1import type * as zeroTrust from "@distilled.cloud/cloudflare/zero-trust";
2import type * as Effect from "effect/Effect";
3import * as Binding from "../../Binding.ts";
4import type { RuntimeContext } from "../../RuntimeContext.ts";
5import type { CloudflareEnvironment } from "../CloudflareEnvironment.ts";
6import type {
7 IdentityProviderAttributes,
8 IdentityProviderType,
9} from "./IdentityProvider.ts";
10
11/**
12 * Filters for looking up an existing Access identity provider. At least
13 * one of `name` or `type` is required; when both are given the IdP must
14 * match both. The first match wins (names are not unique on Cloudflare's
15 * side).
16 */
17export type FindIdentityProviderOptions = {
18 /**
19 * Zone to search (legacy zone-level Access). When omitted, the
20 * account-level (Zero Trust organization) IdPs are searched.
21 */
22 zoneId?: string;
23} & (
24 | {
25 /** Exact display name to match. `""` matches the managed WARP IdP. */
26 name: string;
27 /** IdP type to match, e.g. `"cloudflare"` or `"okta"`. */
28 type?: IdentityProviderType;
29 }
30 | {
31 /** Exact display name to match. `""` matches the managed WARP IdP. */
32 name?: string;
33 /** IdP type to match, e.g. `"cloudflare"` or `"okta"`. */
34 type: IdentityProviderType;
35 }
36);
37
38/**
39 * Looks up an existing Access identity provider by display name and/or
40 * type, returning its attributes — or `undefined` when nothing matches.
41 *
42 * As a **data source**, invoke it at plan time via
43 * {@link getIdentityProvider} — the result is an `Output` resolved during
44 * plan/deploy and inert inside deployed bundles. Useful for referencing
45 * IdPs that are managed outside the stack (e.g. the dashboard-provisioned
46 * `cloudflare` WARP login method, whose display name is often `""`).
47 * The implementation is registered by `Cloudflare.providers()`.
48 *
49 * As a **runtime binding** inside a Worker, provide
50 * {@link GetIdentityProviderHttp} — it mints a scoped
51 * {@link AccountApiToken} with the `Access: Organizations, Identity
52 * Providers, and Groups Read` permission and binds it into the Worker so
53 * the lookup can run at runtime.
54 * ### Looking Up Identity Providers
55 * **Example:** Restrict an Access application to the managed WARP IdP
56 * ```typescript
57 * const warpIdp = Cloudflare.Access.getIdentityProvider({
58 * type: "cloudflare",
59 * });
60 *
61 * yield* Cloudflare.Access.Application("Admin", {
62 * domain: "admin.example.com",
63 * allowedIdps: [warpIdp.identityProviderId.as<string>()],
64 * });
65 * ```
66 * **Example:** Look up an IdP by display name
67 * ```typescript
68 * const okta = Cloudflare.Access.getIdentityProvider({ name: "Okta SSO" });
69 * ```
70 * **Example:** Look up an IdP at runtime inside a Worker
71 * ```typescript
72 * // init — bind the lookup
73 * const findWarpIdp = yield* Cloudflare.Access.GetIdentityProvider({
74 * type: "cloudflare",
75 * });
76 *
77 * // runtime — resolve the IdP
78 * const warp = yield* findWarpIdp();
79 * ```
80 *
81 * @binding
82 */
83export interface GetIdentityProvider extends Binding.Service<
84 GetIdentityProvider,
85 "Cloudflare.Access.GetIdentityProvider",
86 (
87 options: FindIdentityProviderOptions,
88 ) => Effect.Effect<
89 () => Effect.Effect<
90 IdentityProviderAttributes | undefined,
91 | zeroTrust.ListIdentityProvidersForAccountError
92 | zeroTrust.ListIdentityProvidersForZoneError,
93 RuntimeContext
94 >,
95 never,
96 CloudflareEnvironment
97 >
98> {}
99
100export const GetIdentityProvider = Binding.Service<GetIdentityProvider>(
101 "Cloudflare.Access.GetIdentityProvider",
102);
103
104/**
105 * Plan-time identity-provider lookup — the data-source form of
106 * {@link GetIdentityProvider} (what Terraform calls a data source and
107 * Pulumi an invoke). Returns an
108 * `Output<IdentityProviderAttributes | undefined>` resolved during
109 * plan/deploy; safe to call from composition code that is re-executed
110 * inside a deployed runtime bundle.
111 */
112export const getIdentityProvider = GetIdentityProvider.execute;