OAuth

[volovyks]

Info about OIDC, token validation, and how we are planning to handle internal user id added to README.
Some of the TODOs moved to separate issues.

Not sure how to fix audit CI, chrono crate is up tp date. Can we patch time version? Is it a good practice?

[itegulov]

I think we should create a clear separation of concern here. I don't think parsing stuff belongs here, so instead I would replace SupportedTokenVerifiers with something like this:

pub enum OAuthToken {
    GoogleToken(String),
    TestToken(String),
}

#[derive(Debug, PartialEq, Eq)]
struct ParseOAuthError;

impl FromStr for OAuthToken {
    type Err = ParseOAuthError;

    fn from_str(s: &str) -> Result<Self, Self::Err> {
        match s.len() {
            0 => Ok(OAuthToken::TestToken(s.into())),
            _ => Ok(OAuthToken::GoogleToken(s.into())),
        }
    }
}

And then OAuthTokenVerifier only works on OAuthToken and each impl can assert that this specific token corresponds to the expected type (e.g. Universal accepts all, Google only accepts GoogleToken etc). Meaning parsing has already happened by the point of this method's invocation.

[volovyks]

I found out that issuer is a required field in ID token. I will refactor it, but probably in some other, more fundamental way and once we have end-to-end Google + some other verifier. Thanks for suggestion, strong Token typing should be usefull.

[itegulov]

Not a big deal right now, but the right side of Result should ideally be a proper error type, something like

enum OAuthError {
	Type1(...),
	Type2(...)
}

[itegulov]

This should be inside GoogleTokenVerifier

[volovyks]

It should not, because this function will be used in other verifiers (GitHub, Twitter, etc.). The use the same JWT.

[volovyks]

Moved to the OAuthTokenVerifier trait.