75 lines
2.4 KiB
HCL
75 lines
2.4 KiB
HCL
resource "zitadel_project" "services" {
|
|
org_id = zitadel_org.primary.id
|
|
name = var.zitadel_project_name
|
|
project_role_assertion = true
|
|
project_role_check = true
|
|
has_project_check = false
|
|
private_labeling_setting = "PRIVATE_LABELING_SETTING_UNSPECIFIED"
|
|
}
|
|
|
|
resource "zitadel_action" "service_roles_claim" {
|
|
org_id = zitadel_org.primary.id
|
|
name = "service_roles_claim"
|
|
timeout = "10s"
|
|
allowed_to_fail = true
|
|
|
|
script = <<-EOT
|
|
function service_roles_claim(ctx, api) {
|
|
api.v1.claims.setClaim('zitadel_action_ran', 'true');
|
|
|
|
var grants = ctx.v1.user && ctx.v1.user.grants;
|
|
if (!grants || !grants.grants || grants.count == 0) {
|
|
api.v1.claims.setClaim('groups', []);
|
|
return;
|
|
}
|
|
|
|
var roles = [];
|
|
var serviceRoles = [
|
|
'forgejo_user',
|
|
'forgejo_admin',
|
|
'forgejo_restricted',
|
|
'grafana_viewer',
|
|
'grafana_editor',
|
|
'grafana_admin',
|
|
'frigate_viewer',
|
|
'frigate_admin',
|
|
'longhorn_admin',
|
|
'stalwart_admin'
|
|
];
|
|
grants.grants.forEach(function(grant) {
|
|
if (grant.roles && Array.isArray(grant.roles)) {
|
|
grant.roles.forEach(function(role) {
|
|
if (serviceRoles.indexOf(role) !== -1 && roles.indexOf(role) === -1) {
|
|
roles.push(role);
|
|
}
|
|
});
|
|
}
|
|
});
|
|
|
|
var hasForgejoRole = roles.some(function(role) {
|
|
return role.indexOf('forgejo_') === 0;
|
|
});
|
|
if (hasForgejoRole && roles.indexOf('forgejo_login') === -1) {
|
|
roles.push('forgejo_login');
|
|
}
|
|
|
|
api.v1.claims.setClaim('groups', roles);
|
|
}
|
|
EOT
|
|
|
|
depends_on = [zitadel_project_role.forgejo, zitadel_project_role.frigate, zitadel_project_role.grafana, zitadel_project_role.longhorn, zitadel_project_role.stalwart]
|
|
}
|
|
|
|
resource "zitadel_trigger_actions" "service_roles_claim_userinfo" {
|
|
org_id = zitadel_org.primary.id
|
|
flow_type = "FLOW_TYPE_CUSTOMISE_TOKEN"
|
|
trigger_type = "TRIGGER_TYPE_PRE_USERINFO_CREATION"
|
|
action_ids = [zitadel_action.service_roles_claim.id]
|
|
}
|
|
|
|
resource "zitadel_trigger_actions" "service_roles_claim_access_token" {
|
|
org_id = zitadel_org.primary.id
|
|
flow_type = "FLOW_TYPE_CUSTOMISE_TOKEN"
|
|
trigger_type = "TRIGGER_TYPE_PRE_ACCESS_TOKEN_CREATION"
|
|
action_ids = [zitadel_action.service_roles_claim.id]
|
|
}
|