receives the original profile. Its ID cannot replace `account_id`.
19    pub map_profile_to_user: Option<fn(Value) -> Result<OAuthUserInfo, String>>,
20}
21impl AtlassianOptions {
22    #[must_use]
23    pub fn new(client_id: impl Into<String>, client_secret: impl Into<String>) -> Self {
24        Self {
25            client_id: client_id.into(),
26            client_secret: client_secret.into(),
27            scope: Vec::new(),
28            disable_default_scope: false,
29            prompt: None,
30            authorization_endpoint: None,
31            redirect_uri: None,
32            user_info_endpoint: None,
33            map_profile_to_user: None,
34        }
35    }
36}
37impl std::fmt::Debug for AtlassianOptions {
38    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
39        f.debug_struct("AtlassianOptions")
40            .field("client_id", &self.client_id)
41            .field("scope", &self.scope)
42            .field("disable_default_scope", &self.disable_default_scope)
43            .field("prompt", &self.prompt)
44            .field("authorization_endpoint", &self.authorization_endpoint)
45            .field("redirect_uri", &self.redirect_uri)
46            .finish_non_exhaustive()
47    }
48}
49impl OAuthProvider {
50    #[must_use]
51    pub fn atlassian(client_id: &str, client_secret: &str) -> Self {
52        Self::atlassian_with_options(AtlassianOptions::new(client_id, client_secret))
53    }
54    #[must_use]
55    pub fn atlassian_with_options(options: AtlassianOptions) -> Self {
56        let mut provider = Self {
57            client_id: options.client_id,
58            client_secret: options.client_secret,
59            additional_client_ids: Vec::new(),
60            hosted_domain: None,
61            require_email_verification: false,
62            auth_url: String::new(),
63            token_url: String::new(),
64            user_info_url: None,
65            scopes: Vec::new(),
66            authorization: None,
67            authorization_params: Vec::new(),
68            account_subject: None,
69            map_user_info: None,
70            get_user_info: None,
71            refresh_access_token: None,
72            verify_id_token: None,
73            id_token: None,
74            disable_id_token_sign_in: false,
75            disable_implicit_sign_up: false,
76            disable_sign_up: false,
77            override_user_info_on_sign_in: false,
78        };
79        provider.auth_url = options
80            .authorization_endpoint
81            .filter(|value| !value.is_empty())
82            .unwrap_or_else(|| "https://auth.atlassian.com/authorize".into());
83        provider.token_url = "https://auth.atlassian.com/oauth/token".into();
84        provider.user_info_url = Some(
85            options
86                .user_info_endpoint
87                .unwrap_or_else(|| "https://api.atlassian.com/me".into()),
88        );
89        provider.scopes = vec!["read:jira-user".into(), "offline_access".into()];
90        provider.authorization = Some(OAuthAuthorizationPolicy {
91            configured_scopes: options.scope,
92            disable_default_scopes: options.disable_default_scope,
93            prompt: options.prompt,
94            redirect_uri: options.redirect_uri,
95            require_client_secret: true,
96            login_hint: false,
97            ..OAuthAuthorizationPolicy::default()
98        });
99        provider.authorization_params = vec![("audience".into(), "api.atlassian.com".into())];
100        provider.map_user_info = Some(atlassian_user_info);
101        if let Some(mapper) = options.map_profile_to_user {
102            provider.get_user_info = Some(std::sync::Arc::new(AtlassianMappedUserInfo {
103                url: provider.user_info_url.clone().unwrap_or_default(),
104                mapper,
105            }));
106        }
107        provider
108    }
109}
110fn string(value: Option<&Value>) -> Result<Option<String>, String> {
111    match value {
112        Some(Value::String(value)) => Ok(Some(value.clone())),
113        Some(Value::Number(value)) => alibi_core::utils::json::number_to_string(value)
114            .map(Some)
115            .map_err(|error| error.to_string()),
116        Some(Value::Bool(value)) => Ok(Some(value.to_string())),
117        None | Some(Value::Null) => Ok(None),
118        _ => Err("Invalid Atlassian profile field".into()),
119    }
120}
121fn subject(profile: &Value) -> Result<String, String> {
122    let value = string(profile.get("account_id"))?.ok_or("Missing Atlassian account_id")?;
123    if value
124        .trim_matches(|character: char| {
125            (character.is_whitespace() && character != '\u{85}') || character == '\u{feff}'
126        })
127        .is_empty()
128        || value == "null"
129        || value == "undefined"
130    {
131        return Err("Invalid Atlassian account_id".into());
132    }
133    Ok(value)
134}
135fn atlassian_user_info(profile: Value) -> Result<OAuthUserInfo, String> {
136    let name = match profile.get("name") {
137        Some(Value::Bool(false)) => String::new(),
138        Some(Value::Number(value)) if value.as_f64() == Some(0.0) => String::new(),
139        value => string(value)?.unwrap_or_default(),
140    };
141    Ok(OAuthUserInfo {
142        additional_fields: Default::default(),
143        id: subject(&profile)?,
144        name: Some(name),
145        email: profile
146            .get("email")
147            .and_then(Value::as_str)
148            .unwrap_or_default()
149            .into(),
150        image: string(profile.get("picture"))?,
151        email_verified: false,
152    })
153}
154struct AtlassianMappedUserInfo {
155    url: String,
156    mapper: fn(Value) -> Result<OAuthUserInfo, String>,
157}
158#[async_trait::async_trait]
159impl super::OAuthUserInfoHandler for AtlassianMappedUserInfo {
160    async fn get_user_info(
161        &self,
162        request: super::OAuthUserInfoRequest,
163    ) -> Result<super::OAuthUserInfoResponse, String> {
164        let access_token = request
165            .access_token
166            .ok_or("Missing Atlassian access token")?;
167        let response = reqwest::Client::new()
168            .get(&self.url)
169            .bearer_auth(access_token)
170            .send()
171            .await
172            .map_err(|error| error.to_string())?
173            .error_for_status()
174            .map_err(|error| error.to_string())?;
175        let profile: Value = response.json().await.map_err(|error| error.to_string())?;
176        let mut user = (self.mapper)(profile.clone())?;
177        let user_output = Some(user.public_profile(true));
178        user.id = subject(&profile)?;
179        Ok(super::OAuthUserInfoResponse {
180            user_output,
181            user,
182            data: profile,
183        })
184    }
185}
alibi_api/plugins/oauth/providers/atlassian.rs

alibi_api/plugins/oauth/providers/
atlassian.rs
