matrix-rust-sdk

public

Star0

Fork 0

Watch0

5 commits 4 branches 0 tags 0 releases16.6 MiB

Commit `fc58f766d35e`

tarball

atagen <boss@atagen.co>2026-10-22 12:30 UTC

3 files changed+97-9

oauth: let a pending authorization be exported and restored

Modified file: crates/matrix-sdk/src/authentication/oauth/auth_code_builder.rs+2 additions−2 deletions@@ -24,7 +24,7 @@ use tracing::{info, instrument};
 use url::Url;
 
 use super::{ClientRegistrationData, OAuth, OAuthError};
-use crate::{Result, authentication::oauth::AuthorizationValidationData};
+use crate::{Result, authentication::oauth::PendingAuthorization};
 
 /// Builder type used to configure optional settings for authorization with an
 /// OAuth 2.0 authorization server via the Authorization Code flow.
@@ -156,7 +156,7 @@ impl OAuthAuthCodeUrlBuilder {
 
         data.authorization_data.lock().await.insert(
             state.clone(),
-            AuthorizationValidationData { server_metadata, device_id, redirect_uri, pkce_verifier },
+            PendingAuthorization { server_metadata, device_id, redirect_uri, pkce_verifier },
         );
 
         Ok(OAuthAuthorizationData { url, state })

Modified file: crates/matrix-sdk/src/authentication/oauth/mod.rs+63 additions−3 deletions@@ -262,7 +262,7 @@ impl OAuthCtx {
 pub(crate) struct OAuthAuthData {
     pub(crate) client_id: ClientId,
     /// The data necessary to validate authorization responses.
-    authorization_data: Mutex<HashMap<CsrfToken, AuthorizationValidationData>>,
+    authorization_data: Mutex<HashMap<CsrfToken, PendingAuthorization>>,
 }
 
 #[cfg(not(tarpaulin_include))]
@@ -1071,6 +1071,48 @@ impl OAuth {
         }
     }
 
+    /// Get the data of a login that was started but not finished yet, to
+    /// restore it with [`OAuth::restore_pending_authorization()`], typically
+    /// in another process.
+    ///
+    /// The returned data contains the PKCE code verifier of the authorization
+    /// request, so it must be stored as a secret.
+    ///
+    /// # Arguments
+    ///
+    /// * `state` - The state provided in [`OAuthAuthorizationData`] after
+    ///   building the authorization URL.
+    pub async fn pending_authorization(&self, state: &CsrfToken) -> Option<PendingAuthorization> {
+        self.data()?.authorization_data.lock().await.get(state).cloned()
+    }
+
+    /// Restore the data of a login that was started, possibly in another
+    /// process, and exported with [`OAuth::pending_authorization()`], so it
+    /// can be finished with [`OAuth::finish_login()`].
+    ///
+    /// The client must have been registered first, for example with
+    /// [`OAuth::restore_registered_client()`] and the same client ID as when
+    /// the login was started.
+    ///
+    /// The data contains the PKCE code verifier of the authorization request,
+    /// so it must be stored as a secret.
+    ///
+    /// # Arguments
+    ///
+    /// * `state` - The state provided in [`OAuthAuthorizationData`] after
+    ///   building the authorization URL.
+    ///
+    /// * `data` - The data returned by [`OAuth::pending_authorization()`].
+    pub async fn restore_pending_authorization(
+        &self,
+        state: CsrfToken,
+        data: PendingAuthorization,
+    ) -> Result<(), OAuthError> {
+        let auth_data = self.data().ok_or(OAuthError::NotRegistered)?;
+        auth_data.authorization_data.lock().await.insert(state, data);
+        Ok(())
+    }
+
     /// Request codes from the authorization server for logging in with another
     /// device.
     #[cfg(feature = "e2e-encryption")]
@@ -1740,8 +1782,15 @@ pub struct UserSession {
 
 /// The data necessary to validate a response from the Token endpoint in the
 /// Authorization Code flow.
-#[derive(Debug)]
-struct AuthorizationValidationData {
+///
+/// It can be exported with [`OAuth::pending_authorization()`] and restored
+/// with [`OAuth::restore_pending_authorization()`], to finish a login in
+/// another process than the one that started it.
+///
+/// It contains the PKCE code verifier of the authorization request, so it
+/// must be stored as a secret.
+#[derive(Debug, Serialize, Deserialize)]
+pub struct PendingAuthorization {
     /// The metadata of the server,
     server_metadata: AuthorizationServerMetadata,
 
@@ -1755,6 +1804,17 @@ struct AuthorizationValidationData {
     pkce_verifier: PkceCodeVerifier,
 }
 
+impl Clone for PendingAuthorization {
+    fn clone(&self) -> Self {
+        Self {
+            server_metadata: self.server_metadata.clone(),
+            device_id: self.device_id.clone(),
+            redirect_uri: self.redirect_uri.clone(),
+            pkce_verifier: PkceCodeVerifier::new(self.pkce_verifier.secret().clone()),
+        }
+    }
+}
+
 /// The data returned by the server in the redirect URI after a successful
 /// authorization.
 #[derive(Debug, Clone)]

Modified file: crates/matrix-sdk/src/authentication/oauth/tests.rs+32 additions−4 deletions@@ -20,7 +20,7 @@ use super::{
 use crate::{
     Client, Error, SessionChange,
     authentication::oauth::{
-        AuthorizationValidationData, ClientRegistrationData, OAuthAuthorizationCodeError,
+        ClientRegistrationData, OAuthAuthorizationCodeError, PendingAuthorization,
         error::{AuthorizationCodeErrorResponseType, OAuthClientRegistrationError},
     },
     client::caches::CachedValue,
@@ -203,6 +203,34 @@ async fn test_high_level_login() -> anyhow::Result<()> {
 }
 
 #[async_test]
+async fn test_high_level_login_in_another_client() -> anyhow::Result<()> {
+    // Given a login started by a client.
+    let (oauth, server, mut redirect_uri, registration_data) = mock_environment().await.unwrap();
+
+    let authorization_data = oauth
+        .login(redirect_uri.clone(), None, Some(registration_data), None)
+        .build()
+        .await
+        .unwrap();
+
+    // When its pending authorization is exported,
+    let client_id = oauth.client_id().unwrap().clone();
+    let pending = oauth.pending_authorization(&authorization_data.state).await.unwrap();
+    let pending = serde_json::from_str(&serde_json::to_string(&pending)?)?;
+
+    // And restored in a fresh client,
+    let other_oauth = server.client_builder().unlogged().build().await.oauth();
+    other_oauth.restore_registered_client(client_id);
+    other_oauth.restore_pending_authorization(authorization_data.state.clone(), pending).await?;
+
+    // Then that client can finish the login.
+    redirect_uri.set_query(Some(&format!("code=42&state={}", authorization_data.state.secret())));
+    other_oauth.finish_login(redirect_uri.into()).await?;
+
+    Ok(())
+}
+
+#[async_test]
 async fn test_high_level_login_cancellation() -> anyhow::Result<()> {
     // Given a client ready to complete login.
     let (oauth, server, mut redirect_uri, registration_data) = mock_environment().await.unwrap();
@@ -410,7 +438,7 @@ async fn test_finish_login() -> anyhow::Result<()> {
     let state1 = CsrfToken::new("state1".to_owned());
     let redirect_uri = REDIRECT_URI_STRING;
     let (_pkce_code_challenge, pkce_verifier) = PkceCodeChallenge::new_random_sha256();
-    let auth_validation_data = AuthorizationValidationData {
+    let auth_validation_data = PendingAuthorization {
         server_metadata: server_metadata.clone(),
         device_id: owned_device_id!("D3V1C31D"),
         redirect_uri: RedirectUrl::new(redirect_uri.to_owned())?,
@@ -465,7 +493,7 @@ async fn test_finish_login() -> anyhow::Result<()> {
     let state2 = CsrfToken::new("state2".to_owned());
     let redirect_uri = REDIRECT_URI_STRING;
     let (_pkce_code_challenge, pkce_verifier) = PkceCodeChallenge::new_random_sha256();
-    let auth_validation_data = AuthorizationValidationData {
+    let auth_validation_data = PendingAuthorization {
         server_metadata: server_metadata.clone(),
         device_id: owned_device_id!("D3V1C31D"),
         redirect_uri: RedirectUrl::new(redirect_uri.to_owned())?,
@@ -509,7 +537,7 @@ async fn test_finish_login() -> anyhow::Result<()> {
     let state3 = CsrfToken::new("state3".to_owned());
     let redirect_uri = REDIRECT_URI_STRING;
     let (_pkce_code_challenge, pkce_verifier) = PkceCodeChallenge::new_random_sha256();
-    let auth_validation_data = AuthorizationValidationData {
+    let auth_validation_data = PendingAuthorization {
         server_metadata,
         device_id: wrong_device_id.to_owned(),
         redirect_uri: RedirectUrl::new(redirect_uri.to_owned())?,

matrix-rust-sdk

Commit fc58f766d35e

Commit `fc58f766d35e`