git.iko.soy/typeable/oauth2-proxy
on remove-gap-headers help sign in
typeable/oauth2-proxy/pkg/header/injector.go
118 lines 3.5 kB history raw
1package header
3import (
4 "encoding/base64"
5 "fmt"
6 "net/http"
8 "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/apis/options"
9 "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/apis/options/util"
10 sessionsapi "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/apis/sessions"
13type Injector interface {
14 Inject(http.Header, *sessionsapi.SessionState)
17type injector struct {
18 valueInjectors []valueInjector
21func (i injector) Inject(header http.Header, session *sessionsapi.SessionState) {
22 for _, injector := range i.valueInjectors {
23 injector.inject(header, session)
24 }
27func NewInjector(headers []options.Header) (Injector, error) {
28 injectors := []valueInjector{}
29 for _, header := range headers {
30 for _, value := range header.Values {
31 injector, err := newValueinjector(header.Name, value)
32 if err != nil {
33 return nil, fmt.Errorf("error building injector for header %q: %v", header.Name, err)
34 }
35 injectors = append(injectors, injector)
36 }
37 }
39 return &injector{valueInjectors: injectors}, nil
42type valueInjector interface {
43 inject(http.Header, *sessionsapi.SessionState)
46func newValueinjector(name string, value options.HeaderValue) (valueInjector, error) {
47 switch {
48 case value.SecretSource != nil && value.ClaimSource == nil:
49 return newSecretInjector(name, value.SecretSource)
50 case value.SecretSource == nil && value.ClaimSource != nil:
51 return newClaimInjector(name, value.ClaimSource)
52 default:
53 return nil, fmt.Errorf("header %q value has multiple entries: only one entry per value is allowed", name)
54 }
57type injectorFunc struct {
58 injectFunc func(http.Header, *sessionsapi.SessionState)
61func (i *injectorFunc) inject(header http.Header, session *sessionsapi.SessionState) {
62 i.injectFunc(header, session)
65func newInjectorFunc(injectFunc func(header http.Header, session *sessionsapi.SessionState)) valueInjector {
66 return &injectorFunc{injectFunc: injectFunc}
69func newSecretInjector(name string, source *options.SecretSource) (valueInjector, error) {
70 value, err := util.GetSecretValue(source)
71 if err != nil {
72 return nil, fmt.Errorf("error getting secret value: %v", err)
73 }
75 return newInjectorFunc(func(header http.Header, session *sessionsapi.SessionState) {
76 header.Add(name, string(value))
77 }), nil
80func newClaimInjector(name string, source *options.ClaimSource) (valueInjector, error) {
81 switch {
82 case source.BasicAuthPassword != nil:
83 password, err := util.GetSecretValue(source.BasicAuthPassword)
84 if err != nil {
85 return nil, fmt.Errorf("error loading basicAuthPassword: %v", err)
86 }
87 return newInjectorFunc(func(header http.Header, session *sessionsapi.SessionState) {
88 claimValues := session.GetClaim(source.Claim)
89 for _, claim := range claimValues {
90 if claim == "" {
91 continue
92 }
93 auth := claim + ":" + string(password)
94 header.Add(name, "Basic "+base64.StdEncoding.EncodeToString([]byte(auth)))
95 }
96 }), nil
97 case source.Prefix != "":
98 return newInjectorFunc(func(header http.Header, session *sessionsapi.SessionState) {
99 claimValues := session.GetClaim(source.Claim)
100 for _, claim := range claimValues {
101 if claim == "" {
102 continue
103 }
104 header.Add(name, source.Prefix+claim)
105 }
106 }), nil
107 default:
108 return newInjectorFunc(func(header http.Header, session *sessionsapi.SessionState) {
109 claimValues := session.GetClaim(source.Claim)
110 for _, claim := range claimValues {
111 if claim == "" {
112 continue
113 }
114 header.Add(name, claim)
115 }
116 }), nil
117 }