load oauth clients from db instead of env and hardcoding

src/json_api/oauth/generate_token.rs

@@ -3,16 +3,11 @@ use crate::nnid::oauth::generate_token::create_token;
 use crate::nnid::oauth::generate_token::token_type::AUTH_TOKEN;
 use bytemuck::bytes_of;
 use chrono::Utc;
-use once_cell::sync::Lazy;
 use rocket::FromForm;
 use rocket::{State, form::Form, http::Status, post, serde::json::Json};
 use serde::Serialize;
 use sha2::{Digest, Sha256};
 use sqlx::Row;
-use std::env;
-
-pub static CLIENT_SECRET: Lazy<String> =
-    Lazy::new(|| env::var("OAUTH_CLIENT_SECRET").expect("OAUTH_CLIENT_SECRET not set"));
 
 #[derive(Serialize)]
 pub struct OAuthTokenResponse {
@@ -38,10 +33,9 @@ pub fn verify_nintendo_password(pid: i32, text_password: &str, db_bcrypt_hash: &
     sha.update(&[0x02, 0x65, 0x43, 0x46]);
     sha.update(text_password.as_bytes());
     let hashed_password_hex = hex::encode(sha.finalize());
-    bcrypt::verify(hashed_password_hex, db_bcrypt_hash).unwrap_or_else(|_| false)
+    bcrypt::verify(hashed_password_hex, db_bcrypt_hash).unwrap_or(false)
 }
 
-// dummy error responses
 #[derive(Serialize)]
 pub struct OAuthErrorResponse {
     pub error: String,
@@ -54,24 +48,50 @@ pub async fn generate_token(
 ) -> Result<Json<OAuthTokenResponse>, (Status, Json<OAuthErrorResponse>)> {
     println!("redirect URI is: {:?}", form_data.redirect_uri);
 
-    match form_data.client_id {
+    let client_id = form_data.client_id.ok_or((
-        Some("account") | Some("splatnet") => {
+        Status::BadRequest,
-            let cl_secret: String = CLIENT_SECRET.clone();
+        Json(OAuthErrorResponse {
-            if form_data.client_secret != Some(&cl_secret) {
+            error: "invalid_client".to_string(),
-                return Err((
+        }),
-                    Status::Unauthorized,
+    ))?;
-                    Json(OAuthErrorResponse {
+
-                        error: "invalid_client".to_string(),
+    let client_row = match sqlx::query(
-                    }),
+        "SELECT client_secret, is_confidential FROM oauth_clients WHERE client_id = $1",
-                ));
+    )
-            }
+    .bind(client_id)
-        }
+    .fetch_optional(pool.inner())
-        Some("website") => {
+    .await
-            // no secret for this client, cant be kept confidential in the case of the website
+    {
-        }
+        Ok(Some(row)) => row,
         _ => {
             return Err((
-                Status::BadRequest,
+                Status::Unauthorized,
+                Json(OAuthErrorResponse {
+                    error: "invalid_client".to_string(),
+                }),
+            ));
+        }
+    };
+
+    let db_client_secret: Option<String> = client_row.get("client_secret");
+    let is_confidential: bool = client_row.get("is_confidential");
+
+    if is_confidential {
+        let provided_secret = form_data.client_secret.ok_or((
+            Status::Unauthorized,
+            Json(OAuthErrorResponse {
+                error: "invalid_client".to_string(),
+            }),
+        ))?;
+
+        let matches = match db_client_secret {
+            Some(secret) => secret == provided_secret,
+            None => false,
+        };
+
+        if !matches {
+            return Err((
+                Status::Unauthorized,
                 Json(OAuthErrorResponse {
                     error: "invalid_client".to_string(),
                 }),
@@ -79,7 +99,7 @@ pub async fn generate_token(
         }
     }
 
-    // i'm only supporting the password grant incase someone feels lazy.
+    // i'm only supporting the password grant for the id server.
     let pid: i32 = match form_data.grant_type {
         "password" => {
             let username = form_data.username.ok_or((
@@ -190,4 +210,4 @@ pub async fn generate_token(
         token_type: "Bearer".to_string(),
         expires_in: 3600,
     }))
-}
+}