feat: add XH auth plugin intgeration

Author: ctron

Cargo.lock

@@ -17,6 +17,10 @@ rust-version = "1.88"
 name = "oidc"
 path = "src/main.rs"
 
+[[bin]]
+name = "xh-plugin-oidc"
+path = "src/bin/xh-plugin-oidc.rs"
+
 [package.metadata.binstall]
 pkg-url = "{ repo }/releases/download/v{ version }/oidc-{ target }{ binary-ext }"
 pkg-fmt = "bin"
@@ -43,6 +47,7 @@ serde_yaml = "0.9"
 simplelog = "0.12"
 time = { version = "0.3", features = ["serde-well-known", "formatting"] }
 tokio = { version = "1.36", features = ["full"] }
+toml = "1.1.2"
 url = "2"
 
 openssl = "0.10" # transient dependency, required for vendoring

Cargo.toml

@@ -79,6 +79,35 @@ This also works with `curl`:
 curl http://example.com/api -H $(oidc token -H my-client)
 ```
 
+## XH integration
+
+Use the `xh-plugin-oidc` binary with `xh` custom auth plugins:
+
+```bash
+xh --auth-type=plugin:oidc --auth=my-client https://example.com/api
+```
+
+The `xh-plugin-oidc` binary can also discover the client name from a local config file. Starting from
+the current directory, it walks up parent directories and searches for `.xh-auth-oidc.json`,
+`.xh-auth-oidc.yaml`, then `.xh-auth-oidc.toml`:
+
+```toml
+client_name = "my-client"
+
+[http]
+timeout = "60s"
+connect_timeout = "30s"
+min_tls_version = "1.2"
+disable_system_certificates = false
+additional_root_certificates = []
+```
+
+Then the client name does not need to be passed to `xh`:
+
+```bash
+xh --auth-type=plugin:oidc https://example.com/api
+```
+
 ## More examples
 
 Create a public client from an initial refresh token. This can be useful if you have a frontend application, but no

README.md

@@ -0,0 +1,21 @@
+#![deny(clippy::unwrap_used)]
+#![deny(clippy::expect_used)]
+
+use std::{
+    io::{stdin, stdout},
+    process::ExitCode,
+};
+
+#[tokio::main]
+async fn main() -> ExitCode {
+    match oidc_cli::plugin::run(stdin().lock(), stdout().lock()).await {
+        Ok(()) => ExitCode::SUCCESS,
+        Err(err) => {
+            eprintln!("{err}");
+            for (n, cause) in err.chain().enumerate().skip(1) {
+                eprintln!("  {n}: {cause}");
+            }
+            ExitCode::FAILURE
+        }
+    }
+}

src/bin/xh-plugin-oidc.rs

@@ -1,33 +1,5 @@
-mod completion;
-mod create;
-mod delete;
-mod inspect;
-mod list;
-mod token;
-
-use std::process::ExitCode;
-
-#[derive(Debug, clap::Subcommand)]
-#[allow(clippy::large_enum_variant)]
-pub enum Command {
-    Create(create::Create),
-    Delete(delete::Delete),
-    Token(token::GetToken),
-    List(list::List),
-    Inspect(inspect::Inspect),
-    Completion(completion::GetCompletion),
-}
-
-impl Command {
-    pub async fn run(self) -> anyhow::Result<ExitCode> {
-        match self {
-            Self::Create(cmd) => cmd.run().await,
-            Self::Delete(cmd) => cmd.run().await,
-            Self::Token(cmd) => cmd.run().await,
-            Self::List(cmd) => cmd.run().await,
-            Self::Inspect(cmd) => cmd.run().await,
-            Self::Completion(cmd) => cmd.run().await,
-        }
-        .map(|()| ExitCode::SUCCESS)
-    }
-}
+pub mod create;
+pub mod delete;
+pub mod inspect;
+pub mod list;
+pub mod token;

src/cmd/completion.rs

@@ -1,22 +1,27 @@
 use anyhow::Context;
 use reqwest::{header, tls::Version};
+use serde::Deserialize;
 use std::path::PathBuf;
 
 const USER_AGENT: &str = concat!("OIDC-CLI/", env!("CARGO_PKG_VERSION"));
 
-#[derive(Copy, Clone, Eq, PartialEq, Ord, PartialOrd, Debug, clap::ValueEnum)]
+#[derive(Copy, Clone, Eq, PartialEq, Ord, PartialOrd, Debug, clap::ValueEnum, Deserialize)]
 pub enum TlsVersion {
     /// TLS 1.0
     #[value(name("1.0"))]
+    #[serde(rename = "1.0")]
     Tls1_0,
     /// TLS 1.1
     #[value(name("1.1"))]
+    #[serde(rename = "1.1")]
     Tls1_1,
     /// TLS 1.2
     #[value(name("1.2"))]
+    #[serde(rename = "1.2")]
     Tls1_2,
     /// TLS 1.3
     #[value(name("1.3"))]
+    #[serde(rename = "1.3")]
     Tls1_3,
 }
 
@@ -32,8 +37,9 @@ impl From<TlsVersion> for Version {
 }
 
 /// HTTP client options
-#[derive(Clone, Debug, PartialEq, Eq, clap::Args)]
+#[derive(Clone, Debug, PartialEq, Eq, clap::Args, Deserialize)]
 #[command(next_help_heading = "HTTP client options")]
+#[serde(default)]
 pub struct HttpOptions {
     /// Disable TLS validation (INSECURE!)
     #[arg(long)]
@@ -49,17 +55,64 @@ pub struct HttpOptions {
 
     /// Connect timeout
     #[arg(long, default_value = "30s")]
+    #[serde(
+        default = "default::connect_timeout",
+        deserialize_with = "deserialize_duration"
+    )]
     pub connect_timeout: humantime::Duration,
 
     /// Request timeout
     #[arg(long, default_value = "60s", short = 't')]
+    #[serde(
+        default = "default::timeout",
+        deserialize_with = "deserialize_duration"
+    )]
     pub timeout: humantime::Duration,
 
     /// Minimum TLS version
     #[arg(long, value_enum, default_value_t = TlsVersion::Tls1_2)]
+    #[serde(default = "default::min_tls_version")]
     pub min_tls_version: TlsVersion,
 }
 
+impl Default for HttpOptions {
+    fn default() -> Self {
+        Self {
+            tls_insecure: false,
+            additional_root_certificates: Vec::new(),
+            disable_system_certificates: false,
+            connect_timeout: default::connect_timeout(),
+            timeout: default::timeout(),
+            min_tls_version: default::min_tls_version(),
+        }
+    }
+}
+
+mod default {
+    use super::TlsVersion;
+
+    pub(super) fn connect_timeout() -> humantime::Duration {
+        std::time::Duration::from_secs(30).into()
+    }
+
+    pub(super) fn timeout() -> humantime::Duration {
+        std::time::Duration::from_secs(60).into()
+    }
+
+    pub(super) fn min_tls_version() -> TlsVersion {
+        TlsVersion::Tls1_2
+    }
+}
+
+fn deserialize_duration<'de, D>(deserializer: D) -> Result<humantime::Duration, D::Error>
+where
+    D: serde::Deserializer<'de>,
+{
+    String::deserialize(deserializer)?
+        .parse()
+        .map_err(serde::de::Error::custom)
+}
+
 /// A common way to create an HTTP client
 pub async fn create_client(options: &HttpOptions) -> anyhow::Result<reqwest::Client> {
     let mut headers = header::HeaderMap::new();

src/cmd/mod.rs

@@ -0,0 +1,11 @@
+#![deny(clippy::unwrap_used)]
+#![deny(clippy::expect_used)]
+
+pub mod claims;
+pub mod cmd;
+pub mod config;
+pub mod http;
+pub mod oidc;
+pub mod plugin;
+pub mod server;
+pub mod utils;