load oauth clients from db instead of env and hardcoding

src/json_api/oauth/generate_token.rs

@@ -3,16 +3,11 @@ use crate::nnid::oauth::generate_token::create_token;
 use crate::nnid::oauth::generate_token::token_type::AUTH_TOKEN;
 use bytemuck::bytes_of;
 use chrono::Utc;
-use once_cell::sync::Lazy;
 use rocket::FromForm;
 use rocket::{State, form::Form, http::Status, post, serde::json::Json};
 use serde::Serialize;
 use sha2::{Digest, Sha256};
 use sqlx::Row;
-use std::env;
-
-pub static CLIENT_SECRET: Lazy<String> =
-    Lazy::new(|| env::var("OAUTH_CLIENT_SECRET").expect("OAUTH_CLIENT_SECRET not set"));
 
 #[derive(Serialize)]
 pub struct OAuthTokenResponse {
@@ -38,10 +33,9 @@ pub fn verify_nintendo_password(pid: i32, text_password: &str, db_bcrypt_hash: &
     sha.update(&[0x02, 0x65, 0x43, 0x46]);
     sha.update(text_password.as_bytes());
     let hashed_password_hex = hex::encode(sha.finalize());
-    bcrypt::verify(hashed_password_hex, db_bcrypt_hash).unwrap_or_else(|_| false)
+    bcrypt::verify(hashed_password_hex, db_bcrypt_hash).unwrap_or(false)
 }
 
-// dummy error responses
 #[derive(Serialize)]
 pub struct OAuthErrorResponse {
     pub error: String,
@@ -54,10 +48,48 @@ pub async fn generate_token(
 ) -> Result<Json<OAuthTokenResponse>, (Status, Json<OAuthErrorResponse>)> {
     println!("redirect URI is: {:?}", form_data.redirect_uri);
 
-    match form_data.client_id {
-        Some("account") | Some("splatnet") => {
-            let cl_secret: String = CLIENT_SECRET.clone();
-            if form_data.client_secret != Some(&cl_secret) {
+    let client_id = form_data.client_id.ok_or((
+        Status::BadRequest,
+        Json(OAuthErrorResponse {
+            error: "invalid_client".to_string(),
+        }),
+    ))?;
+
+    let client_row = match sqlx::query(
+        "SELECT client_secret, is_confidential FROM oauth_clients WHERE client_id = $1",
+    )
+    .bind(client_id)
+    .fetch_optional(pool.inner())
+    .await
+    {
+        Ok(Some(row)) => row,
+        _ => {
+            return Err((
+                Status::Unauthorized,
+                Json(OAuthErrorResponse {
+                    error: "invalid_client".to_string(),
+                }),
+            ));
+        }
+    };
+
+    let db_client_secret: Option<String> = client_row.get("client_secret");
+    let is_confidential: bool = client_row.get("is_confidential");
+
+    if is_confidential {
+        let provided_secret = form_data.client_secret.ok_or((
+            Status::Unauthorized,
+            Json(OAuthErrorResponse {
+                error: "invalid_client".to_string(),
+            }),
+        ))?;
+
+        let matches = match db_client_secret {
+            Some(secret) => secret == provided_secret,
+            None => false,
+        };
+
+        if !matches {
             return Err((
                 Status::Unauthorized,
                 Json(OAuthErrorResponse {
@@ -66,20 +98,8 @@ pub async fn generate_token(
             ));
         }
     }
-        Some("website") => {
-            // no secret for this client, cant be kept confidential in the case of the website
-        }
-        _ => {
-            return Err((
-                Status::BadRequest,
-                Json(OAuthErrorResponse {
-                    error: "invalid_client".to_string(),
-                }),
-            ));
-        }
-    }
 
-    // i'm only supporting the password grant incase someone feels lazy.
+    // i'm only supporting the password grant for the id server.
     let pid: i32 = match form_data.grant_type {
         "password" => {
             let username = form_data.username.ok_or((