Lightning.Credentials.Resolver (Lightning v2.20.0-pre)

Provides credential resolution abstraction for workflow execution.

Resolves credentials by matching the project's environment to the credential's environment body. For OAuth credentials, passes the environment body during token refresh.

Summary

Types

error_reason()

keychain_selectors()

resolve_error()

Functions

keychain_selectors(run)

Reads, for each keychain the run's jobs use, the external id its path selects from the run's input.

resolve_credential(credential, environment)

Resolves a credential for a run by matching the project's environment, or resolves a credential directly for a specific environment.

resolve_credential(run, id, keychain_selectors)

Types

error_reason()

@type error_reason() ::
  :not_found
  | :environment_not_configured
  | :project_not_found
  | :environment_mismatch
  | Lightning.Credentials.oauth_refresh_error()
  | term()

keychain_selectors()

@type keychain_selectors() :: %{
  required(Ecto.UUID.t()) =>
    {:ok, external_id :: String.t() | nil}
    | {:error, :keychain_input_unavailable | :invalid_keychain_path}
}

resolve_error()

@type resolve_error() :: {error_reason(), Lightning.Credentials.Credential.t() | nil}

Functions

keychain_selectors(run)

@spec keychain_selectors(Lightning.Run.t()) :: keychain_selectors()

Reads, for each keychain the run's jobs use, the external id its path selects from the run's input.

Projects that don't save dataclips have the input wiped as soon as the worker fetches it, which is before it asks for any credential. Call this before the wipe and pass the result to resolve_credential/3.

resolve_credential(credential, environment)

@spec resolve_credential(
  Lightning.Credentials.Credential.t(),
  environment :: String.t()
) ::
  {:ok, Lightning.Credentials.ResolvedCredential.t()}
  | {:error, resolve_error()}

@spec resolve_credential(Lightning.Run.t(), credential_id :: String.t()) ::
  {:ok, Lightning.Credentials.ResolvedCredential.t() | nil}
  | {:error, :not_found | resolve_error()}

Resolves a credential for a run by matching the project's environment, or resolves a credential directly for a specific environment.

For a run, keychain credentials are selected from keychain_selectors (see keychain_selectors/1). When it is nil they are read from the run's stored input.

resolve_credential(run, id, keychain_selectors)

@spec resolve_credential(
  Lightning.Run.t(),
  credential_id :: String.t(),
  keychain_selectors() | nil
) ::
  {:ok, Lightning.Credentials.ResolvedCredential.t() | nil}
  | {:error, :not_found | resolve_error()}