feat: Add support for requesting additional scopes

conduwuit-example.toml

@@ -2055,6 +2055,12 @@
 #
 #client_secret =
 
+# Additional scopes Continuwuity should request from the IDP. This may be
+# necessary to access certain claims. Continuwuity always requests the
+# `openid` scope.
+#
+#additional_scopes = []
+
 # Whether the user should be prompted to choose a localpart
 # when signing in for the first time. If this is `false`, Continuwuity
 # will attempt to use the value of the `preferred_username_claim`

src/core/config/mod.rs

@@ -17,7 +17,7 @@
 use figment::providers::{Env, Format, Toml};
 pub use figment::{Figment, value::Value as FigmentValue};
 use lettre::message::Mailbox;
-use openidconnect::{ClientId, ClientSecret};
+use openidconnect::{ClientId, ClientSecret, Scope};
 use regex::RegexSet;
 use ruma::{
 	OwnedRoomId, OwnedRoomOrAliasId, OwnedServerName, OwnedUserId, RoomVersionId,
@@ -2486,6 +2486,14 @@ pub struct OidcConfig {
 	/// the identity provider.
 	pub client_secret: ClientSecret,
 
+	/// Additional scopes Continuwuity should request from the IDP. This may be
+	/// necessary to access certain claims. Continuwuity always requests the
+	/// `openid` scope.
+	///
+	/// default: []
+	#[serde(default)]
+	pub additional_scopes: Vec<Scope>,
+
 	/// Whether the user should be prompted to choose a localpart
 	/// when signing in for the first time. If this is `false`, Continuwuity
 	/// will attempt to use the value of the `preferred_username_claim`

src/service/oidc/mod.rs

@@ -204,7 +204,8 @@ pub fn restricted_profile_fields(&self) -> Vec<ProfileFieldName> {
 	}
 
 	pub async fn begin_session(&self, prompt: Option<CoreAuthPrompt>) -> (PendingSession, Url) {
-		let OidcClient { machine, .. } = self.client.as_ref().expect("oidc should be configured");
+		let OidcClient { machine, config, .. } =
+			self.client.as_ref().expect("oidc should be configured");
 		let machine = machine.wait().await;
 
 		let (pkce_challenge, pkce_verifier) = PkceCodeChallenge::new_random_sha256();
@@ -215,6 +216,7 @@ pub async fn begin_session(&self, prompt: Option<CoreAuthPrompt>) -> (PendingSes
 				CsrfToken::new_random,
 				Nonce::new_random,
 			)
+			.add_scopes(config.additional_scopes.iter().cloned())
 			.set_pkce_challenge(pkce_challenge);
 
 		if let Some(prompt) = prompt {