Function run_callback_server

crates/openshell-cli/src/auth.rs:403–434

Run the ephemeral callback server. Handles two request types: - `OPTIONS /callback` — CORS preflight, returns 204 with CORS headers. - `POST /callback` — JSON body `{"token":"...","code":"..."}`, validates the confirmation code, sends the token through the channel, and returns a JSON success/error response. CORS is restricted to the gateway origin. Requests with a missing or non-matching `Ori

(
    listener: TcpListener,
    tx: oneshot::Sender<String>,
    expected_code: String,
    gateway_endpoint: String,
)

/// CORS is restricted to the gateway origin. Requests with a missing or
/// non-matching `Origin` header are rejected with 403.
async fn run_callback_server(
    listener: TcpListener,
    tx: oneshot::Sender<String>,
    expected_code: String,
    gateway_endpoint: String,
) {
    let state = Arc::new(CallbackServerState {
        allowed_origin: extract_origin(&gateway_endpoint),
        expected_code,
        tx: Mutex::new(Some(tx)),
    });

    loop {
        let Ok((stream, _)) = listener.accept().await else {
            return;
        };
        let state = Arc::clone(&state);
        tokio::spawn(async move {
            let service = service_fn(move |req| {
                let state = Arc::clone(&state);
                async move { Ok::<_, Infallible>(handle_callback_request(req, state).await) }
            });

            if let Err(error) = Builder::new(TokioExecutor::new())
                .serve_connection(TokioIo::new(stream), service)
                .await
            {
                debug!(error = %error, "callback server connection failed");
            }
        });
    }
}

#[cfg(test)]
mod tests {