use anyhow::{Context, Result, anyhow, bail};
use axum::http::StatusCode;
use serde::Deserialize;
use uuid::Uuid;
use crate::{app_state::AppState, auth::token_store::StoredToken};
const AUTHORIZE_URL: &str = "https://gyazo.com/oauth/authorize";
const TOKEN_URL: &str = "https://gyazo.com/oauth/token";
#[derive(Debug, Clone, Deserialize)]
pub(crate) struct OAuthCallbackQuery {
pub(crate) code: Option<String>,
pub(crate) error: Option<String>,
pub(crate) error_description: Option<String>,
pub(crate) state: Option<String>,
}
#[derive(Debug)]
pub(crate) struct OAuthCallbackFailure {
message: String,
status_code: StatusCode,
}
impl OAuthCallbackFailure {
pub(crate) fn bad_request(message: impl Into<String>) -> Self {
Self {
message: message.into(),
status_code: StatusCode::BAD_REQUEST,
}
}
pub(crate) fn internal(message: impl Into<String>) -> Self {
Self {
message: message.into(),
status_code: StatusCode::INTERNAL_SERVER_ERROR,
}
}
pub(crate) fn bad_gateway(message: impl Into<String>) -> Self {
Self {
message: message.into(),
status_code: StatusCode::BAD_GATEWAY,
}
}
pub(crate) fn into_parts(self) -> (StatusCode, String) {
(self.status_code, self.message)
}
}
pub(crate) fn begin_login(app_state: &AppState) -> Result<String> {
let state = Uuid::new_v4().to_string();
app_state.set_pending_direct_login_state(state.clone())?;
build_gyazo_authorize_url(app_state, &state)
}
pub(crate) async fn complete_login(
app_state: &AppState,
query: OAuthCallbackQuery,
) -> Result<String, OAuthCallbackFailure> {
let OAuthCallbackQuery {
code,
error,
error_description,
state,
} = query;
if let Some(error) = error {
let description = error_description.unwrap_or_default();
let suffix = if description.is_empty() {
String::new()
} else {
format!(": {description}")
};
return Err(OAuthCallbackFailure::bad_request(format!(
"Gyazo OAuth がエラーを返しました ({error}{suffix})"
)));
}
let code = code
.ok_or_else(|| OAuthCallbackFailure::bad_request("callback に code が含まれていません"))?;
let returned_state = state
.ok_or_else(|| OAuthCallbackFailure::bad_request("callback に state が含まれていません"))?;
let pending_state = app_state
.take_pending_direct_login_state()
.map_err(|error| OAuthCallbackFailure::internal(error.to_string()))?
.ok_or_else(|| {
OAuthCallbackFailure::bad_request(
"保留中の OAuth state が見つかりません。/oauth/start から再度実行してください。",
)
})?;
if returned_state != pending_state {
return Err(OAuthCallbackFailure::bad_request(
"OAuth state が一致しません。再度 login を実行してください。",
));
}
let token = exchange_code_for_token(app_state, &code)
.await
.map_err(|error| OAuthCallbackFailure::bad_gateway(error.to_string()))?;
app_state
.save_oauth_token(token)
.map_err(|error| OAuthCallbackFailure::internal(error.to_string()))?;
let token_path = app_state
.auth_state_snapshot()
.map_err(|error| OAuthCallbackFailure::internal(error.to_string()))?
.token_file_path
.map(|path| path.display().to_string())
.unwrap_or_else(|| "（利用不可）".to_string());
Ok(format!(
"Gyazo OAuth login が完了しました。token は {token_path} に保存しました。"
))
}
pub(crate) fn build_gyazo_authorize_url(app_state: &AppState, state: &str) -> Result<String> {
let credentials = app_state
.auth_config()
.oauth_credentials()
.context("GYAZO_MCP_OAUTH_CLIENT_ID と GYAZO_MCP_OAUTH_CLIENT_SECRET を設定してください")?;
Ok(build_authorize_url(
&credentials.client_id,
&app_state.runtime_config().oauth_callback_url(),
state,
))
}
fn build_authorize_url(client_id: &str, redirect_uri: &str, state: &str) -> String {
let query = [
("client_id", client_id),
("redirect_uri", redirect_uri),
("response_type", "code"),
("state", state),
]
.into_iter()
.map(|(key, value)| format!("{key}={}", percent_encode(value)))
.collect::<Vec<_>>()
.join("&");
format!("{AUTHORIZE_URL}?{query}")
}
pub(crate) async fn exchange_code_for_token(
app_state: &AppState,
code: &str,
) -> Result<StoredToken> {
let credentials = app_state
.auth_config()
.oauth_credentials()
.context("GYAZO_MCP_OAUTH_CLIENT_ID と GYAZO_MCP_OAUTH_CLIENT_SECRET を設定してください")?;
let redirect_uri = app_state.runtime_config().oauth_callback_url();
let response = reqwest::Client::new()
.post(TOKEN_URL)
.form(&[
("client_id", credentials.client_id.as_str()),
("client_secret", credentials.client_secret.as_str()),
("code", code),
("grant_type", "authorization_code"),
("redirect_uri", redirect_uri.as_str()),
])
.send()
.await
.context("Gyazo token endpoint の呼び出しに失敗しました")?;
let status = response.status();
let body = response
.text()
.await
.context("Gyazo token endpoint のレスポンス本文を読み取れませんでした")?;
if !status.is_success() {
bail!("Gyazo token の交換に失敗しました (status {status}: {body})");
}
let parsed: GyazoTokenResponse =
serde_json::from_str(&body).context("Gyazo token のレスポンスを解析できませんでした")?;
if parsed.access_token.trim().is_empty() {
return Err(anyhow!(
"Gyazo token のレスポンスに access_token が含まれていません"
));
}
Ok(StoredToken {
access_token: parsed.access_token,
})
}
fn percent_encode(value: &str) -> String {
let mut encoded = String::with_capacity(value.len());
for byte in value.bytes() {
let is_unreserved =
byte.is_ascii_alphanumeric() || matches!(byte, b'-' | b'_' | b'.' | b'~');
if is_unreserved {
encoded.push(byte as char);
} else {
encoded.push_str(&format!("%{:02X}", byte));
}
}
encoded
}
#[derive(Debug, Deserialize)]
struct GyazoTokenResponse {
access_token: String,
}
#[cfg(test)]
mod tests {
use super::build_authorize_url;
#[test]
fn builds_authorize_url_with_required_parameters() {
let url = build_authorize_url(
"client-id",
"http://127.0.0.1:18449/oauth/callback",
"state-123",
);
assert!(url.starts_with("https://gyazo.com/oauth/authorize?"));
assert!(url.contains("client_id=client-id"));
assert!(url.contains("redirect_uri=http%3A%2F%2F127.0.0.1%3A18449%2Foauth%2Fcallback"));
assert!(url.contains("response_type=code"));
assert!(url.contains("state=state-123"));
}
}