From fea943370c614c26bd7152761415dde16ec7518b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?K=C3=A9vin=20Chalet?= <kevinchalet@gmail.com>
Date: Tue, 27 Jun 2023 19:28:33 +0200
Subject: [PATCH] Add Salesforce to the list of supported providers

---
 ...tClientWebIntegrationHandlers.Discovery.cs | 15 ++++++--
 ...penIddictClientWebIntegrationProviders.xml | 31 +++++++++++------
 .../OpenIddictClientHandlers.cs               | 34 +++++++++----------
 3 files changed, 50 insertions(+), 30 deletions(-)

diff --git a/src/OpenIddict.Client.WebIntegration/OpenIddictClientWebIntegrationHandlers.Discovery.cs b/src/OpenIddict.Client.WebIntegration/OpenIddictClientWebIntegrationHandlers.Discovery.cs
index cf776d49..e873c82d 100644
--- a/src/OpenIddict.Client.WebIntegration/OpenIddictClientWebIntegrationHandlers.Discovery.cs
+++ b/src/OpenIddict.Client.WebIntegration/OpenIddictClientWebIntegrationHandlers.Discovery.cs
@@ -106,13 +106,16 @@ public static partial class OpenIddictClientWebIntegrationHandlers
                 // authorization code or implicit flows). To work around that, the list of supported grant
                 // types is amended to include the known supported types for the providers that require it.
 
-                if (context.Registration.ProviderType is ProviderTypes.Apple or ProviderTypes.LinkedIn or ProviderTypes.QuickBooksOnline)
+                if (context.Registration.ProviderType is
+                    ProviderTypes.Apple or ProviderTypes.LinkedIn or ProviderTypes.QuickBooksOnline)
                 {
                     context.Configuration.GrantTypesSupported.Add(GrantTypes.AuthorizationCode);
                     context.Configuration.GrantTypesSupported.Add(GrantTypes.RefreshToken);
                 }
 
-                else if (context.Registration.ProviderType is ProviderTypes.Cognito or ProviderTypes.EpicGames or ProviderTypes.Microsoft)
+                else if (context.Registration.ProviderType is
+                    ProviderTypes.Cognito   or ProviderTypes.EpicGames or
+                    ProviderTypes.Microsoft or ProviderTypes.Salesforce)
                 {
                     context.Configuration.GrantTypesSupported.Add(GrantTypes.AuthorizationCode);
                     context.Configuration.GrantTypesSupported.Add(GrantTypes.ClientCredentials);
@@ -162,12 +165,18 @@ public static partial class OpenIddictClientWebIntegrationHandlers
                 // always uses Proof Key for Code Exchange for these providers, the supported methods
                 // are manually added to the list of supported code challenge methods by this handler.
 
-                if (context.Registration.ProviderType is ProviderTypes.Adobe or ProviderTypes.Autodesk or ProviderTypes.Microsoft)
+                if (context.Registration.ProviderType is
+                    ProviderTypes.Adobe or ProviderTypes.Autodesk or ProviderTypes.Microsoft)
                 {
                     context.Configuration.CodeChallengeMethodsSupported.Add(CodeChallengeMethods.Plain);
                     context.Configuration.CodeChallengeMethodsSupported.Add(CodeChallengeMethods.Sha256);
                 }
 
+                else if (context.Registration.ProviderType is ProviderTypes.Salesforce)
+                {
+                    context.Configuration.CodeChallengeMethodsSupported.Add(CodeChallengeMethods.Sha256);
+                }
+
                 return default;
             }
         }
diff --git a/src/OpenIddict.Client.WebIntegration/OpenIddictClientWebIntegrationProviders.xml b/src/OpenIddict.Client.WebIntegration/OpenIddictClientWebIntegrationProviders.xml
index 9296ff73..1bc0d25f 100644
--- a/src/OpenIddict.Client.WebIntegration/OpenIddictClientWebIntegrationProviders.xml
+++ b/src/OpenIddict.Client.WebIntegration/OpenIddictClientWebIntegrationProviders.xml
@@ -214,8 +214,7 @@
                                               ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀
   -->
 
-  <Provider Name="Deezer" Id="8e6d9b1c-09c8-498f-8c27-8363d5de4c94"
-            Documentation="https://developers.deezer.com/api/oauth">
+  <Provider Name="Deezer" Id="8e6d9b1c-09c8-498f-8c27-8363d5de4c94" Documentation="https://developers.deezer.com/api/oauth">
     <!--
       Note: the Deezer documentation describes an implementation with important deviations from the OAuth 2.0 standard,
       including the use of many non-standard and custom parameters. Luckily, while the documentation hasn't been fixed
@@ -288,8 +287,7 @@
                                           ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀
   -->
 
-  <Provider Name="Dropbox" Id="9f0764f5-a148-4890-b38e-b7ad368824cd"
-            Documentation="https://developers.dropbox.com/oidc-guide">
+  <Provider Name="Dropbox" Id="9f0764f5-a148-4890-b38e-b7ad368824cd" Documentation="https://developers.dropbox.com/oidc-guide">
     <Environment Issuer="https://www.dropbox.com/">
       <!--
         Note: Dropbox requires sending at least either the "profile" or "email" scope.
@@ -662,8 +660,7 @@
                                         ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀
   -->
 
-  <Provider Name="Patreon" Id="0bf83b54-a005-4384-aa4e-828a0601d799"
-            Documentation="https://docs.patreon.com/#oauth">
+  <Provider Name="Patreon" Id="0bf83b54-a005-4384-aa4e-828a0601d799" Documentation="https://docs.patreon.com/#oauth">
     <Environment Issuer="https://www.patreon.com/">
       <Configuration AuthorizationEndpoint="https://www.patreon.com/oauth2/authorize"
                      TokenEndpoint="https://www.patreon.com/api/oauth2/token"
@@ -815,6 +812,22 @@
              Description="The value used as the 'duration' parameter (can be set to 'permanent' to retrieve a refresh token)" />
   </Provider>
 
+  <!--
+                                ▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄
+                                ██ ▄▄▄ █ ▄▄▀██ █████ ▄▄▄██ ▄▄▄ ██ ▄▄▄██ ▄▄▄ ██ ▄▄▀██ ▄▄▀██ ▄▄▄██
+                                ██▄▄▄▀▀█ ▀▀ ██ █████ ▄▄▄██▄▄▄▀▀██ ▄▄███ ███ ██ ▀▀▄██ █████ ▄▄▄██
+                                ██ ▀▀▀ █ ██ ██ ▀▀ ██ ▀▀▀██ ▀▀▀ ██ █████ ▀▀▀ ██ ██ ██ ▀▀▄██ ▀▀▀██
+                                ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀
+  -->
+
+  <Provider Name="Salesforce" Id="3d4728ef-8647-4eab-9269-a0dd6bcc68b7"
+            Documentation="https://help.salesforce.com/s/articleView?id=sf.connected_app_overview.htm">
+    <Environment Issuer="{settings.Issuer}" />
+
+    <Setting PropertyName="Issuer" ParameterName="issuer" Type="Uri" Required="true"
+             Description="The URI used to access the Salesforce instance (e.g https://fabrikam.my.salesforce.com/)" />
+  </Provider>
+
   <!--
                     ▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄
                     ██ ▄▄▄ ██ ▄▄▄██ ▄▄▀██ ███ █▄ ▄██ ▄▄▀██ ▄▄▄██ ▄▄▀██ ██ █ ▄▄▀██ ▀██ ██ ▀██ ██ ▄▄▄██ █████
@@ -1036,8 +1049,7 @@
                               ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀
   -->
 
-  <Provider Name="Streamlabs" Id="b140539d-ba83-4bcb-b46b-ecc19a3b8997"
-            Documentation="https://dev.streamlabs.com/docs/oauth-2">
+  <Provider Name="Streamlabs" Id="b140539d-ba83-4bcb-b46b-ecc19a3b8997" Documentation="https://dev.streamlabs.com/docs/oauth-2">
     <Environment Issuer="https://streamlabs.com/">
       <Configuration AuthorizationEndpoint="https://streamlabs.com/api/v2.0/authorize"
                      TokenEndpoint="https://streamlabs.com/api/v2.0/token"
@@ -1240,8 +1252,7 @@
                                 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀
   -->
 
-  <Provider Name="WordPress" Id="1f32ad54-d87c-454b-b47a-65f18933f4b6"
-            Documentation="https://developer.wordpress.com/docs/oauth2/">
+  <Provider Name="WordPress" Id="1f32ad54-d87c-454b-b47a-65f18933f4b6" Documentation="https://developer.wordpress.com/docs/oauth2/">
     <Environment Issuer="https://wordpress.com/">
       <Configuration AuthorizationEndpoint="https://public-api.wordpress.com/oauth2/authorize"
                      TokenEndpoint="https://public-api.wordpress.com/oauth2/token"
diff --git a/src/OpenIddict.Client/OpenIddictClientHandlers.cs b/src/OpenIddict.Client/OpenIddictClientHandlers.cs
index 92fbb641..cbafdd66 100644
--- a/src/OpenIddict.Client/OpenIddictClientHandlers.cs
+++ b/src/OpenIddict.Client/OpenIddictClientHandlers.cs
@@ -4660,27 +4660,27 @@ public static partial class OpenIddictClientHandlers
                 },
 
                 SupportedServerCodeChallengeMethods: context.Configuration.CodeChallengeMethodsSupported) switch
-            {
-                // If the list of code challenge methods supported by the
-                // client is empty, don't use Proof Key for Code Exchange.
-                ({ Count: 0 }, { Count: _ }) => null,
+                {
+                    // If the list of code challenge methods supported by the
+                    // client is empty, don't use Proof Key for Code Exchange.
+                    ({ Count: 0 }, { Count: _ }) => null,
 
-                // If the server doesn't specify a list of code challenge methods,
-                // Proof Key for Code Exchange is assumed to be unsupported.
-                ({ Count: > 0 }, { Count: 0 }) => null,
+                    // If the server doesn't specify a list of code challenge methods,
+                    // Proof Key for Code Exchange is assumed to be unsupported.
+                    ({ Count: > 0 }, { Count: 0 }) => null,
 
-                // If both the client and the server support S256, use it.
-                ({ Count: > 0 } client, { Count: > 0 } server) when
-                    client.Contains(CodeChallengeMethods.Sha256) && server.Contains(CodeChallengeMethods.Sha256)
-                    => CodeChallengeMethods.Sha256,
+                    // If both the client and the server support S256, use it.
+                    ({ Count: > 0 } client, { Count: > 0 } server) when
+                        client.Contains(CodeChallengeMethods.Sha256) && server.Contains(CodeChallengeMethods.Sha256)
+                        => CodeChallengeMethods.Sha256,
 
-                // If both the client and the server support plain, use it.
-                ({ Count: > 0 } client, { Count: > 0 } server) when
-                    client.Contains(CodeChallengeMethods.Plain) && server.Contains(CodeChallengeMethods.Plain)
-                    => CodeChallengeMethods.Plain,
+                    // If both the client and the server support plain, use it.
+                    ({ Count: > 0 } client, { Count: > 0 } server) when
+                        client.Contains(CodeChallengeMethods.Plain) && server.Contains(CodeChallengeMethods.Plain)
+                        => CodeChallengeMethods.Plain,
 
-                _ => null
-            };
+                    _ => null
+                };
 
             // Note: while enforced by OAuth 2.1 under certain circumstances, PKCE is not a required feature for
             // OAuth 2.0 and OpenID Connect (where features like nonce validation can serve similar purposes).