OpenID routes

Co-Authored-By: Matthias Ahouansou <matthias@ahouansou.cz>

src/api/client_server/mod.rs

@@ -11,6 +11,7 @@ mod keys;
 mod media;
 mod membership;
 mod message;
+mod openid;
 mod presence;
 mod profile;
 mod push;
@@ -47,6 +48,7 @@ pub use keys::*;
 pub use media::*;
 pub use membership::*;
 pub use message::*;
+pub use openid::*;
 pub use presence::*;
 pub use profile::*;
 pub use push::*;

src/api/client_server/openid.rs

@@ -0,0 +1,23 @@
+use std::time::Duration;
+
+use ruma::{api::client::account, authentication::TokenType};
+
+use crate::{services, Result, Ruma};
+
+/// # `POST /_matrix/client/r0/user/{userId}/openid/request_token`
+///
+/// Request an OpenID token to verify identity with third-party services.
+///
+/// - The token generated is only valid for the OpenID API.
+pub async fn create_openid_token_route(
+    body: Ruma<account::request_openid_token::v3::Request>,
+) -> Result<account::request_openid_token::v3::Response> {
+    let (access_token, expires_in) = services().users.create_openid_token(&body.user_id)?;
+
+    Ok(account::request_openid_token::v3::Response {
+        access_token,
+        token_type: TokenType::Bearer,
+        matrix_server_name: services().globals.server_name().to_owned(),
+        expires_in: Duration::from_secs(expires_in),
+    })
+}

src/api/ruma_wrapper/axum.rs

@@ -102,10 +102,15 @@ where
         let (sender_user, sender_device, sender_servername, appservice_info) =
             match (metadata.authentication, token) {
                 (_, Token::Invalid) => {
-                    return Err(Error::BadRequest(
-                        ErrorKind::UnknownToken { soft_logout: false },
-                        "Unknown access token.",
-                    ))
+                    // OpenID endpoint uses a query param with the same name, drop this once query params for user auth are removed from the spec
+                    if query_params.access_token.is_some() {
+                        (None, None, None, None)
+                    } else {
+                        return Err(Error::BadRequest(
+                            ErrorKind::UnknownToken { soft_logout: false },
+                            "Unknown access token.",
+                        ));
+                    }
                 }
                 (AuthScheme::AccessToken, Token::Appservice(info)) => {
                     let user_id = query_params

src/api/server_server.rs

@@ -24,6 +24,7 @@ use ruma::{
             event::{get_event, get_missing_events, get_room_state, get_room_state_ids},
             keys::{claim_keys, get_keys},
             membership::{create_invite, create_join_event, prepare_join_event},
+            openid::get_openid_userinfo,
             query::{get_profile_information, get_room_information},
             transactions::{
                 edu::{DeviceListUpdateContent, DirectDeviceContent, Edu, SigningKeyUpdateContent},
@@ -1914,6 +1915,25 @@ pub async fn claim_keys_route(
     })
 }
 
+/// # `GET /_matrix/federation/v1/openid/userinfo`
+///
+/// Get information about the user that generated the OpenID token.
+pub async fn get_openid_userinfo_route(
+    body: Ruma<get_openid_userinfo::v1::Request>,
+) -> Result<get_openid_userinfo::v1::Response> {
+    Ok(get_openid_userinfo::v1::Response::new(
+        services()
+            .users
+            .find_from_openid_token(&body.access_token)?
+            .ok_or_else(|| {
+                Error::BadRequest(
+                    ErrorKind::Unauthorized,
+                    "OpenID token has expired or does not exist.",
+                )
+            })?,
+    ))
+}
+
 /// # `GET /.well-known/matrix/server`
 ///
 /// Returns the federation server discovery information.