alibi_api/plugins/oauth/providers/
discord.rs

1use super::*;
2impl OAuthProvider {
3    #[must_use]
4    pub fn discord(client_id: &str, client_secret: &str) -> Self {
5        Self {
6            client_id: client_id.to_owned(),
7            additional_client_ids: Vec::new(),
8            hosted_domain: None,
9            require_email_verification: false,
10            client_secret: client_secret.to_owned(),
11            auth_url: "https://discord.com/api/oauth2/authorize".to_owned(),
12            token_url: "https://discord.com/api/oauth2/token".to_owned(),
13            user_info_url: Some("https://discord.com/api/users/@me".to_owned()),
14            scopes: vec!["identify".to_owned(), "email".to_owned()],
15            authorization: Some(OAuthAuthorizationPolicy {
16                scope_order: OAuthScopeOrder::RequestedThenConfigured,
17                pkce: false,
18                default_prompt: Some("none".into()),
19                ..OAuthAuthorizationPolicy::default()
20            }),
21            authorization_params: Vec::new(),
22            account_subject: None,
23            map_user_info: Some(discord_user_info),
24            get_user_info: None,
25            refresh_access_token: None,
26            verify_id_token: None,
27            id_token: None,
28            disable_id_token_sign_in: false,
29            disable_implicit_sign_up: false,
30            disable_sign_up: false,
31            override_user_info_on_sign_in: false,
32        }
33    }
34}
35
36/// Discord's normalized user fields for its declared string profile schema.
37#[expect(
38    clippy::needless_pass_by_value,
39    reason = "Match the public provider callback type, which owns its JSON profile"
40)]
41pub(in crate::plugins::oauth::providers) fn discord_user_info(
42    profile: Value,
43) -> Result<OAuthUserInfo, String> {
44    let id = profile
45        .get("id")
46        .and_then(Value::as_str)
47        .ok_or("missing id")?;
48    let email = profile
49        .get("email")
50        .and_then(Value::as_str)
51        .ok_or("missing email")?;
52    let image = if profile.get("avatar").is_some_and(Value::is_null) {
53        let discriminator = profile
54            .get("discriminator")
55            .and_then(Value::as_str)
56            .ok_or("missing discriminator")?;
57        let index = if discriminator == "0" {
58            // Source converts the shifted BigInt to Number before remainder.
59            // This must retain f64 rounding and overflow, rather than exact mod.
60            if id.is_empty() || !id.bytes().all(|byte| byte.is_ascii_digit()) {
61                return Err("invalid Discord decimal snowflake".to_owned());
62            }
63            let snowflake =
64                rsa::BigUint::parse_bytes(id.as_bytes(), 10).ok_or("invalid Discord snowflake")?;
65            let shifted = (snowflake >> 22usize)
66                .to_str_radix(10)
67                .parse::<f64>()
68                .map_err(|_error| "invalid Discord snowflake number")?;
69            shifted % 6.0
70        } else {
71            // Discord's declared discriminator consists of decimal digits.
72            discriminator
73                .parse::<f64>()
74                .map_err(|_error| "invalid Discord discriminator")?
75                % 5.0
76        };
77        format!("https://cdn.discordapp.com/embed/avatars/{index}.png")
78    } else {
79        let avatar = profile
80            .get("avatar")
81            .and_then(Value::as_str)
82            .ok_or("missing avatar")?;
83        let format = if avatar.starts_with("a_") {
84            "gif"
85        } else {
86            "png"
87        };
88        format!("https://cdn.discordapp.com/avatars/{id}/{avatar}.{format}")
89    };
90    Ok(OAuthUserInfo {
91        additional_fields: Default::default(),
92        id: id.to_owned(),
93        email: email.to_owned(),
94        name: Some(
95            profile
96                .get("global_name")
97                .and_then(Value::as_str)
98                .filter(|name| !name.is_empty())
99                .or_else(|| profile.get("username").and_then(Value::as_str))
100                .unwrap_or_default()
101                .to_owned(),
102        ),
103        image: Some(image),
104        email_verified: profile
105            .get("verified")
106            .and_then(Value::as_bool)
107            .unwrap_or(false),
108    })
109}
alibi_api/plugins/oauth/providers/discord.rs

alibi_api/plugins/oauth/providers/
discord.rs
