Track adapterOS retired Access bypass state

lib/runtime/desired_state.sh

@@ -138,15 +138,65 @@ cfctl_pick_actual_subset_for_desired() {
     --argjson actual "${actual_json}" \
     --argjson desired "${desired_json}" \
     '
+      def actual_value($key):
+        if $actual | has($key) then
+          $actual[$key]
+        else
+          null
+        end;
+
+      def matching_policy($actual_policies; $desired_policy):
+        (
+          $actual_policies[]?
+          | select(
+              (($desired_policy.id // "") != "" and .id == $desired_policy.id)
+              or (($desired_policy.name // "") != "" and .name == $desired_policy.name)
+            )
+        ) // {};
+
+      def actual_policy_subset($desired_policy):
+        (matching_policy(($actual.policies // []); $desired_policy)) as $actual_policy
+        | reduce ($desired_policy | keys_unsorted[]) as $policy_key
+            ({};
+              . + {
+                ($policy_key): (
+                  if $actual_policy | has($policy_key) then
+                    $actual_policy[$policy_key]
+                  else
+                    null
+                  end
+                )
+              }
+            );
+
       reduce ($desired | keys_unsorted[]) as $key
         ({};
           . + {
-            ($key): ($actual[$key] // null)
+            ($key): (
+              if $key == "policies" and ($desired[$key] | type) == "array" then
+                [$desired[$key][] | actual_policy_subset(.)]
+              else
+                actual_value($key)
+              end
+            )
           }
         )
     '
 }
 
+cfctl_prepare_sync_body() {
+  local surface="$1"
+  local spec_json="$2"
+  local prepared=""
+
+  if prepared="$(cfctl_surface_call_module "${surface}" "prepare_sync_body" "${spec_json}" 2>/dev/null)"; then
+    printf '%s\n' "${prepared}"
+    return
+  fi
+
+  jq '(.body // {})' <<< "${spec_json}"
+}
+
 cfctl_diff_surface_json() {
   local surface="$1"
   local actual_items_json="$2"

state/access.app/beta-adapteros.json

@@ -15,7 +15,8 @@
     "same_site_cookie_attribute": "lax",
     "options_preflight_bypass": false,
     "policies": [
-      { "id": "d07a924a-ea93-450f-85e9-b60778540809", "precedence": 1 }
+      { "id": "87544dc1-74f2-43fd-aa29-aacd5560eb34", "precedence": 1 },
+      { "id": "d07a924a-ea93-450f-85e9-b60778540809", "precedence": 2 }
     ]
   }
 }

state/access.app/developers-adapteros.json

@@ -0,0 +1,22 @@
+{
+  "match": { "domain": "developers.adapteros.com" },
+  "body": {
+    "name": "adapterOS Developers",
+    "type": "self_hosted",
+    "domain": "developers.adapteros.com",
+    "self_hosted_domains": ["developers.adapteros.com"],
+    "destinations": [{ "type": "public", "uri": "developers.adapteros.com" }],
+    "app_launcher_visible": false,
+    "allowed_idps": ["7b0bc477-5d42-4dab-b0ea-c97d0aef7810"],
+    "auto_redirect_to_identity": true,
+    "session_duration": "8h",
+    "enable_binding_cookie": true,
+    "http_only_cookie_attribute": true,
+    "same_site_cookie_attribute": "lax",
+    "options_preflight_bypass": false,
+    "policies": [
+      { "id": "54961ddc-c486-490b-9b25-17d0f1217ca6", "precedence": 1 },
+      { "id": "b9a25b2c-0ba1-4e40-8e2e-e6640ed3eeff", "precedence": 2 }
+    ]
+  }
+}

state/access.app/ops-adapteros.json

@@ -15,7 +15,8 @@
     "same_site_cookie_attribute": "lax",
     "options_preflight_bypass": false,
     "policies": [
-      { "id": "d07a924a-ea93-450f-85e9-b60778540809", "precedence": 1 }
+      { "id": "eb878874-72c8-4451-b7c5-83205c1e4754", "precedence": 1 },
+      { "id": "d07a924a-ea93-450f-85e9-b60778540809", "precedence": 2 }
     ]
   }
 }

state/access.policy/aos-retired-beta-bypass.json

@@ -0,0 +1,14 @@
+{
+  "match": {
+    "app_id": "66107cf0-77be-4e2f-8f41-21cd7273d677",
+    "name": "Bypass retired Pages redirect"
+  },
+  "body": {
+    "name": "Bypass retired Pages redirect",
+    "decision": "bypass",
+    "include": [{ "everyone": {} }],
+    "exclude": [],
+    "require": [],
+    "precedence": 1
+  }
+}

state/access.policy/aos-retired-developers-bypass.json

@@ -0,0 +1,14 @@
+{
+  "match": {
+    "app_id": "ae406410-c300-4032-ba07-5e0f63ed3892",
+    "name": "Bypass retired Pages redirect"
+  },
+  "body": {
+    "name": "Bypass retired Pages redirect",
+    "decision": "bypass",
+    "include": [{ "everyone": {} }],
+    "exclude": [],
+    "require": [],
+    "precedence": 1
+  }
+}

state/access.policy/aos-retired-ops-bypass.json

@@ -0,0 +1,14 @@
+{
+  "match": {
+    "app_id": "d71cec38-645b-4506-8cc0-65fb8d6e295c",
+    "name": "Bypass retired Pages redirect"
+  },
+  "body": {
+    "name": "Bypass retired Pages redirect",
+    "decision": "bypass",
+    "include": [{ "everyone": {} }],
+    "exclude": [],
+    "require": [],
+    "precedence": 1
+  }
+}