From c00a8455177ab98a0729e48cecce0b76d6212f8c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Dani=C3=ABlle=20Huisman?= <danielle@huisman.me>
Date: Sat, 13 Jun 2026 14:09:25 +0200
Subject: [PATCH] feat(oauth): add builder for provider

---
 .github/workflows/ci.yml                      |  2 +-
 .github/workflows/labels.yml                  |  2 +-
 .github/workflows/publish.yml                 |  2 +-
 .github/workflows/release.yml                 |  2 +-
 .github/workflows/website.yml                 |  2 +-
 deny.toml                                     |  1 +
 packages/methods/shield-oauth/src/provider.rs | 11 ++++++++++-
 7 files changed, 16 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 64dbd87..c276251 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -12,7 +12,7 @@ permissions:
 jobs:
     rust:
         name: Rust
-        uses: RustForWeb/.github/.github/workflows/rust.yml@c18f3b7315df398b6af8d03f823e31daeda63114
+        uses: RustForWeb/.github/.github/workflows/rust.yml@dc2442c27ef9f920a1a889ec94e615b419b491b2 # v1.0.1
         with:
             enable-test: false
             target: wasm32-unknown-unknown
diff --git a/.github/workflows/labels.yml b/.github/workflows/labels.yml
index 32de412..2c193b3 100644
--- a/.github/workflows/labels.yml
+++ b/.github/workflows/labels.yml
@@ -10,4 +10,4 @@ permissions:
 jobs:
     labels:
         name: Labels
-        uses: RustForWeb/.github/.github/workflows/labels.yml@c18f3b7315df398b6af8d03f823e31daeda63114
+        uses: RustForWeb/.github/.github/workflows/labels.yml@dc2442c27ef9f920a1a889ec94e615b419b491b2 # v1.0.1
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 823af00..77254b5 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -11,4 +11,4 @@ permissions:
 jobs:
     publish:
         name: Publish
-        uses: RustForWeb/.github/.github/workflows/publish.yml@c18f3b7315df398b6af8d03f823e31daeda63114
+        uses: RustForWeb/.github/.github/workflows/publish.yml@dc2442c27ef9f920a1a889ec94e615b419b491b2 # v1.0.1
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 1afcb04..ffd9f14 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -18,6 +18,6 @@ permissions:
 jobs:
     release:
         name: Release
-        uses: RustForWeb/.github/.github/workflows/release.yml@c18f3b7315df398b6af8d03f823e31daeda63114
+        uses: RustForWeb/.github/.github/workflows/release.yml@dc2442c27ef9f920a1a889ec94e615b419b491b2 # v1.0.1
         with:
             bump: ${{ inputs.bump }}
diff --git a/.github/workflows/website.yml b/.github/workflows/website.yml
index a858066..610a946 100644
--- a/.github/workflows/website.yml
+++ b/.github/workflows/website.yml
@@ -18,6 +18,6 @@ concurrency:
 jobs:
     book:
         name: Book
-        uses: RustForWeb/.github/.github/workflows/book.yml@c18f3b7315df398b6af8d03f823e31daeda63114
+        uses: RustForWeb/.github/.github/workflows/book.yml@dc2442c27ef9f920a1a889ec94e615b419b491b2 # v1.0.1
         with:
             combine: false
diff --git a/deny.toml b/deny.toml
index 6e1e167..cb4f6d9 100644
--- a/deny.toml
+++ b/deny.toml
@@ -5,6 +5,7 @@ all-features = true
 ignore = [
     { id = "RUSTSEC-2023-0071", reason = "No safe upgrade available for `rsa`." },
     { id = "RUSTSEC-2024-0436", reason = "No maintained version available for `paste`." },
+    { id = "RUSTSEC-2026-0173", reason = "No maintained version available for `proc-macro-error2`." },
 ]
 yanked = "deny"
 
diff --git a/packages/methods/shield-oauth/src/provider.rs b/packages/methods/shield-oauth/src/provider.rs
index 8e6311e..721270d 100644
--- a/packages/methods/shield-oauth/src/provider.rs
+++ b/packages/methods/shield-oauth/src/provider.rs
@@ -1,3 +1,4 @@
+use bon::Builder;
 use oauth2::{
     AuthUrl, Client, ClientId, ClientSecret, EndpointMaybeSet, EndpointNotSet, IntrospectionUrl,
     RedirectUrl, RevocationUrl, StandardRevocableToken, TokenUrl,
@@ -37,11 +38,18 @@ pub enum OauthProviderPkceCodeChallenge {
     S256,
 }
 
-#[derive(Clone, Debug)]
+#[expect(clippy::duplicated_attributes)]
+#[derive(Builder, Clone, Debug)]
+#[builder(
+    on(String, into),
+    on(SecretString, into),
+    state_mod(vis = "pub(crate)")
+)]
 pub struct OauthProvider {
     pub id: String,
     pub name: String,
     pub slug: Option<String>,
+    #[builder(default = OauthProviderVisibility::Public)]
     pub visibility: OauthProviderVisibility,
     pub client_id: String,
     pub client_secret: Option<SecretString>,
@@ -55,6 +63,7 @@ pub struct OauthProvider {
     pub introspection_url_params: Option<String>,
     pub revocation_url: Option<String>,
     pub revocation_url_params: Option<String>,
+    #[builder(default = OauthProviderPkceCodeChallenge::S256)]
     pub pkce_code_challenge: OauthProviderPkceCodeChallenge,
     pub icon_url: Option<String>,
 }