Function build_oidc_channel

crates/openshell-tui/src/lib.rs:531–563

Build an HTTPS channel for OIDC-authenticated gateways. Tries mTLS client certs for the transport layer when available (the server may still require them alongside the bearer token), falls back to CA-only or system roots.

(name: &str, endpoint: &str)

/// may still require them alongside the bearer token), falls back to CA-only
/// or system roots.
async fn build_oidc_channel(name: &str, endpoint: &str) -> Result<Channel> {
    let mtls_dir = gateway_mtls_dir(name);

    let tls_config = mtls_dir.as_ref().map_or_else(
        || ClientTlsConfig::new().with_enabled_roots(),
        |dir| {
            let ca = std::fs::read(dir.join("ca.crt")).ok();
            let cert = std::fs::read(dir.join("tls.crt")).ok();
            let key = std::fs::read(dir.join("tls.key")).ok();

            match (ca, cert, key) {
                (Some(ca), Some(cert), Some(key)) => ClientTlsConfig::new()
                    .ca_certificate(Certificate::from_pem(ca))
                    .identity(Identity::from_pem(cert, key)),
                (Some(ca), _, _) => {
                    ClientTlsConfig::new().ca_certificate(Certificate::from_pem(ca))
                }
                _ => ClientTlsConfig::new().with_enabled_roots(),
            }
        },
    );

    Endpoint::from_shared(endpoint.to_string())
        .into_diagnostic()?
        .connect_timeout(Duration::from_secs(10))
        .http2_keep_alive_interval(Duration::from_secs(10))
        .keep_alive_while_idle(true)
        .tls_config(tls_config)
        .into_diagnostic()?
        .connect()
        .await
        .into_diagnostic()
}

/// Build a gRPC channel using mTLS client certificates.
async fn build_mtls_channel(name: &str, endpoint: &str) -> Result<Channel> {