Packages
ash_authentication
5.0.0-rc.4
5.0.0-rc.12
5.0.0-rc.11
5.0.0-rc.10
5.0.0-rc.9
5.0.0-rc.8
5.0.0-rc.7
5.0.0-rc.6
5.0.0-rc.5
5.0.0-rc.4
5.0.0-rc.3
5.0.0-rc.2
5.0.0-rc.1
5.0.0-rc.0
4.14.1
4.14.0
4.13.7
4.13.6
4.13.5
4.13.4
4.13.3
4.13.2
retired
4.13.1
retired
4.13.0
4.12.0
4.11.0
4.10.0
4.9.9
4.9.8
4.9.7
4.9.6
4.9.5
4.9.4
4.9.3
4.9.2
4.9.1
4.9.0
4.8.7
4.8.6
4.8.5
4.8.3
4.8.2
4.8.1
4.8.0
4.7.6
4.7.5
4.7.4
4.7.3
4.7.2
4.7.1
4.7.0
4.6.4
4.6.3
4.6.2
4.6.1
4.6.0
4.5.6
4.5.5
4.5.4
4.5.3
4.5.2
4.5.1
4.5.0
4.4.9
4.4.8
4.4.7
4.4.6
4.4.5
4.4.4
4.4.3
4.4.2
4.4.1
4.4.0
4.3.12
4.3.11
4.3.10
4.3.9
4.3.8
4.3.7
4.3.6
4.3.5
4.3.4
4.3.3
4.3.2
4.3.1
4.3.0
4.2.7
4.2.6
4.2.5
4.2.4
4.2.3
4.2.2
4.2.1
4.2.0
4.1.0
4.0.4
4.0.3
4.0.2
4.0.1
4.0.0
4.0.0-rc.6
4.0.0-rc.5
4.0.0-rc.3
4.0.0-rc.2
4.0.0-rc.1
4.0.0-rc.0
3.12.4
3.12.3
3.12.2
3.12.1
3.12.0
3.11.16
3.11.15
3.11.14
3.11.13
3.11.12
3.11.11
3.11.10
3.11.9
3.11.8
3.11.7
3.11.6
3.11.5
3.11.4
3.11.3
3.11.2
3.11.1
3.11.0
3.10.8
3.10.7
3.10.6
3.10.5
3.10.4
3.10.3
3.10.2
3.10.1
3.10.0
3.9.6
3.9.5
3.9.4
3.9.3
3.9.2
3.9.1
3.9.0
3.8.0
3.7.9
3.7.8
3.7.6
3.7.5
3.7.4
3.7.3
3.7.2
3.7.1
3.7.0
3.6.1
3.6.0
3.5.3
3.5.2
3.5.1
3.5.0
3.3.1
3.3.0
3.2.2
3.2.1
3.2.0
3.1.0
3.0.3
Authentication extension for the Ash Framework.
Security advisory:
This version has known vulnerabilities.
View advisories
Current section
Files
Jump to
Current section
Files
lib/ash_authentication/secret.ex
# SPDX-FileCopyrightText: 2022 Alembic Pty Ltd
#
# SPDX-License-Identifier: MIT
defmodule AshAuthentication.Secret do
@moduledoc """
A module to implement retrieving of secrets.
Allows you to implement secrets access via your method or choice at runtime.
The context parameter is either a map with the `conn` key containing the Plug.Conn
if the secret is being retrieved in a plug, or the context of the ash action it is
called in
## Example
```elixir
defmodule MyApp.GetSecret do
use AshAuthentication.Secret
def secret_for([:authentication, :strategies, :oauth2, :client_id], MyApp.User, _opts, _context), do: Application.fetch_env(:my_app, :oauth_client_id)
end
defmodule MyApp.Accounts.User do
use Ash.Resource,
extensions: [AshAuthentication],
domain: MyApp.Accounts
authentication do
strategies do
oauth2 do
client_id MyApp.GetSecret
client_secret MyApp.GetSecret
end
end
end
end
```
You can also implement it directly as a function:
```elixir
defmodule MyApp.User do
use Ash.Resource,
extensions: [AshAuthentication],
domain: MyApp.Accounts
authentication do
strategies do
oauth2 do
client_id fn _secret, _resource ->
Application.fetch_env(:my_app, :oauth_client_id)
end
end
end
end
end
```
## Secret name
Because you may wish to reuse this module for a number of different providers
and resources, the first argument passed to the callback is the "secret name",
it contains the "path" to the option being set. The path is made up of a list
containing the DSL path to the secret.
"""
alias Ash.Resource
alias AshAuthentication.Errors.InvalidSecret
@doc deprecated: "Use AshAuthentication.Secret.secret_for/4 instead"
@callback secret_for(secret_name :: [atom], Resource.t(), keyword) :: {:ok, String.t()} | :error
@doc """
Secret retrieval callback.
This function will be called with the "secret name", see the module
documentation for more info.
The context paramter is either a map with the `conn` key containing the Plug.Conn
if the secret is being retrieved in a plug, or the context of the ash action it is
called in
"""
@callback secret_for(secret_name :: [atom], Resource.t(), keyword, context :: map()) ::
{:ok, String.t()} | :error
@optional_callbacks secret_for: 3,
secret_for: 4
@doc false
@spec __using__(any) :: Macro.t()
defmacro __using__(_) do
quote do
@behaviour AshAuthentication.Secret
@before_compile AshAuthentication.Secret
@after_verify AshAuthentication.Secret
end
end
@doc false
defmacro __before_compile__(_) do
quote do
if Module.defines?(__MODULE__, {:secret_for, 4}, :def) do
def __secret_for_arity__, do: 4
else
def __secret_for_arity__, do: 3
end
end
end
@doc false
def __after_verify__(module) do
Code.ensure_loaded!(module)
if function_exported?(module, :secret_for, 3) and
function_exported?(module, :secret_for, 4) do
raise "#{inspect(module)}: You should only implement `secret_for/3` or `secret_for/4`, not both."
end
if not function_exported?(module, :secret_for, 3) and
not function_exported?(module, :secret_for, 4) do
raise "#{inspect(module)}: You must implement either `secret_for/3` or `secret_for/4`."
end
if function_exported?(module, :secret_for, 3) do
IO.warn(
"#{inspect(module)}: The `secret_for/3` callback is deprecated, please implement `secret_for/4` instead."
)
end
end
@doc false
def secret_for(module, secret_name, resource, opts, context) do
result =
if module.__secret_for_arity__() == 4 do
module.secret_for(secret_name, resource, opts, context)
else
module.secret_for(secret_name, resource, opts)
end
case result do
{:ok, secret} ->
{:ok, secret}
:error ->
:error
other ->
path = secret_name
raise InvalidSecret.exception(
path: path,
resource: resource,
value: other
)
end
end
end