alibi_plugins/oauth/providers/
gitlab.rs

1use super::{OAuthAuthorizationPolicy, OAuthProvider, OAuthUserInfo, Value};
2use serde_json::Map;
3impl OAuthProvider {
4    /// GitLab.com social login with the published `read_user` scope and PKCE.
5    #[must_use]
6    pub fn gitlab(client_id: &str, client_secret: &str) -> Self {
7        Self::gitlab_with_issuer(client_id, client_secret, "https://gitlab.com")
8    }
9
10    /// GitLab social login hosted at an application-configured issuer.
11    ///
12    /// The issuer may include a deployment path. Repeated path slashes follow
13    /// the pinned provider's endpoint construction rather than URL resolution.
14    pub fn gitlab_with_issuer(client_id: &str, client_secret: &str, issuer: &str) -> Self {
15        let issuer = if issuer.is_empty() {
16            "https://gitlab.com"
17        } else {
18            issuer
19        };
20        Self {
21            client_id: client_id.into(),
22            additional_client_ids: Vec::new(),
23            hosted_domain: None,
24            require_email_verification: false,
25            client_secret: client_secret.into(),
26            auth_url: gitlab_endpoint(issuer, "/oauth/authorize"),
27            token_url: gitlab_endpoint(issuer, "/oauth/token"),
28            user_info_url: Some(gitlab_endpoint(issuer, "/api/v4/user")),
29            scopes: vec!["read_user".into()],
30            authorization: Some(OAuthAuthorizationPolicy::default()),
31            authorization_params: Vec::new(),
32            account_subject: None,
33            map_user_info: Some(gitlab_user_info),
34            get_user_info: None,
35            refresh_access_token: None,
36            verify_id_token: None,
37            id_token: None,
38            disable_id_token_sign_in: false,
39            disable_implicit_sign_up: false,
40            disable_sign_up: false,
41            allow_idp_initiated: false,
42            override_user_info_on_sign_in: false,
43        }
44    }
45}
46
47pub(in crate::oauth::providers) fn gitlab_endpoint(issuer: &str, suffix: &str) -> String {
48    format!("{issuer}{suffix}")
49        .split("://")
50        .map(|part| {
51            let mut previous_slash = false;
52            part.chars()
53                .filter(|character| {
54                    let slash = *character == '/';
55                    let retain = !slash || !previous_slash;
56                    previous_slash = slash;
57                    retain
58                })
59                .collect::<String>()
60        })
61        .collect::<Vec<_>>()
62        .join("://")
63}
64
65#[expect(
66    clippy::needless_pass_by_value,
67    reason = "Match the public provider callback type, which owns its JSON profile"
68)]
69pub(in crate::oauth::providers) fn gitlab_user_info(
70    profile: Value,
71) -> Result<OAuthUserInfo, String> {
72    let locked = profile.get("locked").is_some_and(|value| match value {
73        Value::Null => false,
74        Value::Bool(value) => *value,
75        Value::Number(value) => value
76            .as_f64()
77            .is_some_and(|value| value != 0.0 && !value.is_nan()),
78        Value::String(value) => !value.is_empty(),
79        Value::Array(_) | Value::Object(_) => true,
80    });
81    if profile.get("state").and_then(Value::as_str) != Some("active") || locked {
82        return Err("GitLab account is inactive or locked".into());
83    }
84    let id = match profile.get("id") {
85        Some(Value::String(value)) => value.clone(),
86        Some(Value::Number(value)) => {
87            alibi_core::utils::json::number_to_string(value).map_err(|error| error.to_string())?
88        }
89        _ => return Err("Missing GitLab account ID".into()),
90    };
91    Ok(OAuthUserInfo {
92        additional_fields: Map::default(),
93        id,
94        email: profile
95            .get("email")
96            .and_then(Value::as_str)
97            .ok_or("Missing GitLab email")?
98            .into(),
99        name: Some(
100            profile
101                .get("name")
102                .filter(|value| !value.is_null())
103                .or_else(|| profile.get("username").filter(|value| !value.is_null()))
104                .and_then(Value::as_str)
105                .unwrap_or("")
106                .into(),
107        ),
108        image: profile
109            .get("avatar_url")
110            .and_then(Value::as_str)
111            .map(String::from),
112        email_verified: profile
113            .get("email_verified")
114            .and_then(Value::as_bool)
115            .unwrap_or(false),
116    })
117}
alibi_plugins/oauth/providers/gitlab.rs

alibi_plugins/oauth/providers/
gitlab.rs
