feat: Implement oauth auth code and refresh token flows

src/api/client/oauth/mod.rs

@@ -1,17 +1,31 @@
 mod register_client;
 mod server_metadata;
+mod token;
 
 use axum::{
 	Json, Router,
+	extract::State,
 	routing::method_routing::{get, post},
 };
 use serde_json::json;
 pub(crate) use server_metadata::*;
 
-pub(crate) const BASE_PATH: &str = "/_continuwuity/oauth2/";
+const BASE_PATH: &str = "/_continuwuity/oauth2/";
 
 pub(crate) fn router() -> Router<crate::State> {
+	Router::new().nest(BASE_PATH, oauth_router())
+	// TODO(unspecced): used by old versions of the matrix-js-sdk
+	// .route("/.well-known/openid-configuration", get(
+	// 	async |State(services): State<crate::State>| {
+	// 		Json(authorization_server_metadata(&services).await)
+	// 	}
+	// ))
+}
+
+fn oauth_router() -> Router<crate::State> {
 	Router::new()
 		.route("/client/register", post(register_client::register_client_route))
+		// TODO(unspecced): used by old versions of the matrix-js-sdk
 		.route("/client/keys.json", get(async || Json(json!({"keys": []}))))
+		.route("/grant/token", post(token::token_route))
 }

src/api/client/oauth/server_metadata.rs

@@ -1,7 +1,8 @@
 use axum::extract::State;
 use conduwuit::Result;
 use ruma::{api::client::discovery::get_authorization_server_metadata, serde::Raw};
-use serde_json::json;
+use serde_json::{Value, json};
+use service::Services;
 
 use crate::Ruma;
 
@@ -9,13 +10,19 @@ pub(crate) async fn get_authorization_server_metadata_route(
 	State(services): State<crate::State>,
 	_body: Ruma<get_authorization_server_metadata::v1::Request>,
 ) -> Result<get_authorization_server_metadata::v1::Response> {
+	let metadata = Raw::new(&authorization_server_metadata(&services).await).unwrap();
+
+	Ok(get_authorization_server_metadata::v1::Response::new(metadata.cast_unchecked()))
+}
+
+pub(crate) async fn authorization_server_metadata(services: &Services) -> Value {
 	let endpoint_base = services
 		.config
 		.get_client_domain()
 		.join(super::BASE_PATH)
 		.unwrap();
 
-	let metadata = Raw::new(&json!({
+	json!({
 		"authorization_endpoint": endpoint_base.join("grant/authorization_code").unwrap(),
 		"code_challenge_methods_supported": ["S256"],
 		"grant_types_supported": ["authorization_code", "refresh_token"],
@@ -27,8 +34,5 @@ pub(crate) async fn get_authorization_server_metadata_route(
 		"response_types_supported": ["code"],
 		"revocation_endpoint": endpoint_base.join("client/revoke").unwrap(),
 		"token_endpoint": endpoint_base.join("grant/token").unwrap(),
-	}))
-	.unwrap();
-
-	Ok(get_authorization_server_metadata::v1::Response::new(metadata.cast_unchecked()))
+	})
 }

src/api/client/oauth/token.rs

@@ -0,0 +1,13 @@
+use axum::{Form, Json, extract::State, response::IntoResponse};
+use http::StatusCode;
+use service::oauth::grant::TokenRequest;
+
+pub(crate) async fn token_route(
+	State(services): State<crate::State>,
+	Form(request): Form<TokenRequest>,
+) -> impl IntoResponse {
+	match services.oauth.issue_token(request).await {
+		| Ok(response) => Ok(Json(response).into_response()),
+		| Err(err) => Err((StatusCode::BAD_REQUEST, err.message())),
+	}
+}