alibi_core/config/
account.rs

1use crate::config::TrustedProvidersResolver;
2/// Account-level configuration: linking, token encryption, sign-in behavior.
3#[derive(Debug, Clone)]
4pub struct AccountConfig {
5    pub additional_fields: crate::field_policy::FieldConfigs,
6    /// Update OAuth tokens on every sign-in (default: true)
7    pub update_account_on_sign_in: bool,
8    /// Account linking settings
9    pub account_linking: AccountLinkingConfig,
10    /// Encrypt OAuth tokens at rest (default: false)
11    pub encrypt_oauth_tokens: bool,
12    /// Store account data in an account cookie for OAuth-backed access token flows.
13    pub store_account_cookie: bool,
14    /// Override the account cookie lifetime in seconds, including fractional
15    /// and nonfinite values. Equivalent to the published ``account_data`` cookie's
16    /// maxAge attribute; takes precedence over the integer advanced override.
17    /// None inherits the session cache lifetime (or 300 seconds).
18    pub cookie_max_age: Option<f64>,
19    /// Where to persist OAuth state during the authorization flow. Automatic
20    /// selects database state with a server store, cookie state without one.
21    pub store_state_strategy: OAuthStateStrategy,
22    /// Skip state-cookie verification during callback processing.
23    ///
24    /// This is security-sensitive and should stay disabled in normal use.
25    pub skip_state_cookie_check: bool,
26}
27
28/// Settings that control how OAuth accounts are linked to existing users.
29#[derive(Debug, Clone)]
30pub struct AccountLinkingConfig {
31    /// Enable account linking (default: true)
32    pub enabled: bool,
33    /// Providers trusted for linking even when their email is unverified.
34    /// Empty does not bypass the provider email-verification requirement.
35    pub trusted_providers: Vec<String>,
36    /// Optional async policy replacing the static list at init and per request.
37    pub trusted_providers_resolver: Option<std::sync::Arc<dyn TrustedProvidersResolver>>,
38    /// Allow linking accounts with different emails (default: false) - SECURITY WARNING
39    pub allow_different_emails: bool,
40    /// Allow unlinking all accounts (default: false)
41    pub allow_unlinking_all: bool,
42    /// Disable implicit linking during sign-in; only explicit link-social may link.
43    pub disable_implicit_linking: bool,
44    /// Require the *existing local* account's email to be verified before a
45    /// social account may be linked to it implicitly (default: true).
46    pub require_local_email_verified: bool,
47    /// Update user info when a new account is linked (default: false)
48    pub update_user_info_on_link: bool,
49}
50
51/// Strategy for persisting OAuth state between the sign-in and callback steps.
52#[derive(Debug, Clone, Copy, PartialEq, Eq, Default)]
53pub enum OAuthStateStrategy {
54    /// Select the deployment default during builder initialization. Initialized
55    /// contexts never retain this variant. Low-level uninitialized contexts
56    /// keep the historical database fallback for compatibility.
57    #[default]
58    Automatic,
59    /// Persist state in an encrypted cookie.
60    Cookie,
61    /// Persist state in the verification store plus a signed state cookie.
62    Database,
63}
64
65impl Default for AccountConfig {
66    fn default() -> Self {
67        Self {
68            additional_fields: crate::field_policy::FieldConfigs::new(),
69            update_account_on_sign_in: true,
70            account_linking: AccountLinkingConfig::default(),
71            encrypt_oauth_tokens: false,
72            store_account_cookie: false,
73            cookie_max_age: None,
74            store_state_strategy: OAuthStateStrategy::Automatic,
75            skip_state_cookie_check: false,
76        }
77    }
78}
79
80impl Default for AccountLinkingConfig {
81    fn default() -> Self {
82        Self {
83            enabled: true,
84            trusted_providers: Vec::new(),
85            trusted_providers_resolver: None,
86            allow_different_emails: false,
87            allow_unlinking_all: false,
88            disable_implicit_linking: false,
89            require_local_email_verified: true,
90            update_user_info_on_link: false,
91        }
92    }
93}
alibi_core/config/account.rs

alibi_core/config/
account.rs
