92 lines
2.8 KiB
Python
92 lines
2.8 KiB
Python
import uuid
|
|
from datetime import datetime
|
|
from typing import Optional
|
|
|
|
from pydantic import BaseModel, ConfigDict, Field, field_validator
|
|
|
|
|
|
class IdentityProviderBase(BaseModel):
|
|
name: str = Field(..., min_length=2, max_length=150)
|
|
slug: str = Field(..., min_length=2, max_length=100, pattern=r"^[a-z0-9-]+$")
|
|
issuer: Optional[str] = Field(None, max_length=500)
|
|
client_id: Optional[str] = Field(None, max_length=255)
|
|
scopes: str = "openid email profile"
|
|
allowed_domains: Optional[str] = None
|
|
jit_provisioning: bool = True
|
|
default_role_id: Optional[uuid.UUID] = None
|
|
link_existing_by_email: bool = False
|
|
enabled: bool = False
|
|
|
|
@field_validator("issuer")
|
|
@classmethod
|
|
def issuer_must_be_https(cls, value: Optional[str]) -> Optional[str]:
|
|
if value and not value.startswith("https://"):
|
|
raise ValueError("issuer must be an https URL")
|
|
return value.rstrip("/") if value else value
|
|
|
|
|
|
class IdentityProviderCreate(IdentityProviderBase):
|
|
client_secret: Optional[str] = None
|
|
|
|
|
|
class IdentityProviderUpdate(BaseModel):
|
|
model_config = ConfigDict(extra="forbid")
|
|
|
|
name: Optional[str] = Field(None, min_length=2, max_length=150)
|
|
issuer: Optional[str] = Field(None, max_length=500)
|
|
client_id: Optional[str] = Field(None, max_length=255)
|
|
client_secret: Optional[str] = None
|
|
scopes: Optional[str] = None
|
|
allowed_domains: Optional[str] = None
|
|
jit_provisioning: Optional[bool] = None
|
|
default_role_id: Optional[uuid.UUID] = None
|
|
link_existing_by_email: Optional[bool] = None
|
|
enabled: Optional[bool] = None
|
|
|
|
|
|
class IdentityProviderResponse(BaseModel):
|
|
"""Deliberately has no `client_secret`.
|
|
|
|
A secret that can be read back is a secret in every log of every response,
|
|
every browser cache and every screen-share. `client_secret_set` says whether
|
|
one exists, which is all a configuration screen needs.
|
|
"""
|
|
|
|
model_config = ConfigDict(from_attributes=True)
|
|
|
|
id: uuid.UUID
|
|
tenant_id: uuid.UUID
|
|
kind: str
|
|
name: str
|
|
slug: str
|
|
enabled: bool
|
|
issuer: Optional[str] = None
|
|
client_id: Optional[str] = None
|
|
scopes: str
|
|
allowed_domains: Optional[str] = None
|
|
jit_provisioning: bool
|
|
default_role_id: Optional[uuid.UUID] = None
|
|
link_existing_by_email: bool
|
|
authorization_endpoint: Optional[str] = None
|
|
token_endpoint: Optional[str] = None
|
|
jwks_uri: Optional[str] = None
|
|
discovered_at: Optional[datetime] = None
|
|
created_at: datetime
|
|
|
|
client_secret_set: bool = False
|
|
|
|
|
|
class PublicProvider(BaseModel):
|
|
"""What an unauthenticated login page may know.
|
|
|
|
Enough to render "Sign in with Contoso" and nothing else — a signed-out
|
|
visitor should not be able to read a workspace's client id or its issuer.
|
|
"""
|
|
|
|
slug: str
|
|
name: str
|
|
|
|
|
|
class SsoLoginResponse(BaseModel):
|
|
authorization_url: str
|