Crate rustlavel_oauth

Expand description

OAuth 2.1 for Rustlavel — the protocol vocabulary, and the client half.

This crate is what you reach for when your application signs users in through somebody else: Google, GitHub, or any provider that speaks the authorisation code flow. The other half — being a provider yourself — lives in rustlavel-oauth-provider, which depends on the types defined here so both ends agree on the wire format by construction.

use rustlavel_oauth::prelude::*;

let github = OAuthClient::new(Provider::github())
    .credentials(config.string("services.github.id", ""), config.string("services.github.secret", ""))
    .redirect_uri("https://app.test/auth/github/callback");

App::new().plugin(Socialite::new().provider(github).on_login(|user, req| async move {
    req.auth().login(&user);
    Response::see_other("/dashboard")
}));

Two things are not configurable, because a client that can be talked out of them is a client that will be: PKCE is always sent, always S256, and every callback is checked against a state this application issued. Skipping the second is login CSRF — see state for what that costs.

Written from scratch on RFC 6749, 6750, 7009 and 7636, save for SHA-256 and AES-GCM, which come from the RustCrypto crates by way of rustlavel-auth.

Re-exports§

pub use client::Authorization;
pub use client::OAuthClient;
pub use error::OAuthError;
pub use error::OAuthErrorCode;
pub use pkce::ChallengeMethod;
pub use pkce::Pkce;
pub use provider::ClientAuth;
pub use provider::Provider;
pub use provider::UserMap;
pub use routes::Socialite;
pub use scope::Scopes;
pub use state::SealedState;
pub use state::SessionState;
pub use state::StateError;
pub use state::StateGuard;
pub use token::TokenResponse;
pub use user::SocialUser;

Modules§

client: The client half: sending somebody to a provider, and trading what comes back for a token.
error: The error vocabulary both halves of OAuth share.
pkce: PKCE — Proof Key for Code Exchange, RFC 7636.
prelude: What a routes/web.rs or a controller imports to use this package.
provider: One provider’s endpoints and quirks.
routes: The two handlers every social login needs, so an application does not write them again for each provider.
scope: Scopes: what a token is allowed to do.
state: The state parameter: the only thing standing between a login button and login CSRF.
token: The token endpoint’s response, RFC 6749 §5.1.
url: Percent-encoding and form bodies.
user: One shape of user, out of five differently-shaped userinfo responses.
verify: Deciding whether a bearer token is good, the two ways there are.

Enums§

Error: Every failure the framework itself can produce.

Type Aliases§

Result: The framework-wide result type.