(
&self,
request: Request<api::OpenIdConnectLoginRequest>,
)
| 452 | } |
| 453 | |
| 454 | async fn open_id_connect_login( |
| 455 | &self, |
| 456 | request: Request<api::OpenIdConnectLoginRequest>, |
| 457 | ) -> Result<Response<api::OpenIdConnectLoginResponse>, Status> { |
| 458 | let req = request.get_ref(); |
| 459 | let conf = config::get(); |
| 460 | let oidc_user = oidc::get_user(&req.code, &req.state) |
| 461 | .await |
| 462 | .map_err(|e| e.status())?; |
| 463 | |
| 464 | let external_id = oidc_user.subject().to_string(); |
| 465 | let email = match oidc_user.email() { |
| 466 | Some(v) => v.to_string(), |
| 467 | None => { |
| 468 | return Err(Status::invalid_argument("email is missing")); |
| 469 | } |
| 470 | }; |
| 471 | let email_verified = oidc_user.email_verified().unwrap_or_default() |
| 472 | || conf |
| 473 | .user_authentication |
| 474 | .openid_connect |
| 475 | .assume_email_verified; |
| 476 | |
| 477 | if !email_verified { |
| 478 | return Err(Status::failed_precondition( |
| 479 | "email address must be verified before you can login", |
| 480 | )); |
| 481 | } |
| 482 | |
| 483 | // try to get user by external id |
| 484 | let mut u: Option<user::User> = match user::get_by_external_id(&external_id).await { |
| 485 | Ok(v) => Some(v), |
| 486 | Err(e) => match e { |
| 487 | Error::NotFound(_) => None, |
| 488 | _ => { |
| 489 | return Err(e.status()); |
| 490 | } |
| 491 | }, |
| 492 | }; |
| 493 | |
| 494 | // try to get user by email and set external id |
| 495 | if u.is_none() { |
| 496 | u = match user::get_by_email(&email).await { |
| 497 | Ok(mut v) => { |
| 498 | v.external_id = Some(external_id.clone()); |
| 499 | Some(v) |
| 500 | } |
| 501 | Err(e) => match e { |
| 502 | Error::NotFound(_) => None, |
| 503 | _ => { |
| 504 | return Err(e.status()); |
| 505 | } |
| 506 | }, |
| 507 | }; |
| 508 | } |
| 509 | |
| 510 | // register the user (if enabled) |
| 511 | if u.is_none() && conf.user_authentication.openid_connect.registration_enabled { |
nothing calls this directly
no test coverage detected