<commit_before>/*jshint esversion: 6 */

function (user, context, callback) {
  const WHITELIST = [
    '7PQFR1tyqr6TIqdHcgbRcYcbmbgYflVE', // ldap-pwless.testrp.security.allizom.org
    'xRFzU2bj7Lrbo3875aXwyxIArdkq1AOT', // Federated AWS CLI auth0-dev
    'N7lULzWtfVUDGymwDs0yDEq6ZcwmFazj', // Federated AWS CLI auth0-prod
  ];
  if (WHITELIST.includes(context.clientID)) {
    const S3_BUCKET_NAME = configuration.auth0_aws_assests_s3_bucket;
    const S3_FILE_NAME = "access-group-iam-role-map.json";
    const ACCESS_KEY_ID = configuration.auth0_aws_assests_access_key_id;
    const SECRET_KEY = configuration.auth0_aws_assests_access_secret_key;

    // Given a set of groups that a user is in (groups), and a filter upon those groups,
    // return the intersection of the two
    const groupIntersection = (groups, filter) => {
      // from lodash.escapeRegExp, except without ? and *
      const reRegExpChar = /[\\^$.+()[\]{}|]/g,
            reHasRegExpChar = RegExp(reRegExpChar.source),
            overlap = new Set();

      const escapeRegExp = (string) => {
        string = (string && reHasRegExpChar.test(string))? string.replace(reRegExpChar, '\\$&') : string;

        // in AWS, we support ? and * as wildcard characters
        return string.replace(/\?/g, '.').replace(/\*/g, '.*');
      };

      const filters = filter.map(i => new RegExp(escapeRegExp(i)));

      groups.forEach(group => {
        // This is not a foreach loop, simply because we want to break.
        // We do this to slightly reduce this looping structure from O(n * m).
        for (let filter of filters) {
          if (filter.test(group)) {
            overlap.add(group);
            break;
          }
        }
      });

      return [...overlap];
    };

    if (!("auth0_aws_assests_s3_bucket" in configuration) ||
        !("auth0_aws_assests_access_key_id" in configuration) ||
        !("auth0_aws_assests_access_secret_key" in configuration)) {
      console.log("Enriching id_token with amr for AWS Federated CLI");
      throw new Error("Missing Auth0 AWS Federated AMR rule configuration values");
    }

    console.log("Enriching id_token with amr for AWS Federated CLI");

    // Amazon will read in the id token's `amr` list and allow you to match on policies with a string condition.
    // See
    // https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String
    //
    // Note that this abuses the `amr` value (see https://tools.ietf.org/html/rfc8176) as these are not listed as<commit_msg>Put test for config settings at top<commit_after>/*jshint esversion: 6 */

function (user, context, callback) {
  const WHITELIST = [
    '7PQFR1tyqr6TIqdHcgbRcYcbmbgYflVE', // ldap-pwless.testrp.security.allizom.org
    'xRFzU2bj7Lrbo3875aXwyxIArdkq1AOT', // Federated AWS CLI auth0-dev
    'N7lULzWtfVUDGymwDs0yDEq6ZcwmFazj', // Federated AWS CLI auth0-prod
  ];

  if (WHITELIST.includes(context.clientID)) {
    if (!("auth0_aws_assests_s3_bucket" in configuration) ||
        !("auth0_aws_assests_access_key_id" in configuration) ||
        !("auth0_aws_assests_access_secret_key" in configuration)) {
      console.log("Enriching id_token with amr for AWS Federated CLI");
      throw new Error("Missing Auth0 AWS Federated AMR rule configuration values");
    }

    const S3_BUCKET_NAME = configuration.auth0_aws_assests_s3_bucket;
    const S3_FILE_NAME = "access-group-iam-role-map.json";
    const ACCESS_KEY_ID = configuration.auth0_aws_assests_access_key_id;
    const SECRET_KEY = configuration.auth0_aws_assests_access_secret_key;

    // Given a set of groups that a user is in (groups), and a filter upon those groups,
    // return the intersection of the two
    const groupIntersection = (groups, filter) => {
      // from lodash.escapeRegExp, except without ? and *
      const reRegExpChar = /[\\^$.+()[\]{}|]/g,
            reHasRegExpChar = RegExp(reRegExpChar.source),
            overlap = new Set();

      const escapeRegExp = (string) => {
        string = (string && reHasRegExpChar.test(string)) ? string.replace(reRegExpChar, '\\$&') : string;

        // in AWS, we support ? and * as wildcard characters
        return string.replace(/\?/g, '.').replace(/\*/g, '.*');
      };

      const filters = filter.map(i => new RegExp(escapeRegExp(i)));

      groups.forEach(group => {
        // This is not a foreach loop, simply because we want to break.
        // We do this to slightly reduce this looping structure from O(n * m).
        for (let filter of filters) {
          if (filter.test(group)) {
            overlap.add(group);
            break;
          }
        }
      });

      return [...overlap];
    };

    console.log("Enriching id_token with amr for AWS Federated CLI");

    // Amazon will read in the id token's `amr` list and allow you to match on policies with a string condition.
    // See
    // https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String
    //
    // Note that this abuses the `amr` value (see https://tools.ietf.org/html/rfc8176) as these are not listed as
{'fraction_non_alphanumeric': 0.11669242658423493, 'fraction_numerical': 0.011978361669242658, 'mean_word_length': 2.9309035687167806, 'pattern_counts': {'":': 0, '<': 3, '<?xml version=': 0, '>': 11, 'https://': 4, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '1974454', 'n_tokens_mistral': 1716, 'n_tokens_neox': 1671, 'n_words': 421}