keycloak 26.6.2

use std::future::Future;

use async_trait::async_trait;
use serde::{Deserialize, Serialize};

use crate::{prelude::reqwest, types::*, KeycloakError};

mod default_response;
mod generated_rest;
mod manual_rest;
mod url_enc;

pub use default_response::DefaultResponse;

pub struct KeycloakAdmin<TS: KeycloakTokenSupplier = KeycloakAdminToken> {
    url: String,
    client: reqwest::Client,
    token_supplier: TS,
}

#[async_trait]
pub trait KeycloakTokenSupplier {
    async fn get(&self, url: &str) -> Result<String, KeycloakError>;
}

#[derive(Clone)]
pub struct KeycloakServiceAccountAdminTokenRetriever {
    client_id: String,
    client_secret: String,
    realm: String,
    reqwest_client: reqwest::Client,
}

#[async_trait]
impl KeycloakTokenSupplier for KeycloakServiceAccountAdminTokenRetriever {
    async fn get(&self, url: &str) -> Result<String, KeycloakError> {
        let admin_token = self.acquire(url).await?;
        Ok(admin_token.access_token)
    }
}

impl KeycloakServiceAccountAdminTokenRetriever {
    /// Creates a token retriever for a [service account] in the `master` realm.
    ///
    /// Use this when you want to authenticate against Keycloak using a
    /// confidential client whose `Service Accounts` feature is enabled and
    /// whose `client_id` lives in the `master` realm.
    ///
    /// To target a different realm, use [`KeycloakServiceAccountAdminTokenRetriever::create_with_custom_realm`].
    ///
    /// [service account]: https://www.keycloak.org/docs/latest/server_development/#authenticating-with-a-service-account
    ///
    /// # Arguments
    ///
    /// * `client_id` - The client id of a client with the following characteristics:
    ///   1. Exists in the `master` realm.
    ///   2. `confidential` access type.
    ///   3. `Service Accounts` option is enabled.
    /// * `client_secret` - The secret credential assigned to the given `client_id`.
    /// * `client` - A reqwest `Client` used to perform the token retrieval call.
    ///
    /// # Example
    ///
    /// ```no_run
    /// # async fn doc() -> Result<(), keycloak::KeycloakError> {
    /// use keycloak::{prelude::reqwest, KeycloakAdmin, KeycloakServiceAccountAdminTokenRetriever};
    ///
    /// let client = reqwest::Client::new();
    /// let url = "https://keycloak.example.com";
    ///
    /// let retriever = KeycloakServiceAccountAdminTokenRetriever::create(
    ///     "my-client",
    ///     "my-secret",
    ///     client.clone(),
    /// );
    ///
    /// let admin = KeycloakAdmin::new(url, retriever, client);
    /// // ... use `admin` to call the Admin REST API.
    /// # let _ = admin;
    /// # Ok(()) }
    /// ```
    pub fn create(client_id: &str, client_secret: &str, client: reqwest::Client) -> Self {
        Self {
            client_id: client_id.into(),
            client_secret: client_secret.into(),
            realm: "master".into(),
            reqwest_client: client,
        }
    }

    /// Creates a token retriever for a [service account] in a caller-specified realm.
    ///
    /// This is the same as [`KeycloakServiceAccountAdminTokenRetriever::create`],
    /// but the realm is supplied explicitly rather than defaulting to `master`.
    ///
    /// [service account]: https://www.keycloak.org/docs/latest/server_development/#authenticating-with-a-service-account
    ///
    /// # Arguments
    ///
    /// * `client_id` - The client id of a client with the following characteristics:
    ///   1. Exists in `realm`.
    ///   2. `confidential` access type.
    ///   3. `Service Accounts` option is enabled.
    /// * `client_secret` - The secret credential assigned to the given `client_id`.
    /// * `realm` - The Keycloak realm the `client_id` lives in.
    /// * `client` - A reqwest `Client` used to perform the token retrieval call.
    ///
    /// # Example
    ///
    /// ```no_run
    /// # async fn doc() -> Result<(), keycloak::KeycloakError> {
    /// use keycloak::{prelude::reqwest, KeycloakAdmin, KeycloakServiceAccountAdminTokenRetriever};
    ///
    /// let client = reqwest::Client::new();
    /// let url = "https://keycloak.example.com";
    ///
    /// let retriever = KeycloakServiceAccountAdminTokenRetriever::create_with_custom_realm(
    ///     "my-client",
    ///     "my-secret",
    ///     "my-realm",
    ///     client.clone(),
    /// );
    ///
    /// let admin = KeycloakAdmin::new(url, retriever, client);
    /// // ... use `admin` to call the Admin REST API.
    /// # let _ = admin;
    /// # Ok(()) }
    /// ```
    pub fn create_with_custom_realm(
        client_id: &str,
        client_secret: &str,
        realm: &str,
        client: reqwest::Client,
    ) -> Self {
        Self {
            client_id: client_id.into(),
            client_secret: client_secret.into(),
            realm: realm.into(),
            reqwest_client: client,
        }
    }

    /// Fetches a fresh [`KeycloakAdminToken`] for the configured service account.
    ///
    /// Each call performs a new HTTP request against Keycloak's token endpoint
    /// using the `client_credentials` grant. To avoid the per-request round-trip,
    /// cache the returned [`KeycloakAdminToken`] yourself (e.g. using its
    /// [`KeycloakAdminToken::expires_in`] field) or implement a custom
    /// [`KeycloakTokenSupplier`].
    ///
    /// # Arguments
    ///
    /// * `url` - Base URL of the Keycloak server (e.g. `https://keycloak.example.com`).
    pub async fn acquire(&self, url: &str) -> Result<KeycloakAdminToken, KeycloakError> {
        let realm = &self.realm;
        let response = self
            .reqwest_client
            .post(format!(
                "{url}/realms/{realm}/protocol/openid-connect/token",
            ))
            .form(&[
                ("client_id", self.client_id.as_str()),
                ("client_secret", self.client_secret.as_str()),
                ("grant_type", "client_credentials"),
            ])
            .send()
            .await?;
        Ok(error_check(response).await?.json().await?)
    }
}

#[derive(Debug, Clone, PartialEq, Eq, Deserialize, Serialize)]
pub struct KeycloakAdminToken {
    access_token: String,
    expires_in: usize,
    #[serde(rename = "not-before-policy")]
    not_before_policy: Option<usize>,
    refresh_expires_in: Option<usize>,
    refresh_token: Option<String>,
    scope: String,
    session_state: Option<String>,
    token_type: String,
}

impl KeycloakAdminToken {
    /// Returns the access token issued by Keycloak.
    pub fn access_token(&self) -> &str {
        &self.access_token
    }

    /// Returns the lifetime in seconds of the access token.
    pub fn expires_in(&self) -> usize {
        self.expires_in
    }

    /// Returns the `not-before-policy` value, if provided by Keycloak.
    pub fn not_before_policy(&self) -> Option<usize> {
        self.not_before_policy
    }

    /// Returns the lifetime in seconds of the refresh token, if a refresh
    /// token was issued.
    pub fn refresh_expires_in(&self) -> Option<usize> {
        self.refresh_expires_in
    }

    /// Returns the refresh token, if one was issued.
    pub fn refresh_token(&self) -> Option<&str> {
        self.refresh_token.as_deref()
    }

    /// Returns the OAuth scope(s) associated with the token.
    pub fn scope(&self) -> &str {
        &self.scope
    }

    /// Returns the session state, if provided by Keycloak.
    pub fn session_state(&self) -> Option<&str> {
        self.session_state.as_deref()
    }

    /// Returns the token type (typically `Bearer`).
    pub fn token_type(&self) -> &str {
        &self.token_type
    }
}

#[async_trait]
impl KeycloakTokenSupplier for KeycloakAdminToken {
    async fn get(&self, _url: &str) -> Result<String, KeycloakError> {
        Ok(self.access_token.clone())
    }
}

impl KeycloakAdminToken {
    pub async fn acquire(
        url: &str,
        username: &str,
        password: &str,
        client: &reqwest::Client,
    ) -> Result<KeycloakAdminToken, KeycloakError> {
        Self::acquire_custom_realm(
            url,
            username,
            password,
            "master",
            "admin-cli",
            "password",
            client,
        )
        .await
    }

    pub async fn acquire_custom_realm(
        url: &str,
        username: &str,
        password: &str,
        realm: &str,
        client_id: &str,
        grant_type: &str,
        client: &reqwest::Client,
    ) -> Result<KeycloakAdminToken, KeycloakError> {
        let response = client
            .post(format!(
                "{url}/realms/{realm}/protocol/openid-connect/token",
            ))
            .form(&[
                ("username", username),
                ("password", password),
                ("client_id", client_id),
                ("grant_type", grant_type),
            ])
            .send()
            .await?;
        Ok(error_check(response).await?.json().await?)
    }
}

async fn error_check(response: reqwest::Response) -> Result<reqwest::Response, KeycloakError> {
    if !response.status().is_success() {
        let status = response.status().into();
        let text = response.text().await?;
        return Err(KeycloakError::HttpFailure {
            status,
            body: serde_json::from_str(&text).ok(),
            text,
        });
    }

    Ok(response)
}

impl<TS: KeycloakTokenSupplier> KeycloakAdmin<TS> {
    pub fn new(url: &str, token_supplier: TS, client: reqwest::Client) -> Self {
        Self {
            url: url.into(),
            client,
            token_supplier,
        }
    }

    pub fn realm<'a>(&'a self, realm: &'a str) -> KeycloakRealmAdmin<'a, TS> {
        KeycloakRealmAdmin { realm, admin: self }
    }
}

pub struct KeycloakRealmAdmin<'a, TS: KeycloakTokenSupplier> {
    pub realm: &'a str,
    pub(crate) admin: &'a KeycloakAdmin<TS>,
}

pub trait KeycloakRealmAdminMethod {
    type Output;
    type Args: Default;

    fn opts(
        self,
        args: Self::Args,
    ) -> impl Future<Output = Result<Self::Output, KeycloakError>> + Send;

    fn with_default<F>(
        self,
        f: F,
    ) -> impl Future<Output = Result<Self::Output, KeycloakError>> + Send
    where
        Self: Sized,
        Self::Args: Default,
        F: FnOnce(Self::Args) -> Self::Args,
    {
        self.opts(f(Default::default()))
    }

    #[cfg(feature = "builder")]
    fn builder<'m>(self) -> crate::builder::Builder<'m, Self>
    where
        Self: 'm + Sized,
    {
        From::from(self)
    }
}