1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
package openbaoctl
import (
"regexp"
"strings"
"github.com/johnandersen777/socialweb-computer-kcp/api/v1alpha1"
"github.com/johnandersen777/socialweb-computer-kcp/internal/baosync"
)
const AtprotoPluginAsset = "openbao-plugin-auth-atproto"
var accessorPlaceholder = regexp.MustCompile(`%accessor:([a-z0-9-]+)%`)
func AccessorPlaceholder(mount string) string { return "%accessor:" + strings.Trim(mount, "/") + "%" }
func renderAccessors(hcl string, accessors map[string]string) (string, []string) {
var missing []string
out := accessorPlaceholder.ReplaceAllStringFunc(hcl, func(m string) string {
mount := accessorPlaceholder.FindStringSubmatch(m)[1]
if a := accessors[mount]; a != "" {
return a
}
missing = append(missing, mount)
return m
})
return out, missing
}
func atprotoObjects(p placedPlugin) []baosync.Object {
a := p.spec.Atproto
if a == nil {
return nil
}
mount := strings.Trim(p.spec.MountPath, "/")
var out []baosync.Object
if c := a.Config; c.ClientID != "" {
data := map[string]any{"client_id": c.ClientID, "redirect_uris": c.RedirectURIs}
put(data, "client_name", c.ClientName)
put(data, "scope", c.Scope)
put(data, "plc_directory_url", c.PLCDirectoryURL)
put(data, "trusted_hosts", c.TrustedHosts)
o := baosync.Object{Path: "auth/" + mount + "/config", Data: data}
if c.TrustedCAPEM != "" {
data["trusted_ca_pem"] = c.TrustedCAPEM
o.WriteOnly = []string{"trusted_ca_pem"}
o.Derived = map[string]any{"trusted_ca_set": true}
}
out = append(out, o)
}
for _, r := range a.Roles {
data := map[string]any{"token_policies": r.Policies}
put(data, "bound_dids", r.BoundDIDs)
put(data, "bound_handles", r.BoundHandles)
put(data, "token_ttl", r.TokenTTL)
put(data, "token_max_ttl", r.TokenMaxTTL)
out = append(out, baosync.Object{Path: "auth/" + mount + "/role/" + r.Name, Data: data})
}
return out
}
func atprotoPlugin(p v1alpha1.OpenBaoPlugin) bool { return p.Asset.Name == AtprotoPluginAsset }
