OAuth token request uses the Resource Owner Password Credentials grant (grant_type=password).

use oauth2::basic::BasicClient;
use oauth2::{ResourceOwnerPassword, ResourceOwnerUsername};
use reqwest::Client;

// oauth2 crate ROPC helper — the password grant.
async fn login_oauth2(client: &BasicClient, username: &str, password: &str) {
    let http = reqwest::Client::new();
    // ruleid: auth.rust.oauth.ropc-grant
    let _ = client
        .exchange_password(
            &ResourceOwnerUsername::new(username.to_string()),
            &ResourceOwnerPassword::new(password.to_string()),
        )
        .request_async(&http)
        .await;
}

// Hand-built reqwest form carrying the password grant.
async fn login_form(client: &Client, username: &str, password: &str) {
    // ruleid: auth.rust.oauth.ropc-grant
    let params = [
        ("grant_type", "password"),
        ("username", username),
        ("password", password),
    ];
    let _ = client
        .post("https://issuer.example.com/oauth/token")
        .form(&params)
        .send()
        .await;
}

// URL-encoded body string built by hand.
async fn login_raw_body(client: &Client, username: &str) {
    // ruleid: auth.rust.oauth.ropc-grant
    let body = format!("grant_type=password&username={}", username);
    let _ = client
        .post("https://issuer.example.com/oauth/token")
        .body(body)
        .send()
        .await;
}

fn main() {}

use oauth2::basic::BasicClient;
use oauth2::AuthorizationCode;
use reqwest::Client;

// Safe: authorization-code exchange — the recommended user-login flow.
async fn login_auth_code(client: &BasicClient, code: String) {
    let http = reqwest::Client::new();
    // ok: auth.rust.oauth.ropc-grant
    let _ = client
        .exchange_code(AuthorizationCode::new(code))
        .request_async(&http)
        .await;
}

// Safe: client-credentials grant — a different grant_type value must not match.
async fn login_client_creds(client: &Client) {
    // ok: auth.rust.oauth.ropc-grant
    let params = [("grant_type", "client_credentials"), ("client_id", "svc")];
    let _ = client
        .post("https://issuer.example.com/oauth/token")
        .form(&params)
        .send()
        .await;
}

// Safe trap: a password-reset body whose grant_type prefix-matches
// "password" but is a distinct, bounded value.
async fn reset_password(client: &Client) {
    // ok: auth.rust.oauth.ropc-grant
    let body = "grant_type=password_reset&email=user@example.com";
    let _ = client
        .post("https://issuer.example.com/reset")
        .body(body)
        .send()
        .await;
}

fn main() {}