alibi_plugins/oauth/providers/
reddit.rs

1//! Reddit's non-PKCE Basic grants and stable placeholder-email profile.
2use super::{
3    OAuthAuthorizationPolicy, OAuthProvider, OAuthTokenEndpointAuth, OAuthUserInfo,
4    OAuthUserInfoHandler, OAuthUserInfoRequest, OAuthUserInfoResponse,
5};
6use async_trait::async_trait;
7use serde_json::Value;
8
9/// Application-owned Reddit configuration. Signup policies and asynchronous
10/// user-info/refresh overrides remain available on the returned native provider.
11#[derive(Clone)]
12pub struct RedditOptions {
13    pub client_id: String,
14    pub client_secret: Option<String>,
15    pub scope: Vec<String>,
16    pub disable_default_scope: bool,
17    /// Forwarded when nonempty; caller additional parameters take precedence.
18    pub duration: Option<String>,
19    pub authorization_endpoint: Option<String>,
20    pub redirect_uri: Option<String>,
21    /// Trusted application transport override preserving Reddit's mapping.
22    pub user_info_endpoint: Option<String>,
23    /// Receives the original profile before account identity resolution.
24    pub map_profile_to_user: Option<fn(Value) -> Result<OAuthUserInfo, String>>,
25}
26impl RedditOptions {
27    #[must_use]
28    pub fn new(client_id: impl Into<String>, client_secret: Option<String>) -> Self {
29        Self {
30            client_id: client_id.into(),
31            client_secret,
32            scope: Vec::new(),
33            disable_default_scope: false,
34            duration: None,
35            authorization_endpoint: None,
36            redirect_uri: None,
37            user_info_endpoint: None,
38            map_profile_to_user: None,
39        }
40    }
41}
42impl std::fmt::Debug for RedditOptions {
43    fn fmt(&self, formatter: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
44        formatter
45            .debug_struct("RedditOptions")
46            .field("client_id", &self.client_id)
47            .field("scope", &self.scope)
48            .field("disable_default_scope", &self.disable_default_scope)
49            .field("duration", &self.duration)
50            .field("authorization_endpoint", &self.authorization_endpoint)
51            .field("redirect_uri", &self.redirect_uri)
52            .finish_non_exhaustive()
53    }
54}
55impl OAuthProvider {
56    #[must_use]
57    pub fn reddit(client_id: &str, client_secret: Option<&str>) -> Self {
58        Self::reddit_with_options(RedditOptions::new(
59            client_id,
60            client_secret.map(str::to_owned),
61        ))
62    }
63    #[must_use]
64    pub fn reddit_with_options(options: RedditOptions) -> Self {
65        let endpoint = options
66            .user_info_endpoint
67            .unwrap_or_else(|| "https://oauth.reddit.com/api/v1/me".into());
68        Self {
69            client_id: options.client_id,
70            client_secret: options.client_secret.unwrap_or_default(),
71            additional_client_ids: Vec::new(),
72            hosted_domain: None,
73            require_email_verification: false,
74            auth_url: options
75                .authorization_endpoint
76                .filter(|v| !v.is_empty())
77                .unwrap_or_else(|| "https://www.reddit.com/api/v1/authorize".into()),
78            token_url: "https://www.reddit.com/api/v1/access_token".into(),
79            user_info_url: Some(endpoint.clone()),
80            scopes: vec!["identity".into()],
81            authorization: Some(OAuthAuthorizationPolicy {
82                preserve_raw_profile_scalars: true,
83                source_profile_exceptions: true,
84                allow_missing_access_token: true,
85                preserve_raw_email_errors: true,
86                configured_scopes: options.scope,
87                disable_default_scopes: options.disable_default_scope,
88                require_client_id: true,
89                token_endpoint_auth: Some(OAuthTokenEndpointAuth::ClientSecretBasic),
90                authorization_code_headers: vec![
91                    ("accept".into(), "text/plain".into()),
92                    ("user-agent".into(), "better-auth".into()),
93                ],
94                redirect_uri: options.redirect_uri,
95                login_hint: false,
96                pkce: false,
97                ..OAuthAuthorizationPolicy::default()
98            }),
99            allowed_request_params: Vec::new(),
100            authorization_params: options
101                .duration
102                .filter(|v| !v.is_empty())
103                .map(|v| vec![("duration".into(), v)])
104                .unwrap_or_default(),
105            account_subject: Some(subject),
106            map_user_info: None,
107            get_user_info: Some(std::sync::Arc::new(RedditUserInfo {
108                application_mapper: None,
109                endpoint,
110                mapper: options.map_profile_to_user,
111            })),
112            refresh_access_token: None,
113            verify_id_token: None,
114            id_token: None,
115            disable_id_token_sign_in: false,
116            disable_implicit_sign_up: false,
117            disable_sign_up: false,
118            allow_idp_initiated: false,
119            override_user_info_on_sign_in: false,
120        }
121    }
122}
123#[derive(Clone)]
124struct RedditUserInfo {
125    application_mapper: Option<std::sync::Arc<dyn super::OAuthProfileMapper>>,
126    endpoint: String,
127    mapper: Option<fn(Value) -> Result<OAuthUserInfo, String>>,
128}
129#[async_trait]
130impl OAuthUserInfoHandler for RedditUserInfo {
131    fn errors_are_exceptions(&self) -> bool {
132        false
133    }
134
135    fn mapped_handler(
136        &self,
137        mapper: std::sync::Arc<dyn super::OAuthProfileMapper>,
138    ) -> Option<std::sync::Arc<dyn OAuthUserInfoHandler>> {
139        let mut handler = self.clone();
140        handler.mapper = None;
141        handler.application_mapper = Some(mapper);
142        Some(std::sync::Arc::new(handler))
143    }
144
145    async fn get_user_info(
146        &self,
147        request: OAuthUserInfoRequest,
148    ) -> Result<OAuthUserInfoResponse, String> {
149        let access_token = super::remaining_profile::bearer_access_token(&request)?;
150        let profile: Value = reqwest::Client::new()
151            .get(&self.endpoint)
152            .bearer_auth(access_token)
153            .header("User-Agent", "better-auth")
154            .send()
155            .await
156            .map_err(|e| e.to_string())?
157            .error_for_status()
158            .map_err(|e| e.to_string())?
159            .json()
160            .await
161            .map_err(|e| e.to_string())?;
162        let mapped = if let Some(mapper) = &self.application_mapper {
163            mapper
164                .map_profile(profile.clone())
165                .await
166                .map_err(super::remaining_profile::profile_exception)?
167        } else {
168            self.mapper
169                .map(|mapper| mapper(profile.clone()))
170                .transpose()
171                .map_err(super::remaining_profile::profile_exception)?
172                .map(|user| user.public_profile(true))
173                .unwrap_or_default()
174        };
175        if profile.is_null() {
176            return Err(super::remaining_profile::profile_exception(
177                "Null Reddit profile",
178            ));
179        }
180        let email = if let Some(value) = mapped
181            .get("email")
182            .filter(|value| super::remaining_profile::truthy(value))
183        {
184            value.clone()
185        } else {
186            let identifier = profile
187                .get("id")
188                .map(super::remaining_profile::js_string)
189                .transpose()
190                .map_err(super::remaining_profile::profile_exception)?
191                .unwrap_or_else(|| "undefined".into());
192            let email = format!("{identifier}@reddit.placeholder.invalid");
193            if !crate::authentication_helpers::is_valid_email(&email) {
194                return Err(super::remaining_profile::profile_exception(
195                    "Invalid placeholder email",
196                ));
197            }
198            Value::String(email)
199        };
200        let image = match profile.get("icon_img") {
201            None | Some(Value::Null) => None,
202            Some(Value::String(image)) => Some(Value::String(
203                image.split('?').next().unwrap_or_default().into(),
204            )),
205            _ => {
206                return Err(super::remaining_profile::profile_exception(
207                    "Invalid Reddit icon_img",
208                ));
209            }
210        };
211        let mut output = serde_json::Map::new();
212        if let Some(name) = profile.get("name") {
213            _ = output.insert("name".into(), name.clone());
214        }
215        if let Some(image) = image {
216            _ = output.insert("image".into(), image);
217        }
218        output.extend(mapped.clone());
219        _ = output.insert("email".into(), email);
220        _ = output.insert(
221            "emailVerified".into(),
222            mapped
223                .get("emailVerified")
224                .filter(|value| !value.is_null())
225                .cloned()
226                .unwrap_or(Value::Bool(false)),
227        );
228        let user = OAuthUserInfo {
229            additional_fields: output
230                .iter()
231                .filter(|(key, _)| {
232                    !matches!(
233                        key.as_str(),
234                        "id" | "name" | "email" | "image" | "emailVerified"
235                    )
236                })
237                .map(|(key, value)| (key.clone(), value.clone()))
238                .collect(),
239            id: profile
240                .get("id")
241                .map(super::remaining_profile::js_string)
242                .transpose()
243                .map_err(super::remaining_profile::profile_exception)?
244                .unwrap_or_default(),
245            name: super::remaining_profile::scalar(
246                output
247                    .get("name")
248                    .filter(|value| super::remaining_profile::truthy(value)),
249            )?,
250            email: output
251                .get("email")
252                .and_then(Value::as_str)
253                .unwrap_or_default()
254                .into(),
255            image: super::remaining_profile::scalar(output.get("image"))?,
256            email_verified: output
257                .get("emailVerified")
258                .is_some_and(super::remaining_profile::truthy),
259        };
260        Ok(OAuthUserInfoResponse {
261            user_output: Some(output),
262            user,
263            data: profile,
264        })
265    }
266}
267fn subject(profile: &Value) -> Result<String, String> {
268    super::remaining_profile::raw_subject(profile.get("id"))
269}
alibi_plugins/oauth/providers/reddit.rs

alibi_plugins/oauth/providers/
reddit.rs
