lib

Documentation

Index

• Constants
• Variables
• func AbsoluteURL(urlRef string, origin *url.URL) (string, error)
• func CreateJWT(signatureAlgorithm string, key interface{}, mapClaims jwt.MapClaims, ...) (string, error)
• func Merge(args []cty.Value) (cty.Value, error)
• func NewJwtSignFunction(ctx *hcl.EvalContext, jwtSigningConfigs map[string]*JWTSigningConfig, ...) function.Function
• func NewOAuthAuthorizationURLFunction(ctx *hcl.EvalContext, oauth2s map[string]config.OAuth2Authorization, ...) function.Function
• func NewOAuthCodeChallengeFunction(verifier func() (*pkce.CodeVerifier, error)) function.Function
• func NewOAuthCodeVerifierFunction(verifier func() (*pkce.CodeVerifier, error)) function.Function
• func NewSamlSsoURLFunction(configs []*config.SAML, origin *url.URL) function.Function
• type JWTSigningConfig
  • func NewJWTSigningConfigFromJWT(j *config.JWT) (*JWTSigningConfig, error)
  • func NewJWTSigningConfigFromJWTSigningProfile(j *config.JWTSigningProfile, algCheckFunc func(alg acjwt.Algorithm) error) (*JWTSigningConfig, error)

Constants

const (
	CodeVerifier                  = "code_verifier"
	FnOAuthAuthorizationURL       = "oauth2_authorization_url"
	FnOAuthVerifier               = "oauth2_verifier"
	InternalFnOAuthHashedVerifier = "internal_oauth_hashed_verifier"
)

const (
	FnSamlSsoURL            = "saml_sso_url"
	NameIDFormatUnspecified = "urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified"
)

const FnJWTSign = "jwt_sign"

Variables

var (
	Base64DecodeFunc = newBase64DecodeFunction()
	Base64EncodeFunc = newBase64EncodeFunction()
)

var (
	URLDecodeFunc   = newURLDecodeFunction()
	URLEncodeFunc   = newURLEncodeFunction()
	RelativeURLFunc = newRelativeURLFunction()
)

var DefaultFunc = function.New(&function.Spec{
	VarParam: &function.Parameter{
		Name:             "vals",
		Type:             cty.DynamicPseudoType,
		AllowUnknown:     true,
		AllowDynamicType: true,
		AllowNull:        true,
	},
	Type: func(args []cty.Value) (cty.Type, error) {
		var argTypes []cty.Type
		for _, val := range args {

			if val.Type() == cty.NilType {
				continue
			}
			argTypes = append(argTypes, val.Type())
		}
		if len(argTypes) == 0 {

			return cty.NilType, nil
		}
		retType, _ := convert.UnifyUnsafe(argTypes)
		if retType == cty.NilType {
			return cty.NilType, fmt.Errorf("all defined arguments must have the same type")
		}
		return retType, nil
	},
	Impl: func(args []cty.Value, retType cty.Type) (cty.Value, error) {
		for _, argVal := range args {
			if !argVal.IsKnown() {
				return cty.UnknownVal(retType), nil
			}
			if argVal.IsNull() || argVal.Type() == cty.NilType {
				continue
			}

			if argVal.Type() == cty.String && argVal.AsString() == "" && retType == cty.String {
				continue
			}

			return convert.Convert(argVal, retType)
		}
		return args[len(args)-1], nil
	},
})

var MergeFunc = newMergeFunction()

var NoOpJwtSignFunction = function.New(&function.Spec{
	Params: []function.Parameter{
		{
			Name: "jwt_signing_profile_label",
			Type: cty.String,
		},
		{
			Name: "claims",
			Type: cty.DynamicPseudoType,
		},
	},
	Type: function.StaticReturnType(cty.String),
	Impl: func(args []cty.Value, _ cty.Type) (ret cty.Value, err error) {
		if len(args) > 0 {
			return cty.StringVal(""), fmt.Errorf("missing jwt_signing_profile or jwt (with signing_ttl) block with referenced label %q", args[0].AsString())
		}
		return cty.StringVal(""), fmt.Errorf("missing jwt_signing_profile or jwt (with signing_ttl) definitions")
	},
})

var NoOpOAuthAuthorizationURLFunction = function.New(&function.Spec{
	Params: []function.Parameter{
		{
			Name: "oauth2_label",
			Type: cty.String,
		},
	},
	Type: function.StaticReturnType(cty.String),
	Impl: func(args []cty.Value, _ cty.Type) (ret cty.Value, err error) {
		if len(args) > 0 {
			return cty.StringVal(""), fmt.Errorf("missing oidc or beta_oauth2 block with referenced label %q", args[0].AsString())
		}
		return cty.StringVal(""), fmt.Errorf("missing oidc or beta_oauth2 definitions")
	},
})

var NoOpSamlSsoURLFunction = function.New(&function.Spec{
	Params: []function.Parameter{
		{
			Name: "saml_label",
			Type: cty.String,
		},
	},
	Type: function.StaticReturnType(cty.String),
	Impl: func(args []cty.Value, _ cty.Type) (ret cty.Value, err error) {
		if len(args) > 0 {
			return cty.StringVal(""), fmt.Errorf("missing saml block with referenced label %q", args[0].AsString())
		}
		return cty.StringVal(""), fmt.Errorf("missing saml definitions")
	},
})

var (
	UnixtimeFunc = newUnixtimeFunction()
)

Functions

func AbsoluteURL

func AbsoluteURL(urlRef string, origin *url.URL) (string, error)

func CreateJWT

func CreateJWT(signatureAlgorithm string, key interface{}, mapClaims jwt.MapClaims, headers map[string]interface{}) (string, error)

func Merge

func Merge(args []cty.Value) (cty.Value, error)

func NewJwtSignFunction

func NewJwtSignFunction(ctx *hcl.EvalContext, jwtSigningConfigs map[string]*JWTSigningConfig,
	evalFn func(*hcl.EvalContext, hcl.Expression) (cty.Value, error)) function.Function

func NewOAuthAuthorizationURLFunction

func NewOAuthAuthorizationURLFunction(ctx *hcl.EvalContext, oauth2s map[string]config.OAuth2Authorization,
	verifier func() (*pkce.CodeVerifier, error), origin *url.URL,
	evalFn func(*hcl.EvalContext, hcl.Expression) (cty.Value, error)) function.Function

func NewOAuthCodeChallengeFunction

func NewOAuthCodeChallengeFunction(verifier func() (*pkce.CodeVerifier, error)) function.Function

func NewOAuthCodeVerifierFunction

func NewOAuthCodeVerifierFunction(verifier func() (*pkce.CodeVerifier, error)) function.Function

func NewSamlSsoURLFunction

func NewSamlSsoURLFunction(configs []*config.SAML, origin *url.URL) function.Function

Types

type JWTSigningConfig

type JWTSigningConfig struct {
	Claims             config.Claims
	Headers            hcl.Expression
	Key                interface{}
	SignatureAlgorithm string
	TTL                int64
}

func NewJWTSigningConfigFromJWT

func NewJWTSigningConfigFromJWT(j *config.JWT) (*JWTSigningConfig, error)

func NewJWTSigningConfigFromJWTSigningProfile

func NewJWTSigningConfigFromJWTSigningProfile(j *config.JWTSigningProfile, algCheckFunc func(alg acjwt.Algorithm) error) (*JWTSigningConfig, error)