Function oidc_browser_auth_flow

crates/openshell-cli/src/oidc_auth.rs:102–182

Run the OIDC Authorization Code + PKCE browser flow. Opens the user's browser to the Keycloak login page and waits for the authorization code redirect on a localhost callback server.

(
    issuer: &str,
    client_id: &str,
    audience: Option<&str>,
    scopes: Option<&str>,
    insecure: bool,
)

/// Opens the user's browser to the Keycloak login page and waits for
/// the authorization code redirect on a localhost callback server.
pub async fn oidc_browser_auth_flow(
    issuer: &str,
    client_id: &str,
    audience: Option<&str>,
    scopes: Option<&str>,
    insecure: bool,
) -> Result<OidcTokenBundle> {
    let discovery = discover(issuer, insecure).await?;

    let listener = TcpListener::bind("127.0.0.1:0").await.into_diagnostic()?;
    let port = listener.local_addr().into_diagnostic()?.port();
    let redirect_uri = format!("http://127.0.0.1:{port}/callback");

    let client = BasicClient::new(ClientId::new(client_id.to_string()))
        .set_auth_uri(AuthUrl::new(discovery.authorization_endpoint).into_diagnostic()?)
        .set_token_uri(TokenUrl::new(discovery.token_endpoint).into_diagnostic()?)
        .set_redirect_uri(RedirectUrl::new(redirect_uri).into_diagnostic()?);

    let (pkce_challenge, pkce_verifier) = PkceCodeChallenge::new_random_sha256();

    let mut auth_request = client
        .authorize_url(CsrfToken::new_random)
        .set_pkce_challenge(pkce_challenge);

    for scope in build_scopes(scopes) {
        auth_request = auth_request.add_scope(scope);
    }

    let (mut auth_url, csrf_token) = auth_request.url();

    // Append audience parameter for providers like Entra ID where the API
    // audience differs from the client ID.
    if let Some(aud) = audience {
        auth_url.query_pairs_mut().append_pair("audience", aud);
    }

    let (tx, rx) = oneshot::channel::<String>();
    let expected_state = csrf_token.secret().clone();

    let server_handle = tokio::spawn(run_oidc_callback_server(listener, tx, expected_state));

    eprintln!("  Opening browser for OIDC authentication...");
    if let Err(e) = crate::auth::open_browser_url(auth_url.as_str()) {
        debug!(error = %e, "failed to open browser");
        eprintln!("Could not open browser automatically.");
        eprintln!("Open this URL in your browser:");
        eprintln!("  {auth_url}");
        eprintln!();
    } else {
        eprintln!("  Browser opened. Waiting for authentication...");
    }

    let code = tokio::select! {
        result = rx => {
            result.map_err(|_| miette::miette!("OIDC callback channel closed unexpectedly"))?
        }
        () = tokio::time::sleep(AUTH_TIMEOUT) => {
            return Err(miette::miette!(