3ebb221a9b
Register v1 API scopes in coredata, advertise them in OIDC discovery and protected-resource metadata, show them on the consent screen, and enforce scope-to-action mapping in the IAM Authorizer before policy evaluation. Signed-off-by: Ludovic Vielle <ludovic@probo.com>
73 lines
1.9 KiB
Go
73 lines
1.9 KiB
Go
// Copyright (c) 2026 Probo Inc <hello@probo.com>.
|
|
//
|
|
// Permission to use, copy, modify, and/or distribute this software for any
|
|
// purpose with or without fee is hereby granted, provided that the above
|
|
// copyright notice and this permission notice appear in all copies.
|
|
//
|
|
// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
|
|
// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
|
|
// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
|
|
// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
|
|
// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
|
|
// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
|
|
// PERFORMANCE OF THIS SOFTWARE.
|
|
|
|
package oauth2
|
|
|
|
import (
|
|
"fmt"
|
|
"strings"
|
|
|
|
"go.probo.inc/probo/pkg/coredata"
|
|
)
|
|
|
|
const (
|
|
ScopeOpenID coredata.OAuth2Scope = "openid"
|
|
ScopeProfile coredata.OAuth2Scope = "profile"
|
|
ScopeEmail coredata.OAuth2Scope = "email"
|
|
ScopeOfflineAccess coredata.OAuth2Scope = "offline_access"
|
|
)
|
|
|
|
func IsStandardScope(scope coredata.OAuth2Scope) bool {
|
|
switch scope {
|
|
case ScopeOpenID, ScopeProfile, ScopeEmail, ScopeOfflineAccess:
|
|
return true
|
|
}
|
|
|
|
return false
|
|
}
|
|
|
|
func IsValid(scope coredata.OAuth2Scope) bool {
|
|
return IsStandardScope(scope)
|
|
}
|
|
|
|
func UnmarshalScope(text []byte) (coredata.OAuth2Scope, error) {
|
|
scope := coredata.OAuth2Scope(text)
|
|
if !IsValid(scope) {
|
|
return "", fmt.Errorf("invalid oauth2 scope value: %q", string(text))
|
|
}
|
|
|
|
return scope, nil
|
|
}
|
|
|
|
func UnmarshalScopes(text []byte) (coredata.OAuth2Scopes, error) {
|
|
str := string(text)
|
|
if str == "" {
|
|
return nil, nil
|
|
}
|
|
|
|
fields := strings.Fields(str)
|
|
|
|
scopes := make(coredata.OAuth2Scopes, len(fields))
|
|
for i, f := range fields {
|
|
scope, err := UnmarshalScope([]byte(f))
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
scopes[i] = scope
|
|
}
|
|
|
|
return scopes, nil
|
|
}
|