wim/rustsf_auth
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

OAuth Web server flow

Browse Source
This commit is contained in:
Wim Velzeboer
2026-09-22 18:05:06 +01:00
parent 8010d33b11
commit 5def68ef61
9 changed files with 205 additions and 144 deletions
Download Patch File Download Diff File Expand all files Collapse all files
examples/web_server.rs
+15 -8
View File
@@ -9,11 +9,11 @@
//!
//! The user must have API access enabled to be able to make API calls to Salesforce.
//!
use std::process::Command;
use oauth2::http::header::AUTHORIZATION;
use oauth2::http::{HeaderMap, HeaderValue};
use rustsf_auth::{SalesforceCredentials};
use rustsf_auth::OAuthWebService;
pub const CONNECT_TIMEOUT: u64 = 15;
pub const REQUEST_TIMEOUT: u64 = 30;
@@ -42,7 +42,7 @@ fn open_browser(url: &str) {
}
#[tokio::main]
async fn main(){
async fn main() {
// The client id, urls and scopes.
let login_url = "https://example.my.salesforce.com/";
let client_id = "PlatformCLI"; // The connected app the SFDX CLI is using
@@ -57,7 +57,18 @@ async fn main(){
client_secret,
redirect_url,
scopes,
);
)
// Optionally: add a custom callback response the user will see after authentication
.with_callback_response(
r#"<!doctype html>
<html>
<head><title>Authenticated</title></head>
<body>
<h1>Authentication complete</h1>
<p>You can close this tab.</p>
</body>
</html>"#,
);
let auth_url = web_service.authorization_url().await.unwrap();
// Ask user to authenticate themselves
@@ -65,10 +76,6 @@ async fn main(){
open_browser(&auth_url);
let session = web_service.connect().await.unwrap();
// Constructing the authentication session and connecting to Salesforce
// This will open the default browser and wait for the user to complete the authentication process.
let session = config.connect().await.unwrap();
// Build the headers to include the access token
let mut headers = HeaderMap::new();
let auth_value = format!("Bearer {}", session.access_token().await.unwrap());
src/credentials/access_token.rs
-2
View File
@@ -44,8 +44,6 @@ impl SalesforceCredentials {
access_token: Some(access_token.into()),
refresh_token,
instance_url: Some(instance_url.into()),
redirect_uri: None,
scopes: vec![],
}
}
src/credentials/client_credentials.rs
-2
View File
@@ -35,8 +35,6 @@ impl SalesforceCredentials {
access_token: None,
refresh_token: None,
instance_url: None,
redirect_uri: None,
scopes: vec![],
}
}
src/credentials/jwt_bearer.rs
-2
View File
@@ -66,8 +66,6 @@ impl SalesforceCredentials {
access_token: None,
refresh_token: None,
instance_url: None,
redirect_uri: None,
scopes: vec![],
}
}
src/credentials/mod.rs
+1 -11
View File
@@ -10,7 +10,7 @@ mod access_token;
mod client_credentials;
mod jwt_bearer;
pub(crate) mod sfdx_auth_url;
mod web_server;
pub mod web_server;
/// Supported Salesforce OAuth authentication flows.
///
@@ -36,9 +36,6 @@ pub enum SalesforceAuthFlow {
/// Authenticate from an SFDX auth URL.
SfdxUrl,
/// Authenticate using the OAuth 2.0 Web Server Flow.
WebServer,
/// Use an already available Salesforce access token.
AccessToken,
}
@@ -95,12 +92,6 @@ pub struct SalesforceCredentials {
/// Salesforce instance URL, for example `https://example.my.salesforce.com`.
pub instance_url: Option<String>,
/// OAuth redirect URI used by the Web Server Flow.
pub redirect_uri: Option<String>,
/// OAuth scopes requested by the Web Server Flow.
pub scopes: Vec<String>,
}
impl SalesforceCredentials {
@@ -180,7 +171,6 @@ impl SalesforceCredentials {
SalesforceAuthFlow::ClientCredentials => self.connect_client_credentials().await,
SalesforceAuthFlow::JwtBearer => self.connect_jwt().await,
SalesforceAuthFlow::SfdxUrl => self.connect_sfdx_url().await,
SalesforceAuthFlow::WebServer => self.connect_web_server().await,
}
}
src/credentials/sfdx_auth_url.rs
-2
View File
@@ -91,8 +91,6 @@ impl SalesforceCredentials {
access_token: None,
refresh_token: Some(refresh_token),
instance_url: None,
redirect_uri: None,
scopes: vec![],
})
}
src/credentials/web_server.rs
+144 -113
View File
@@ -1,51 +1,55 @@
use std::collections::HashMap;
use std::process::Command;
use std::sync::RwLock;
use std::time::{SystemTime, UNIX_EPOCH};
use log::trace;
use oauth2::TokenUrl;
use tokio::io::{AsyncReadExt, AsyncWriteExt};
use tokio::net::TcpListener;
use url::Url;
use crate::credentials::{http_client, required, SalesforceAuthFlow, SalesforceCredentials};
use crate::credentials::{
http_client, parse_salesforce_identity_ids, required, SalesforceAuthFlow, SalesforceCredentials,
};
use crate::salesforce_token_response::SalesforceTokenResponse;
use crate::SalesforceAuthError;
use crate::{SalesforceAuthError, SalesforceAuthSession, SalesforceAuthToken};
const DEFAULT_WEB_SERVER_SCOPES: &[&str] = &["api", "refresh_token", "offline_access"];
impl SalesforceCredentials {
/// Creates a configuration for the OAuth 2.0 Web Server Flow.
const DEFAULT_CALLBACK_RESPONSE: &str = concat!(
"<!doctype html>",
"<html>",
"<head><title>Salesforce Login Complete</title></head>",
"<body>",
"<h1>Salesforce login complete</h1>",
"<p>You can close this browser window and return to your application.</p>",
"</body>",
"</html>"
);
/// OAuth 2.0 Web Server Flow helper.
///
/// This type prepares a Salesforce authorization URL, lets the caller decide how
/// to open it, then listens for the OAuth callback and exchanges the received
/// authorization code for a Salesforce session.
#[derive(Debug, Clone)]
pub struct OAuthWebService {
login_url: String,
client_id: String,
client_secret: Option<String>,
redirect_uri: String,
scopes: Vec<String>,
state: String,
callback_response: Option<String>,
}
impl OAuthWebService {
/// Creates a new OAuth Web Server Flow helper.
///
/// This flow opens the Salesforce authorization URL in the user's browser,
/// starts a temporary local callback server, receives the authorization code,
/// and exchanges it for an access token and refresh token.
///
/// The connected app must have a callback URL matching `redirect_uri`, for example:
///
/// `http://localhost:1717/OauthRedirect`
///
/// # Examples
///
/// ```rust,no_run
/// use rustsf_auth::{SalesforceAuthFlow, SalesforceCredentials};
///
/// # async fn example() -> Result<(), rustsf_auth::SalesforceAuthError> {
/// let config = SalesforceCredentials::web_server(
/// "https://login.salesforce.com",
/// "client-id",
/// Some("client-secret".to_string()),
/// "http://localhost:1717/OauthRedirect",
/// None,
/// );
///
/// assert_eq!(config.flow, SalesforceAuthFlow::WebServer);
///
/// let session = config.connect().await?;
/// println!("{}", session.access_token().await?);
/// # Ok(())
/// # }
/// ```
pub fn web_server(
/// The caller should call [`OAuthWebService::authorization_url`] first, open
/// the returned URL in a browser, then call [`OAuthWebService::connect`] to
/// wait for the callback and receive a [`SalesforceAuthSession`].
pub fn new(
login_url: impl Into<String>,
client_id: impl Into<String>,
client_secret: Option<String>,
@@ -53,59 +57,57 @@ impl SalesforceCredentials {
scopes: Option<Vec<String>>,
) -> Self {
Self {
flow: SalesforceAuthFlow::WebServer,
login_url: Some(login_url.into()),
client_id: Some(client_id.into()),
login_url: login_url.into(),
client_id: client_id.into(),
client_secret,
username: None,
private_key_pem: None,
access_token: None,
refresh_token: None,
instance_url: None,
redirect_uri: Some(redirect_uri.into()),
redirect_uri: redirect_uri.into(),
scopes: scopes.unwrap_or_else(|| {
DEFAULT_WEB_SERVER_SCOPES
.iter()
.map(|scope| (*scope).to_string())
.collect()
}),
state: create_state(),
callback_response: None,
}
}
/// Builds the Salesforce authorization URL for the Web Server Flow.
/// Builds the Salesforce authorization URL.
///
/// This is useful if callers want to present or open the URL themselves.
pub fn web_server_authorization_url(&self, state: &str) -> Result<String, SalesforceAuthError> {
let login_url = required(self.login_url.as_deref(), "login_url")?;
let client_id = required(self.client_id.as_deref(), "client_id")?;
let redirect_uri = required(self.redirect_uri.as_deref(), "redirect_uri")?;
/// This method does not open a browser. The caller is responsible for opening
/// the returned URL or presenting it to the user.
pub async fn authorization_url(&self) -> Result<String, SalesforceAuthError> {
let normalized = self.login_url.trim_end_matches('/');
let authorize_url = format!("{normalized}/services/oauth2/authorize");
let normalized = login_url.trim_end_matches('/');
let mut url = Url::parse(&format!("{normalized}/services/oauth2/authorize"))
let mut url = Url::parse(&authorize_url)
.map_err(|source| SalesforceAuthError::InvalidUrl {
url: format!("{normalized}/services/oauth2/authorize"),
url: authorize_url,
source,
})?;
url.query_pairs_mut()
.append_pair("response_type", "code")
.append_pair("client_id", client_id)
.append_pair("redirect_uri", redirect_uri)
.append_pair("client_id", &self.client_id)
.append_pair("redirect_uri", &self.redirect_uri)
.append_pair("scope", &self.scopes.join(" "))
.append_pair("state", state)
.append_pair("state", &self.state)
.append_pair("prompt", "login");
Ok(url.to_string())
}
pub(crate) async fn connect_web_server(&self) -> Result<SalesforceTokenResponse, SalesforceAuthError> {
let state = create_state();
let auth_url = self.web_server_authorization_url(&state)?;
let redirect_uri = required(self.redirect_uri.as_deref(), "redirect_uri")?;
let callback_url = Url::parse(redirect_uri).map_err(|source| SalesforceAuthError::InvalidUrl {
url: redirect_uri.to_string(),
source,
})?;
/// Starts listening for the OAuth callback and exchanges the authorization
/// code for a Salesforce authentication session.
///
/// Call [`OAuthWebService::authorization_url`] first and open that URL in a
/// browser before awaiting this method.
pub async fn connect(&self) -> Result<SalesforceAuthSession, SalesforceAuthError> {
let callback_url = Url::parse(&self.redirect_uri)
.map_err(|source| SalesforceAuthError::InvalidUrl {
url: self.redirect_uri.clone(),
source,
})?;
let host = callback_url.host_str().unwrap_or("127.0.0.1");
let port = callback_url
@@ -115,18 +117,16 @@ impl SalesforceCredentials {
let bind_host = if host == "localhost" { "127.0.0.1" } else { host };
let listener = TcpListener::bind((bind_host, port)).await?;
trace!("Web Server Flow authorization URL: {}", auth_url);
open_browser(&auth_url);
println!("Open this URL in your browser if it did not open automatically:\n{auth_url}");
let callback = receive_oauth_callback(
listener,
self.callback_response.as_deref(),
).await?;
let callback = receive_oauth_callback(listener).await?;
let callback_state = callback
.get("state")
.ok_or(SalesforceAuthError::InvalidOAuthCallback)?;
if callback_state != &state {
if callback_state != &self.state {
return Err(SalesforceAuthError::OAuthStateMismatch);
}
@@ -134,23 +134,32 @@ impl SalesforceCredentials {
.get("code")
.ok_or(SalesforceAuthError::InvalidOAuthCallback)?;
self.exchange_authorization_code(code).await
let token_response = self.exchange_authorization_code(code).await?;
self.session_from_token_response(token_response)
}
/// Sets the HTML response returned to the browser after Salesforce redirects
/// back to the local OAuth callback listener.
///
/// If this method is not called, a default "Salesforce login complete" page is
/// returned.
pub fn with_callback_response(mut self, response: impl Into<String>) -> Self {
self.callback_response = Some(response.into());
self
}
async fn exchange_authorization_code(
&self,
code: &str,
) -> Result<SalesforceTokenResponse, SalesforceAuthError> {
let client_id = required(self.client_id.as_deref(), "client_id")?;
let redirect_uri = required(self.redirect_uri.as_deref(), "redirect_uri")?;
let url = self.token_url()?.url().clone();
let mut data = vec![
("grant_type", "authorization_code"),
("code", code),
("client_id", client_id),
("redirect_uri", redirect_uri),
("client_id", self.client_id.as_str()),
("redirect_uri", self.redirect_uri.as_str()),
];
if let Some(client_secret) = self.client_secret.as_deref() {
@@ -177,10 +186,56 @@ impl SalesforceCredentials {
Ok(serde_json::from_str::<SalesforceTokenResponse>(&body)
.map_err(|e| SalesforceAuthError::TokenExchange(e.to_string()))?)
}
fn session_from_token_response(
&self,
token_response: SalesforceTokenResponse,
) -> Result<SalesforceAuthSession, SalesforceAuthError> {
let (org_id, user_id) = parse_salesforce_identity_ids(token_response.id.as_deref());
let instance_url = token_response
.instance_url
.clone()
.unwrap_or_else(|| self.login_url.trim_end_matches('/').to_string());
let credentials = SalesforceCredentials {
flow: SalesforceAuthFlow::AccessToken,
login_url: Some(self.login_url.clone()),
client_id: Some(self.client_id.clone()),
client_secret: self.client_secret.clone(),
username: None,
private_key_pem: None,
access_token: Some(token_response.access_token.clone()),
refresh_token: token_response.refresh_token.clone(),
instance_url: Some(instance_url.clone()),
};
Ok(SalesforceAuthSession {
token: RwLock::new(SalesforceAuthToken {
access_token: token_response.access_token,
token_type: token_response.token_type,
issued_at: token_response.issued_at,
signature: token_response.signature,
}),
credentials,
instance_url,
org_id,
user_id,
})
}
fn token_url(&self) -> Result<TokenUrl, SalesforceAuthError> {
let normalized = self.login_url.trim_end_matches('/');
let url = format!("{normalized}/services/oauth2/token");
Ok(TokenUrl::new(url.clone())
.map_err(|source| SalesforceAuthError::InvalidUrl { url, source })?)
}
}
async fn receive_oauth_callback(
listener: TcpListener,
callback_response: Option<&str>,
) -> Result<HashMap<String, String>, SalesforceAuthError> {
let (mut stream, _) = listener.accept().await?;
@@ -206,19 +261,18 @@ async fn receive_oauth_callback(
.map(|(key, value)| (key.to_string(), value.to_string()))
.collect::<HashMap<_, _>>();
let response = concat!(
"HTTP/1.1 200 OK\r\n",
"Content-Type: text/html; charset=utf-8\r\n",
"Connection: close\r\n",
"\r\n",
"<!doctype html>",
"<html>",
"<head><title>Salesforce Login Complete</title></head>",
"<body>",
"<h1>Salesforce login complete</h1>",
"<p>You can close this browser window and return to your application.</p>",
"</body>",
"</html>"
let body = callback_response.unwrap_or(DEFAULT_CALLBACK_RESPONSE);
let response = format!(
concat!(
"HTTP/1.1 200 OK\r\n",
"Content-Type: text/html; charset=utf-8\r\n",
"Content-Length: {}\r\n",
"Connection: close\r\n",
"\r\n",
"{}"
),
body.len(),
body
);
stream.write_all(response.as_bytes()).await?;
@@ -234,27 +288,4 @@ fn create_state() -> String {
.unwrap_or_default();
format!("rustsf-auth-{nanos}")
}
fn open_browser(url: &str) {
#[cfg(target_os = "windows")]
{
let _ = Command::new("cmd")
.args(["/C", "start", "", url])
.spawn();
}
#[cfg(target_os = "macos")]
{
let _ = Command::new("open")
.arg(url)
.spawn();
}
#[cfg(all(unix, not(target_os = "macos")))]
{
let _ = Command::new("xdg-open")
.arg(url)
.spawn();
}
}
src/lib.rs
+1
View File
@@ -10,6 +10,7 @@ use self::salesforce_auth_token::SalesforceAuthToken;
pub use self::credentials::{SalesforceAuthFlow, SalesforceCredentials};
pub use self::credentials::sfdx_auth_url::SfdxAuthJson;
pub use self::credentials::web_server::OAuthWebService;
/// The default Salesforce production login URL.
///
src/main.rs
+44 -4
View File
@@ -1,7 +1,9 @@
use std::process::Command;
use anyhow::{Context, Result};
use log::LevelFilter;
use reqwest::header::{AUTHORIZATION, HeaderMap, HeaderValue};
use rustsf_auth::credentials::SalesforceCredentials;
use rustsf_auth::OAuthWebService;
pub const CONNECT_TIMEOUT: u64 = 15;
pub const REQUEST_TIMEOUT: u64 = 30;
@@ -15,6 +17,29 @@ pub fn get_http_client() -> Result<reqwest::Client> {
.context("Failed to build HTTP client")?)
}
fn open_browser(url: &str) {
#[cfg(target_os = "windows")]
{
let _ = Command::new("cmd")
.args(["/C", "start", "", url])
.spawn();
}
#[cfg(target_os = "macos")]
{
let _ = Command::new("open")
.arg(url)
.spawn();
}
#[cfg(all(unix, not(target_os = "macos")))]
{
let _ = Command::new("xdg-open")
.arg(url)
.spawn();
}
}
#[tokio::main]
async fn main() {
println!("Hello, world!");
@@ -53,18 +78,33 @@ async fn main() {
);
*/
// WEB Flow
let config = SalesforceCredentials::web_server(
let web_service = OAuthWebService::new(
"https://computing-platform-9537--qa.sandbox.my.salesforce.com",
"PlatformCLI",
None,
"http://localhost:1717/OauthRedirect",
None,
);
)
.with_callback_response(
r#"<!doctype html>
<html>
<head><title>Authenticated</title></head>
<body>
<h1>Authentication complete</h1>
<p>You can close this tab.</p>
</body>
</html>"#,
);
let auth_url = web_service.authorization_url().await.unwrap();
// Ask user to authenticate themselves
println!("Open this URL in your browser if it did not open automatically:\n{auth_url}");
open_browser(&auth_url);
let session = web_service.connect().await.unwrap();
println!("Config: {:?}", config);
// println!("Config: {:?}", config);
let session = config.connect().await.unwrap();
// let session = config.connect().await.unwrap();
println!("Instance URL: {}", session.instance_url);
println!("Access token: {}", session.access_token().await.unwrap());