c60cc7ca75
Some checks failed
CI / Run tests and lints (push) Failing after 29s
CI / Build CLI docs (push) Has been skipped
CI / Run Playwright end-to-end tests (mysql) (push) Failing after 3s
CI / Run Playwright end-to-end tests (postgres) (push) Failing after 2s
CI / Run Playwright end-to-end tests (sqlite) (push) Failing after 3s
CodeQL / Analyze (go) (push) Failing after 4s
CodeQL / Analyze (javascript) (push) Failing after 3s
Docker Image Scanners / scanners (push) Failing after 4s
Synchronize Issue Labels / Synchronize Issue Labels (push) Has been skipped
CI / Run end-to-end tests (postgres) (push) Failing after 19s
CI / Run end-to-end tests (sqlite) (push) Failing after 2s
CI / Run Playwright end-to-end tests (cockroach) (push) Failing after 2s
CI / Draft newsletter (push) Has been skipped
CI / Generate release (push) Has been skipped
CI / Pending approval Slack notification (push) Has been skipped
CI / Send newsletter (push) Has been skipped
94 lines
2.3 KiB
Go
94 lines
2.3 KiB
Go
// Copyright © 2023 Ory Corp
|
|
// SPDX-License-Identifier: Apache-2.0
|
|
|
|
package oidc
|
|
|
|
import (
|
|
"context"
|
|
"fmt"
|
|
"net/url"
|
|
"slices"
|
|
|
|
"github.com/ory/herodot"
|
|
|
|
"github.com/pkg/errors"
|
|
"golang.org/x/oauth2"
|
|
|
|
"github.com/ory/x/stringsx"
|
|
|
|
"github.com/slack-go/slack"
|
|
)
|
|
|
|
var _ OAuth2Provider = (*ProviderSlack)(nil)
|
|
|
|
type ProviderSlack struct {
|
|
config *Configuration
|
|
reg Dependencies
|
|
}
|
|
|
|
func NewProviderSlack(
|
|
config *Configuration,
|
|
reg Dependencies,
|
|
) Provider {
|
|
return &ProviderSlack{
|
|
config: config,
|
|
reg: reg,
|
|
}
|
|
}
|
|
|
|
func (d *ProviderSlack) Config() *Configuration {
|
|
return d.config
|
|
}
|
|
|
|
func (d *ProviderSlack) oauth2(ctx context.Context) *oauth2.Config {
|
|
return &oauth2.Config{
|
|
ClientID: d.config.ClientID,
|
|
ClientSecret: d.config.ClientSecret,
|
|
Endpoint: oauth2.Endpoint{
|
|
// slack's oauth v2 does not implement the oauth2 standard so we use the old version.
|
|
// to use v2 we would need to rename the request 'scope' field to 'user_scope'.
|
|
AuthURL: "https://slack.com/oauth/authorize",
|
|
TokenURL: slack.APIURL + "oauth.access",
|
|
},
|
|
RedirectURL: d.config.Redir(d.reg.Config().OIDCRedirectURIBase(ctx)),
|
|
Scopes: d.config.Scope,
|
|
}
|
|
}
|
|
|
|
func (d *ProviderSlack) OAuth2(ctx context.Context) (*oauth2.Config, error) {
|
|
return d.oauth2(ctx), nil
|
|
}
|
|
|
|
func (d *ProviderSlack) AuthCodeURLOptions(r ider) []oauth2.AuthCodeOption {
|
|
return []oauth2.AuthCodeOption{}
|
|
}
|
|
|
|
func (d *ProviderSlack) Claims(ctx context.Context, exchange *oauth2.Token, query url.Values) (*Claims, error) {
|
|
grantedScopes := stringsx.Splitx(fmt.Sprintf("%s", exchange.Extra("scope")), ",")
|
|
for _, check := range d.Config().Scope {
|
|
if !slices.Contains(grantedScopes, check) {
|
|
return nil, errors.WithStack(ErrScopeMissing())
|
|
}
|
|
}
|
|
|
|
api := slack.New(exchange.AccessToken)
|
|
identity, err := api.GetUserIdentity()
|
|
if err != nil {
|
|
return nil, errors.WithStack(herodot.ErrUpstreamError().WithWrap(err).WithReasonf("%s", err))
|
|
}
|
|
|
|
claims := &Claims{
|
|
Issuer: "https://slack.com/oauth/",
|
|
Subject: identity.User.ID,
|
|
Name: identity.User.Name,
|
|
PreferredUsername: identity.User.Name,
|
|
Nickname: identity.User.Name,
|
|
Email: identity.User.Email,
|
|
EmailVerified: true,
|
|
Picture: identity.User.Image512,
|
|
Team: identity.Team.ID,
|
|
}
|
|
|
|
return claims, nil
|
|
}
|