Function handle_oidc_callback

crates/openshell-cli/src/oidc_auth.rs:379–435

(
    req: hyper::Request<hyper::body::Incoming>,
    state: Arc<CallbackState>,
)

}

fn handle_oidc_callback(
    req: hyper::Request<hyper::body::Incoming>,
    state: Arc<CallbackState>,
) -> Response<Full<Bytes>> {
    if req.method() != Method::GET || !req.uri().path().starts_with("/callback") {
        return Response::builder()
            .status(StatusCode::NOT_FOUND)
            .body(Full::new(Bytes::from("not found")))
            .expect("response");
    }

    let query = req.uri().query().unwrap_or("");
    let params: std::collections::HashMap<String, String> = query
        .split('&')
        .filter_map(|pair| {
            let mut parts = pair.splitn(2, '=');
            let key = percent_decode(parts.next()?);
            let value = percent_decode(parts.next().unwrap_or(""));
            Some((key, value))
        })
        .collect();

    // Check for error response from the IdP.
    if let Some(error) = params.get("error") {
        let desc = params.get("error_description").map_or("", String::as_str);
        debug!(error = %error, description = %desc, "OIDC auth error");
        let _ = state.take_sender();
        return html_response(
            StatusCode::BAD_REQUEST,
            &format!("Authentication failed: {error}. {desc}"),
        );
    }

    let code = match params.get("code") {
        Some(c) if !c.is_empty() => c,
        _ => {
            let _ = state.take_sender();
            return html_response(StatusCode::BAD_REQUEST, "Missing authorization code.");
        }
    };

    let received_state = params.get("state").map_or("", String::as_str);
    if received_state != state.expected_state {
        debug!("OIDC state mismatch");
        let _ = state.take_sender();
        return html_response(StatusCode::FORBIDDEN, "State parameter mismatch.");
    }

    if let Some(sender) = state.take_sender() {
        let _ = sender.send(code.clone());
    }

    html_response(
        StatusCode::OK,
        "Authentication successful! You can close this tab and return to the terminal.",
    )
}