klieo-auth-oauth 3.4.0

OAuth 2.0 bearer-token Authenticator for klieo HTTP transports
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41

//! OpenID Connect Discovery 1.0 — fetch the IdP's
//! configuration document at
//! `{issuer}/.well-known/openid-configuration`.
//!
//! Returns `jwks_uri` + `issuer` so operators can configure
//! `OAuthAuthenticatorBuilder` with a single URL instead of
//! threading jwks_uri separately. ADR-021 (revisited in
//! cluster 0.25 cleanup).

use crate::error::OAuthError;
use serde::Deserialize;

#[derive(Debug, Deserialize)]
pub(crate) struct DiscoveryDoc {
    pub issuer: String,
    pub jwks_uri: String,
}

pub(crate) async fn fetch(
    http: &reqwest::Client,
    issuer_url: &str,
) -> Result<DiscoveryDoc, OAuthError> {
    let url = format!(
        "{}/.well-known/openid-configuration",
        issuer_url.trim_end_matches('/')
    );
    let resp = http
        .get(&url)
        .send()
        .await
        .map_err(|e| OAuthError::DiscoveryFailed(format!("request failed: {e}")))?;
    if !resp.status().is_success() {
        return Err(OAuthError::DiscoveryFailed(format!(
            "status {}",
            resp.status()
        )));
    }
    resp.json::<DiscoveryDoc>()
        .await
        .map_err(|e| OAuthError::DiscoveryFailed(format!("body: {e}")))
}