Merge branch 'feature/smbcloud-auth-sdk' into development

Author: keypair34

Cargo.lock

@@ -31,6 +31,7 @@ smbcloud-model = { version = "0.3", path = "crates/smbcloud-model" }
 smbcloud-network = { version = "0.3", path = "crates/smbcloud-network" }
 smbcloud-networking = { version = "0.3", path = "crates/smbcloud-networking" }
 smbcloud-auth = { version = "0.3", path = "crates/smbcloud-auth" }
+smbcloud-auth-sdk = { version = "0.3", path = "crates/smbcloud-auth-sdk" }
 smbcloud-networking-project = { version = "0.3", path = "crates/smbcloud-networking-project" }
 smbcloud-utils = { version = "0.3", path = "crates/smbcloud-utils" }
 spinners = "4.1.0"

Cargo.toml

@@ -0,0 +1,23 @@
+[package]
+name = "smbcloud-auth-sdk"
+version = "0.3.34"
+edition = "2024"
+authors = ["Seto Elkahfi <hej@setoelkahfi.se>"]
+description = "Client SDK for smbCloud Auth — authenticate your users via smbCloud Auth service."
+license = "Apache-2.0"
+repository = "https://github.com/smbcloudXYZ/smbcloud-cli"
+documentation = "https://smbcloud.xyz/posts"
+keywords = ["auth", "oidc", "authentication", "smbcloud", "sdk"]
+categories = ["authentication", "web-programming", "api-bindings"]
+readme = "README.md"
+
+[dependencies]
+base64 = "0.22"
+reqwest = { workspace = true, features = ["json", "rustls-tls-native-roots"] }
+serde = { workspace = true, features = ["derive"] }
+serde_json = { workspace = true }
+sha2 = "0.10"
+smbcloud-model = { workspace = true }
+smbcloud-network = { workspace = true }
+url-builder = { workspace = true }
+uuid = { version = "1", features = ["v4"] }

crates/smbcloud-auth-sdk/Cargo.toml

@@ -0,0 +1,29 @@
+# smbcloud-auth-sdk
+
+Client SDK for [smbCloud Auth](https://smbcloud.xyz/) — lets you authenticate your users against the smbCloud Auth service using your app credentials (`client_id` / `client_secret`).
+
+## Usage
+
+```rust
+use smbcloud_auth_sdk::{
+    client_credentials::ClientCredentials,
+    login::login_with_client,
+    signup::signup_with_client,
+    me::me_with_client,
+};
+use smbcloud_network::environment::Environment;
+
+let client = ClientCredentials {
+    app_id: "your-app-id",
+    app_secret: "your-app-secret",
+};
+
+// Sign up
+let result = signup_with_client(Environment::Production, client, email, password).await?;
+
+// Sign in
+let status = login_with_client(Environment::Production, client, email, password).await?;
+
+// Profile
+let user = me_with_client(Environment::Production, client, &access_token).await?;
+```

crates/smbcloud-auth-sdk/README.md

@@ -0,0 +1,115 @@
+use {
+    crate::client_credentials::{ClientCredentials, base_url_builder as tenant_base_url_builder},
+    reqwest::Url,
+    serde::{Deserialize, Serialize},
+    smbcloud_model::error_codes::{ErrorCode, ErrorResponse},
+    smbcloud_network::environment::Environment,
+    uuid::Uuid,
+};
+
+const TENANT_APPLE_AUTHORIZE_PATH: &str = "v1/client/oauth/apple/authorize";
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct AppleAuthorizationRequest {
+    pub authorize_url: String,
+    pub redirect_uri: String,
+    pub state: String,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct AppleAuthSession {
+    pub access_token: String,
+    pub refresh_token: Option<String>,
+    pub email: Option<String>,
+    pub name: Option<String>,
+    pub provider: String,
+    pub provider_account_id: String,
+    pub state: Option<String>,
+}
+
+pub fn build_authorization_request_with_client(
+    env: Environment,
+    client: ClientCredentials<'_>,
+    redirect_uri: String,
+    state: Option<String>,
+) -> Result<AppleAuthorizationRequest, ErrorResponse> {
+    let state = state.unwrap_or_else(|| Uuid::new_v4().to_string());
+    let mut url_builder = tenant_base_url_builder(env, client);
+
+    url_builder
+        .add_route(TENANT_APPLE_AUTHORIZE_PATH)
+        .add_param("redirect_uri", &redirect_uri)
+        .add_param("state", &state);
+
+    Ok(AppleAuthorizationRequest {
+        authorize_url: url_builder.build(),
+        redirect_uri,
+        state,
+    })
+}
+
+pub fn parse_callback_url(
+    callback_url: &str,
+    expected_state: Option<&str>,
+) -> Result<AppleAuthSession, ErrorResponse> {
+    let url = Url::parse(callback_url).map_err(|err| ErrorResponse::Error {
+        error_code: ErrorCode::ParseError,
+        message: err.to_string(),
+    })?;
+
+    let mut access_token = None;
+    let mut refresh_token = None;
+    let mut email = None;
+    let mut name = None;
+    let mut provider = None;
+    let mut provider_account_id = None;
+    let mut state = None;
+    let mut error = None;
+
+    for (key, value) in url.query_pairs() {
+        match key.as_ref() {
+            "access_token" => access_token = Some(value.into_owned()),
+            "refresh_token" => refresh_token = Some(value.into_owned()),
+            "email" => email = Some(value.into_owned()),
+            "name" => name = Some(value.into_owned()),
+            "provider" => provider = Some(value.into_owned()),
+            "provider_account_id" => provider_account_id = Some(value.into_owned()),
+            "state" => state = Some(value.into_owned()),
+            "error" => error = Some(value.into_owned()),
+            _ => {}
+        }
+    }
+
+    if let Some(error) = error {
+        return Err(ErrorResponse::Error {
+            error_code: ErrorCode::InvalidParams,
+            message: error,
+        });
+    }
+
+    if let Some(expected_state) = expected_state {
+        if state.as_deref() != Some(expected_state) {
+            return Err(ErrorResponse::Error {
+                error_code: ErrorCode::InvalidParams,
+                message: "Apple callback state mismatch.".to_string(),
+            });
+        }
+    }
+
+    Ok(AppleAuthSession {
+        access_token: required_param("access_token", access_token)?,
+        refresh_token,
+        email,
+        name,
+        provider: provider.unwrap_or_else(|| "apple".to_string()),
+        provider_account_id: required_param("provider_account_id", provider_account_id)?,
+        state,
+    })
+}
+
+fn required_param(name: &str, value: Option<String>) -> Result<String, ErrorResponse> {
+    value.ok_or_else(|| ErrorResponse::Error {
+        error_code: ErrorCode::InvalidParams,
+        message: format!("Missing `{name}` in Apple callback URL."),
+    })
+}

crates/smbcloud-auth-sdk/src/apple.rs

@@ -0,0 +1,17 @@
+use {smbcloud_network::environment::Environment, url_builder::URLBuilder};
+
+#[derive(Clone, Copy)]
+pub struct ClientCredentials<'a> {
+    pub app_id: &'a str,
+    pub app_secret: &'a str,
+}
+
+pub fn base_url_builder(env: Environment, client: ClientCredentials<'_>) -> URLBuilder {
+    let mut url_builder = URLBuilder::new();
+    url_builder
+        .set_protocol(&env.api_protocol())
+        .set_host(&env.api_host())
+        .add_param("client_id", client.app_id)
+        .add_param("client_secret", client.app_secret);
+    url_builder
+}

crates/smbcloud-auth-sdk/src/client_credentials.rs

@@ -0,0 +1,8 @@
+pub mod apple;
+pub mod client_credentials;
+pub mod login;
+pub mod logout;
+pub mod me;
+pub mod oidc;
+pub mod remove;
+pub mod signup;

crates/smbcloud-auth-sdk/src/lib.rs

@@ -0,0 +1,34 @@
+use {
+    crate::client_credentials::{ClientCredentials, base_url_builder as tenant_base_url_builder},
+    reqwest::Client,
+    smbcloud_model::{
+        error_codes::ErrorResponse,
+        login::{AccountStatus, LoginParams, UserParam},
+    },
+    smbcloud_network::{environment::Environment, network::request_login},
+};
+
+pub async fn login_with_client(
+    env: Environment,
+    client: ClientCredentials<'_>,
+    username: String,
+    password: String,
+) -> Result<AccountStatus, ErrorResponse> {
+    let login_params = LoginParams {
+        user: UserParam {
+            email: username,
+            password,
+        },
+    };
+    let builder = Client::new()
+        .post(build_login_url(env, client))
+        .json(&login_params)
+        .header("User-agent", client.app_id);
+    request_login(builder).await
+}
+
+fn build_login_url(env: Environment, client: ClientCredentials<'_>) -> String {
+    let mut url_builder = tenant_base_url_builder(env, client);
+    url_builder.add_route("v1/client/users/sign_in");
+    url_builder.build()
+}

crates/smbcloud-auth-sdk/src/login.rs

@@ -0,0 +1,43 @@
+use {
+    crate::client_credentials::{ClientCredentials, base_url_builder as tenant_base_url_builder},
+    reqwest::{Client, StatusCode},
+    smbcloud_model::error_codes::{ErrorCode, ErrorResponse},
+    smbcloud_network::environment::Environment,
+};
+
+pub async fn logout_with_client(
+    env: Environment,
+    client: ClientCredentials<'_>,
+    access_token: String,
+) -> Result<(), ErrorResponse> {
+    let response = match Client::new()
+        .delete(build_logout_url(env, client))
+        .header("Authorization", access_token)
+        .header("Accept", "application/json")
+        .header("Content-Type", "application/x-www-form-urlencoded")
+        .send()
+        .await
+    {
+        Ok(response) => response,
+        Err(_) => {
+            return Err(ErrorResponse::Error {
+                error_code: ErrorCode::Unknown,
+                message: ErrorCode::Unknown.message(None).to_string(),
+            });
+        }
+    };
+
+    match response.status() {
+        StatusCode::OK => Ok(()),
+        _ => Err(ErrorResponse::Error {
+            error_code: ErrorCode::Unauthorized,
+            message: ErrorCode::Unauthorized.message(None).to_string(),
+        }),
+    }
+}
+
+fn build_logout_url(env: Environment, client: ClientCredentials<'_>) -> String {
+    let mut url_builder = tenant_base_url_builder(env, client);
+    url_builder.add_route("v1/client/users/sign_out");
+    url_builder.build()
+}

crates/smbcloud-auth-sdk/src/logout.rs

@@ -0,0 +1,25 @@
+use {
+    crate::client_credentials::{ClientCredentials, base_url_builder as tenant_base_url_builder},
+    reqwest::Client,
+    smbcloud_model::{account::User, error_codes::ErrorResponse},
+    smbcloud_network::{environment::Environment, network::request},
+};
+
+pub async fn me_with_client(
+    env: Environment,
+    client: ClientCredentials<'_>,
+    access_token: &str,
+) -> Result<User, ErrorResponse> {
+    let builder = Client::new()
+        .get(build_me_url(env, client))
+        .header("Authorization", access_token)
+        .header("Accept", "application/json")
+        .header("Content-Type", "application/x-www-form-urlencoded");
+    request(builder).await
+}
+
+fn build_me_url(env: Environment, client: ClientCredentials<'_>) -> String {
+    let mut url_builder = tenant_base_url_builder(env, client);
+    url_builder.add_route("v1/client/me");
+    url_builder.build()
+}