|
| 1 | +//! Audience format detection and validation for cloud providers. |
| 2 | +
|
| 3 | +use crate::error::BridgeError; |
| 4 | + |
| 5 | +/// Detected cloud provider based on audience format. |
| 6 | +#[derive(Debug, Clone, Copy, PartialEq, Eq)] |
| 7 | +pub enum AudienceKind { |
| 8 | + /// AWS STS (e.g. `sts.amazonaws.com`). |
| 9 | + Aws, |
| 10 | + /// GCP Workload Identity Federation. |
| 11 | + Gcp, |
| 12 | + /// Azure AD / Entra ID. |
| 13 | + Azure, |
| 14 | + /// Unknown or custom audience. |
| 15 | + Custom, |
| 16 | +} |
| 17 | + |
| 18 | +impl AudienceKind { |
| 19 | + /// Returns the provider name as a string, or `None` for `Custom`. |
| 20 | + pub fn provider_name(self) -> Option<&'static str> { |
| 21 | + match self { |
| 22 | + Self::Aws => Some("aws"), |
| 23 | + Self::Gcp => Some("gcp"), |
| 24 | + Self::Azure => Some("azure"), |
| 25 | + Self::Custom => None, |
| 26 | + } |
| 27 | + } |
| 28 | +} |
| 29 | + |
| 30 | +/// Controls how audience format mismatches are handled. |
| 31 | +#[derive(Debug, Clone, Copy, PartialEq, Eq, Default)] |
| 32 | +pub enum AudienceValidation { |
| 33 | + /// Log warnings on format mismatch but allow the request (default). |
| 34 | + #[default] |
| 35 | + Warn, |
| 36 | + /// Reject requests with audience format mismatches. |
| 37 | + Strict, |
| 38 | + /// Skip audience format validation entirely. |
| 39 | + None, |
| 40 | +} |
| 41 | + |
| 42 | +impl AudienceValidation { |
| 43 | + /// Parse from a string value (for env var parsing). |
| 44 | + pub fn from_str_value(s: &str) -> Option<Self> { |
| 45 | + match s.to_lowercase().as_str() { |
| 46 | + "warn" => Some(Self::Warn), |
| 47 | + "strict" => Some(Self::Strict), |
| 48 | + "none" => Some(Self::None), |
| 49 | + _ => Option::None, |
| 50 | + } |
| 51 | + } |
| 52 | +} |
| 53 | + |
| 54 | +/// Detect the cloud provider from the audience string and validate the format. |
| 55 | +/// |
| 56 | +/// Returns the detected `AudienceKind`. In `Strict` mode, returns an error |
| 57 | +/// for format mismatches. In `Warn` mode, logs warnings. In `None` mode, |
| 58 | +/// skips all validation. |
| 59 | +pub fn validate_audience_format( |
| 60 | + audience: &str, |
| 61 | + mode: &AudienceValidation, |
| 62 | +) -> Result<AudienceKind, BridgeError> { |
| 63 | + let kind = detect_audience_kind(audience); |
| 64 | + |
| 65 | + if *mode == AudienceValidation::None { |
| 66 | + return Ok(kind); |
| 67 | + } |
| 68 | + |
| 69 | + // Check for GCP format mismatches |
| 70 | + if kind == AudienceKind::Gcp && !is_valid_gcp_audience(audience) { |
| 71 | + let msg = format!( |
| 72 | + "GCP audience format mismatch: expected \ |
| 73 | + https://iam.googleapis.com/projects/{{NUMBER}}/locations/global/\ |
| 74 | + workloadIdentityPools/{{POOL}}/providers/{{PROVIDER}}, got: {audience}" |
| 75 | + ); |
| 76 | + match mode { |
| 77 | + AudienceValidation::Strict => { |
| 78 | + return Err(BridgeError::InvalidRequest(msg)); |
| 79 | + } |
| 80 | + AudienceValidation::Warn => { |
| 81 | + tracing::warn!("{msg}"); |
| 82 | + } |
| 83 | + AudienceValidation::None => unreachable!(), |
| 84 | + } |
| 85 | + } |
| 86 | + |
| 87 | + tracing::info!(audience = audience, kind = ?kind, "audience format detected"); |
| 88 | + Ok(kind) |
| 89 | +} |
| 90 | + |
| 91 | +/// Detect the audience kind from the audience string. |
| 92 | +pub fn detect_audience_kind(audience: &str) -> AudienceKind { |
| 93 | + if audience.contains("amazonaws.com") { |
| 94 | + AudienceKind::Aws |
| 95 | + } else if audience.starts_with("https://iam.googleapis.com/") { |
| 96 | + AudienceKind::Gcp |
| 97 | + } else if audience.starts_with("api://") || looks_like_guid(audience) { |
| 98 | + AudienceKind::Azure |
| 99 | + } else { |
| 100 | + AudienceKind::Custom |
| 101 | + } |
| 102 | +} |
| 103 | + |
| 104 | +/// Check if a GCP audience matches the expected Workload Identity Federation format. |
| 105 | +/// |
| 106 | +/// Expected: `https://iam.googleapis.com/projects/{NUMBER}/locations/global/workloadIdentityPools/{POOL}/providers/{PROVIDER}` |
| 107 | +fn is_valid_gcp_audience(audience: &str) -> bool { |
| 108 | + let Some(rest) = audience.strip_prefix("https://iam.googleapis.com/projects/") else { |
| 109 | + return false; |
| 110 | + }; |
| 111 | + |
| 112 | + // Expected: {NUMBER}/locations/global/workloadIdentityPools/{POOL}/providers/{PROVIDER} |
| 113 | + let parts: Vec<&str> = rest |
| 114 | + .splitn(2, "/locations/global/workloadIdentityPools/") |
| 115 | + .collect(); |
| 116 | + if parts.len() != 2 { |
| 117 | + return false; |
| 118 | + } |
| 119 | + |
| 120 | + let project_number = parts[0]; |
| 121 | + if project_number.is_empty() || !project_number.chars().all(|c| c.is_ascii_digit()) { |
| 122 | + return false; |
| 123 | + } |
| 124 | + |
| 125 | + // Expected: {POOL}/providers/{PROVIDER} |
| 126 | + let provider_parts: Vec<&str> = parts[1].splitn(2, "/providers/").collect(); |
| 127 | + if provider_parts.len() != 2 { |
| 128 | + return false; |
| 129 | + } |
| 130 | + |
| 131 | + let pool_id = provider_parts[0]; |
| 132 | + let provider_id = provider_parts[1]; |
| 133 | + |
| 134 | + !pool_id.is_empty() && !provider_id.is_empty() |
| 135 | +} |
| 136 | + |
| 137 | +/// Check if a string looks like a GUID (8-4-4-4-12 hex digits). |
| 138 | +fn looks_like_guid(s: &str) -> bool { |
| 139 | + let parts: Vec<&str> = s.split('-').collect(); |
| 140 | + parts.len() == 5 |
| 141 | + && parts[0].len() == 8 |
| 142 | + && parts[1].len() == 4 |
| 143 | + && parts[2].len() == 4 |
| 144 | + && parts[3].len() == 4 |
| 145 | + && parts[4].len() == 12 |
| 146 | + && parts |
| 147 | + .iter() |
| 148 | + .all(|p| p.chars().all(|c| c.is_ascii_hexdigit())) |
| 149 | +} |
0 commit comments