alibi_plugins/oauth/providers/
tiktok.rs

1//! `TikTok`'s client-key grants, comma-separated scopes and nested profile.
2use super::{
3    OAuthAuthorizationPolicy, OAuthProvider, OAuthTokenEndpointAuth, OAuthUserInfo,
4    OAuthUserInfoHandler, OAuthUserInfoRequest, OAuthUserInfoResponse,
5};
6use serde_json::Map;
7use serde_json::Value;
8
9#[derive(Clone)]
10pub struct TikTokOptions {
11    pub client_key: String,
12    pub client_secret: String,
13    pub scope: Vec<String>,
14    pub disable_default_scope: bool,
15    pub redirect_uri: Option<String>,
16    /// Trusted transport override, preserving the published fields query.
17    pub user_info_endpoint: Option<String>,
18}
19impl TikTokOptions {
20    #[must_use]
21    pub fn new(client_key: impl Into<String>, client_secret: impl Into<String>) -> Self {
22        Self {
23            client_key: client_key.into(),
24            client_secret: client_secret.into(),
25            scope: Vec::new(),
26            disable_default_scope: false,
27            redirect_uri: None,
28            user_info_endpoint: None,
29        }
30    }
31}
32impl std::fmt::Debug for TikTokOptions {
33    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
34        f.debug_struct("TikTokOptions")
35            .field("client_key", &self.client_key)
36            .field("scope", &self.scope)
37            .finish_non_exhaustive()
38    }
39}
40impl OAuthProvider {
41    #[must_use]
42    pub fn tiktok(client_key: &str, client_secret: &str) -> Self {
43        Self::tiktok_with_options(TikTokOptions::new(client_key, client_secret))
44    }
45    #[must_use]
46    pub fn tiktok_with_options(options: TikTokOptions) -> Self {
47        let endpoint = options
48            .user_info_endpoint
49            .unwrap_or_else(|| "https://open.tiktokapis.com/v2/user/info/".into());
50        Self {
51            client_id: options.client_key,
52            client_secret: options.client_secret,
53            additional_client_ids: Vec::new(),
54            hosted_domain: None,
55            require_email_verification: false,
56            auth_url: "https://www.tiktok.com/v2/auth/authorize".into(),
57            token_url: "https://open.tiktokapis.com/v2/oauth/token/".into(),
58            user_info_url: Some(endpoint.clone()),
59            scopes: vec!["user.info.profile".into()],
60            authorization: Some(OAuthAuthorizationPolicy {
61                preserve_raw_profile_scalars: true,
62                source_profile_exceptions: true,
63                client_id_parameter: "client_key".into(),
64                scope_separator: ",".into(),
65                emit_empty_scope: true,
66                configured_scopes: options.scope,
67                disable_default_scopes: options.disable_default_scope,
68                redirect_uri: options.redirect_uri,
69                pkce: false,
70                authorization_code_pkce: Some(true),
71                login_hint: false,
72                token_endpoint_auth: Some(OAuthTokenEndpointAuth::ClientKeyPost),
73                allow_missing_access_token: true,
74                preserve_raw_email_errors: true,
75                supports_profile_mapper: false,
76                ..OAuthAuthorizationPolicy::default()
77            }),
78            authorization_params: Vec::new(),
79            account_subject: Some(subject),
80            map_user_info: None,
81            get_user_info: Some(std::sync::Arc::new(TikTokProfile { endpoint })),
82            refresh_access_token: None,
83            verify_id_token: None,
84            id_token: None,
85            disable_id_token_sign_in: false,
86            disable_implicit_sign_up: false,
87            disable_sign_up: false,
88            allow_idp_initiated: false,
89            override_user_info_on_sign_in: false,
90        }
91    }
92}
93fn subject(profile: &Value) -> Result<String, String> {
94    super::remaining_profile::raw_subject(profile.pointer("/data/user/open_id"))
95}
96struct TikTokProfile {
97    endpoint: String,
98}
99#[async_trait::async_trait]
100impl OAuthUserInfoHandler for TikTokProfile {
101    fn errors_are_exceptions(&self) -> bool {
102        false
103    }
104
105    async fn get_user_info(
106        &self,
107        request: OAuthUserInfoRequest,
108    ) -> Result<OAuthUserInfoResponse, String> {
109        let profile: Value = reqwest::Client::new()
110            .get(&self.endpoint)
111            .query(&[("fields", "open_id,avatar_large_url,display_name,username")])
112            .bearer_auth(super::remaining_profile::bearer_access_token(&request)?)
113            .send()
114            .await
115            .map_err(|e| e.to_string())?
116            .error_for_status()
117            .map_err(|e| e.to_string())?
118            .json()
119            .await
120            .map_err(|e| e.to_string())?;
121        let data = profile
122            .pointer("/data/user")
123            .filter(|value| !value.is_null())
124            .ok_or_else(|| super::remaining_profile::profile_exception("Missing TikTok user"))?;
125        let raw_id = data
126            .get("open_id")
127            .map(super::remaining_profile::js_string)
128            .transpose()
129            .map_err(super::remaining_profile::profile_exception)?
130            .unwrap_or_else(|| "undefined".into());
131        let email = if let Some(email) = data
132            .get("email")
133            .filter(|value| super::remaining_profile::truthy(value))
134        {
135            email.clone()
136        } else {
137            let email = format!("{raw_id}@tiktok.placeholder.invalid");
138            if !crate::authentication_helpers::is_valid_email(&email) {
139                return Err(super::remaining_profile::profile_exception(
140                    "Invalid TikTok placeholder email",
141                ));
142            }
143            Value::String(email)
144        };
145        let name = data
146            .get("display_name")
147            .filter(|value| super::remaining_profile::truthy(value))
148            .or_else(|| {
149                data.get("username")
150                    .filter(|value| super::remaining_profile::truthy(value))
151            })
152            .cloned()
153            .unwrap_or_else(|| Value::String(String::new()));
154        let mut output = serde_json::Map::new();
155        _ = output.insert("name".into(), name.clone());
156        _ = output.insert("email".into(), email.clone());
157        _ = output.insert("emailVerified".into(), Value::Bool(false));
158        if let Some(image) = data.get("avatar_large_url") {
159            _ = output.insert("image".into(), image.clone());
160        }
161        let user = OAuthUserInfo {
162            additional_fields: Map::default(),
163            id: raw_id,
164            name: super::remaining_profile::scalar(Some(&name))?,
165            email: email.as_str().unwrap_or_default().into(),
166            image: super::remaining_profile::scalar(data.get("avatar_large_url"))?,
167            email_verified: false,
168        };
169        Ok(OAuthUserInfoResponse {
170            user_output: Some(output),
171            user,
172            data: profile,
173        })
174    }
175}
alibi_plugins/oauth/providers/tiktok.rs

alibi_plugins/oauth/providers/
tiktok.rs
