| Safe Haskell | None |
|---|---|
| Language | GHC2021 |
Ecluse.Config.MirrorCredential
Description
Derive a mount's mirror-write credential from its mirror-target URL.
The mirror-target URL is the single source of truth for how the mirror write is
authenticated. A CodeArtifact endpoint
({domain}-{owner}.d.codeartifact.{region}.amazonaws.com) encodes its whole mint
identity in its host, so a CodeArtifact target dictates a minted token scoped to
exactly the domain the worker writes to. Any other host is written with an
operator-supplied static bearer.
Because the credential is derived from the very URL it will be sent to, a token can never be paired with an endpoint it was not minted for: the divergence class is unrepresentable rather than merely guarded (issue #808). Two arrangements are refused at load so neither degrades silently: a non-CodeArtifact target with no static token, and a CodeArtifact target that also carries a static token.
Synopsis
- resolveMirrorCredential :: Ecosystem -> RegistryUrl -> Maybe Secret -> Maybe Natural -> Either ConfigError MirrorCredential
- parseCodeArtifactHost :: Text -> Maybe (Text, Text, Text)
- isAccountId :: Text -> Bool
Documentation
resolveMirrorCredential :: Ecosystem -> RegistryUrl -> Maybe Secret -> Maybe Natural -> Either ConfigError MirrorCredential Source #
Derive the mirror-write credential from the resolved mirror-target URL, its
optional static token, and the optional token-duration. A CodeArtifact host yields a
MirrorCodeArtifact whose identity is parsed straight from the host (so the mint is
scoped to the domain the worker writes to); any other host yields a MirrorStatic
from the supplied token. The two refusals keep a "derived" credential from ever
meaning a silent one.
parseCodeArtifactHost :: Text -> Maybe (Text, Text, Text) Source #
Parse a CodeArtifact npm endpoint host into its (domain, owner, region). The host
shape is {domain}-{owner}.d.codeartifact.{region}.amazonaws.com; the {owner} is the
12-digit account id after the last hyphen of the first label, so a domain may
itself contain hyphens. Nothing for any host that is not this shape -- including one
whose tail after the last hyphen is not an account id, so a hyphen-bearing
non-CodeArtifact host never mis-parses into a bogus owner (and so is treated as a
static-token target, not a CodeArtifact one).
isAccountId :: Text -> Bool Source #
Whether a value is a 12-digit AWS account id (shared with the SQS queue-URL shape validation in Ecluse.Config.QueueTarget).