synced/coder
1
0
Fork 0
mirror of https://github.com/coder/coder.git synced 2025-07-09 11:45:56 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat: add endpoint for partial updates to org sync mapping (#16316)

Browse Source
This commit is contained in:
ケイラ
2025-01-30 10:52:50 -07:00
committed by GitHub
parent f651ab937b
commit 2371153a37
17 changed files with 595 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
enterprise/coderd/coderd.go
View File

@ -295,7 +295,9 @@ func New(ctx context.Context, options *Options) (_ *API, err error) {
r.Route("/organization", func(r chi.Router) {
r.Get("/", api.organizationIDPSyncSettings)
r.Patch("/", api.patchOrganizationIDPSyncSettings)
r.Patch("/mapping", api.patchOrganizationIDPSyncMapping)
})
r.Get("/available-fields", api.deploymentIDPSyncClaimFields)
r.Get("/field-values", api.deploymentIDPSyncClaimFieldValues)
})
@ -307,11 +309,12 @@ func New(ctx context.Context, options *Options) (_ *API, err error) {
httpmw.ExtractOrganizationParam(api.Database),
)
r.Route("/organizations/{organization}/settings", func(r chi.Router) {
r.Get("/idpsync/available-fields", api.organizationIDPSyncClaimFields)
r.Get("/idpsync/groups", api.groupIDPSyncSettings)
r.Patch("/idpsync/groups", api.patchGroupIDPSyncSettings)
r.Get("/idpsync/roles", api.roleIDPSyncSettings)
r.Patch("/idpsync/roles", api.patchRoleIDPSyncSettings)
r.Get("/idpsync/available-fields", api.organizationIDPSyncClaimFields)
r.Get("/idpsync/field-values", api.organizationIDPSyncClaimFieldValues)
})
})

2
enterprise/coderd/enidpsync/enidpsync.go
View File

@ -7,6 +7,8 @@ import (
"github.com/coder/coder/v2/coderd/runtimeconfig"
)
var _ idpsync.IDPSync = &EnterpriseIDPSync{}
// EnterpriseIDPSync enabled syncing user information from an external IDP.
// The sync is an enterprise feature, so this struct wraps the AGPL implementation
// and extends it with enterprise capabilities. These capabilities can entirely

2
enterprise/coderd/enidpsync/organizations_test.go
View File

@ -300,7 +300,7 @@ func TestOrganizationSync(t *testing.T) {
// Create a new sync object
sync := enidpsync.NewSync(logger, runtimeconfig.NewManager(), caseData.Entitlements, caseData.Settings)
if caseData.RuntimeSettings != nil {
err := sync.UpdateOrganizationSettings(ctx, rdb, *caseData.RuntimeSettings)
err := sync.UpdateOrganizationSyncSettings(ctx, rdb, *caseData.RuntimeSettings)
require.NoError(t, err)
}

91
enterprise/coderd/idpsync.go
View File

@ -3,6 +3,7 @@ package coderd
import (
"fmt"
"net/http"
"slices"
"github.com/google/uuid"
@ -14,6 +15,7 @@ import (
"github.com/coder/coder/v2/coderd/idpsync"
"github.com/coder/coder/v2/coderd/rbac"
"github.com/coder/coder/v2/coderd/rbac/policy"
"github.com/coder/coder/v2/coderd/util/slice"
"github.com/coder/coder/v2/codersdk"
)
@ -292,7 +294,7 @@ func (api *API) patchOrganizationIDPSyncSettings(rw http.ResponseWriter, r *http
}
aReq.Old = *existing
err = api.IDPSync.UpdateOrganizationSettings(sysCtx, api.Database, idpsync.OrganizationSyncSettings{
err = api.IDPSync.UpdateOrganizationSyncSettings(sysCtx, api.Database, idpsync.OrganizationSyncSettings{
Field: req.Field,
// We do not check if the mappings point to actual organizations.
Mapping: req.Mapping,
@ -317,6 +319,93 @@ func (api *API) patchOrganizationIDPSyncSettings(rw http.ResponseWriter, r *http
})
}
// @Summary Update organization IdP Sync mapping
// @ID update-organization-idp-sync-mapping
// @Security CoderSessionToken
// @Produce json
// @Accept json
// @Tags Enterprise
// @Success 200 {object} codersdk.OrganizationSyncSettings
// @Param request body codersdk.PatchOrganizationIDPSyncMappingRequest true "Description of the mappings to add and remove"
// @Router /settings/idpsync/organization/mapping [patch]
func (api *API) patchOrganizationIDPSyncMapping(rw http.ResponseWriter, r *http.Request) {
ctx := r.Context()
auditor := *api.AGPL.Auditor.Load()
aReq, commitAudit := audit.InitRequest[idpsync.OrganizationSyncSettings](rw, &audit.RequestParams{
Audit: auditor,
Log: api.Logger,
Request: r,
Action: database.AuditActionWrite,
})
defer commitAudit()
if !api.Authorize(r, policy.ActionUpdate, rbac.ResourceIdpsyncSettings) {
httpapi.Forbidden(rw)
return
}
var req codersdk.PatchOrganizationIDPSyncMappingRequest
if !httpapi.Read(ctx, rw, r, &req) {
return
}
var settings idpsync.OrganizationSyncSettings
//nolint:gocritic // Requires system context to update runtime config
sysCtx := dbauthz.AsSystemRestricted(ctx)
err := database.ReadModifyUpdate(api.Database, func(tx database.Store) error {
existing, err := api.IDPSync.OrganizationSyncSettings(sysCtx, tx)
if err != nil {
return err
}
aReq.Old = *existing
newMapping := make(map[string][]uuid.UUID)
// Copy existing mapping
for key, ids := range existing.Mapping {
newMapping[key] = append(newMapping[key], ids...)
}
// Add unique entries
for _, mapping := range req.Add {
if !slice.Contains(newMapping[mapping.Given], mapping.Gets) {
newMapping[mapping.Given] = append(newMapping[mapping.Given], mapping.Gets)
}
}
// Remove entries
for _, mapping := range req.Remove {
newMapping[mapping.Given] = slices.DeleteFunc(newMapping[mapping.Given], func(u uuid.UUID) bool {
return u == mapping.Gets
})
}
settings = idpsync.OrganizationSyncSettings{
Field: existing.Field,
Mapping: newMapping,
AssignDefault: existing.AssignDefault,
}
err = api.IDPSync.UpdateOrganizationSyncSettings(sysCtx, tx, settings)
if err != nil {
return err
}
return nil
})
if err != nil {
httpapi.InternalServerError(rw, err)
return
}
aReq.New = settings
httpapi.Write(ctx, rw, http.StatusOK, codersdk.OrganizationSyncSettings{
Field: settings.Field,
Mapping: settings.Mapping,
AssignDefault: settings.AssignDefault,
})
}
// @Summary Get the available organization idp sync claim fields
// @ID get-the-available-organization-idp-sync-claim-fields
// @Security CoderSessionToken

204
enterprise/coderd/idpsync_test.go
View File

@ -5,6 +5,7 @@ import (
"regexp"
"testing"
"github.com/google/uuid"
"github.com/stretchr/testify/require"
"github.com/coder/coder/v2/coderd/coderdtest"
@ -82,7 +83,7 @@ func TestGetGroupSyncConfig(t *testing.T) {
})
}
func TestPostGroupSyncConfig(t *testing.T) {
func TestPatchGroupSyncConfig(t *testing.T) {
t.Parallel()
t.Run("OK", func(t *testing.T) {
@ -174,7 +175,7 @@ func TestGetRoleSyncConfig(t *testing.T) {
})
}
func TestPostRoleSyncConfig(t *testing.T) {
func TestPatchRoleSyncConfig(t *testing.T) {
t.Parallel()
t.Run("OK", func(t *testing.T) {
@ -231,3 +232,202 @@ func TestPostRoleSyncConfig(t *testing.T) {
require.Equal(t, http.StatusForbidden, apiError.StatusCode())
})
}
func TestGetOrganizationSyncSettings(t *testing.T) {
t.Parallel()
t.Run("OK", func(t *testing.T) {
t.Parallel()
owner, _, _, user := coderdenttest.NewWithAPI(t, &coderdenttest.Options{
LicenseOptions: &coderdenttest.LicenseOptions{
Features: license.Features{
codersdk.FeatureCustomRoles: 1,
codersdk.FeatureMultipleOrganizations: 1,
},
},
})
expected := map[string][]uuid.UUID{"foo": {user.OrganizationID}}
ctx := testutil.Context(t, testutil.WaitShort)
settings, err := owner.PatchOrganizationIDPSyncSettings(ctx, codersdk.OrganizationSyncSettings{
Field: "august",
Mapping: expected,
})
require.NoError(t, err)
require.Equal(t, "august", settings.Field)
require.Equal(t, expected, settings.Mapping)
settings, err = owner.OrganizationIDPSyncSettings(ctx)
require.NoError(t, err)
require.Equal(t, "august", settings.Field)
require.Equal(t, expected, settings.Mapping)
})
}
func TestPatchOrganizationSyncSettings(t *testing.T) {
t.Parallel()
t.Run("OK", func(t *testing.T) {
t.Parallel()
owner, _ := coderdenttest.New(t, &coderdenttest.Options{
LicenseOptions: &coderdenttest.LicenseOptions{
Features: license.Features{
codersdk.FeatureCustomRoles: 1,
codersdk.FeatureMultipleOrganizations: 1,
},
},
})
ctx := testutil.Context(t, testutil.WaitShort)
//nolint:gocritic // Only owners can change Organization IdP sync settings
settings, err := owner.PatchOrganizationIDPSyncSettings(ctx, codersdk.OrganizationSyncSettings{
Field: "august",
})
require.NoError(t, err)
require.Equal(t, "august", settings.Field)
fetchedSettings, err := owner.OrganizationIDPSyncSettings(ctx)
require.NoError(t, err)
require.Equal(t, "august", fetchedSettings.Field)
})
t.Run("NotAuthorized", func(t *testing.T) {
t.Parallel()
owner, user := coderdenttest.New(t, &coderdenttest.Options{
LicenseOptions: &coderdenttest.LicenseOptions{
Features: license.Features{
codersdk.FeatureCustomRoles: 1,
codersdk.FeatureMultipleOrganizations: 1,
},
},
})
member, _ := coderdtest.CreateAnotherUser(t, owner, user.OrganizationID)
ctx := testutil.Context(t, testutil.WaitShort)
_, err := member.PatchRoleIDPSyncSettings(ctx, user.OrganizationID.String(), codersdk.RoleSyncSettings{
Field: "august",
})
var apiError *codersdk.Error
require.ErrorAs(t, err, &apiError)
require.Equal(t, http.StatusForbidden, apiError.StatusCode())
_, err = member.RoleIDPSyncSettings(ctx, user.OrganizationID.String())
require.ErrorAs(t, err, &apiError)
require.Equal(t, http.StatusForbidden, apiError.StatusCode())
})
}
func TestPatchOrganizationSyncMapping(t *testing.T) {
t.Parallel()
t.Run("OK", func(t *testing.T) {
t.Parallel()
owner, _ := coderdenttest.New(t, &coderdenttest.Options{
LicenseOptions: &coderdenttest.LicenseOptions{
Features: license.Features{
codersdk.FeatureCustomRoles: 1,
codersdk.FeatureMultipleOrganizations: 1,
},
},
})
// These IDs are easier to visually diff if the test fails than truly random
// ones.
orgs := []uuid.UUID{
uuid.MustParse("00000000-b8bd-46bb-bb6c-6c2b2c0dd2ea"),
uuid.MustParse("01000000-fbe8-464c-9429-fe01a03f3644"),
uuid.MustParse("02000000-0926-407b-9998-39af62e3d0c5"),
uuid.MustParse("03000000-92f6-4bfd-bba6-0f54667b131c"),
uuid.MustParse("04000000-b9d0-46fe-910f-6e2ea0c62caa"),
uuid.MustParse("05000000-67c0-4c19-a52d-0dc3f65abee0"),
uuid.MustParse("06000000-a8a8-4a2c-bdd0-b59aa6882b55"),
uuid.MustParse("07000000-5390-4cc7-a9c8-e4330a683ae7"),
}
ctx := testutil.Context(t, testutil.WaitShort)
//nolint:gocritic // Only owners can change Organization IdP sync settings
settings, err := owner.PatchOrganizationIDPSyncMapping(ctx, codersdk.PatchOrganizationIDPSyncMappingRequest{
Add: []codersdk.IDPSyncMapping[uuid.UUID]{
{Given: "wibble", Gets: orgs[0]},
{Given: "wibble", Gets: orgs[1]},
{Given: "wobble", Gets: orgs[0]},
{Given: "wobble", Gets: orgs[1]},
{Given: "wobble", Gets: orgs[2]},
{Given: "wobble", Gets: orgs[3]},
{Given: "wooble", Gets: orgs[0]},
},
// Remove takes priority over Add, so "3" should not actually be added to wooble.
Remove: []codersdk.IDPSyncMapping[uuid.UUID]{
{Given: "wobble", Gets: orgs[3]},
},
})
expected := map[string][]uuid.UUID{
"wibble": {orgs[0], orgs[1]},
"wobble": {orgs[0], orgs[1], orgs[2]},
"wooble": {orgs[0]},
}
require.NoError(t, err)
require.Equal(t, expected, settings.Mapping)
fetchedSettings, err := owner.OrganizationIDPSyncSettings(ctx)
require.NoError(t, err)
require.Equal(t, expected, fetchedSettings.Mapping)
ctx = testutil.Context(t, testutil.WaitShort)
settings, err = owner.PatchOrganizationIDPSyncMapping(ctx, codersdk.PatchOrganizationIDPSyncMappingRequest{
Add: []codersdk.IDPSyncMapping[uuid.UUID]{
{Given: "wibble", Gets: orgs[2]},
{Given: "wobble", Gets: orgs[3]},
{Given: "wooble", Gets: orgs[0]},
},
// Remove takes priority over Add, so `f` should not actually be added.
Remove: []codersdk.IDPSyncMapping[uuid.UUID]{
{Given: "wibble", Gets: orgs[0]},
{Given: "wobble", Gets: orgs[1]},
},
})
expected = map[string][]uuid.UUID{
"wibble": {orgs[1], orgs[2]},
"wobble": {orgs[0], orgs[2], orgs[3]},
"wooble": {orgs[0]},
}
require.NoError(t, err)
require.Equal(t, expected, settings.Mapping)
fetchedSettings, err = owner.OrganizationIDPSyncSettings(ctx)
require.NoError(t, err)
require.Equal(t, expected, fetchedSettings.Mapping)
})
t.Run("NotAuthorized", func(t *testing.T) {
t.Parallel()
owner, user := coderdenttest.New(t, &coderdenttest.Options{
LicenseOptions: &coderdenttest.LicenseOptions{
Features: license.Features{
codersdk.FeatureCustomRoles: 1,
codersdk.FeatureMultipleOrganizations: 1,
},
},
})
member, _ := coderdtest.CreateAnotherUser(t, owner, user.OrganizationID)
ctx := testutil.Context(t, testutil.WaitShort)
_, err := member.PatchOrganizationIDPSyncMapping(ctx, codersdk.PatchOrganizationIDPSyncMappingRequest{})
var apiError *codersdk.Error
require.ErrorAs(t, err, &apiError)
require.Equal(t, http.StatusForbidden, apiError.StatusCode())
})
}