Struct OAuthConfig 

pub struct OAuthConfig {
    pub provider: String,
    pub client_id: String,
    pub client_secret: String,
    pub redirect_uri: String,
    pub scopes_override: Option<String>,
    pub tenant: Option<String>,
    pub apple: Option<AppleConfig>,
    pub oidc_issuer: Option<String>,
}

Fields

provider: String

client_id: String

client_secret: String

redirect_uri: String

scopes_override: Option<String>

Optional scope override — replaces the spec’s default scope when set. Use cases: requesting repo on GitHub for app installation flows, requesting https://www.googleapis.com/... scopes on Google for app-specific data access.

tenant: Option<String>

Tenant id for Microsoft/Entra. Defaults to common. Single- tenant apps use a directory GUID; multi-tenant work-only apps use organizations.

apple: Option<AppleConfig>

Apple-specific extras (team id, key id, ES256 PEM). Required for Sign in with Apple — ignored for any other provider.

oidc_issuer: Option<String>

OIDC issuer URL when this config targets a generic-OIDC provider (Auth0, Okta, Keycloak, Cognito, etc.). When set, the runtime fetches <issuer>/.well-known/openid-configuration and synthesizes a provider::ProviderSpec from the discovered endpoints.

Implementations

impl OAuthConfig

pub fn auth_url(&self) -> String

Generate the authorization URL for the provider.

Callers MUST append a &state=<random> parameter and validate it in the callback to prevent CSRF attacks. See OAuthStateStore for a minimal implementation.

For PKCE-required providers (Twitter/X, Kick), callers should prefer Self::auth_url_with_pkce so the code_challenge pair survives to the callback.

pub fn auth_url_with_state(&self, state: &str) -> String

Generate the authorization URL with a CSRF state parameter attached.

pub fn auth_url_with_pkce( &self, state: &str, ) -> Result<(String, Option<String>), String>

Generate the authorization URL with state + a freshly minted PKCE pair when the provider requires it. Returns (url, code_verifier) — the verifier MUST be persisted in the OAuth state record and replayed in the token exchange.

pub fn token_url(&self) -> String

Generate the token exchange URL.

pub fn userinfo_url(&self) -> String

URL for the userinfo endpoint, which returns the authenticated user’s profile.

pub fn exchange_code_full(&self, code: &str) -> Result<TokenSet, String>

Exchange an authorization code for the full token set (access_token, optional refresh_token, optional id_token, expires_in, scope). When the provider uses PKCE, code_verifier MUST be supplied (the value previously returned from Self::auth_url_with_pkce).

pub fn exchange_code_full_pkce( &self, code: &str, code_verifier: Option<&str>, ) -> Result<TokenSet, String>

pub fn exchange_code(&self, code: &str) -> Result<String, String>

Exchange an authorization code for an access token. Thin wrapper around OAuthConfig::exchange_code_full for callers that only need the access token.

pub fn fetch_userinfo( &self, access_token: &str, ) -> Result<(String, Option<String>), String>

Fetch the authenticated user’s email + display name using an access token.

pub fn fetch_userinfo_full( &self, access_token: &str, ) -> Result<UserInfo, String>

Fetch the authenticated user’s full identity info — email + name + the provider-stable account ID. Uses the spec’s provider::UserinfoParser so adding a new provider is a table change, not a new branch.

pub fn fetch_userinfo_with_id_token( &self, access_token: &str, id_token: Option<&str>, ) -> Result<UserInfo, String>

Fetch userinfo, falling back to the supplied id_token JWT when the provider has no userinfo endpoint (Apple). The id_token is the one returned by Self::exchange_code_full in TokenSet::id_token.

Trait Implementations

impl Clone for OAuthConfig

fn clone(&self) -> OAuthConfig

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for OAuthConfig

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for OAuthConfig

fn default() -> OAuthConfig

Returns the “default value” for a type.

impl<'de> Deserialize<'de> for OAuthConfig

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Serialize for OAuthConfig

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.