spacebar/account
Watch
13
0
Fork
You've already forked account
 2
Code Issues 2 Pull requests Projects Releases Packages 1 Wiki Activity Actions

allow website to not use a client secret

Browse source
This commit is contained in:
red binder 2026-06-21 23:19:41 +02:00
commit 381610c2ec
1 changed files with 20 additions and 14 deletions
Download patch file Download diff file Expand all files Collapse all files

34
src/json_api/oauth/generate_token.rs
View file

@ -59,19 +59,25 @@ pub async fn generate_token(
form_data: Form<TokenRequest<'_>>
) -> Result<Json<OAuthTokenResponse>, (Status, Json<OAuthErrorResponse>)> {
if form_data.client_id != Some("account") {
return Err((
Status::BadRequest,
Json(OAuthErrorResponse { error: "invalid_client".to_string() })
));
}
let cl_secret: String = CLIENT_SECRET.clone();
if form_data.client_secret != Some(&cl_secret) {
return Err((
Status::Unauthorized,
Json(OAuthErrorResponse { error: "invalid_client".to_string() })
));
match form_data.client_id {
Some("account") | Some("splatnet") => {
let cl_secret: String = CLIENT_SECRET.clone();
if form_data.client_secret != Some(&cl_secret) {
return Err((
Status::Unauthorized,
Json(OAuthErrorResponse { error: "invalid_client".to_string() })
));
}
}
Some("website") => {
// no secret for this client, cant be kept confidential in the case of the website
}
_ => {
return Err((
Status::BadRequest,
Json(OAuthErrorResponse { error: "invalid_client".to_string() })
));
}
}
// i'm only supporting the password grant incase someone feels lazy.
@ -163,4 +169,4 @@ pub async fn generate_token(
token_type: "Bearer".to_string(),
expires_in: 3600,
}))
}
}