Skip to content

Commit a3c93a2

Browse files
mativm02mativm02
committed
Merge branch 'master' of github.com:TykTechnologies/tyk into TT-15507
2 parents 3c572f1 + dbabb5f commit a3c93a2

14 files changed

+1147
-73
lines changed

‎apidef/oas/authentication.go

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -484,6 +484,11 @@ type Scopes struct {
484484
// - For JWT: `scopes.jwt.scope_claim_name`
485485
ClaimName string `bson:"claimName,omitempty" json:"claimName,omitempty"`
486486

487+
// Claims contains a list of claims that contains the claim name.
488+
// The first match from the list of claims in the token is used.
489+
// OAS only field applied to OAS apis.
490+
Claims []string `bson:"claims,omitempty" json:"claims,omitempty"`
491+
487492
// ScopeToPolicyMapping contains the mappings of scopes to policy IDs.
488493
//
489494
// Tyk classic API definition:
@@ -495,6 +500,9 @@ type Scopes struct {
495500
// Fill fills *Scopes from *apidef.ScopeClaim.
496501
func (s *Scopes) Fill(scopeClaim *apidef.ScopeClaim) {
497502
s.ClaimName = scopeClaim.ScopeClaimName
503+
if s.ClaimName != "" {
504+
s.Claims = []string{scopeClaim.ScopeClaimName}
505+
}
498506

499507
s.ScopeToPolicyMapping = []ScopeToPolicy{}
500508

‎apidef/oas/authentication_test.go

Lines changed: 32 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -22,15 +22,41 @@ func TestAuthentication(t *testing.T) {
2222
}
2323

2424
func TestScopes(t *testing.T) {
25-
var emptyScopes Scopes
25+
t.Run("default", func(t *testing.T) {
26+
var emptyScopes Scopes
2627

27-
scopeClaim := apidef.ScopeClaim{}
28-
emptyScopes.ExtractTo(&scopeClaim)
28+
scopeClaim := apidef.ScopeClaim{}
29+
emptyScopes.ExtractTo(&scopeClaim)
2930

30-
var resultScopes Scopes
31-
resultScopes.Fill(&scopeClaim)
31+
var resultScopes Scopes
32+
resultScopes.Fill(&scopeClaim)
33+
34+
assert.Equal(t, emptyScopes, resultScopes)
35+
})
36+
t.Run("fill scope claim", func(t *testing.T) {
37+
var emptyScopes Scopes
38+
39+
scopeClaim := apidef.ScopeClaim{
40+
ScopeClaimName: "test",
41+
}
42+
43+
emptyScopes.Fill(&scopeClaim)
44+
45+
assert.Equal(t, emptyScopes.Claims, []string{scopeClaim.ScopeClaimName})
46+
})
47+
48+
t.Run("extract scope claim", func(t *testing.T) {
49+
var emptydefScopeClaim apidef.ScopeClaim
50+
51+
scope := Scopes{
52+
Claims: []string{"test", "second"},
53+
ClaimName: "test",
54+
}
55+
56+
scope.ExtractTo(&emptydefScopeClaim)
57+
assert.Equal(t, emptydefScopeClaim.ScopeClaimName, "test")
58+
})
3259

33-
assert.Equal(t, emptyScopes, resultScopes)
3460
}
3561

3662
func TestAuthSources(t *testing.T) {

‎apidef/oas/default.go

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,7 @@ import (
66
"net/http"
77
"net/url"
88
"reflect"
9+
"slices"
910
"strconv"
1011
"strings"
1112

@@ -220,22 +221,42 @@ func (s *OAS) importMiddlewares(overRideValues TykExtensionConfigParams) {
220221
xTykAPIGateway.Middleware = &Middleware{}
221222
}
222223

224+
currentOperations := make([]string, 0)
225+
223226
for path, pathItem := range s.Paths.Map() {
224227
overRideValues.pathItemHasParameters = len(pathItem.Parameters) > 0
225228
for _, method := range allowedMethods {
226229
if operation := pathItem.GetOperation(method); operation != nil {
227230
tykOperation := s.getTykOperation(method, path)
228231
tykOperation.Import(operation, overRideValues)
232+
currentOperations = append(currentOperations, s.getOperationID(path, method))
229233
s.deleteTykOperationIfEmpty(tykOperation, method, path)
230234
}
231235
}
232236
}
233237

238+
s.removeObsoleteOperations(currentOperations)
239+
234240
if ShouldOmit(xTykAPIGateway.Middleware) {
235241
xTykAPIGateway.Middleware = nil
236242
}
237243
}
238244

245+
func (s *OAS) removeObsoleteOperations(currentOperations []string) {
246+
tykOperations := s.getTykOperations()
247+
obsoleteOperations := make([]string, 0)
248+
249+
for id := range tykOperations {
250+
if !slices.Contains(currentOperations, id) {
251+
obsoleteOperations = append(obsoleteOperations, id)
252+
}
253+
}
254+
255+
for _, operationID := range obsoleteOperations {
256+
delete(tykOperations, operationID)
257+
}
258+
}
259+
239260
func (s *OAS) getTykOperation(method, path string) *Operation {
240261
xTykAPIGateway := s.GetTykExtension()
241262
operationID := s.getOperationID(path, method)

‎apidef/oas/default_test.go

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -563,6 +563,34 @@ func TestOAS_BuildDefaultTykExtension(t *testing.T) {
563563
return operations
564564
}
565565

566+
t.Run("operations not present in new oas paths definition should be removed", func(t *testing.T) {
567+
fakeOperationName := "fakeOperation"
568+
fakeOperation := &Operation{
569+
MockResponse: &MockResponse{
570+
Enabled: true,
571+
},
572+
}
573+
oasDef := getOASDef(true, true)
574+
575+
tykExtensionConfigParams := TykExtensionConfigParams{
576+
MockResponse: &trueVal,
577+
}
578+
579+
extension := &XTykAPIGateway{
580+
Middleware: &Middleware{
581+
Operations: map[string]*Operation{fakeOperationName: fakeOperation},
582+
},
583+
}
584+
oasDef.SetTykExtension(extension)
585+
assert.Greater(t, len(oasDef.getTykOperations()), 0)
586+
587+
expectedOperations := getExpectedOperations(true, true, middlewareMockResponse)
588+
err := oasDef.BuildDefaultTykExtension(tykExtensionConfigParams, true)
589+
590+
assert.NoError(t, err)
591+
assert.Equal(t, expectedOperations, oasDef.getTykOperations())
592+
})
593+
566594
t.Run("allowList", func(t *testing.T) {
567595
t.Run("enable allowList for all paths when no configured operationID in OAS", func(t *testing.T) {
568596
oasDef := getOASDef(false, false)

‎apidef/oas/schema/x-tyk-api-gateway.json

Lines changed: 30 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -218,6 +218,10 @@
218218
"claimName": {
219219
"type": "string"
220220
},
221+
"claims": {
222+
"type": "array",
223+
"items": {"type": "string"}
224+
},
221225
"scopeToPolicyMapping": {
222226
"type": "array",
223227
"items": [
@@ -920,8 +924,7 @@
920924
},
921925
"required": [
922926
"in",
923-
"pattern",
924-
"negate"
927+
"pattern"
925928
]
926929
},
927930
"X-Tyk-URLRewriteRule": {
@@ -949,8 +952,7 @@
949952
"required": [
950953
"in",
951954
"name",
952-
"pattern",
953-
"negate"
955+
"pattern"
954956
]
955957
},
956958
"X-Tyk-EndpointPostPlugin": {
@@ -1614,12 +1616,36 @@
16141616
"identityBaseField": {
16151617
"type": "string"
16161618
},
1619+
"subjectClaims": {
1620+
"type": "array",
1621+
"items": {"type": "string"}
1622+
},
16171623
"skipKid": {
16181624
"type": "boolean"
16191625
},
16201626
"policyFieldName": {
16211627
"type": "string"
16221628
},
1629+
"basePolicyClaims": {
1630+
"type": "array",
1631+
"items": {"type": "string"}
1632+
},
1633+
"allowedIssuers": {
1634+
"type": "array",
1635+
"items": {"type": "string"}
1636+
},
1637+
"allowedAudiences": {
1638+
"type": "array",
1639+
"items": {"type": "string"}
1640+
},
1641+
"jtiValidation": {
1642+
"type": "array",
1643+
"items": {"type": "string"}
1644+
},
1645+
"allowedSubjects": {
1646+
"type": "array",
1647+
"items": {"type": "string"}
1648+
},
16231649
"clientBaseField": {
16241650
"type": "string"
16251651
},

‎apidef/oas/schema/x-tyk-api-gateway.strict.json

Lines changed: 44 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -229,6 +229,12 @@
229229
"claimName": {
230230
"type": "string"
231231
},
232+
"claims": {
233+
"type": "array",
234+
"items": {
235+
"type": "string"
236+
}
237+
},
232238
"scopeToPolicyMapping": {
233239
"type": "array",
234240
"items": [
@@ -959,8 +965,7 @@
959965
},
960966
"required": [
961967
"in",
962-
"pattern",
963-
"negate"
968+
"pattern"
964969
],
965970
"additionalProperties": false
966971
},
@@ -989,8 +994,7 @@
989994
"required": [
990995
"in",
991996
"name",
992-
"pattern",
993-
"negate"
997+
"pattern"
994998
],
995999
"additionalProperties": false
9961000
},
@@ -1680,12 +1684,48 @@
16801684
"identityBaseField": {
16811685
"type": "string"
16821686
},
1687+
"subjectClaims": {
1688+
"type": "array",
1689+
"items": {
1690+
"type": "string"
1691+
}
1692+
},
16831693
"skipKid": {
16841694
"type": "boolean"
16851695
},
16861696
"policyFieldName": {
16871697
"type": "string"
16881698
},
1699+
"basePolicyClaims": {
1700+
"type": "array",
1701+
"items": {
1702+
"type": "string"
1703+
}
1704+
},
1705+
"allowedIssuers": {
1706+
"type": "array",
1707+
"items": {
1708+
"type": "string"
1709+
}
1710+
},
1711+
"allowedAudiences": {
1712+
"type": "array",
1713+
"items": {
1714+
"type": "string"
1715+
}
1716+
},
1717+
"jtiValidation": {
1718+
"type": "array",
1719+
"items": {
1720+
"type": "string"
1721+
}
1722+
},
1723+
"allowedSubjects": {
1724+
"type": "array",
1725+
"items": {
1726+
"type": "string"
1727+
}
1728+
},
16891729
"clientBaseField": {
16901730
"type": "string"
16911731
},

0 commit comments

Comments
 (0)