tuwunel_admin/query/oauth/
mod.rs

1mod adopt;
2mod associate;
3mod delete;
4mod list_providers;
5mod list_sessions;
6mod list_users;
7mod revoke;
8mod show_provider;
9mod show_session;
10mod show_user;
11mod token_info;
12
13use clap::Subcommand;
14use ruma::OwnedUserId;
15use tuwunel_core::{
16	Result,
17	either::{Either, Left, Right},
18};
19use tuwunel_service::oauth::{ProviderId, SessionId};
20
21use crate::admin_command_dispatch;
22
23#[admin_command_dispatch(handler_prefix = "oauth")]
24#[derive(Debug, Subcommand)]
25/// Query OAuth service state
26pub(crate) enum OauthCommand {
27	/// Adopt provider subjects from a migrated database.
28	///
29	/// The provider must use the same issuer and subject space as the source.
30	/// If the source changed providers, associate each user individually.
31	Adopt {
32		/// ID of the configured provider that issued the subjects.
33		///
34		/// The provider must represent the issuer for every stored subject.
35		provider: String,
36	},
37
38	/// Associate existing user with future authorization claims.
39	Associate {
40		/// ID of configured provider to listen on.
41		provider: String,
42
43		/// MXID of local user to associate.
44		user_id: OwnedUserId,
45
46		/// List of claims to match in key=value format.
47		#[arg(long, required = true)]
48		claim: Vec<String>,
49
50		/// Replace existing committed SSO sessions before recording the claim;
51		/// without it, associate refuses when committed sessions exist.
52		#[arg(long)]
53		force: bool,
54	},
55
56	/// List configured OAuth providers.
57	ListProviders,
58
59	/// List users associated with any OAuth session
60	ListUsers,
61
62	/// List session ID's
63	ListSessions {
64		#[arg(long)]
65		user: Option<OwnedUserId>,
66	},
67
68	/// Show active configuration of a provider.
69	ShowProvider {
70		id: ProviderId,
71
72		#[arg(long)]
73		config: bool,
74	},
75
76	/// Show session state
77	ShowSession {
78		id: SessionId,
79	},
80
81	/// Show user sessions
82	ShowUser {
83		user_id: OwnedUserId,
84	},
85
86	/// Token introspection request to provider.
87	TokenInfo {
88		id: SessionId,
89	},
90
91	/// Revoke token for user_id or sess_id.
92	Revoke {
93		#[arg(value_parser = session_or_user_id)]
94		id: Either<SessionId, OwnedUserId>,
95	},
96
97	/// Remove oauth state (DANGER!)
98	Delete {
99		#[arg(value_parser = session_or_user_id)]
100		id: Either<SessionId, OwnedUserId>,
101
102		#[arg(long)]
103		force: bool,
104	},
105}
106
107type SessionOrUserId = Either<SessionId, OwnedUserId>;
108
109fn session_or_user_id(input: &str) -> Result<SessionOrUserId> {
110	OwnedUserId::parse(input)
111		.map(Right)
112		.or_else(|_| Ok(Left(input.to_owned())))
113}
tuwunel_admin/query/oauth/mod.rs

tuwunel_admin/query/oauth/
mod.rs
