Function handle_callback_request

crates/openshell-cli/src/auth.rs:297–391

(
    req: Request<Incoming>,
    state: Arc<CallbackServerState>,
)

}

async fn handle_callback_request(
    req: Request<Incoming>,
    state: Arc<CallbackServerState>,
) -> CallbackResponse {
    let method = req.method().clone();
    let path = req.uri().path().to_string();
    debug!(method = %method, path = %path, "callback request received");

    let allowed_origin = state.allowed_origin.as_deref();
    if path != "/callback" {
        return empty_response(StatusCode::NOT_FOUND, allowed_origin);
    }

    if let Some(expected_origin) = allowed_origin {
        let request_origin = req
            .headers()
            .get(ORIGIN)
            .and_then(|value| value.to_str().ok());
        if request_origin != Some(expected_origin) {
            debug!(
                request_origin = ?request_origin,
                allowed_origin = expected_origin,
                "callback origin mismatch"
            );
            let _ = state.take_sender();
            return json_response(
                StatusCode::FORBIDDEN,
                allowed_origin,
                r#"{"ok":false,"error":"origin not allowed"}"#,
            );
        }
    }

    if method == Method::OPTIONS {
        return empty_response(StatusCode::NO_CONTENT, allowed_origin);
    }

    if method != Method::POST {
        return json_response(
            StatusCode::METHOD_NOT_ALLOWED,
            allowed_origin,
            r#"{"error":"method not allowed"}"#,
        );
    }

    let body = match req.into_body().collect().await {
        Ok(body) => body.to_bytes(),
        Err(error) => {
            debug!(error = %error, "failed to read callback body");
            let _ = state.take_sender();
            return json_response(
                StatusCode::BAD_REQUEST,
                allowed_origin,
                r#"{"ok":false,"error":"invalid request body"}"#,
            );
        }
    };