alibi_core/config/
account.rs

1use crate::config::TrustedProvidersResolver;
2/// Account-level configuration: linking, token encryption, sign-in behavior.
3#[derive(Debug, Clone)]
4pub struct AccountConfig {
5    pub additional_fields: crate::field_policy::FieldConfigs,
6    /// Update OAuth tokens on every sign-in (default: true)
7    pub update_account_on_sign_in: bool,
8    /// Account linking settings
9    pub account_linking: AccountLinkingConfig,
10    /// Encrypt OAuth tokens at rest (default: false)
11    pub encrypt_oauth_tokens: bool,
12    /// Store account data in an account cookie for OAuth-backed access token flows.
13    pub store_account_cookie: bool,
14    /// Override the account cookie lifetime in seconds, including fractional
15    /// and nonfinite values. Equivalent to the published ``account_data`` cookie's
16    /// maxAge attribute; takes precedence over the integer advanced override.
17    /// None inherits the session cache lifetime (or 300 seconds).
18    pub cookie_max_age: Option<f64>,
19    /// Where to persist OAuth state during the authorization flow. Automatic
20    /// selects database state with a server store, cookie state without one.
21    pub store_state_strategy: OAuthStateStrategy,
22    /// Skip state-cookie verification during callback processing.
23    ///
24    /// This is security-sensitive and should stay disabled in normal use.
25    pub skip_state_cookie_check: bool,
26}
27
28/// Settings that control how OAuth accounts are linked to existing users.
29#[derive(Debug, Clone)]
30pub struct AccountLinkingConfig {
31    /// Enable account linking (default: true)
32    pub enabled: bool,
33    /// Providers trusted for linking even when their email is unverified.
34    /// Empty does not bypass the provider email-verification requirement.
35    pub trusted_providers: Vec<String>,
36    /// Optional async policy replacing the static list at init and per request.
37    pub trusted_providers_resolver: Option<std::sync::Arc<dyn TrustedProvidersResolver>>,
38    /// Allow linking accounts with different emails (default: false) - SECURITY WARNING
39    pub allow_different_emails: bool,
40    /// Allow unlinking all accounts (default: false)
41    pub allow_unlinking_all: bool,
42    /// Disable implicit linking during sign-in; only explicit link-social may link.
43    pub disable_implicit_linking: bool,
44    /// Require the *existing local* account's email to be verified before a
45    /// social account may be linked to it implicitly (default: true).
46    pub require_local_email_verified: bool,
47    /// Update user info when a new account is linked (default: false)
48    pub update_user_info_on_link: bool,
49}
50
51/// Strategy for persisting OAuth state between the sign-in and callback steps.
52#[derive(Debug, Clone, Copy, PartialEq, Eq, Default)]
53pub enum OAuthStateStrategy {
54    /// Select the deployment default during initialization. Initialized
55    /// contexts never retain this variant.
56    #[default]
57    Automatic,
58    /// Persist state in an encrypted cookie.
59    Cookie,
60    /// Persist state in the verification store plus a signed state cookie.
61    Database,
62}
63
64impl Default for AccountConfig {
65    fn default() -> Self {
66        Self {
67            additional_fields: crate::field_policy::FieldConfigs::new(),
68            update_account_on_sign_in: true,
69            account_linking: AccountLinkingConfig::default(),
70            encrypt_oauth_tokens: false,
71            store_account_cookie: false,
72            cookie_max_age: None,
73            store_state_strategy: OAuthStateStrategy::Automatic,
74            skip_state_cookie_check: false,
75        }
76    }
77}
78
79impl Default for AccountLinkingConfig {
80    fn default() -> Self {
81        Self {
82            enabled: true,
83            trusted_providers: Vec::new(),
84            trusted_providers_resolver: None,
85            allow_different_emails: false,
86            allow_unlinking_all: false,
87            disable_implicit_linking: false,
88            require_local_email_verified: true,
89            update_user_info_on_link: false,
90        }
91    }
92}
alibi_core/config/account.rs

alibi_core/config/
account.rs
