Function oidc_client_credentials_flow

crates/openshell-cli/src/oidc_auth.rs:187–226

Run the OIDC Client Credentials flow (for CI/automation). Reads `OPENSHELL_OIDC_CLIENT_SECRET` from the environment.

(
    issuer: &str,
    client_id: &str,
    audience: Option<&str>,
    scopes: Option<&str>,
    insecure: bool,
)

///
/// Reads `OPENSHELL_OIDC_CLIENT_SECRET` from the environment.
pub async fn oidc_client_credentials_flow(
    issuer: &str,
    client_id: &str,
    audience: Option<&str>,
    scopes: Option<&str>,
    insecure: bool,
) -> Result<OidcTokenBundle> {
    let client_secret = std::env::var("OPENSHELL_OIDC_CLIENT_SECRET").map_err(|_| {
        miette::miette!(
            "OPENSHELL_OIDC_CLIENT_SECRET environment variable is required for client credentials flow"
        )
    })?;

    let discovery = discover(issuer, insecure).await?;

    let client = BasicClient::new(ClientId::new(client_id.to_string()))
        .set_client_secret(ClientSecret::new(client_secret))
        .set_token_uri(TokenUrl::new(discovery.token_endpoint).into_diagnostic()?)
        .set_auth_type(AuthType::RequestBody);

    let mut request = client.exchange_client_credentials();
    for scope in build_ci_scopes(scopes) {
        request = request.add_scope(scope);
    }
    if let Some(aud) = audience {
        request = request.add_extra_param("audience", aud);
    }

    let http = http_client(insecure);
    let token_response = request
        .request_async(&http)
        .await
        .map_err(|e| miette::miette!("client credentials token exchange failed: {e}"))?;

    Ok(bundle_from_oauth2_response(
        &token_response,
        issuer,
        client_id,
    ))
}

/// Refresh an OIDC token using the `refresh_token` grant.
///