zt/controller/model/external_jwt_signer_model.go

/*
	Copyright NetFoundry Inc.

	Licensed under the Apache License, Version 2.0 (the "License");
	you may not use this file except in compliance with the License.
	You may obtain a copy of the License at

	https://www.apache.org/licenses/LICENSE-2.0

	Unless required by applicable law or agreed to in writing, software
	distributed under the License is distributed on an "AS IS" BASIS,
	WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
	See the License for the specific language governing permissions and
	limitations under the License.
*/

package model

import (
	"time"

	nfpem "github.com/hanzozt/foundation/v2/pem"
	"github.com/hanzozt/storage/boltz"
	"github.com/hanzozt/zt/v2/controller/apierror"
	"github.com/hanzozt/zt/v2/controller/db"
	"github.com/hanzozt/zt/v2/controller/models"
	"go.etcd.io/bbolt"
)

type ExternalJwtSigner struct {
	models.BaseEntity
	Name            string
	CertPem         *string
	JwksEndpoint    *string
	Kid             *string
	Enabled         bool
	ExternalAuthUrl *string
	UseExternalId   bool
	ClaimsProperty  *string
	Issuer          *string
	Audience        *string
	ClientId        *string
	Scopes          []string

	CommonName                    string
	Fingerprint                   *string
	NotAfter                      time.Time
	NotBefore                     time.Time
	TargetToken                   string
	EnrollToCertEnabled           bool
	EnrollToTokenEnabled          bool
	EnrollAttributeClaimsSelector string
	EnrollAuthPolicyId            string
	EnrollNameClaimselector       string
}

func (entity *ExternalJwtSigner) toBoltEntity() (*db.ExternalJwtSigner, error) {
	signer := &db.ExternalJwtSigner{
		BaseExtEntity:                 *boltz.NewExtEntity(entity.Id, entity.Tags),
		Name:                          entity.Name,
		CertPem:                       entity.CertPem,
		JwksEndpoint:                  entity.JwksEndpoint,
		Enabled:                       entity.Enabled,
		ExternalAuthUrl:               entity.ExternalAuthUrl,
		UseExternalId:                 entity.UseExternalId,
		IdentityIdClaimsSelector:      entity.ClaimsProperty,
		Kid:                           entity.Kid,
		Issuer:                        entity.Issuer,
		Audience:                      entity.Audience,
		ClientId:                      entity.ClientId,
		Scopes:                        entity.Scopes,
		TargetToken:                   entity.TargetToken,
		EnrollToCertEnabled:           entity.EnrollToCertEnabled,
		EnrollToTokenEnabled:          entity.EnrollToTokenEnabled,
		EnrollAttributeClaimsSelector: entity.EnrollAttributeClaimsSelector,
		EnrollAuthPolicyId:            entity.EnrollAuthPolicyId,
		EnrollNameClaimSelector:       entity.EnrollNameClaimselector,
	}

	if entity.CertPem != nil && *entity.CertPem != "" {
		signerCerts := nfpem.PemStringToCertificates(*entity.CertPem)

		if len(signerCerts) != 1 {
			return nil, apierror.NewInvalidCertificatePem()
		}

		signerCert := signerCerts[0]
		fingerprint := nfpem.FingerprintFromCertificate(signerCert)

		signer.CommonName = signerCert.Subject.CommonName
		signer.NotBefore = &signerCert.NotBefore
		signer.NotAfter = &signerCert.NotAfter
		signer.Fingerprint = &fingerprint
	}
	return signer, nil
}

func (entity *ExternalJwtSigner) toBoltEntityForCreate(*bbolt.Tx, Env) (*db.ExternalJwtSigner, error) {
	return entity.toBoltEntity()
}

func (entity *ExternalJwtSigner) toBoltEntityForUpdate(*bbolt.Tx, Env, boltz.FieldChecker) (*db.ExternalJwtSigner, error) {
	return entity.toBoltEntity()
}

func (entity *ExternalJwtSigner) fillFrom(_ Env, _ *bbolt.Tx, boltExternalJwtSigner *db.ExternalJwtSigner) error {
	entity.FillCommon(boltExternalJwtSigner)
	entity.Name = boltExternalJwtSigner.Name
	entity.CommonName = boltExternalJwtSigner.CommonName
	entity.CertPem = boltExternalJwtSigner.CertPem
	entity.JwksEndpoint = boltExternalJwtSigner.JwksEndpoint
	entity.Fingerprint = boltExternalJwtSigner.Fingerprint
	entity.Enabled = boltExternalJwtSigner.Enabled

	entity.NotBefore = timeOrEmpty(boltExternalJwtSigner.NotBefore)
	entity.NotAfter = timeOrEmpty(boltExternalJwtSigner.NotAfter)
	entity.ExternalAuthUrl = boltExternalJwtSigner.ExternalAuthUrl
	entity.ClaimsProperty = boltExternalJwtSigner.IdentityIdClaimsSelector
	entity.UseExternalId = boltExternalJwtSigner.UseExternalId
	entity.Kid = boltExternalJwtSigner.Kid
	entity.Issuer = boltExternalJwtSigner.Issuer
	entity.Audience = boltExternalJwtSigner.Audience
	entity.ClientId = boltExternalJwtSigner.ClientId
	entity.Scopes = boltExternalJwtSigner.Scopes
	entity.TargetToken = boltExternalJwtSigner.TargetToken
	entity.EnrollToCertEnabled = boltExternalJwtSigner.EnrollToCertEnabled
	entity.EnrollToTokenEnabled = boltExternalJwtSigner.EnrollToTokenEnabled
	entity.EnrollAttributeClaimsSelector = boltExternalJwtSigner.EnrollAttributeClaimsSelector
	entity.EnrollNameClaimselector = boltExternalJwtSigner.EnrollNameClaimSelector
	entity.EnrollAuthPolicyId = boltExternalJwtSigner.EnrollAuthPolicyId
	return nil
}

func timeOrEmpty(t *time.Time) time.Time {
	if t == nil {
		return time.Time{}
	}

	return *t
}