{
"$schema": "https://ui.shadcn.com/schema/registry-item.json",
"name": "provider-azure-zod",
"title": "Azure Provider (Zod)",
"description": "A self-contained form component that emits an OidcPolicy for a Microsoft Entra ID workload: tenant, the caller's object ID, optional client ID, and audience. Validated with Zod.",
"dependencies": [
"zod"
],
"registryDependencies": [
"https://ui.shadcn.com/oidc/r/policy.json",
"https://ui.shadcn.com/oidc/r/claims.json",
"button",
"field",
"input"
],
"files": [
{
"path": "registry/oidc/flavors/none-zod/provider-azure.tsx",
"content": "\"use client\"\n\nimport * as React from \"react\"\n\nimport { z } from \"zod\"\n\nimport { cn } from \"@/lib/utils\"\nimport { Button } from \"@/components/ui/button\"\nimport {\n Field,\n FieldDescription,\n FieldError,\n FieldLabel,\n} from \"@/components/ui/field\"\nimport { Input } from \"@/components/ui/input\"\nimport {\n ClaimChip,\n ClaimsList,\n claimRowsFromPolicy,\n claimsListValid,\n mergeClaimRows,\n} from \"@/components/oidc/claims\"\nimport type { OidcPolicy } from \"@/lib/oidc/policy\"\n\nfunction AzureIcon({ ...props }: React.ComponentProps<\"svg\">) {\n return (\n \n )\n}\n\nconst tenantIdSchema = z\n .string()\n .min(1, \"Enter the tenant ID.\")\n .regex(\n /^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$/,\n \"Enter the tenant GUID.\"\n )\nconst objectIdSchema = z\n .string()\n .min(1, \"Enter the object ID.\")\n .regex(\n /^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$/,\n \"Enter the object GUID.\"\n )\nconst clientIdSchema = z.union([\n z.literal(\"\"),\n z\n .string()\n .regex(\n /^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$/,\n \"Enter the client GUID.\"\n ),\n])\nconst audienceSchema = z.string().min(1, \"Enter the audience.\")\nconst extraClaimsSchema = z.array(\n z.object({ name: z.string(), values: z.string() })\n)\n\nconst schema = z.object({\n tenantId: tenantIdSchema,\n objectId: objectIdSchema,\n clientId: clientIdSchema,\n audience: audienceSchema,\n extraClaims: extraClaimsSchema,\n})\n\ntype Fields = z.infer\n\nconst DEFAULTS: Fields = {\n tenantId: \"\",\n objectId: \"\",\n clientId: \"\",\n audience: \"\",\n extraClaims: [],\n}\n\nfunction fieldErrors(fields: Fields) {\n const result = schema.safeParse(fields)\n const errors: Partial> = {}\n if (!result.success) {\n for (const issue of result.error.issues) {\n const key = issue.path[0] as keyof Fields | undefined\n if (key && !errors[key]) {\n errors[key] = issue.message\n }\n }\n }\n return { valid: result.success, errors }\n}\n\nconst FIRST_CLASS_CLAIMS = [\"aud\", \"oid\", \"azp\"]\n\nconst ISSUER_PATTERN =\n /^https:\\/\\/login\\.microsoftonline\\.com\\/([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})\\/v2\\.0$/\n\nconst GUID_PATTERN =\n /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/\n\n// Entra tokens carry lowercase GUIDs; normalize pastes.\nfunction compile(fields: Fields) {\n const claims: Record = {}\n if (fields.audience) {\n claims.aud = [fields.audience]\n }\n if (fields.objectId) {\n claims.oid = [fields.objectId.toLowerCase()]\n }\n if (fields.clientId) {\n claims.azp = [fields.clientId.toLowerCase()]\n }\n mergeClaimRows(claims, fields.extraClaims, FIRST_CLASS_CLAIMS)\n return {\n issuer: `https://login.microsoftonline.com/${fields.tenantId.toLowerCase()}/v2.0`,\n claims,\n }\n}\n\nfunction parse(policy: OidcPolicy) {\n const tenantId = ISSUER_PATTERN.exec(policy.issuer)?.[1]\n if (!tenantId) {\n return null\n }\n if (\n FIRST_CLASS_CLAIMS.some((name) => (policy.claims[name]?.length ?? 0) > 1)\n ) {\n return null\n }\n const objectId = policy.claims.oid?.[0] ?? \"\"\n const clientId = policy.claims.azp?.[0] ?? \"\"\n if (\n (objectId && !GUID_PATTERN.test(objectId)) ||\n (clientId && !GUID_PATTERN.test(clientId))\n ) {\n return null\n }\n const extraClaims = claimRowsFromPolicy(policy.claims, FIRST_CLASS_CLAIMS)\n if (extraClaims === null) {\n return null\n }\n\n return {\n tenantId,\n objectId,\n clientId,\n audience: policy.claims.aud?.[0] ?? \"\",\n extraClaims,\n }\n}\n\n/** True when this form can represent the policy — for routing an edit. */\nfunction matchesAzurePolicy(policy: OidcPolicy) {\n return parse(policy) !== null\n}\n\nfunction AzurePolicyForm({\n defaultValue,\n onChange,\n onSubmit,\n className,\n}: {\n defaultValue?: OidcPolicy\n onChange?: (policy: OidcPolicy) => void\n onSubmit: (policy: OidcPolicy) => void\n className?: string\n}) {\n const [fields, setFields] = React.useState(() =>\n defaultValue ? (parse(defaultValue) ?? DEFAULTS) : DEFAULTS\n )\n const [attempted, setAttempted] = React.useState(false)\n const { errors } = fieldErrors(fields)\n\n const apply = (next: Fields) => {\n setFields(next)\n const policy = compile(next)\n onChange?.(\n defaultValue?.label ? { ...policy, label: defaultValue.label } : policy\n )\n }\n\n const handleSubmit = (event: React.FormEvent) => {\n event.preventDefault()\n if (!(\n fieldErrors(fields).valid &&\n claimsListValid(fields.extraClaims, FIRST_CLASS_CLAIMS)\n )) {\n setAttempted(true)\n return\n }\n const policy = compile(fields)\n onSubmit(\n defaultValue?.label ? { ...policy, label: defaultValue.label } : policy\n )\n }\n\n return (\n \n \n \n Tenant ID iss\n \n \n apply({ ...fields, tenantId: event.target.value.trim() })\n }\n />\n {!!(errors.tenantId && (fields.tenantId || attempted)) ? (\n {errors.tenantId}\n ) : null}\n \n Entra admin center → Overview → Tenant ID. Sets the issuer\n https://login.microsoftonline.com/<tenant>/v2.0.\n \n \n \n \n Object ID oid\n \n \n apply({ ...fields, objectId: event.target.value.trim() })\n }\n />\n {!!(errors.objectId && (fields.objectId || attempted)) ? (\n {errors.objectId}\n ) : null}\n \n The workload's Object (principal) ID. Survives renames.\n \n \n \n \n Application (client) ID azp\n \n \n apply({ ...fields, clientId: event.target.value.trim() })\n }\n />\n {!!(errors.clientId && (fields.clientId || attempted)) ? (\n {errors.clientId}\n ) : null}\n \n Optional: also pin the app registration the token was issued to.\n \n \n \n \n Audience aud\n \n \n apply({ ...fields, audience: event.target.value.trim() })\n }\n />\n {!!(errors.audience && (fields.audience || attempted)) ? (\n {errors.audience}\n ) : null}\n \n The audience the caller requests its token for.\n \n \n apply({ ...fields, extraClaims: rows })}\n reserved={FIRST_CLASS_CLAIMS}\n />\n \n \n )\n}\n\nexport { AzureIcon, AzurePolicyForm, matchesAzurePolicy }\n",
"type": "registry:component",
"target": "@components/oidc/provider-azure.tsx"
}
],
"meta": {
"tagline": "Trust an Entra ID workload"
},
"categories": [
"auth",
"forms"
],
"type": "registry:component"
}