feat: support string comparison for jwt-role-claim-key
This commit is contained in:
M. Taimoor Zaeem
committed by
Steve Chavez
Steve Chavez
parent
2df167637d
commit
af6b79d4d7
@@ -0,0 +1,39 @@
|
||||
db-aggregates-enabled = false
|
||||
db-anon-role = ""
|
||||
db-channel = "pgrst"
|
||||
db-channel-enabled = true
|
||||
db-extra-search-path = "public"
|
||||
db-hoisted-tx-settings = "statement_timeout,plan_filter.statement_cost_limit,default_transaction_isolation"
|
||||
db-max-rows = ""
|
||||
db-plan-enabled = false
|
||||
db-pool = 10
|
||||
db-pool-acquisition-timeout = 10
|
||||
db-pool-max-lifetime = 1800
|
||||
db-pool-max-idletime = 30
|
||||
db-pool-automatic-recovery = true
|
||||
db-pre-request = ""
|
||||
db-prepared-statements = true
|
||||
db-root-spec = ""
|
||||
db-schemas = "public"
|
||||
db-config = true
|
||||
db-pre-config = ""
|
||||
db-tx-end = "commit"
|
||||
db-uri = "postgresql://"
|
||||
jwt-aud = ""
|
||||
jwt-role-claim-key = ".\"roles\"[?(@ == \"role1\")]"
|
||||
jwt-secret = ""
|
||||
jwt-secret-is-base64 = false
|
||||
jwt-cache-max-lifetime = 0
|
||||
log-level = "error"
|
||||
openapi-mode = "follow-privileges"
|
||||
openapi-security-active = false
|
||||
openapi-server-proxy-uri = ""
|
||||
server-cors-allowed-origins = ""
|
||||
server-host = "!4"
|
||||
server-port = 3000
|
||||
server-trace-header = ""
|
||||
server-timing-enabled = false
|
||||
server-unix-socket = ""
|
||||
server-unix-socket-mode = "660"
|
||||
admin-server-host = "!4"
|
||||
admin-server-port = ""
|
||||
@@ -0,0 +1,39 @@
|
||||
db-aggregates-enabled = false
|
||||
db-anon-role = ""
|
||||
db-channel = "pgrst"
|
||||
db-channel-enabled = true
|
||||
db-extra-search-path = "public"
|
||||
db-hoisted-tx-settings = "statement_timeout,plan_filter.statement_cost_limit,default_transaction_isolation"
|
||||
db-max-rows = ""
|
||||
db-plan-enabled = false
|
||||
db-pool = 10
|
||||
db-pool-acquisition-timeout = 10
|
||||
db-pool-max-lifetime = 1800
|
||||
db-pool-max-idletime = 30
|
||||
db-pool-automatic-recovery = true
|
||||
db-pre-request = ""
|
||||
db-prepared-statements = true
|
||||
db-root-spec = ""
|
||||
db-schemas = "public"
|
||||
db-config = true
|
||||
db-pre-config = ""
|
||||
db-tx-end = "commit"
|
||||
db-uri = "postgresql://"
|
||||
jwt-aud = ""
|
||||
jwt-role-claim-key = ".\"roles\"[?(@ != \"role1\")]"
|
||||
jwt-secret = ""
|
||||
jwt-secret-is-base64 = false
|
||||
jwt-cache-max-lifetime = 0
|
||||
log-level = "error"
|
||||
openapi-mode = "follow-privileges"
|
||||
openapi-security-active = false
|
||||
openapi-server-proxy-uri = ""
|
||||
server-cors-allowed-origins = ""
|
||||
server-host = "!4"
|
||||
server-port = 3000
|
||||
server-trace-header = ""
|
||||
server-timing-enabled = false
|
||||
server-unix-socket = ""
|
||||
server-unix-socket-mode = "660"
|
||||
admin-server-host = "!4"
|
||||
admin-server-port = ""
|
||||
@@ -0,0 +1,39 @@
|
||||
db-aggregates-enabled = false
|
||||
db-anon-role = ""
|
||||
db-channel = "pgrst"
|
||||
db-channel-enabled = true
|
||||
db-extra-search-path = "public"
|
||||
db-hoisted-tx-settings = "statement_timeout,plan_filter.statement_cost_limit,default_transaction_isolation"
|
||||
db-max-rows = ""
|
||||
db-plan-enabled = false
|
||||
db-pool = 10
|
||||
db-pool-acquisition-timeout = 10
|
||||
db-pool-max-lifetime = 1800
|
||||
db-pool-max-idletime = 30
|
||||
db-pool-automatic-recovery = true
|
||||
db-pre-request = ""
|
||||
db-prepared-statements = true
|
||||
db-root-spec = ""
|
||||
db-schemas = "public"
|
||||
db-config = true
|
||||
db-pre-config = ""
|
||||
db-tx-end = "commit"
|
||||
db-uri = "postgresql://"
|
||||
jwt-aud = ""
|
||||
jwt-role-claim-key = ".\"roles\"[?(@ ^== \"role1\")]"
|
||||
jwt-secret = ""
|
||||
jwt-secret-is-base64 = false
|
||||
jwt-cache-max-lifetime = 0
|
||||
log-level = "error"
|
||||
openapi-mode = "follow-privileges"
|
||||
openapi-security-active = false
|
||||
openapi-server-proxy-uri = ""
|
||||
server-cors-allowed-origins = ""
|
||||
server-host = "!4"
|
||||
server-port = 3000
|
||||
server-trace-header = ""
|
||||
server-timing-enabled = false
|
||||
server-unix-socket = ""
|
||||
server-unix-socket-mode = "660"
|
||||
admin-server-host = "!4"
|
||||
admin-server-port = ""
|
||||
@@ -0,0 +1,39 @@
|
||||
db-aggregates-enabled = false
|
||||
db-anon-role = ""
|
||||
db-channel = "pgrst"
|
||||
db-channel-enabled = true
|
||||
db-extra-search-path = "public"
|
||||
db-hoisted-tx-settings = "statement_timeout,plan_filter.statement_cost_limit,default_transaction_isolation"
|
||||
db-max-rows = ""
|
||||
db-plan-enabled = false
|
||||
db-pool = 10
|
||||
db-pool-acquisition-timeout = 10
|
||||
db-pool-max-lifetime = 1800
|
||||
db-pool-max-idletime = 30
|
||||
db-pool-automatic-recovery = true
|
||||
db-pre-request = ""
|
||||
db-prepared-statements = true
|
||||
db-root-spec = ""
|
||||
db-schemas = "public"
|
||||
db-config = true
|
||||
db-pre-config = ""
|
||||
db-tx-end = "commit"
|
||||
db-uri = "postgresql://"
|
||||
jwt-aud = ""
|
||||
jwt-role-claim-key = ".\"roles\"[?(@ ==^ \"role1\")]"
|
||||
jwt-secret = ""
|
||||
jwt-secret-is-base64 = false
|
||||
jwt-cache-max-lifetime = 0
|
||||
log-level = "error"
|
||||
openapi-mode = "follow-privileges"
|
||||
openapi-security-active = false
|
||||
openapi-server-proxy-uri = ""
|
||||
server-cors-allowed-origins = ""
|
||||
server-host = "!4"
|
||||
server-port = 3000
|
||||
server-trace-header = ""
|
||||
server-timing-enabled = false
|
||||
server-unix-socket = ""
|
||||
server-unix-socket-mode = "660"
|
||||
admin-server-host = "!4"
|
||||
admin-server-port = ""
|
||||
@@ -0,0 +1,39 @@
|
||||
db-aggregates-enabled = false
|
||||
db-anon-role = ""
|
||||
db-channel = "pgrst"
|
||||
db-channel-enabled = true
|
||||
db-extra-search-path = "public"
|
||||
db-hoisted-tx-settings = "statement_timeout,plan_filter.statement_cost_limit,default_transaction_isolation"
|
||||
db-max-rows = ""
|
||||
db-plan-enabled = false
|
||||
db-pool = 10
|
||||
db-pool-acquisition-timeout = 10
|
||||
db-pool-max-lifetime = 1800
|
||||
db-pool-max-idletime = 30
|
||||
db-pool-automatic-recovery = true
|
||||
db-pre-request = ""
|
||||
db-prepared-statements = true
|
||||
db-root-spec = ""
|
||||
db-schemas = "public"
|
||||
db-config = true
|
||||
db-pre-config = ""
|
||||
db-tx-end = "commit"
|
||||
db-uri = "postgresql://"
|
||||
jwt-aud = ""
|
||||
jwt-role-claim-key = ".\"roles\"[?(@ *== \"role1\")]"
|
||||
jwt-secret = ""
|
||||
jwt-secret-is-base64 = false
|
||||
jwt-cache-max-lifetime = 0
|
||||
log-level = "error"
|
||||
openapi-mode = "follow-privileges"
|
||||
openapi-security-active = false
|
||||
openapi-server-proxy-uri = ""
|
||||
server-cors-allowed-origins = ""
|
||||
server-host = "!4"
|
||||
server-port = 3000
|
||||
server-trace-header = ""
|
||||
server-timing-enabled = false
|
||||
server-unix-socket = ""
|
||||
server-unix-socket-mode = "660"
|
||||
admin-server-host = "!4"
|
||||
admin-server-port = ""
|
||||
@@ -0,0 +1 @@
|
||||
jwt-role-claim-key = ".roles[?(@ == \"role1\")]"
|
||||
@@ -0,0 +1 @@
|
||||
jwt-role-claim-key = ".roles[?(@ != \"role1\")]"
|
||||
@@ -0,0 +1 @@
|
||||
jwt-role-claim-key = ".roles[?(@ ^== \"role1\")]"
|
||||
@@ -0,0 +1 @@
|
||||
jwt-role-claim-key = ".roles[?(@ ==^ \"role1\")]"
|
||||
@@ -0,0 +1 @@
|
||||
jwt-role-claim-key = ".roles[?(@ *== \"role1\")]"
|
||||
@@ -153,6 +153,48 @@ roleclaims:
|
||||
role: postgrest_test_author
|
||||
other: true
|
||||
expected_status: 401
|
||||
# https://github.com/PostgREST/postgrest/pull/3813
|
||||
- key: '.realm_access.roles[?(@ == "postgrest_test_author")]'
|
||||
data:
|
||||
realm_access:
|
||||
roles:
|
||||
- other
|
||||
- postgrest_test_author
|
||||
expected_status: 200
|
||||
- key: '.realm_access.roles[?(@ != "other")]'
|
||||
data:
|
||||
realm_access:
|
||||
roles:
|
||||
- other
|
||||
- postgrest_test_author
|
||||
expected_status: 200
|
||||
- key: '.realm_access.roles[?(@ ^== "postgrest_te")]'
|
||||
data:
|
||||
realm_access:
|
||||
roles:
|
||||
- other
|
||||
- postgrest_test_author
|
||||
expected_status: 200
|
||||
- key: '.realm_access.roles[?(@ ==^ "st_test_author")]'
|
||||
data:
|
||||
realm_access:
|
||||
roles:
|
||||
- other
|
||||
- postgrest_test_author
|
||||
expected_status: 200
|
||||
- key: '.realm_access.roles[?(@ *== "_test_")]'
|
||||
data:
|
||||
realm_access:
|
||||
roles:
|
||||
- other
|
||||
- postgrest_test_author
|
||||
expected_status: 200
|
||||
- key: '.realm_access.roles[?(@ == "string")]'
|
||||
data:
|
||||
realm_access:
|
||||
roles:
|
||||
- obj_key: obj_value
|
||||
expected_status: 401 # fails because it compares an object with a string
|
||||
|
||||
invalidroleclaimkeys:
|
||||
- 'role.other'
|
||||
@@ -160,6 +202,7 @@ invalidroleclaimkeys:
|
||||
- '.my_role;;domain'
|
||||
- '.#$$%&$%/'
|
||||
- '1234'
|
||||
- '.role[?(@ =)]'
|
||||
|
||||
invalidopenapimodes:
|
||||
- 'follow-'
|
||||
|
||||
Reference in New Issue
Block a user