From acb04bd782ec1eb6b5be42406086420c7528eb43 Mon Sep 17 00:00:00 2001
From: red binder <redbinder0526@proton.me>
Date: Mon, 10 Aug 2026 04:39:06 +0200
Subject: [PATCH] load oauth clients from db instead of env and hardcoding

---
 src/json_api/oauth/generate_token.rs | 70 ++++++++++++++++++----------
 1 file changed, 45 insertions(+), 25 deletions(-)

diff --git a/src/json_api/oauth/generate_token.rs b/src/json_api/oauth/generate_token.rs
index 091a99f..ee5aaf9 100644
--- a/src/json_api/oauth/generate_token.rs
+++ b/src/json_api/oauth/generate_token.rs
@@ -3,16 +3,11 @@ use crate::nnid::oauth::generate_token::create_token;
 use crate::nnid::oauth::generate_token::token_type::AUTH_TOKEN;
 use bytemuck::bytes_of;
 use chrono::Utc;
-use once_cell::sync::Lazy;
 use rocket::FromForm;
 use rocket::{State, form::Form, http::Status, post, serde::json::Json};
 use serde::Serialize;
 use sha2::{Digest, Sha256};
 use sqlx::Row;
-use std::env;
-
-pub static CLIENT_SECRET: Lazy<String> =
-    Lazy::new(|| env::var("OAUTH_CLIENT_SECRET").expect("OAUTH_CLIENT_SECRET not set"));
 
 #[derive(Serialize)]
 pub struct OAuthTokenResponse {
@@ -38,10 +33,9 @@ pub fn verify_nintendo_password(pid: i32, text_password: &str, db_bcrypt_hash: &
     sha.update(&[0x02, 0x65, 0x43, 0x46]);
     sha.update(text_password.as_bytes());
     let hashed_password_hex = hex::encode(sha.finalize());
-    bcrypt::verify(hashed_password_hex, db_bcrypt_hash).unwrap_or_else(|_| false)
+    bcrypt::verify(hashed_password_hex, db_bcrypt_hash).unwrap_or(false)
 }
 
-// dummy error responses
 #[derive(Serialize)]
 pub struct OAuthErrorResponse {
     pub error: String,
@@ -54,24 +48,50 @@ pub async fn generate_token(
 ) -> Result<Json<OAuthTokenResponse>, (Status, Json<OAuthErrorResponse>)> {
     println!("redirect URI is: {:?}", form_data.redirect_uri);
 
-    match form_data.client_id {
-        Some("account") | Some("splatnet") => {
-            let cl_secret: String = CLIENT_SECRET.clone();
-            if form_data.client_secret != Some(&cl_secret) {
-                return Err((
-                    Status::Unauthorized,
-                    Json(OAuthErrorResponse {
-                        error: "invalid_client".to_string(),
-                    }),
-                ));
-            }
-        }
-        Some("website") => {
-            // no secret for this client, cant be kept confidential in the case of the website
-        }
+    let client_id = form_data.client_id.ok_or((
+        Status::BadRequest,
+        Json(OAuthErrorResponse {
+            error: "invalid_client".to_string(),
+        }),
+    ))?;
+
+    let client_row = match sqlx::query(
+        "SELECT client_secret, is_confidential FROM oauth_clients WHERE client_id = $1",
+    )
+    .bind(client_id)
+    .fetch_optional(pool.inner())
+    .await
+    {
+        Ok(Some(row)) => row,
         _ => {
             return Err((
-                Status::BadRequest,
+                Status::Unauthorized,
+                Json(OAuthErrorResponse {
+                    error: "invalid_client".to_string(),
+                }),
+            ));
+        }
+    };
+
+    let db_client_secret: Option<String> = client_row.get("client_secret");
+    let is_confidential: bool = client_row.get("is_confidential");
+
+    if is_confidential {
+        let provided_secret = form_data.client_secret.ok_or((
+            Status::Unauthorized,
+            Json(OAuthErrorResponse {
+                error: "invalid_client".to_string(),
+            }),
+        ))?;
+
+        let matches = match db_client_secret {
+            Some(secret) => secret == provided_secret,
+            None => false,
+        };
+
+        if !matches {
+            return Err((
+                Status::Unauthorized,
                 Json(OAuthErrorResponse {
                     error: "invalid_client".to_string(),
                 }),
@@ -79,7 +99,7 @@ pub async fn generate_token(
         }
     }
 
-    // i'm only supporting the password grant incase someone feels lazy.
+    // i'm only supporting the password grant for the id server.
     let pid: i32 = match form_data.grant_type {
         "password" => {
             let username = form_data.username.ok_or((
@@ -190,4 +210,4 @@ pub async fn generate_token(
         token_type: "Bearer".to_string(),
         expires_in: 3600,
     }))
-}
+}
\ No newline at end of file