Upgrade dependent version: github.com/open-policy-agent/opa (#5315)

Upgrade dependent version: github.com/open-policy-agent/opa v0.18.0 -> v0.45.0

Signed-off-by: hongzhouzi <hongzhouzi@kubesphere.io>

Signed-off-by: hongzhouzi <hongzhouzi@kubesphere.io>

vendor/github.com/open-policy-agent/opa/internal/jwx/jwa/elliptic.go

@@ -0,0 +1,11 @@
+package jwa
+
+// EllipticCurveAlgorithm represents the algorithms used for EC keys
+type EllipticCurveAlgorithm string
+
+// Supported values for EllipticCurveAlgorithm
+const (
+	P256 EllipticCurveAlgorithm = "P-256"
+	P384 EllipticCurveAlgorithm = "P-384"
+	P521 EllipticCurveAlgorithm = "P-521"
+)

vendor/github.com/open-policy-agent/opa/internal/jwx/jwa/key_type.go

@@ -0,0 +1,67 @@
+package jwa
+
+import (
+	"errors"
+	"fmt"
+	"strconv"
+)
+
+// KeyType represents the key type ("kty") that are supported
+type KeyType string
+
+var keyTypeAlg = map[string]struct{}{"EC": {}, "oct": {}, "RSA": {}}
+
+// Supported values for KeyType
+const (
+	EC             KeyType = "EC"  // Elliptic Curve
+	InvalidKeyType KeyType = ""    // Invalid KeyType
+	OctetSeq       KeyType = "oct" // Octet sequence (used to represent symmetric keys)
+	RSA            KeyType = "RSA" // RSA
+)
+
+// Accept is used when conversion from values given by
+// outside sources (such as JSON payloads) is required
+func (keyType *KeyType) Accept(value interface{}) error {
+	var tmp KeyType
+	switch x := value.(type) {
+	case string:
+		tmp = KeyType(x)
+	case KeyType:
+		tmp = x
+	default:
+		return fmt.Errorf("invalid type for jwa.KeyType: %T", value)
+	}
+	_, ok := keyTypeAlg[tmp.String()]
+	if !ok {
+		return errors.New("unknown Key Type algorithm")
+	}
+
+	*keyType = tmp
+	return nil
+}
+
+// String returns the string representation of a KeyType
+func (keyType KeyType) String() string {
+	return string(keyType)
+}
+
+// UnmarshalJSON unmarshals and checks data as KeyType Algorithm
+func (keyType *KeyType) UnmarshalJSON(data []byte) error {
+	var quote byte = '"'
+	var quoted string
+	if data[0] == quote {
+		var err error
+		quoted, err = strconv.Unquote(string(data))
+		if err != nil {
+			return fmt.Errorf("failed to process signature algorithm: %w", err)
+		}
+	} else {
+		quoted = string(data)
+	}
+	_, ok := keyTypeAlg[quoted]
+	if !ok {
+		return errors.New("unknown signature algorithm")
+	}
+	*keyType = KeyType(quoted)
+	return nil
+}

vendor/github.com/open-policy-agent/opa/internal/jwx/jwa/parameters.go

@@ -0,0 +1,29 @@
+package jwa
+
+import (
+	"crypto/elliptic"
+
+	"github.com/open-policy-agent/opa/internal/jwx/buffer"
+)
+
+// EllipticCurve provides a indirect type to standard elliptic curve such that we can
+// use it for unmarshal
+type EllipticCurve struct {
+	elliptic.Curve
+}
+
+// AlgorithmParameters provides a single structure suitable to unmarshaling any JWK
+type AlgorithmParameters struct {
+	N   buffer.Buffer          `json:"n,omitempty"`
+	E   buffer.Buffer          `json:"e,omitempty"`
+	D   buffer.Buffer          `json:"d,omitempty"`
+	P   buffer.Buffer          `json:"p,omitempty"`
+	Q   buffer.Buffer          `json:"q,omitempty"`
+	Dp  buffer.Buffer          `json:"dp,omitempty"`
+	Dq  buffer.Buffer          `json:"dq,omitempty"`
+	Qi  buffer.Buffer          `json:"qi,omitempty"`
+	Crv EllipticCurveAlgorithm `json:"crv,omitempty"`
+	X   buffer.Buffer          `json:"x,omitempty"`
+	Y   buffer.Buffer          `json:"y,omitempty"`
+	K   buffer.Buffer          `json:"k,omitempty"`
+}

vendor/github.com/open-policy-agent/opa/internal/jwx/jwa/signature.go

@@ -0,0 +1,78 @@
+package jwa
+
+import (
+	"errors"
+	"fmt"
+	"strconv"
+)
+
+// SignatureAlgorithm represents the various signature algorithms as described in https://tools.ietf.org/html/rfc7518#section-3.1
+type SignatureAlgorithm string
+
+var signatureAlg = map[string]struct{}{"ES256": {}, "ES384": {}, "ES512": {}, "HS256": {}, "HS384": {}, "HS512": {}, "PS256": {}, "PS384": {}, "PS512": {}, "RS256": {}, "RS384": {}, "RS512": {}, "none": {}}
+
+// Supported values for SignatureAlgorithm
+const (
+	ES256       SignatureAlgorithm = "ES256" // ECDSA using P-256 and SHA-256
+	ES384       SignatureAlgorithm = "ES384" // ECDSA using P-384 and SHA-384
+	ES512       SignatureAlgorithm = "ES512" // ECDSA using P-521 and SHA-512
+	HS256       SignatureAlgorithm = "HS256" // HMAC using SHA-256
+	HS384       SignatureAlgorithm = "HS384" // HMAC using SHA-384
+	HS512       SignatureAlgorithm = "HS512" // HMAC using SHA-512
+	NoSignature SignatureAlgorithm = "none"
+	PS256       SignatureAlgorithm = "PS256" // RSASSA-PSS using SHA256 and MGF1-SHA256
+	PS384       SignatureAlgorithm = "PS384" // RSASSA-PSS using SHA384 and MGF1-SHA384
+	PS512       SignatureAlgorithm = "PS512" // RSASSA-PSS using SHA512 and MGF1-SHA512
+	RS256       SignatureAlgorithm = "RS256" // RSASSA-PKCS-v1.5 using SHA-256
+	RS384       SignatureAlgorithm = "RS384" // RSASSA-PKCS-v1.5 using SHA-384
+	RS512       SignatureAlgorithm = "RS512" // RSASSA-PKCS-v1.5 using SHA-512
+	NoValue     SignatureAlgorithm = ""      // No value is different from none
+	Unsupported SignatureAlgorithm = "unsupported"
+)
+
+// Accept is used when conversion from values given by
+// outside sources (such as JSON payloads) is required
+func (signature *SignatureAlgorithm) Accept(value interface{}) error {
+	var tmp SignatureAlgorithm
+	switch x := value.(type) {
+	case string:
+		tmp = SignatureAlgorithm(x)
+	case SignatureAlgorithm:
+		tmp = x
+	default:
+		return fmt.Errorf("invalid type for jwa.SignatureAlgorithm: %T", value)
+	}
+	_, ok := signatureAlg[tmp.String()]
+	if !ok {
+		return errors.New("unknown signature algorithm")
+	}
+	*signature = tmp
+	return nil
+}
+
+// String returns the string representation of a SignatureAlgorithm
+func (signature SignatureAlgorithm) String() string {
+	return string(signature)
+}
+
+// UnmarshalJSON unmarshals and checks data as Signature Algorithm
+func (signature *SignatureAlgorithm) UnmarshalJSON(data []byte) error {
+	var quote byte = '"'
+	var quoted string
+	if data[0] == quote {
+		var err error
+		quoted, err = strconv.Unquote(string(data))
+		if err != nil {
+			return fmt.Errorf("failed to process signature algorithm: %w", err)
+		}
+	} else {
+		quoted = string(data)
+	}
+	_, ok := signatureAlg[quoted]
+	if !ok {
+		*signature = Unsupported
+		return nil
+	}
+	*signature = SignatureAlgorithm(quoted)
+	return nil
+}