|
| 1 | +use crate::helpers; |
| 2 | +use base64::prelude::{Engine, BASE64_URL_SAFE_NO_PAD}; |
| 3 | +use serde::Deserialize; |
| 4 | +use url::Url; |
| 5 | + |
| 6 | +const BASE_URL: &str = "https://accounts.google.com/o/oauth2/v2/auth"; |
| 7 | +const SCOPES: &str = "openid email"; |
| 8 | + |
| 9 | +#[derive(Deserialize)] |
| 10 | +pub struct IdToken { |
| 11 | + pub iss: String, |
| 12 | + pub azp: String, |
| 13 | + pub email_verified: bool, |
| 14 | + pub at_hash: String, |
| 15 | + pub aud: String, |
| 16 | + pub exp: u64, |
| 17 | + pub iat: u64, |
| 18 | + pub sub: String, |
| 19 | + pub hd: String, |
| 20 | + pub email: String, |
| 21 | +} |
| 22 | + |
| 23 | +pub struct AuthorizeData { |
| 24 | + pub authorize_url: String, |
| 25 | + pub state: String, |
| 26 | +} |
| 27 | + |
| 28 | +pub fn get_authorize_data(client_id: &str, redirect_uri: &str) -> AuthorizeData { |
| 29 | + let state = helpers::generate_alphanumeric_otp(32); |
| 30 | + let mut authorize_url = Url::parse(BASE_URL).expect("Failed to parse URL"); |
| 31 | + authorize_url.query_pairs_mut().extend_pairs(&[ |
| 32 | + ("response_type", "code"), |
| 33 | + ("client_id", client_id), |
| 34 | + ("redirect_uri", redirect_uri), |
| 35 | + ("scope", SCOPES), |
| 36 | + ("state", &state), |
| 37 | + ]); |
| 38 | + |
| 39 | + AuthorizeData { authorize_url: authorize_url.into(), state } |
| 40 | +} |
| 41 | + |
| 42 | +pub fn decode_id_token(token: &str) -> Result<IdToken, &'static str> { |
| 43 | + let parts: Vec<&str> = token.split('.').collect(); |
| 44 | + if parts.len() != 3 { |
| 45 | + return Err("Invalid token format"); |
| 46 | + } |
| 47 | + let payload = base64_decode(parts[1])?; |
| 48 | + let claims: IdToken = serde_json::from_str(&payload).map_err(|_| "Failed to parse claims")?; |
| 49 | + Ok(claims) |
| 50 | +} |
| 51 | + |
| 52 | +fn base64_decode(input: &str) -> Result<String, &'static str> { |
| 53 | + let decoded = &BASE64_URL_SAFE_NO_PAD.decode(input).map_err(|_| "Failed to decode base64")?; |
| 54 | + |
| 55 | + Ok(String::from_utf8_lossy(decoded).to_string()) |
| 56 | +} |
| 57 | + |
| 58 | +#[cfg(test)] |
| 59 | +mod tests { |
| 60 | + use super::*; |
| 61 | + use std::format; |
| 62 | + use url::Url; |
| 63 | + |
| 64 | + #[test] |
| 65 | + fn test_get_authorize_data() { |
| 66 | + let client_id = "client_id"; |
| 67 | + let redirect_uri = "http://localhost:8080"; |
| 68 | + let authorize_data = get_authorize_data(client_id, redirect_uri); |
| 69 | + |
| 70 | + let authorize_url = Url::parse(&authorize_data.authorize_url).unwrap(); |
| 71 | + std::println!("{:?}", authorize_url.as_str()); |
| 72 | + let expected_url = format!("https://accounts.google.com/o/oauth2/v2/auth?response_type=code&client_id=client_id&redirect_uri=http%3A%2F%2Flocalhost%3A8080&scope=openid+email&state={}", authorize_data.state); |
| 73 | + |
| 74 | + assert_eq!(authorize_url.as_str(), expected_url); |
| 75 | + } |
| 76 | + |
| 77 | + #[test] |
| 78 | + fn decode_id_token_works() { |
| 79 | + let token = "eyJhbGciOiJSUzI1NiIsImtpZCI6IjM2MjgyNTg2MDExMTNlNjU3NmE0NTMzNzM2NWZlOGI4OTczZDE2NzEiLCJ0eXAiOiJKV1QifQ.eyJpc3MiOiJodHRwczovL2FjY291bnRzLmdvb2dsZS5jb20iLCJhenAiOiI2ODYyOTM4MTAwNjktbTBhNzVwYm9mMWVwbzJzZzkyYTU3cHRtazg1c2FnbGYuYXBwcy5nb29nbGV1c2VyY29udGVudC5jb20iLCJhdWQiOiI2ODYyOTM4MTAwNjktbTBhNzVwYm9mMWVwbzJzZzkyYTU3cHRtazg1c2FnbGYuYXBwcy5nb29nbGV1c2VyY29udGVudC5jb20iLCJzdWIiOiIxMDE2NTk5MjE1MTM4NzY4MzIwNDgiLCJoZCI6Imthd2FnYXJiby10ZWNoLmlvIiwiZW1haWwiOiJmcmFuY2lzY29Aa2F3YWdhcmJvLXRlY2guaW8iLCJlbWFpbF92ZXJpZmllZCI6dHJ1ZSwiYXRfaGFzaCI6IlBuYndCRVIzTnVBa055dFplR2wzcGciLCJpYXQiOjE3MzMyMzU4NDcsImV4cCI6MTczMzIzOTQ0N30.n4gYeYhp2U1ud4bZNW02xMJadki_93CzlcsJnr8F6eIBXwu4-CbsqToNNn40Kq780Wwz44MqnrEIU8dkBLqBc6MBWkMqzQV-RteEXMiZSOAhkNl8dIzds4vDZUnXunom4y-RYcW7yFMu_Vzpdi9A1NmgMvKVf9wqgfTJrqmPwaUh1GfgV8e7SrqHJiI3XVTE_zIxQVdjybR-7dXGh2B9LaXtA1m8v47tNkvtifa7KUw-miSIVt0of0Dq3keETLyptf8HJ1HouwpACMnxSH-Foq3r5EVp3lfGmkmf5dWMxweagsi7-hMhSKsGY2q2g3gy8xxsCaS1Q3uiB1Htw1Dn7Q"; |
| 80 | + let id_token = decode_id_token(token).unwrap(); |
| 81 | + |
| 82 | + assert_eq!(id_token.iss, "https://accounts.google.com"); |
| 83 | + assert_eq!( |
| 84 | + id_token.azp, |
| 85 | + "686293810069-m0a75pbof1epo2sg92a57ptmk85saglf.apps.googleusercontent.com" |
| 86 | + ); |
| 87 | + assert!(id_token.email_verified); |
| 88 | + assert_eq!(id_token.at_hash, "PnbwBER3NuAkNytZeGl3pg"); |
| 89 | + assert_eq!( |
| 90 | + id_token.aud, |
| 91 | + "686293810069-m0a75pbof1epo2sg92a57ptmk85saglf.apps.googleusercontent.com" |
| 92 | + ); |
| 93 | + assert_eq!(id_token.exp, 1733239447); |
| 94 | + assert_eq!(id_token.iat, 1733235847); |
| 95 | + assert_eq!(id_token.sub, "101659921513876832048"); |
| 96 | + assert_eq!(id_token.hd, "kawagarbo-tech.io"); |
| 97 | + assert_eq!(id_token .email , "[email protected]"); |
| 98 | + } |
| 99 | +} |
0 commit comments