alibi_plugins/oauth_provider/
continuation.rs

1//! Resume provider-issued authorization state after an authenticated interaction.
2use super::OAuthProviderPlugin;
3use alibi_core::endpoint::{EndpointResponse, ServerEndpoint};
4use alibi_core::session::SessionRequest;
5use alibi_core::utils::json::JsValue;
6use alibi_core::{AuthContext, AuthError, AuthResult, AuthSchema};
7use serde_json::{Value, json};
8#[derive(serde::Deserialize)]
9pub(super) struct ContinuationInput {
10    selected: Option<bool>,
11    created: Option<bool>,
12    #[serde(rename = "postLogin")]
13    post_login: Option<bool>,
14    oauth_query: Option<String>,
15}
16pub(super) fn validate(input: Option<&JsValue>) -> AuthResult<JsValue> {
17    use crate::authentication_helpers::{JsonField, JsonFieldKind};
18    crate::endpoint::validate_fields(
19        input,
20        "body",
21        &[
22            JsonField {
23                name: "selected",
24                kind: JsonFieldKind::Boolean,
25                required: false,
26            },
27            JsonField {
28                name: "created",
29                kind: JsonFieldKind::Boolean,
30                required: false,
31            },
32            JsonField {
33                name: "postLogin",
34                kind: JsonFieldKind::Boolean,
35                required: false,
36            },
37            JsonField::string("oauth_query", false),
38        ],
39    )
40}
41pub(super) fn interaction_query(supplied: &str) -> serde_json::Map<String, Value> {
42    let mut query = serde_json::Map::new();
43    for (key, value) in url::form_urlencoded::parse(supplied.as_bytes()) {
44        if ["sig", "exp", "ba_iat", "ba_pl"].contains(&key.as_ref()) {
45            continue;
46        }
47        match query.entry(key.into_owned()) {
48            serde_json::map::Entry::Vacant(entry) => {
49                _ = entry.insert(json!(value));
50            }
51            serde_json::map::Entry::Occupied(mut entry) => {
52                let previous = entry.get().clone();
53                if let Some(values) = entry.get_mut().as_array_mut() {
54                    values.push(json!(value));
55                } else {
56                    _ = entry.insert(json!([previous, value]));
57                }
58            }
59        }
60    }
61    query
62}
63impl OAuthProviderPlugin {
64    /// Resume a signed OAuth request after account selection, registration or post-login interaction.
65    pub fn oauth2_continue_endpoint(
66        input: &impl serde::Serialize,
67    ) -> AuthResult<ServerEndpoint<Value>> {
68        ServerEndpoint::new("oauth-provider", "oauth2Continue").with_body(input)
69    }
70    pub(super) async fn continue_authorization<S: AuthSchema>(
71        &self,
72        input: ContinuationInput,
73        req: &impl SessionRequest,
74        ctx: &AuthContext<S>,
75    ) -> AuthResult<EndpointResponse> {
76        let supplied = input.oauth_query.as_deref().unwrap_or("");
77        if !supplied.is_empty()
78            && !super::authorization::verify_authorization_query(
79                supplied,
80                ctx.config.current_secret(),
81            )?
82        {
83            return Ok(EndpointResponse::error(AuthError::Api {
84                status: 400,
85                code: None,
86                message: String::new(),
87            })
88            .with_error_body(alibi_core::utils::json::parse_value(
89                r#"{"error":"invalid_signature"}"#,
90            )?));
91        }
92        _ = Box::pin(crate::helpers::ordinary_session(req, ctx)).await?;
93        let remove = if input.selected == Some(true) {
94            Some("select_account")
95        } else if input.created == Some(true) {
96            Some("create")
97        } else if input.post_login == Some(true) {
98            None
99        } else {
100            return super::clients::status_protocol_error(
101                400,
102                "invalid_request",
103                "Missing parameters",
104            );
105        };
106        if supplied.is_empty() {
107            return super::clients::status_protocol_error(
108                400,
109                "invalid_request",
110                "missing oauth query",
111            );
112        }
113        let mut query = interaction_query(supplied);
114        if let Some(remove) = remove
115            && let Some(prompt) = query.get("prompt").and_then(Value::as_str)
116        {
117            let mut prompts = prompt.split(' ').collect::<Vec<_>>();
118            if let Some(index) = prompts.iter().position(|prompt| *prompt == remove) {
119                _ = prompts.remove(index);
120                if prompts.is_empty() {
121                    _ = query.remove("prompt");
122                } else {
123                    _ = query.insert("prompt".into(), json!(prompts.join(" ")));
124                }
125            }
126        }
127        Box::pin(self.resume_authorization(query, req, ctx)).await
128    }
129}
alibi_plugins/oauth_provider/continuation.rs

alibi_plugins/oauth_provider/
continuation.rs
