Import upstream v0.16.22, stripped

Upstream commit: 474dd0229cb20cf513036619781ed97bd8073c3f Enterprise-only files removed or emptied: 63 Enterprise-only snippets removed: 117 in 50 files Dangling module declarations removed: 5 Cargo edits turning enterprise off: 14 Verification: clean Enterprise feature gates left for rebuilt features: 19 in 18 files Produced by tools/fork/strip.py. The full report is in docs/fork/strip-reports/ on main.
2026-09-18 10:21:56 -07:00
commit 7dae9b29fd
1650 changed files with 485521 additions and 0 deletions
@@ -0,0 +1,87 @@
+/*
+ * SPDX-FileCopyrightText: 2020 Stalwart Labs LLC <[email protected]>
+ *
+ * SPDX-License-Identifier: AGPL-3.0-only OR LicenseRef-SEL
+ */
+
+use crate::utils::{http::HttpRequest, server::TestServerBuilder};
+use registry::{
+    schema::structs::{Directory, OidcDirectory},
+    types::map::Map,
+};
+
+const EXTERNAL_ENDPOINT: &str =
+    "http://localhost:9080/realms/stalwart/protocol/openid-connect/auth";
+const INTERNAL_ENDPOINT: &str = "https://127.0.0.1:8899/login";
+
+pub async fn test() {
+    println!("Running OIDC account discovery tests...");
+    crate::utils::containers::ensure_keycloak().await;
+    let test = TestServerBuilder::new("directory_discovery_test")
+        .await
+        .with_default_listeners()
+        .await
+        .disable_services()
+        .with_object(Directory::Oidc(oidc_test_directory()))
+        .await
+        .build()
+        .await;
+    assert!(
+        test.server
+            .get_default_directory()
+            .and_then(|directory| directory.oidc_discovery_document())
+            .is_some_and(|discovery| discovery.document.authorization_endpoint
+                == EXTERNAL_ENDPOINT),
+        "The default directory is not the test OpenID Connect provider"
+    );
+    let http = HttpRequest::new();
+
+    for (account_name, expected) in [
+        ("[email protected]", EXTERNAL_ENDPOINT),
+        ("[email protected]", EXTERNAL_ENDPOINT),
+        (
+            "[email protected]%[email protected]",
+            EXTERNAL_ENDPOINT,
+        ),
+        ("admin", INTERNAL_ENDPOINT),
+        ("[email protected]%admin", INTERNAL_ENDPOINT),
+        ("[email protected]%Admin", INTERNAL_ENDPOINT),
+        ("john.doe@", INTERNAL_ENDPOINT),
+    ] {
+        assert_eq!(
+            authorization_endpoint(&http, account_name).await,
+            expected,
+            "Unexpected discovery document for {account_name:?}"
+        );
+    }
+}
+
+async fn authorization_endpoint(http: &HttpRequest, account_name: &str) -> String {
+    http.get::<serde_json::Value>(&format!(
+        "/api/discover/{}",
+        account_name.replace('%', "%25")
+    ))
+    .await
+    .unwrap()
+    .get("authorization_endpoint")
+    .and_then(|endpoint| endpoint.as_str())
+    .unwrap_or_else(|| panic!("No authorization endpoint returned for {account_name:?}"))
+    .to_string()
+}
+
+fn oidc_test_directory() -> OidcDirectory {
+    OidcDirectory {
+        description: "Test OIDC directory".to_string(),
+        issuer_url: "http://localhost:9080/realms/stalwart".to_string(),
+        claim_username: "preferred_username".to_string(),
+        claim_name: Some("name".to_string()),
+        claim_groups: Some("groups".to_string()),
+        require_audience: Some("stalwart".to_string()),
+        require_scopes: Map::new(vec![
+            "email".to_string(),
+            "profile".to_string(),
+            "openid".to_string(),
+        ]),
+        ..Default::default()
+    }
+}