rightkit-daemon 0.2.7

One discovery/auth convention for Right Suite local services: service.json, ranking and takeover, current-user-only Unix socket / named pipe, per-app request allowlist.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47

//! Adapter from the daemon's OAuth callback class to `rightkit-oauth`'s
//! server flow. The flow consumes the one-time state and PKCE verifier; this
//! adapter additionally refuses a callback whose completed provider differs
//! from the route's provider, and persists tokens through the host `TokenStore`.

use std::sync::Arc;

use rightkit_oauth::server::{CallbackQuery, ServerAuthError, ServerAuthFlow, TokenStore};

use crate::remote::core::{OAuthCallbackHandler, OAuthOutcome};

pub struct FlowOAuthHandler {
    pub flow: Arc<ServerAuthFlow>,
    pub tokens: Arc<dyn TokenStore>,
}

impl OAuthCallbackHandler for FlowOAuthHandler {
    fn complete(
        &self,
        provider: &str,
        code: Option<String>,
        state: Option<String>,
        error: Option<String>,
    ) -> OAuthOutcome {
        let done = match self.flow.complete(CallbackQuery { code, state, error }) {
            Ok(d) => d,
            Err(
                ServerAuthError::StateMismatch
                | ServerAuthError::StateExpired
                | ServerAuthError::InvalidCallback
                | ServerAuthError::ProviderError,
            ) => return OAuthOutcome::Rejected,
            Err(_) => return OAuthOutcome::Unavailable,
        };
        if done.provider != provider {
            // Tokens for another provider never attach to this route.
            return OAuthOutcome::Rejected;
        }
        match self
            .tokens
            .put(&done.account_hint, &done.provider, &done.tokens)
        {
            Ok(()) => OAuthOutcome::Completed,
            Err(_) => OAuthOutcome::Unavailable,
        }
    }
}