refactor(oidc): Only support authorization URL parameters defined in MSCs

`prompt=create` is defined in MSC2964, and
`login_hint=mxid:@user:server.name` is defined in MSC4198.
The other parameters came from OpenID Connect.

Signed-off-by: Kévin Commaille <[email protected]>

Author: zecakeh

crates/matrix-sdk/CHANGELOG.md

@@ -80,6 +80,10 @@ simpler methods:
   - Only one request is made to revoke the access token, since the server is
     supposed to revoke both the access token and the associated refresh token
     when the request is made.
+- [**breaking**]: Remove most of the parameter methods of
+  `OidcAuthCodeUrlBuilder`, since they were parameters defined in OpenID
+  Connect. Only the `prompt` and `user_id_hint` parameters are still supported.
+  ([#4699](https://github.com/matrix-org/matrix-rust-sdk/pull/4699))
 
 ## [0.10.0] - 2025-02-04
 

crates/matrix-sdk/src/authentication/oidc/auth_code_builder.rs

@@ -12,15 +12,9 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-use std::{collections::HashSet, num::NonZeroU32};
-
-use language_tags::LanguageTag;
 use mas_oidc_client::{
     requests::authorization_code::{build_authorization_url, AuthorizationRequestData},
-    types::{
-        requests::{Display, Prompt},
-        scope::Scope,
-    },
+    types::{requests::Prompt, scope::Scope},
 };
 use ruma::UserId;
 use tracing::{info, instrument};
@@ -38,92 +32,36 @@ pub struct OidcAuthCodeUrlBuilder {
     oidc: Oidc,
     scope: Scope,
     redirect_uri: Url,
-    display: Option<Display>,
     prompt: Option<Vec<Prompt>>,
-    max_age: Option<NonZeroU32>,
-    ui_locales: Option<Vec<LanguageTag>>,
     login_hint: Option<String>,
-    acr_values: Option<HashSet<String>>,
 }
 
 impl OidcAuthCodeUrlBuilder {
     pub(super) fn new(oidc: Oidc, scope: Scope, redirect_uri: Url) -> Self {
-        Self {
-            oidc,
-            scope,
-            redirect_uri,
-            display: None,
-            prompt: None,
-            max_age: None,
-            ui_locales: None,
-            login_hint: None,
-            acr_values: None,
-        }
-    }
-
-    /// Set how the Authorization Server should display the authentication and
-    /// consent user interface pages to the End-User.
-    pub fn display(mut self, display: Display) -> Self {
-        self.display = Some(display);
-        self
+        Self { oidc, scope, redirect_uri, prompt: None, login_hint: None }
     }
 
     /// Set the [`Prompt`] of the authorization URL.
     ///
+    /// If this is not set, it is assumed that the user wants to log into an
+    /// existing account.
+    ///
     /// [`Prompt::Create`] can be used to signify that the user wants to
-    /// register a new account. If [`Prompt::None`] is used, it must be the only
-    /// value.
+    /// register a new account.
     pub fn prompt(mut self, prompt: Vec<Prompt>) -> Self {
         self.prompt = Some(prompt);
         self
     }
 
-    /// Set the allowable elapsed time in seconds since the last time the
-    /// End-User was actively authenticated by the OpenID Provider.
-    pub fn max_age(mut self, max_age: NonZeroU32) -> Self {
-        self.max_age = Some(max_age);
-        self
-    }
-
-    /// Set the preferred locales of the user.
-    ///
-    /// Must be ordered from the preferred locale to the least preferred locale.
-    pub fn ui_locales(mut self, ui_locales: Vec<LanguageTag>) -> Self {
-        self.ui_locales = Some(ui_locales);
-        self
-    }
-
-    /// Set the hint to the Authorization Server about the login identifier the
-    /// End-User might use to log in.
-    ///
-    /// To set a Matrix user ID as a login hint, use [`Self::user_id_hint()`].
-    ///
-    /// Erases any value set with [`Self::user_id_hint()`].
-    pub fn login_hint(mut self, login_hint: String) -> Self {
-        self.login_hint = Some(login_hint);
-        self
-    }
-
     /// Set the hint to the Authorization Server about the Matrix user ID the
-    /// End-User might use to log in.
-    ///
-    /// To set another type of identifier as a login hint, use
-    /// [`Self::login_hint()`].
+    /// End-User might use to log in, as defined in [MSC4198].
     ///
-    /// Erases any value set with [`Self::login_hint()`].
+    /// [MSC4198]: https://github.com/matrix-org/matrix-spec-proposals/pull/4198
     pub fn user_id_hint(mut self, user_id: &UserId) -> Self {
         self.login_hint = Some(format!("mxid:{user_id}"));
         self
     }
 
-    /// Set the requested Authentication Context Class Reference values.
-    ///
-    /// This is only necessary with specific providers.
-    pub fn acr_values(mut self, acr_values: HashSet<String>) -> Self {
-        self.acr_values = Some(acr_values);
-        self
-    }
-
     /// Get the URL that should be presented to login via the Authorization Code
     /// flow.
     ///
@@ -135,17 +73,7 @@ impl OidcAuthCodeUrlBuilder {
     /// request fails.
     #[instrument(target = "matrix_sdk::client", skip_all)]
     pub async fn build(self) -> Result<OidcAuthorizationData, OidcError> {
-        let Self {
-            oidc,
-            scope,
-            redirect_uri,
-            display,
-            prompt,
-            max_age,
-            ui_locales,
-            login_hint,
-            acr_values,
-        } = self;
+        let Self { oidc, scope, redirect_uri, prompt, login_hint } = self;
 
         let data = oidc.data().ok_or(OidcError::NotAuthenticated)?;
         info!(
@@ -159,16 +87,8 @@ impl OidcAuthCodeUrlBuilder {
             AuthorizationRequestData::new(data.client_id.0.clone(), scope, redirect_uri);
         authorization_data.code_challenge_methods_supported =
             provider_metadata.code_challenge_methods_supported.clone();
-        authorization_data.display = display;
         authorization_data.prompt = prompt;
-        authorization_data.max_age = max_age;
-        authorization_data.ui_locales = ui_locales;
         authorization_data.login_hint = login_hint;
-        authorization_data.acr_values = acr_values;
-
-        if let Some(id_token) = oidc.latest_id_token() {
-            authorization_data.id_token_hint = Some(id_token.into_string());
-        }
 
         let authorization_endpoint = provider_metadata.authorization_endpoint();