alibi_plugins/oauth/providers/
tiktok.rs

1//! `TikTok`'s client-key grants, comma-separated scopes and nested profile.
2use super::{
3    OAuthAuthorizationPolicy, OAuthProvider, OAuthTokenEndpointAuth, OAuthUserInfo,
4    OAuthUserInfoHandler, OAuthUserInfoRequest, OAuthUserInfoResponse,
5};
6use serde_json::Map;
7use serde_json::Value;
8
9#[derive(Clone)]
10pub struct TikTokOptions {
11    pub client_key: String,
12    pub client_secret: String,
13    pub scope: Vec<String>,
14    pub disable_default_scope: bool,
15    pub redirect_uri: Option<String>,
16    /// Trusted transport override, preserving the published fields query.
17    pub user_info_endpoint: Option<String>,
18}
19impl TikTokOptions {
20    #[must_use]
21    pub fn new(client_key: impl Into<String>, client_secret: impl Into<String>) -> Self {
22        Self {
23            client_key: client_key.into(),
24            client_secret: client_secret.into(),
25            scope: Vec::new(),
26            disable_default_scope: false,
27            redirect_uri: None,
28            user_info_endpoint: None,
29        }
30    }
31}
32impl std::fmt::Debug for TikTokOptions {
33    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
34        f.debug_struct("TikTokOptions")
35            .field("client_key", &self.client_key)
36            .field("scope", &self.scope)
37            .finish_non_exhaustive()
38    }
39}
40impl OAuthProvider {
41    #[must_use]
42    pub fn tiktok(client_key: &str, client_secret: &str) -> Self {
43        Self::tiktok_with_options(TikTokOptions::new(client_key, client_secret))
44    }
45    #[must_use]
46    pub fn tiktok_with_options(options: TikTokOptions) -> Self {
47        let endpoint = options
48            .user_info_endpoint
49            .unwrap_or_else(|| "https://open.tiktokapis.com/v2/user/info/".into());
50        Self {
51            client_id: options.client_key,
52            client_secret: options.client_secret,
53            additional_client_ids: Vec::new(),
54            hosted_domain: None,
55            require_email_verification: false,
56            auth_url: "https://www.tiktok.com/v2/auth/authorize".into(),
57            token_url: "https://open.tiktokapis.com/v2/oauth/token/".into(),
58            user_info_url: Some(endpoint.clone()),
59            scopes: vec!["user.info.profile".into()],
60            authorization: Some(OAuthAuthorizationPolicy {
61                preserve_raw_profile_scalars: true,
62                source_profile_exceptions: true,
63                client_id_parameter: "client_key".into(),
64                scope_separator: ",".into(),
65                emit_empty_scope: true,
66                configured_scopes: options.scope,
67                disable_default_scopes: options.disable_default_scope,
68                redirect_uri: options.redirect_uri,
69                pkce: false,
70                authorization_code_pkce: Some(true),
71                login_hint: false,
72                token_endpoint_auth: Some(OAuthTokenEndpointAuth::ClientKeyPost),
73                allow_missing_access_token: true,
74                preserve_raw_email_errors: true,
75                supports_profile_mapper: false,
76                ..OAuthAuthorizationPolicy::default()
77            }),
78            allowed_request_params: Vec::new(),
79            authorization_params: Vec::new(),
80            account_subject: Some(subject),
81            map_user_info: None,
82            get_user_info: Some(std::sync::Arc::new(TikTokProfile { endpoint })),
83            refresh_access_token: None,
84            verify_id_token: None,
85            id_token: None,
86            disable_id_token_sign_in: false,
87            disable_implicit_sign_up: false,
88            disable_sign_up: false,
89            allow_idp_initiated: false,
90            override_user_info_on_sign_in: false,
91        }
92    }
93}
94fn subject(profile: &Value) -> Result<String, String> {
95    super::remaining_profile::raw_subject(profile.pointer("/data/user/open_id"))
96}
97struct TikTokProfile {
98    endpoint: String,
99}
100#[async_trait::async_trait]
101impl OAuthUserInfoHandler for TikTokProfile {
102    fn errors_are_exceptions(&self) -> bool {
103        false
104    }
105
106    async fn get_user_info(
107        &self,
108        request: OAuthUserInfoRequest,
109    ) -> Result<OAuthUserInfoResponse, String> {
110        let profile: Value = reqwest::Client::new()
111            .get(&self.endpoint)
112            .query(&[("fields", "open_id,avatar_large_url,display_name,username")])
113            .bearer_auth(super::remaining_profile::bearer_access_token(&request)?)
114            .send()
115            .await
116            .map_err(|e| e.to_string())?
117            .error_for_status()
118            .map_err(|e| e.to_string())?
119            .json()
120            .await
121            .map_err(|e| e.to_string())?;
122        let data = profile
123            .pointer("/data/user")
124            .filter(|value| !value.is_null())
125            .ok_or_else(|| super::remaining_profile::profile_exception("Missing TikTok user"))?;
126        let raw_id = data
127            .get("open_id")
128            .map(super::remaining_profile::js_string)
129            .transpose()
130            .map_err(super::remaining_profile::profile_exception)?
131            .unwrap_or_else(|| "undefined".into());
132        let email = if let Some(email) = data
133            .get("email")
134            .filter(|value| super::remaining_profile::truthy(value))
135        {
136            email.clone()
137        } else {
138            let email = format!("{raw_id}@tiktok.placeholder.invalid");
139            if !crate::authentication_helpers::is_valid_email(&email) {
140                return Err(super::remaining_profile::profile_exception(
141                    "Invalid TikTok placeholder email",
142                ));
143            }
144            Value::String(email)
145        };
146        let name = data
147            .get("display_name")
148            .filter(|value| super::remaining_profile::truthy(value))
149            .or_else(|| {
150                data.get("username")
151                    .filter(|value| super::remaining_profile::truthy(value))
152            })
153            .cloned()
154            .unwrap_or_else(|| Value::String(String::new()));
155        let mut output = serde_json::Map::new();
156        _ = output.insert("name".into(), name.clone());
157        _ = output.insert("email".into(), email.clone());
158        _ = output.insert("emailVerified".into(), Value::Bool(false));
159        if let Some(image) = data.get("avatar_large_url") {
160            _ = output.insert("image".into(), image.clone());
161        }
162        let user = OAuthUserInfo {
163            additional_fields: Map::default(),
164            id: raw_id,
165            name: super::remaining_profile::scalar(Some(&name))?,
166            email: email.as_str().unwrap_or_default().into(),
167            image: super::remaining_profile::scalar(data.get("avatar_large_url"))?,
168            email_verified: false,
169        };
170        Ok(OAuthUserInfoResponse {
171            user_output: Some(output),
172            user,
173            data: profile,
174        })
175    }
176}
alibi_plugins/oauth/providers/tiktok.rs

alibi_plugins/oauth/providers/
tiktok.rs
