AkurAI-Notes / crates/notes-api/src/auth/mod.rs

Latest change 21fd83f4a6eb769a0ee34aa30f721b5cdc6881af - Fix IDP OAuth: split public issuer vs internal loopback URL for token exchange by Claude Code

pub mod idp_client;
pub mod session;

use crate::router_setup::{internal_error, json_response, NotesState};
use akurai_http::{Request, Response};
use akurai_json::Value;
use std::sync::{Arc, Mutex};

/// GET /auth/login — redirect to IDP /authorize
pub fn login_route(
    state: Arc<Mutex<NotesState>>,
) -> Box<dyn Fn(&Request) -> Response + Send + Sync> {
    Box::new(move |_req: &Request| {
        let cfg = {
            let lock = match state.lock() {
                Ok(s) => s,
                Err(_) => return internal_error("lock poisoned"),
            };
            idp_client::IdpConfig {
                issuer: lock.idp_cfg.issuer.clone(),
                internal_url: lock.idp_cfg.internal_url.clone(),
                client_id: lock.idp_cfg.client_id.clone(),
                redirect_uri: lock.idp_cfg.redirect_uri.clone(),
                client_secret: String::new(),
                allow: Vec::new(),
            }
        };

        let state_token = format!(
            "notes_{}",
            std::time::SystemTime::now()
                .duration_since(std::time::UNIX_EPOCH)
                .unwrap_or_default()
                .as_nanos()
        );

        let location = format!(
            "{issuer}/authorize\
             ?client_id={client_id}\
             &redirect_uri={redirect_uri}\
             &response_type=code\
             &scope=openid+profile+email\
             &state={state_token}",
            issuer = cfg.issuer,
            client_id = cfg.client_id,
            redirect_uri = cfg.redirect_uri,
            state_token = state_token,
        );

        let cookie =
            format!("notes_oauth_state={state_token}; Path=/; HttpOnly; SameSite=Lax; Max-Age=600");

        let mut resp = Response::ok();
        resp.status = 302;
        resp.reason = "Found".to_string();
        resp = resp.with_header("Location", &location);
        resp = resp.with_header("Set-Cookie", &cookie);
        resp
    })
}

/// GET /auth/callback — exchange code, create session, redirect to app
pub fn callback_route(
    state: Arc<Mutex<NotesState>>,
) -> Box<dyn Fn(&Request) -> Response + Send + Sync> {
    Box::new(move |req: &Request| {
        let query = req.query.as_deref().unwrap_or("");
        let mut code = String::new();
        let mut returned_state = String::new();

        for pair in query.split('&') {
            if let Some((key, value)) = pair.split_once('=') {
                match key {
                    "code" => code = value.to_string(),
                    "state" => returned_state = value.to_string(),
                    _ => {}
                }
            }
        }

        if code.is_empty() || returned_state.is_empty() {
            return auth_redirect_error();
        }

        let cfg = {
            let lock = match state.lock() {
                Ok(s) => s,
                Err(_) => return internal_error("lock poisoned"),
            };
            idp_client::IdpConfig {
                issuer: lock.idp_cfg.issuer.clone(),
                internal_url: lock.idp_cfg.internal_url.clone(),
                client_id: lock.idp_cfg.client_id.clone(),
                client_secret: lock.idp_cfg.client_secret.clone(),
                redirect_uri: lock.idp_cfg.redirect_uri.clone(),
                allow: lock.idp_cfg.allow.clone(),
            }
        };

        match idp_client::exchange_code(&code, &returned_state, &cfg) {
            Ok(userinfo) => {
                let email_lower = userinfo.email.to_lowercase();
                if !cfg
                    .allow
                    .iter()
                    .any(|a| a.eq_ignore_ascii_case(&email_lower))
                {
                    return auth_redirect_error();
                }

                let session_id = {
                    let state_lock = match state.lock() {
                        Ok(s) => s,
                        Err(_) => return internal_error("lock poisoned"),
                    };
                    let mut db = match state_lock.db.lock() {
                        Ok(db) => db,
                        Err(_) => return internal_error("db lock poisoned"),
                    };
                    session::create(&mut db, &userinfo.sub, &userinfo.email)
                };

                let cookie = format!(
                    "notes_session={session_id}; Path=/; HttpOnly; SameSite=Lax; Max-Age=86400"
                );

                let mut resp = Response::ok();
                resp.status = 302;
                resp.reason = "Found".to_string();
                resp = resp.with_header("Location", "/app");
                resp = resp.with_header("Set-Cookie", &cookie);
                resp
            }
            Err(_) => auth_redirect_error(),
        }
    })
}

/// GET /api/me — return current user info from session
pub fn me_route(state: Arc<Mutex<NotesState>>) -> Box<dyn Fn(&Request) -> Response + Send + Sync> {
    Box::new(move |req: &Request| {
        let session_id = session::extract_session_id(req);
        let user = match session_id {
            Some(ref sid) => {
                let state_lock = match state.lock() {
                    Ok(s) => s,
                    Err(_) => return internal_error("lock poisoned"),
                };
                let mut db = match state_lock.db.lock() {
                    Ok(db) => db,
                    Err(_) => return internal_error("db lock poisoned"),
                };
                session::get_user(&mut db, sid)
            }
            None => None,
        };

        match user {
            Some(u) => json_response(Value::Object(vec![
                ("authenticated".into(), Value::Bool(true)),
                ("sub".into(), Value::Str(u.sub)),
                ("email".into(), Value::Str(u.email)),
            ])),
            None => json_response(Value::Object(vec![(
                "authenticated".into(),
                Value::Bool(false),
            )])),
        }
    })
}

/// GET /auth/logout — delete session and clear cookie
pub fn logout_route(
    state: Arc<Mutex<NotesState>>,
) -> Box<dyn Fn(&Request) -> Response + Send + Sync> {
    Box::new(move |req: &Request| {
        if let Some(sid) = session::extract_session_id(req) {
            if let Ok(state_lock) = state.lock() {
                if let Ok(mut db) = state_lock.db.lock() {
                    let key = format!("_session:{sid}");
                    let _ = db.delete(key.as_bytes());
                    let _ = db.commit();
                }
            }
        }

        let cookie = "notes_session=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0".to_string();

        let mut resp = Response::ok();
        resp.status = 302;
        resp.reason = "Found".to_string();
        resp = resp.with_header("Location", "/");
        resp = resp.with_header("Set-Cookie", &cookie);
        resp
    })
}

fn auth_redirect_error() -> Response {
    let mut resp = Response::ok();
    resp.status = 302;
    resp.reason = "Found".to_string();
    resp = resp.with_header("Location", "/?auth_error=1");
    resp
}