|
| 1 | +import type { DeploymentRegion } from "core/ports/OnyxiaApi"; |
| 2 | +import { id } from "tsafe/id"; |
| 3 | +import { z } from "zod"; |
| 4 | +import { getValueAtPath } from "core/tools/Stringifyable"; |
| 5 | + |
| 6 | +export type ResolvedTemplateStsRole = { |
| 7 | + roleARN: string; |
| 8 | + roleSessionName: string; |
| 9 | +}; |
| 10 | + |
| 11 | +export async function resolveTemplatedStsRole(params: { |
| 12 | + stsRole_region: DeploymentRegion.S3Next.S3Profile.StsRole; |
| 13 | + getDecodedIdToken: () => Promise<Record<string, unknown>>; |
| 14 | +}): Promise<ResolvedTemplateStsRole[]> { |
| 15 | + const { stsRole_region, getDecodedIdToken } = params; |
| 16 | + |
| 17 | + if (stsRole_region.claimName === undefined) { |
| 18 | + return [ |
| 19 | + id<ResolvedTemplateStsRole>({ |
| 20 | + roleARN: stsRole_region.roleARN, |
| 21 | + roleSessionName: stsRole_region.roleSessionName |
| 22 | + }) |
| 23 | + ]; |
| 24 | + } |
| 25 | + |
| 26 | + const { claimName, excludedClaimPattern, includedClaimPattern } = stsRole_region; |
| 27 | + |
| 28 | + const decodedIdToken = await getDecodedIdToken(); |
| 29 | + |
| 30 | + const claimValue_arr: string[] = (() => { |
| 31 | + let claimValue_untrusted: unknown = (() => { |
| 32 | + const candidate = decodedIdToken[claimName]; |
| 33 | + |
| 34 | + if (candidate !== undefined) { |
| 35 | + return candidate; |
| 36 | + } |
| 37 | + |
| 38 | + const claimPath = claimName.split("."); |
| 39 | + |
| 40 | + if (claimPath.length === 1) { |
| 41 | + return undefined; |
| 42 | + } |
| 43 | + |
| 44 | + return getValueAtPath({ |
| 45 | + // @ts-expect-error: We know decodedIdToken is Stringifyable |
| 46 | + stringifyableObjectOrArray: decodedIdToken, |
| 47 | + doDeleteFromSource: false, |
| 48 | + doFailOnUnresolved: false, |
| 49 | + path: claimPath |
| 50 | + }); |
| 51 | + })(); |
| 52 | + |
| 53 | + if (!claimValue_untrusted) { |
| 54 | + return []; |
| 55 | + } |
| 56 | + |
| 57 | + let claimValue: string | string[]; |
| 58 | + |
| 59 | + try { |
| 60 | + claimValue = z |
| 61 | + .union([z.string(), z.array(z.string())]) |
| 62 | + .parse(claimValue_untrusted); |
| 63 | + } catch (error) { |
| 64 | + throw new Error( |
| 65 | + [ |
| 66 | + `decodedIdToken -> ${claimName} is supposed to be`, |
| 67 | + `string or array of string`, |
| 68 | + `The decoded id token is:`, |
| 69 | + JSON.stringify(decodedIdToken, null, 2) |
| 70 | + ].join(" "), |
| 71 | + { cause: error } |
| 72 | + ); |
| 73 | + } |
| 74 | + |
| 75 | + return claimValue instanceof Array ? claimValue : [claimValue]; |
| 76 | + })(); |
| 77 | + |
| 78 | + const includedRegex = |
| 79 | + includedClaimPattern !== undefined ? new RegExp(includedClaimPattern) : /^(.+)$/; |
| 80 | + const excludedRegex = |
| 81 | + excludedClaimPattern !== undefined ? new RegExp(excludedClaimPattern) : undefined; |
| 82 | + |
| 83 | + return claimValue_arr |
| 84 | + .map(value => { |
| 85 | + if (excludedRegex !== undefined && excludedRegex.test(value)) { |
| 86 | + return undefined; |
| 87 | + } |
| 88 | + |
| 89 | + const match = includedRegex.exec(value); |
| 90 | + |
| 91 | + if (match === null) { |
| 92 | + return undefined; |
| 93 | + } |
| 94 | + |
| 95 | + const substituteTemplateString = (str: string) => |
| 96 | + str.replace(/\$(\d+)/g, (_, i) => match[parseInt(i)] ?? ""); |
| 97 | + |
| 98 | + return id<ResolvedTemplateStsRole>({ |
| 99 | + roleARN: substituteTemplateString(stsRole_region.roleARN), |
| 100 | + roleSessionName: substituteTemplateString(stsRole_region.roleSessionName) |
| 101 | + }); |
| 102 | + }) |
| 103 | + .filter(x => x !== undefined); |
| 104 | +} |
0 commit comments