alibi-plugins 0.9.0

Built-in authentication plugins and API metadata for Alibi
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132

//! Provider domain normalization for SSO authorization selection.
// Better Auth uses tldts hostname extraction rather than strict URL admission.
pub(super) fn matches(search: &str, domain_list: &str) -> bool {
    let search = search.trim().to_lowercase();
    if search.is_empty() {
        return false;
    }
    let mut matched = false;
    for entry in domain_list
        .split(',')
        .map(str::trim)
        .filter(|entry| !entry.is_empty())
    {
        let Some(domain) = hostname(entry) else {
            return false;
        };
        matched |= search == domain || search.ends_with(&format!(".{domain}"));
    }
    matched
}

fn hostname(entry: &str) -> Option<String> {
    let cleaned: String = entry
        .chars()
        .filter(|c| !matches!(c, '\t' | '\r' | '\n'))
        .collect();
    let mut input = cleaned.trim_matches(|c: char| c <= ' ');
    if input.starts_with("data:") {
        return None;
    }
    let mut special = false;
    if let Some(rest) = input.strip_prefix("//") {
        input = rest;
    } else if let Some((scheme, rest)) = input.split_once(":/") {
        let scheme = scheme.to_ascii_lowercase();
        special = matches!(
            scheme.as_str(),
            "http" | "https" | "ftp" | "ws" | "wss" | "file"
        );
        if scheme == "file" {
            input = rest.strip_prefix('/')?;
        } else if special {
            input = rest.trim_start_matches(['/', '\\']);
        } else {
            if scheme.is_empty()
                || !scheme
                    .chars()
                    .all(|c| c.is_ascii_alphanumeric() || matches!(c, '+' | '.' | '-'))
            {
                return None;
            }
            input = rest.strip_prefix('/')?;
        }
    } else if !input.starts_with('[') {
        let authority = input.split(['/', '\\', '?', '#']).next()?;
        if let Some((scheme, rest)) = authority.split_once(':')
            && !authority.contains('@')
            && !rest.contains(':')
            && (rest.is_empty() || !rest.chars().all(|c| c.is_ascii_digit()))
        {
            let scheme = scheme.to_ascii_lowercase();
            if !matches!(
                scheme.as_str(),
                "http" | "https" | "ftp" | "ws" | "wss" | "file"
            ) {
                return None;
            }
            special = true;
            input = input.split_once(':')?.1;
            input = if scheme == "file" {
                input
                    .strip_prefix("//")
                    .or_else(|| input.strip_prefix("\\\\"))?
            } else {
                input.trim_start_matches(['/', '\\'])
            };
        }
    }
    let authority = input
        .split(|c| matches!(c, '/' | '?' | '#') || (special && c == '\\'))
        .next()?;
    let host = authority.rsplit('@').next()?;
    let host = if let Some(rest) = host.strip_prefix('[') {
        rest.split_once(']')?.0
    } else if host.matches(':').count() == 1 {
        host.split_once(':')?.0
    } else {
        host
    };
    let host = host.trim_end_matches('.').to_lowercase();
    if host.parse::<std::net::IpAddr>().is_ok() {
        return Some(host);
    }
    if host.is_empty() || host.encode_utf16().count() > 255 {
        return None;
    }
    for (index, label) in host.split('.').enumerate() {
        if (label.is_empty() && index != 0)
            || label.encode_utf16().count() > 63
            || label.starts_with('-')
            || label.ends_with('-')
            || !label
                .chars()
                .all(|c| c.is_ascii_alphanumeric() || matches!(c, '-' | '_') || !c.is_ascii())
        {
            return None;
        }
    }
    Some(host)
}

/// Canonical social identities must contain exactly one usable email domain.
pub(super) fn email_domain(email: &str) -> Option<String> {
    let email = email.trim().to_lowercase();
    let mut parts = email.split('@');
    if parts.next()?.is_empty() {
        return None;
    }
    let domain = parts.next()?;
    if parts.next().is_some() || domain.contains(['/', '\\', ':']) {
        return None;
    }
    let mut domains = domain
        .split(',')
        .map(str::trim)
        .filter(|entry| !entry.is_empty());
    let domain = domains.next()?;
    if domains.next().is_some() {
        return None;
    }
    hostname(domain)
}