ms2k/quorate
SHA256
Watch
0
Code Releases Activity

ce7cb702218693d08ea6d83464d2457c9250027c

Browse source
This commit is contained in:
ms2k 2026-11-12 20:46:28 +09:00
commit 34c5f8963c
1 changed files with 145336 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

75
terraform/internal/zitadel/services.tf Normal file
View file

@ -0,0 +1,75 @@
resource "zitadel_project" "services" {
org_id = zitadel_org.primary.id
name = var.zitadel_project_name
project_role_assertion = true
project_role_check = true
has_project_check = false
private_labeling_setting = "PRIVATE_LABELING_SETTING_UNSPECIFIED"
}
resource "zitadel_action" "service_roles_claim" {
org_id = zitadel_org.primary.id
name = "service_roles_claim"
timeout = "10s"
allowed_to_fail = true
script = <<-EOT
function service_roles_claim(ctx, api) {
api.v1.claims.setClaim('zitadel_action_ran', 'true');
var grants = ctx.v1.user && ctx.v1.user.grants;
if (!grants || !grants.grants || grants.count == 0) {
api.v1.claims.setClaim('groups', []);
return;
}
var roles = [];
var serviceRoles = [
'forgejo_user',
'forgejo_admin',
'forgejo_restricted',
'grafana_viewer',
'grafana_editor',
'grafana_admin',
'frigate_viewer',
'frigate_admin',
'longhorn_admin',
'stalwart_admin'
];
grants.grants.forEach(function(grant) {
if (grant.roles && Array.isArray(grant.roles)) {
grant.roles.forEach(function(role) {
if (serviceRoles.indexOf(role) !== -1 && roles.indexOf(role) === -1) {
roles.push(role);
}
});
}
});
var hasForgejoRole = roles.some(function(role) {
return role.indexOf('forgejo_') === 0;
});
if (hasForgejoRole && roles.indexOf('forgejo_login') === -1) {
roles.push('forgejo_login');
}
api.v1.claims.setClaim('groups', roles);
}
EOT
depends_on = [zitadel_project_role.forgejo, zitadel_project_role.frigate, zitadel_project_role.grafana, zitadel_project_role.longhorn, zitadel_project_role.stalwart]
}
resource "zitadel_trigger_actions" "service_roles_claim_userinfo" {
org_id = zitadel_org.primary.id
flow_type = "FLOW_TYPE_CUSTOMISE_TOKEN"
trigger_type = "TRIGGER_TYPE_PRE_USERINFO_CREATION"
action_ids = [zitadel_action.service_roles_claim.id]
}
resource "zitadel_trigger_actions" "service_roles_claim_access_token" {
org_id = zitadel_org.primary.id
flow_type = "FLOW_TYPE_CUSTOMISE_TOKEN"
trigger_type = "TRIGGER_TYPE_PRE_ACCESS_TOKEN_CREATION"
action_ids = [zitadel_action.service_roles_claim.id]
}