alibi_plugins/oauth/providers/
atlassian.rs

1//! Atlassian's published scope, PKCE, fixed audience and stable account subject.
2use super::{OAuthAuthorizationPolicy, OAuthProvider, OAuthUserInfo};
3use serde_json::Map;
4use serde_json::Value;
5
6/// Atlassian-specific configuration; callback and persistence policies remain
7/// configurable on the returned OAuth provider.
8#[derive(Clone)]
9pub struct AtlassianOptions {
10    pub client_id: String,
11    pub client_secret: String,
12    pub scope: Vec<String>,
13    pub disable_default_scope: bool,
14    pub prompt: Option<String>,
15    pub authorization_endpoint: Option<String>,
16    pub redirect_uri: Option<String>,
17    /// Trusted user-info transport endpoint, retaining the Atlassian mapping.
18    pub user_info_endpoint: Option<String>,
19    /// Receives the original profile. Its ID cannot replace `account_id`.
20    pub map_profile_to_user: Option<fn(Value) -> Result<OAuthUserInfo, String>>,
21}
22impl AtlassianOptions {
23    #[must_use]
24    pub fn new(client_id: impl Into<String>, client_secret: impl Into<String>) -> Self {
25        Self {
26            client_id: client_id.into(),
27            client_secret: client_secret.into(),
28            scope: Vec::new(),
29            disable_default_scope: false,
30            prompt: None,
31            authorization_endpoint: None,
32            redirect_uri: None,
33            user_info_endpoint: None,
34            map_profile_to_user: None,
35        }
36    }
37}
38impl std::fmt::Debug for AtlassianOptions {
39    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
40        f.debug_struct("AtlassianOptions")
41            .field("client_id", &self.client_id)
42            .field("scope", &self.scope)
43            .field("disable_default_scope", &self.disable_default_scope)
44            .field("prompt", &self.prompt)
45            .field("authorization_endpoint", &self.authorization_endpoint)
46            .field("redirect_uri", &self.redirect_uri)
47            .finish_non_exhaustive()
48    }
49}
50impl OAuthProvider {
51    #[must_use]
52    pub fn atlassian(client_id: &str, client_secret: &str) -> Self {
53        Self::atlassian_with_options(AtlassianOptions::new(client_id, client_secret))
54    }
55    #[must_use]
56    pub fn atlassian_with_options(options: AtlassianOptions) -> Self {
57        let mut provider = Self {
58            client_id: options.client_id,
59            client_secret: options.client_secret,
60            additional_client_ids: Vec::new(),
61            hosted_domain: None,
62            require_email_verification: false,
63            auth_url: String::new(),
64            token_url: String::new(),
65            user_info_url: None,
66            scopes: Vec::new(),
67            authorization: None,
68            authorization_params: Vec::new(),
69            account_subject: None,
70            map_user_info: None,
71            get_user_info: None,
72            refresh_access_token: None,
73            verify_id_token: None,
74            id_token: None,
75            disable_id_token_sign_in: false,
76            disable_implicit_sign_up: false,
77            disable_sign_up: false,
78            allow_idp_initiated: false,
79            override_user_info_on_sign_in: false,
80        };
81        provider.auth_url = options
82            .authorization_endpoint
83            .filter(|value| !value.is_empty())
84            .unwrap_or_else(|| "https://auth.atlassian.com/authorize".into());
85        provider.token_url = "https://auth.atlassian.com/oauth/token".into();
86        provider.user_info_url = Some(
87            options
88                .user_info_endpoint
89                .unwrap_or_else(|| "https://api.atlassian.com/me".into()),
90        );
91        provider.scopes = vec!["read:jira-user".into(), "offline_access".into()];
92        provider.authorization = Some(OAuthAuthorizationPolicy {
93            configured_scopes: options.scope,
94            disable_default_scopes: options.disable_default_scope,
95            prompt: options.prompt,
96            redirect_uri: options.redirect_uri,
97            require_client_secret: true,
98            login_hint: false,
99            ..OAuthAuthorizationPolicy::default()
100        });
101        provider.authorization_params = vec![("audience".into(), "api.atlassian.com".into())];
102        provider.map_user_info = Some(atlassian_user_info);
103        if let Some(mapper) = options.map_profile_to_user {
104            provider.get_user_info = Some(std::sync::Arc::new(AtlassianMappedUserInfo {
105                url: provider.user_info_url.clone().unwrap_or_default(),
106                mapper,
107            }));
108        }
109        provider
110    }
111}
112fn string(value: Option<&Value>) -> Result<Option<String>, String> {
113    match value {
114        Some(Value::String(value)) => Ok(Some(value.clone())),
115        Some(Value::Number(value)) => alibi_core::utils::json::number_to_string(value)
116            .map(Some)
117            .map_err(|error| error.to_string()),
118        Some(Value::Bool(value)) => Ok(Some(value.to_string())),
119        None | Some(Value::Null) => Ok(None),
120        _ => Err("Invalid Atlassian profile field".into()),
121    }
122}
123fn subject(profile: &Value) -> Result<String, String> {
124    let value = string(profile.get("account_id"))?.ok_or("Missing Atlassian account_id")?;
125    if value
126        .trim_matches(|character: char| {
127            (character.is_whitespace() && character != '\u{85}') || character == '\u{feff}'
128        })
129        .is_empty()
130        || value == "null"
131        || value == "undefined"
132    {
133        return Err("Invalid Atlassian account_id".into());
134    }
135    Ok(value)
136}
137#[expect(
138    clippy::needless_pass_by_value,
139    reason = "signature fixed by the map_user_info callback type"
140)]
141fn atlassian_user_info(profile: Value) -> Result<OAuthUserInfo, String> {
142    let name = match profile.get("name") {
143        Some(Value::Bool(false)) => String::new(),
144        Some(Value::Number(value)) if value.as_f64() == Some(0.0) => String::new(),
145        value => string(value)?.unwrap_or_default(),
146    };
147    Ok(OAuthUserInfo {
148        additional_fields: Map::default(),
149        id: subject(&profile)?,
150        name: Some(name),
151        email: profile
152            .get("email")
153            .and_then(Value::as_str)
154            .unwrap_or_default()
155            .into(),
156        image: string(profile.get("picture"))?,
157        email_verified: false,
158    })
159}
160struct AtlassianMappedUserInfo {
161    url: String,
162    mapper: fn(Value) -> Result<OAuthUserInfo, String>,
163}
164#[async_trait::async_trait]
165impl super::OAuthUserInfoHandler for AtlassianMappedUserInfo {
166    async fn get_user_info(
167        &self,
168        request: super::OAuthUserInfoRequest,
169    ) -> Result<super::OAuthUserInfoResponse, String> {
170        let access_token = request
171            .access_token
172            .ok_or("Missing Atlassian access token")?;
173        let response = reqwest::Client::new()
174            .get(&self.url)
175            .bearer_auth(access_token)
176            .send()
177            .await
178            .map_err(|error| error.to_string())?
179            .error_for_status()
180            .map_err(|error| error.to_string())?;
181        let profile: Value = response.json().await.map_err(|error| error.to_string())?;
182        let mut user = (self.mapper)(profile.clone())?;
183        let user_output = Some(user.public_profile(true));
184        user.id = subject(&profile)?;
185        Ok(super::OAuthUserInfoResponse {
186            user_output,
187            user,
188            data: profile,
189        })
190    }
191}
alibi_plugins/oauth/providers/atlassian.rs

alibi_plugins/oauth/providers/
atlassian.rs
