9362a10
ZhenYi
refactor: remove OAuth-related modules and update references for identity service integration
9362a10
use auth::server::http::token::TokenRequest;
use auth::session::Session;
use export::http::{Query, Response, State};
use serde::Deserialize;
use crate::auth::errors::ApiError;
use crate::auth::session::cookie::redirect_with_cookies;
use crate::auth::session::project;
use crate::auth::services::AuthService;
const JWT_TTL_SECS: i64 = 900;
#[derive(Debug, Deserialize)]
pub struct CallbackQuery {
#[serde(default)]
pub redirect: Option<String>,
}
pub async fn callback(
State(service): State<AuthService>,
session: Session,
Query(query): Query<CallbackQuery>,
) -> Result<Response, ApiError> {
let cookie = issue_session_cookie(&service, &session).await?;
Ok(redirect_with_cookies(
&sanitize_redirect(query.redirect.as_deref()),
&[cookie],
))
}
pub async fn issue_session_cookie(
service: &AuthService,
session: &Session,
) -> Result<String, ApiError> {
let client = service
.state
.kenauth
.as_ref()
.ok_or_else(|| ApiError::internal("identity service is unavailable"))?;
let auth = client.service();
let request_id = export::middleware::request_id().unwrap_or_default();
let user_id = auth
.require_session(session, Some(request_id.as_str()))
.await
.map_err(map_identity)?;
let public = client.get_user_public(user_id).await.map_err(map_client)?;
project::upsert(service, &public).await?;
let issued = auth
.issue_user_token(
session,
user_id,
TokenRequest::default(),
Some(request_id.as_str()),
)
.await
.map_err(map_identity)?;
Ok(token::session_cookie(
&service.config().jwt,
&issued.token,
JWT_TTL_SECS,
))
}
fn sanitize_redirect(raw: Option<&str>) -> String {
match raw.map(str::trim) {
Some(value) if value.starts_with('/') && !value.starts_with("//") => value.to_string(),
_ => "/app".to_string(),
}
}
fn map_identity(error: auth::server::errors::AuthError) -> ApiError {
match error {
auth::server::errors::AuthError::Unauthenticated => ApiError::unauthorized(),
auth::server::errors::AuthError::Forbidden => ApiError::forbidden(),
other => ApiError::internal(other.to_string()),
}
}
fn map_client(error: auth::client::error::KenAuthError) -> ApiError {
match error {
auth::client::error::KenAuthError::NotFound => ApiError::not_found("user not found"),
auth::client::error::KenAuthError::Unauthenticated => ApiError::unauthorized(),
other => ApiError::internal(other.to_string()),
}
}