Skip to content

Commit 09b89a5

Browse files
ChrisJBurnsChrisJBurns
authored
Merge branch 'main' into cburns/oidc-configref-resource-url
2 parents 1418484 + bb213f1 commit 09b89a5

30 files changed

Lines changed: 243 additions & 95 deletions

‎cmd/thv/app/client.go‎

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -292,15 +292,16 @@ func registerClientsGlobally(
292292
) error {
293293
for _, clientToRegister := range clients {
294294
// Update the global config to register the client
295-
err := config.UpdateConfig(func(c *config.Config) {
295+
err := config.UpdateConfig(func(c *config.Config) error {
296296
for _, registeredClient := range c.Clients.RegisteredClients {
297297
if registeredClient == string(clientToRegister.Name) {
298298
slog.Debug(fmt.Sprintf("Client %s is already registered, skipping...", clientToRegister.Name))
299-
return
299+
return nil
300300
}
301301
}
302302

303303
c.Clients.RegisteredClients = append(c.Clients.RegisteredClients, string(clientToRegister.Name))
304+
return nil
304305
})
305306
if err != nil {
306307
return fmt.Errorf("failed to update configuration for client %s: %w", clientToRegister.Name, err)
@@ -411,15 +412,16 @@ func removeClientGlobally(
411412
}
412413

413414
// Remove client from global registered clients list
414-
err = config.UpdateConfig(func(c *config.Config) {
415+
err = config.UpdateConfig(func(c *config.Config) error {
415416
for i, registeredClient := range c.Clients.RegisteredClients {
416417
if registeredClient == string(clientToRemove.Name) {
417418
// Remove client from slice
418419
c.Clients.RegisteredClients = append(c.Clients.RegisteredClients[:i], c.Clients.RegisteredClients[i+1:]...)
419420
slog.Debug(fmt.Sprintf("Successfully unregistered client: %s", clientToRemove.Name))
420-
return
421+
return nil
421422
}
422423
}
424+
return nil
423425
})
424426
if err != nil {
425427
return fmt.Errorf("failed to update configuration for client %s: %w", clientToRemove.Name, err)

‎cmd/thv/app/common.go‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -78,9 +78,10 @@ func SetSecretsProvider(ctx context.Context, provider secrets.ProviderType) erro
7878
}
7979

8080
// Update the secrets provider type and mark setup as completed
81-
err := config.UpdateConfig(func(c *config.Config) {
81+
err := config.UpdateConfig(func(c *config.Config) error {
8282
c.Secrets.ProviderType = string(provider)
8383
c.Secrets.SetupCompleted = true
84+
return nil
8485
})
8586
if err != nil {
8687
return fmt.Errorf("failed to update configuration: %w", err)

‎cmd/thv/app/config.go‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -344,8 +344,9 @@ func usageMetricsCmdFunc(_ *cobra.Command, args []string) error {
344344
return fmt.Errorf("invalid argument: %s (expected 'enable' or 'disable')", action)
345345
}
346346

347-
err := config.UpdateConfig(func(c *config.Config) {
347+
err := config.UpdateConfig(func(c *config.Config) error {
348348
c.DisableUsageMetrics = disable
349+
return nil
349350
})
350351
if err != nil {
351352
return fmt.Errorf("failed to update configuration: %w", err)

‎cmd/thv/app/otel.go‎

Lines changed: 28 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -235,8 +235,9 @@ func setOtelEndpointCmdFunc(_ *cobra.Command, args []string) error {
235235
}
236236

237237
// Update the configuration
238-
err := config.UpdateConfig(func(c *config.Config) {
238+
err := config.UpdateConfig(func(c *config.Config) error {
239239
c.OTEL.Endpoint = endpoint
240+
return nil
240241
})
241242
if err != nil {
242243
return fmt.Errorf("failed to update configuration: %w", err)
@@ -269,8 +270,9 @@ func unsetOtelEndpointCmdFunc(_ *cobra.Command, _ []string) error {
269270
}
270271

271272
// Update the configuration
272-
err := config.UpdateConfig(func(c *config.Config) {
273+
err := config.UpdateConfig(func(c *config.Config) error {
273274
c.OTEL.Endpoint = ""
275+
return nil
274276
})
275277
if err != nil {
276278
return fmt.Errorf("failed to update configuration: %w", err)
@@ -292,8 +294,9 @@ func setOtelSamplingRateCmdFunc(_ *cobra.Command, args []string) error {
292294
}
293295

294296
// Update the configuration
295-
err = config.UpdateConfig(func(c *config.Config) {
297+
err = config.UpdateConfig(func(c *config.Config) error {
296298
c.OTEL.SamplingRate = rate
299+
return nil
297300
})
298301
if err != nil {
299302
return fmt.Errorf("failed to update configuration: %w", err)
@@ -326,8 +329,9 @@ func unsetOtelSamplingRateCmdFunc(_ *cobra.Command, _ []string) error {
326329
}
327330

328331
// Update the configuration
329-
err := config.UpdateConfig(func(c *config.Config) {
332+
err := config.UpdateConfig(func(c *config.Config) error {
330333
c.OTEL.SamplingRate = 0.0
334+
return nil
331335
})
332336
if err != nil {
333337
return fmt.Errorf("failed to update configuration: %w", err)
@@ -346,8 +350,9 @@ func setOtelEnvVarsCmdFunc(_ *cobra.Command, args []string) error {
346350
}
347351

348352
// Update the configuration
349-
err := config.UpdateConfig(func(c *config.Config) {
353+
err := config.UpdateConfig(func(c *config.Config) error {
350354
c.OTEL.EnvVars = vars
355+
return nil
351356
})
352357
if err != nil {
353358
return fmt.Errorf("failed to update configuration: %w", err)
@@ -380,8 +385,9 @@ func unsetOtelEnvVarsCmdFunc(_ *cobra.Command, _ []string) error {
380385
}
381386

382387
// Update the configuration
383-
err := config.UpdateConfig(func(c *config.Config) {
388+
err := config.UpdateConfig(func(c *config.Config) error {
384389
c.OTEL.EnvVars = []string{}
390+
return nil
385391
})
386392
if err != nil {
387393
return fmt.Errorf("failed to update configuration: %w", err)
@@ -398,8 +404,9 @@ func setOtelMetricsEnabledCmdFunc(_ *cobra.Command, args []string) error {
398404
}
399405

400406
// Update the configuration
401-
err = config.UpdateConfig(func(c *config.Config) {
407+
err = config.UpdateConfig(func(c *config.Config) error {
402408
c.OTEL.MetricsEnabled = &enabled
409+
return nil
403410
})
404411
if err != nil {
405412
return fmt.Errorf("failed to update configuration: %w", err)
@@ -428,8 +435,9 @@ func unsetOtelMetricsEnabledCmdFunc(_ *cobra.Command, _ []string) error {
428435
}
429436

430437
// Update the configuration
431-
err := config.UpdateConfig(func(c *config.Config) {
438+
err := config.UpdateConfig(func(c *config.Config) error {
432439
c.OTEL.MetricsEnabled = nil
440+
return nil
433441
})
434442
if err != nil {
435443
return fmt.Errorf("failed to update configuration: %w", err)
@@ -446,8 +454,9 @@ func setOtelTracingEnabledCmdFunc(_ *cobra.Command, args []string) error {
446454
}
447455

448456
// Update the configuration
449-
err = config.UpdateConfig(func(c *config.Config) {
457+
err = config.UpdateConfig(func(c *config.Config) error {
450458
c.OTEL.TracingEnabled = &enabled
459+
return nil
451460
})
452461
if err != nil {
453462
return fmt.Errorf("failed to update configuration: %w", err)
@@ -476,8 +485,9 @@ func unsetOtelTracingEnabledCmdFunc(_ *cobra.Command, _ []string) error {
476485
}
477486

478487
// Update the configuration
479-
err := config.UpdateConfig(func(c *config.Config) {
488+
err := config.UpdateConfig(func(c *config.Config) error {
480489
c.OTEL.TracingEnabled = nil
490+
return nil
481491
})
482492
if err != nil {
483493
return fmt.Errorf("failed to update configuration: %w", err)
@@ -494,8 +504,9 @@ func setOtelInsecureCmdFunc(_ *cobra.Command, args []string) error {
494504
}
495505

496506
// Update the configuration
497-
err = config.UpdateConfig(func(c *config.Config) {
507+
err = config.UpdateConfig(func(c *config.Config) error {
498508
c.OTEL.Insecure = enabled
509+
return nil
499510
})
500511
if err != nil {
501512
return fmt.Errorf("failed to update configuration: %w", err)
@@ -523,8 +534,9 @@ func unsetOtelInsecureCmdFunc(_ *cobra.Command, _ []string) error {
523534
}
524535

525536
// Update the configuration
526-
err := config.UpdateConfig(func(c *config.Config) {
537+
err := config.UpdateConfig(func(c *config.Config) error {
527538
c.OTEL.Insecure = false
539+
return nil
528540
})
529541
if err != nil {
530542
return fmt.Errorf("failed to update configuration: %w", err)
@@ -541,8 +553,9 @@ func setOtelEnablePrometheusMetricsPathCmdFunc(_ *cobra.Command, args []string)
541553
}
542554

543555
// Update the configuration
544-
err = config.UpdateConfig(func(c *config.Config) {
556+
err = config.UpdateConfig(func(c *config.Config) error {
545557
c.OTEL.EnablePrometheusMetricsPath = enabled
558+
return nil
546559
})
547560
if err != nil {
548561
return fmt.Errorf("failed to update configuration: %w", err)
@@ -570,8 +583,9 @@ func unsetOtelEnablePrometheusMetricsPathCmdFunc(_ *cobra.Command, _ []string) e
570583
}
571584

572585
// Update the configuration
573-
err := config.UpdateConfig(func(c *config.Config) {
586+
err := config.UpdateConfig(func(c *config.Config) error {
574587
c.OTEL.EnablePrometheusMetricsPath = false
588+
return nil
575589
})
576590
if err != nil {
577591
return fmt.Errorf("failed to update configuration: %w", err)

‎cmd/thv/app/run_flags_test.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -43,7 +43,7 @@ func createTestConfigProvider(t *testing.T, cfg *config.Config) (config.Provider
4343

4444
// Write the config file if one is provided
4545
if cfg != nil {
46-
err = provider.UpdateConfig(func(c *config.Config) { *c = *cfg })
46+
err = provider.UpdateConfig(func(c *config.Config) error { *c = *cfg; return nil })
4747
require.NoError(t, err)
4848
}
4949

‎pkg/api/v1/clients.go‎

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -351,15 +351,16 @@ func (c *ClientRoutes) performClientRegistration(ctx context.Context, clients []
351351
} else {
352352
// We should never reach this point once groups are enabled
353353
for _, clientToRegister := range clients {
354-
err := config.UpdateConfig(func(c *config.Config) {
354+
err := config.UpdateConfig(func(c *config.Config) error {
355355
for _, registeredClient := range c.Clients.RegisteredClients {
356356
if registeredClient == string(clientToRegister.Name) {
357357
slog.Debug("client already registered, skipping", "client", clientToRegister.Name)
358-
return
358+
return nil
359359
}
360360
}
361361

362362
c.Clients.RegisteredClients = append(c.Clients.RegisteredClients, string(clientToRegister.Name))
363+
return nil
363364
})
364365
if err != nil {
365366
return fmt.Errorf("failed to update configuration for client %s: %w", clientToRegister.Name, err)
@@ -459,15 +460,16 @@ func (c *ClientRoutes) removeClientGlobally(
459460

460461
// Remove clients from global registered clients list
461462
for _, clientToRemove := range clients {
462-
err := config.UpdateConfig(func(c *config.Config) {
463+
err := config.UpdateConfig(func(c *config.Config) error {
463464
for i, registeredClient := range c.Clients.RegisteredClients {
464465
if registeredClient == string(clientToRemove.Name) {
465466
// Remove client from slice
466467
c.Clients.RegisteredClients = append(c.Clients.RegisteredClients[:i], c.Clients.RegisteredClients[i+1:]...)
467468
slog.Debug("successfully unregistered client", "client", clientToRemove.Name)
468-
return
469+
return nil
469470
}
470471
}
472+
return nil
471473
})
472474
if err != nil {
473475
return fmt.Errorf("failed to update configuration for client %s: %w", clientToRemove.Name, err)

‎pkg/api/v1/registry_test.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -41,7 +41,7 @@ func CreateTestConfigProvider(t *testing.T, cfg *config.Config) (config.Provider
4141

4242
// Write the config file if one is provided
4343
if cfg != nil {
44-
err = provider.UpdateConfig(func(c *config.Config) { *c = *cfg })
44+
err = provider.UpdateConfig(func(c *config.Config) error { *c = *cfg; return nil })
4545
require.NoError(t, err)
4646
}
4747

‎pkg/api/v1/secrets.go‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -182,9 +182,10 @@ func (s *SecretsRoutes) setupSecretsProvider(w http.ResponseWriter, r *http.Requ
182182
}
183183

184184
// Update the secrets provider type and mark setup as completed
185-
err := s.configProvider.UpdateConfig(func(c *config.Config) {
185+
err := s.configProvider.UpdateConfig(func(c *config.Config) error {
186186
c.Secrets.ProviderType = string(providerType)
187187
c.Secrets.SetupCompleted = true
188+
return nil
188189
})
189190
if err != nil {
190191
return fmt.Errorf("failed to update configuration: %w", err)

‎pkg/authz/authorizers/cedar/core.go‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -164,6 +164,9 @@ type Authorizer struct {
164164
// groupClaimName is the JWT claim key that contains group membership.
165165
// When empty, the well-known defaults are checked ("groups", "roles", etc.).
166166
groupClaimName string
167+
// roleClaimName is the JWT claim key that contains role membership.
168+
// When empty, no role extraction is performed (backward compatible).
169+
roleClaimName string
167170
// claimKeyLog rate-limits the diagnostic log of resolved JWT claim keys
168171
// so it emits at most once per 30 seconds instead of once per authorization check.
169172
claimKeyLog *syncutil.AtMost
@@ -189,6 +192,12 @@ type ConfigOptions struct {
189192
// under a URI-style claim (e.g. "https://example.com/groups" in Auth0/Okta).
190193
// When empty, only the well-known claim names are checked.
191194
GroupClaimName string `json:"group_claim_name,omitempty" yaml:"group_claim_name,omitempty"`
195+
196+
// RoleClaimName is the JWT claim key that contains role membership for the
197+
// principal. When set, the claim is extracted separately from GroupClaimName
198+
// and both are mapped to Cedar THVGroup entities.
199+
// When empty, no role extraction is performed (backward compatible).
200+
RoleClaimName string `json:"role_claim_name,omitempty" yaml:"role_claim_name,omitempty"`
192201
}
193202

194203
// NewCedarAuthorizer creates a new Cedar authorizer.
@@ -199,6 +208,7 @@ func NewCedarAuthorizer(options ConfigOptions) (authorizers.Authorizer, error) {
199208
entityFactory: NewEntityFactory(),
200209
primaryUpstreamProvider: options.PrimaryUpstreamProvider,
201210
groupClaimName: options.GroupClaimName,
211+
roleClaimName: options.RoleClaimName,
202212
claimKeyLog: syncutil.NewAtMost(30 * time.Second),
203213
}
204214

0 commit comments

Comments
 (0)