Constellation, Spacedust, Slingshot, UFOs: atproto crates and services for microcosm
auth rejection
author
phil
date
(Jul 2, 2025, 3:37 PM -0400)
commit
998eafed
998eafedae0ee8ad443209874a63d1a74ccd1353
parent
c2463bad
c2463badb172c2245aff5e12c566758f9402cec2
+58
-71
+52
-69
who-am-i/src/server.rs
+52
-69
who-am-i/src/server.rs
···
247
247
use atrium_identity::Error as IdError;
248
248
use atrium_oauth::Error as OAuthError;
249
249
250
+
let err = |code, reason| {
251
+
let info = json!({
252
+
"result": "fail",
253
+
"reason": reason,
254
+
});
255
+
(code, RenderHtml("auth-fail", engine.clone(), info)).into_response()
256
+
};
257
+
250
258
match oauth.begin(¶ms.handle).await {
251
259
Ok(auth_url) => (jar, Redirect::to(&auth_url)).into_response(),
252
-
Err(OAuthError::Identity(IdError::NotFound)) => {
253
-
let info = json!({ "reason": "handle not found" });
254
-
(StatusCode::NOT_FOUND, RenderHtml("auth-fail", engine, info)).into_response()
255
-
}
256
-
Err(OAuthError::Identity(IdError::AtIdentifier(r))) => {
257
-
let info = json!({ "reason": r });
258
-
(StatusCode::NOT_FOUND, RenderHtml("auth-fail", engine, info)).into_response()
259
-
}
260
-
Err(OAuthError::Identity(IdError::HttpStatus(StatusCode::NOT_FOUND))) => {
261
-
let info = json!({ "reason": "handle not found" });
262
-
(StatusCode::NOT_FOUND, RenderHtml("auth-fail", engine, info)).into_response()
263
-
}
260
+
Err(OAuthError::Identity(
261
+
IdError::NotFound | IdError::HttpStatus(StatusCode::NOT_FOUND),
262
+
)) => err(StatusCode::NOT_FOUND, "handle not found"),
263
+
Err(OAuthError::Identity(IdError::AtIdentifier(r))) => err(StatusCode::BAD_REQUEST, &r),
264
264
Err(e) => {
265
265
eprintln!("begin auth failed: {e:?}");
266
-
let info = json!({ "reason": "unknown" });
267
-
(
268
-
StatusCode::INTERNAL_SERVER_ERROR,
269
-
RenderHtml("auth-fail", engine, info),
270
-
)
271
-
.into_response()
266
+
err(StatusCode::INTERNAL_SERVER_ERROR, "unknown")
272
267
}
273
268
}
274
269
}
275
270
276
-
impl OAuthCompleteError {
277
-
fn to_error_response(&self, engine: AppEngine) -> Response {
278
-
let (level, desc) = match self {
279
-
OAuthCompleteError::Denied { description, .. } => {
280
-
("warn", format!("asdf: {description:?}"))
281
-
}
282
-
OAuthCompleteError::Failed { .. } => (
283
-
"error",
284
-
"Something went wrong while requesting permission, sorry!".to_string(),
285
-
),
286
-
OAuthCompleteError::CallbackFailed(_) => (
287
-
"error",
288
-
"Something went wrong after permission was granted, sorry!".to_string(),
289
-
),
290
-
OAuthCompleteError::NoDid => (
291
-
"error",
292
-
"Something went wrong when trying to confirm your identity, sorry!".to_string(),
293
-
),
294
-
};
295
-
(
296
-
if level == "warn" {
297
-
StatusCode::FORBIDDEN
298
-
} else {
299
-
StatusCode::INTERNAL_SERVER_ERROR
300
-
},
301
-
RenderHtml(
302
-
"auth-fail",
303
-
engine,
304
-
json!({
305
-
"reason": desc,
306
-
}),
307
-
),
308
-
)
309
-
.into_response()
310
-
}
311
-
}
312
-
313
271
async fn complete_oauth(
314
272
State(AppState {
315
273
engine,
···
320
278
}): State<AppState>,
321
279
Query(params): Query<OAuthCallbackParams>,
322
280
jar: SignedCookieJar,
323
-
) -> Result<(SignedCookieJar, impl IntoResponse), Response> {
281
+
) -> Response {
282
+
let err = |code, result, reason| {
283
+
let info = json!({
284
+
"result": result,
285
+
"reason": reason,
286
+
});
287
+
(code, RenderHtml("auth-fail", engine.clone(), info)).into_response()
288
+
};
289
+
324
290
let did = match oauth.complete(params).await {
325
291
Ok(did) => did,
326
-
Err(e) => return Err(e.to_error_response(engine)),
292
+
Err(e) => {
293
+
return match e {
294
+
OAuthCompleteError::Denied { description, .. } => {
295
+
let desc = description.unwrap_or("permission to share was denied".to_string());
296
+
err(StatusCode::FORBIDDEN, "deny", desc.as_str())
297
+
}
298
+
OAuthCompleteError::Failed { .. } => {
299
+
eprintln!("auth completion failed: {e:?}");
300
+
err(
301
+
StatusCode::INTERNAL_SERVER_ERROR,
302
+
"fail",
303
+
"failed to complete",
304
+
)
305
+
}
306
+
OAuthCompleteError::CallbackFailed(e) => {
307
+
eprintln!("auth callback failed: {e:?}");
308
+
err(
309
+
StatusCode::INTERNAL_SERVER_ERROR,
310
+
"fail",
311
+
"failed to complete callback",
312
+
)
313
+
}
314
+
OAuthCompleteError::NoDid => err(StatusCode::BAD_REQUEST, "fail", "no DID found"),
315
+
};
316
+
}
327
317
};
328
318
329
319
let cookie = Cookie::build((DID_COOKIE_KEY, did.to_string()))
···
342
332
},
343
333
shutdown.child_token(),
344
334
);
345
-
346
-
Ok((
347
-
jar,
348
-
RenderHtml(
349
-
"authorized",
350
-
engine,
351
-
json!({
352
-
"did": did,
353
-
"fetch_key": fetch_key,
354
-
}),
355
-
),
356
-
))
335
+
let info = json!({
336
+
"did": did,
337
+
"fetch_key": fetch_key,
338
+
});
339
+
(jar, RenderHtml("authorized", engine, info)).into_response()
357
340
}
+1
-1
who-am-i/templates/auth-fail.hbs
+1
-1
who-am-i/templates/auth-fail.hbs
+5
-1
who-am-i/templates/prompt.hbs
+5
-1
who-am-i/templates/prompt.hbs
···
87
87
fail(`uh oh: ${parsed.reason}`);
88
88
}
89
89
90
+
if (parsed.result === "deny") {
91
+
fail(parsed.reason);
92
+
}
93
+
90
94
infoEl.classList.add('hidden');
91
95
92
96
const handle = await lookUp(parsed.fetch_key);
···
111
115
const shareAllow = handle => {
112
116
top.postMessage(
113
117
{ action: "allow", handle },
114
-
{{{json parent_host}}},
118
+
{{{json parent_origin}}},
115
119
);
116
120
}
117
121