auth: extract community auth crate

apps/admin-api/src/app.rs

@@ -194,9 +194,11 @@ mod tests {
     use std::{
         collections::BTreeMap,
         env, fmt,
+        sync::Arc,
         time::{SystemTime, UNIX_EPOCH},
     };
 
+    use async_trait::async_trait;
     use axum::{Json, Router, routing::post};
     #[cfg(any())]
     use crank_adapter_grpc::test_support as grpc_test_support;
@@ -211,6 +213,7 @@ mod tests {
         OperationSecurityLevel, Protocol, ResponseCachePolicy, RestTarget, SecretKind, Target,
         ToolDescription, WebsocketTarget, WorkspaceId,
     };
+    use crank_core::{IdentityError, IdentityProvider, IdentityProviderKind, LoginOutcome};
     use crank_mapping::{MappingRule, MappingSet};
     use crank_registry::PostgresRegistry;
     #[cfg(any())]
@@ -227,7 +230,7 @@ mod tests {
     use crate::{
         app::build_app,
         auth::{AuthSettings, BootstrapAdminConfig, hash_password},
-        service::{AdminService, OperationPayload},
+        service::{AdminService, AdminServiceBuilder, OperationPayload},
         state::AppState,
     };
 
@@ -272,6 +275,26 @@ mod tests {
         }
     }
 
+    struct RejectingIdentityProvider;
+
+    #[async_trait]
+    impl IdentityProvider for RejectingIdentityProvider {
+        fn id(&self) -> &str {
+            "rejecting-test-provider"
+        }
+
+        fn kind(&self) -> IdentityProviderKind {
+            IdentityProviderKind::Password
+        }
+
+        async fn login_password(
+            &self,
+            _payload: crank_core::LoginPayload,
+        ) -> Result<LoginOutcome, IdentityError> {
+            Err(IdentityError::BadCredentials)
+        }
+    }
+
     #[tokio::test(flavor = "multi_thread")]
     #[serial]
     async fn creates_publishes_and_tests_rest_operation() {
@@ -3344,6 +3367,34 @@ mod tests {
         let _ = handle.await;
     }
 
+    #[tokio::test(flavor = "multi_thread")]
+    #[serial]
+    async fn login_uses_identity_provider_when_configured() {
+        let registry = test_registry().await;
+        let storage_root = test_storage_root("identity_provider_login");
+        let service = AdminServiceBuilder::new(
+            registry,
+            storage_root,
+            test_auth_settings(),
+            test_secret_crypto(),
+            crank_runtime::community_default().build(),
+        )
+        .with_identity_provider(Arc::new(RejectingIdentityProvider))
+        .build();
+
+        let error = match service
+            .login(crate::service::LoginPayload {
+                email: TEST_AUTH_EMAIL.to_owned(),
+                password: TEST_AUTH_PASSWORD.to_owned(),
+            })
+            .await
+        {
+            Ok(_) => panic!("login should delegate to identity provider"),
+            Err(error) => error,
+        };
+        assert_eq!(error.to_string(), "invalid email or password");
+    }
+
     async fn assert_success_json(response: reqwest::Response) -> Value {
         let status = response.status();
         let body = response.text().await.unwrap();