Skip to main content

alibi_plugins/oauth_provider/
token_storage.rs

1//! Application-owned token hashing shared by issuance, lookup and trusted server callers.
2use alibi_core::AuthResult;
3use async_trait::async_trait;
4use base64::{Engine as _, engine::general_purpose::URL_SAFE_NO_PAD};
5use sha2::{Digest as _, Sha256};
6
7/// Custom opaque-token storage matching Better Auth's `storeTokens.hash` callback.
8/// `kind` identifies the token domain; trusted callers may also supply application kinds.
9#[async_trait]
10pub trait OAuthTokenHasher: Send + Sync + std::fmt::Debug {
11    async fn hash(&self, token: &str, kind: &str) -> AuthResult<String>;
12}
13impl super::OAuthProviderPlugin {
14    /// Hash a token using this provider's storage policy (`getOAuthProviderApi().hashToken`).
15    pub async fn hash_token(&self, token: &str, kind: &str) -> AuthResult<String> {
16        if let Some(hasher) = &self.config.token_hasher {
17            hasher.hash(token, kind).await
18        } else {
19            Ok(URL_SAFE_NO_PAD.encode(Sha256::digest(token)))
20        }
21    }
22}