alibi_plugins/sso/
provider_list.rs

1//! Enumerate only configurations the authenticated caller can manage.
2use super::{
3    AuthContext, AuthResult, AuthSchema, AuthUser, EndpointResponse, SessionRequest, SsoPlugin,
4    Value, json,
5};
6impl SsoPlugin {
7    #[must_use]
8    pub fn list_sso_providers_endpoint() -> super::ServerEndpoint<Value> {
9        super::ServerEndpoint::new("sso", "listSSOProviders")
10    }
11    pub(super) async fn list<S: AuthSchema>(
12        &self,
13        request: &impl SessionRequest,
14        ctx: &AuthContext<S>,
15    ) -> AuthResult<EndpointResponse> {
16        let (user, _) = super::super::helpers::ordinary_session(request, ctx).await?;
17        let rows = ctx.database.list_sso_providers().await?;
18        let org_enabled = ctx
19            .get_metadata(super::super::organization::METADATA_ENABLED)
20            .is_some();
21        let mut accessible = Vec::new();
22        for row in rows.iter().filter(|row| {
23            row.organization_id.is_none() && row.user_id.as_deref() == Some(user.id().as_ref())
24        }) {
25            accessible.push(super::provider_read::sanitize(row, ctx)?);
26        }
27        for row in rows.iter().filter(|row| row.organization_id.is_some()) {
28            let allowed = if org_enabled {
29                if let Some(id) = row.organization_id.as_deref().filter(|id| !id.is_empty()) {
30                    ctx.database
31                        .get_member(id, user.id().as_ref())
32                        .await?
33                        .is_some_and(|member| {
34                            member
35                                .role
36                                .split(',')
37                                .any(|role| matches!(role.trim(), "owner" | "admin"))
38                        })
39                } else {
40                    false
41                }
42            } else {
43                row.user_id.as_deref() == Some(user.id().as_ref())
44            };
45            if allowed {
46                accessible.push(super::provider_read::sanitize(row, ctx)?);
47            }
48        }
49        EndpointResponse::json(&json!({"providers":accessible}))
50    }
51}
alibi_plugins/sso/provider_list.rs

alibi_plugins/sso/
provider_list.rs
