mapper

type CELMapper ¶

type CELMapper struct {
	// contains filtered or unexported fields
}

CELMapper is a ClaimMapper that uses CEL (Common Expression Language) expressions to produce claims from the MapperInput.

The CEL expression has access to the following variables and functions:

• datasource(name) - function to fetch data from a named data source
• now_ms() - current Unix time in milliseconds
• fail(message) - reject as an internal/mapping failure (no OAuth error)
• Layer A OAuth aborts: invalidRequest, invalidTarget, invalidGrant, …
• Layer B reason helpers: invalidSubject, invalidActor, invalidAudience, unsupportedTokenType
• subject - the subject identity information as a map
• actor - the actor identity information as a map
• request - the request attributes as a map

The expression should evaluate to a map that will be used as the claims, call a Layer A/B abort helper (Deny decision, err nil), or call fail() for an unexpected mapping/system failure (error).

Example CEL expressions:

// Simple claim from subject
{"user": subject.subject}

// Fetch from data source
{"roles": datasource("user_roles").roles}

// Policy guard (Layer B) then map
!has(subject.claims.idp)
  ? invalidSubject("claim 'idp' is required")
  : {"user": subject.subject}

// Reject unrecognised input (Layer B → invalid_request)
condition ? {"user": subject.subject} : unsupportedTokenType("unsupported_token_type")

// Complex expressions
{
  "user": subject.subject,
  "ip": request.ip_address,
  "roles": datasource("user_roles").roles,
  "region": datasource("geo").region
}

func NewCELMapper(script string, opts ...CELMapperOption) (*CELMapper, error)

func (m *CELMapper) Map(ctx context.Context, input *service.MapperInput) (service.MappingResult, error)

func (m *CELMapper) Script() string

type CELMapperOption ¶

type CELMapperOption func(*celMapperConfig)

CELMapperOption configures a CELMapper.

func WithClock(clk clock.Clock) CELMapperOption