Skip to content

Commit 73ec6b2

Browse files
EmyrkEmyrk
authored
chore: audit log entries for all idp sync changes (coder#15919)
1 parent 761a196 commit 73ec6b2

File tree

18 files changed

+259
-64
lines changed

18 files changed

+259
-64
lines changed

‎coderd/apidoc/docs.go

Lines changed: 12 additions & 2 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎coderd/apidoc/swagger.json

Lines changed: 12 additions & 2 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎coderd/audit/diff.go

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@ package audit
22

33
import (
44
"github.com/coder/coder/v2/coderd/database"
5+
"github.com/coder/coder/v2/coderd/idpsync"
56
)
67

78
// Auditable is mostly a marker interface. It contains a definitive list of all
@@ -26,7 +27,10 @@ type Auditable interface {
2627
database.CustomRole |
2728
database.AuditableOrganizationMember |
2829
database.Organization |
29-
database.NotificationTemplate
30+
database.NotificationTemplate |
31+
idpsync.OrganizationSyncSettings |
32+
idpsync.GroupSyncSettings |
33+
idpsync.RoleSyncSettings
3034
}
3135

3236
// Map is a map of changed fields in an audited resource. It maps field names to

‎coderd/audit/request.go

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,7 @@ import (
2020
"github.com/coder/coder/v2/coderd/database"
2121
"github.com/coder/coder/v2/coderd/database/dbtime"
2222
"github.com/coder/coder/v2/coderd/httpmw"
23+
"github.com/coder/coder/v2/coderd/idpsync"
2324
"github.com/coder/coder/v2/coderd/tracing"
2425
)
2526

@@ -121,11 +122,22 @@ func ResourceTarget[T Auditable](tgt T) string {
121122
return typed.Name
122123
case database.NotificationTemplate:
123124
return typed.Name
125+
case idpsync.OrganizationSyncSettings:
126+
return "Organization Sync"
127+
case idpsync.GroupSyncSettings:
128+
return "Organization Group Sync"
129+
case idpsync.RoleSyncSettings:
130+
return "Organization Role Sync"
124131
default:
125132
panic(fmt.Sprintf("unknown resource %T for ResourceTarget", tgt))
126133
}
127134
}
128135

136+
// noID can be used for resources that do not have an uuid.
137+
// An example is singleton configuration resources.
138+
// 51A51C = "Static"
139+
var noID = uuid.MustParse("51A51C00-0000-0000-0000-000000000000")
140+
129141
func ResourceID[T Auditable](tgt T) uuid.UUID {
130142
switch typed := any(tgt).(type) {
131143
case database.Template:
@@ -169,6 +181,12 @@ func ResourceID[T Auditable](tgt T) uuid.UUID {
169181
return typed.ID
170182
case database.NotificationTemplate:
171183
return typed.ID
184+
case idpsync.OrganizationSyncSettings:
185+
return noID // Deployment all uses the same org sync settings
186+
case idpsync.GroupSyncSettings:
187+
return noID // Org field on audit log has org id
188+
case idpsync.RoleSyncSettings:
189+
return noID // Org field on audit log has org id
172190
default:
173191
panic(fmt.Sprintf("unknown resource %T for ResourceID", tgt))
174192
}
@@ -214,6 +232,12 @@ func ResourceType[T Auditable](tgt T) database.ResourceType {
214232
return database.ResourceTypeOrganization
215233
case database.NotificationTemplate:
216234
return database.ResourceTypeNotificationTemplate
235+
case idpsync.OrganizationSyncSettings:
236+
return database.ResourceTypeIdpSyncSettingsOrganization
237+
case idpsync.RoleSyncSettings:
238+
return database.ResourceTypeIdpSyncSettingsRole
239+
case idpsync.GroupSyncSettings:
240+
return database.ResourceTypeIdpSyncSettingsGroup
217241
default:
218242
panic(fmt.Sprintf("unknown resource %T for ResourceType", typed))
219243
}
@@ -261,6 +285,12 @@ func ResourceRequiresOrgID[T Auditable]() bool {
261285
return true
262286
case database.NotificationTemplate:
263287
return false
288+
case idpsync.OrganizationSyncSettings:
289+
return false
290+
case idpsync.GroupSyncSettings:
291+
return true
292+
case idpsync.RoleSyncSettings:
293+
return true
264294
default:
265295
panic(fmt.Sprintf("unknown resource %T for ResourceRequiresOrgID", tgt))
266296
}

‎coderd/database/dump.sql

Lines changed: 4 additions & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎coderd/database/migrations/000281_idpsync_settings.down.sql

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
-- Nothing to do

‎coderd/database/migrations/000281_idpsync_settings.up.sql

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
-- Allow modifications to notification templates to be audited.
2+
ALTER TYPE resource_type ADD VALUE IF NOT EXISTS 'idp_sync_settings_organization';
3+
ALTER TYPE resource_type ADD VALUE IF NOT EXISTS 'idp_sync_settings_group';
4+
ALTER TYPE resource_type ADD VALUE IF NOT EXISTS 'idp_sync_settings_role';

‎coderd/database/models.go

Lines changed: 29 additions & 20 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎coderd/idpsync/organization.go

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -149,13 +149,13 @@ type OrganizationSyncSettings struct {
149149
// Field selects the claim field to be used as the created user's
150150
// organizations. If the field is the empty string, then no organization updates
151151
// will ever come from the OIDC provider.
152-
Field string
152+
Field string `json:"field"`
153153
// Mapping controls how organizations returned by the OIDC provider get mapped
154-
Mapping map[string][]uuid.UUID
154+
Mapping map[string][]uuid.UUID `json:"mapping"`
155155
// AssignDefault will ensure all users that authenticate will be
156156
// placed into the default organization. This is mostly a hack to support
157157
// legacy deployments.
158-
AssignDefault bool
158+
AssignDefault bool `json:"assign_default"`
159159
}
160160

161161
func (s *OrganizationSyncSettings) Set(v string) error {

‎codersdk/audit.go

Lines changed: 13 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -30,10 +30,13 @@ const (
3030
ResourceTypeOrganization ResourceType = "organization"
3131
ResourceTypeOAuth2ProviderApp ResourceType = "oauth2_provider_app"
3232
// nolint:gosec // This is not a secret.
33-
ResourceTypeOAuth2ProviderAppSecret ResourceType = "oauth2_provider_app_secret"
34-
ResourceTypeCustomRole ResourceType = "custom_role"
35-
ResourceTypeOrganizationMember = "organization_member"
36-
ResourceTypeNotificationTemplate = "notification_template"
33+
ResourceTypeOAuth2ProviderAppSecret ResourceType = "oauth2_provider_app_secret"
34+
ResourceTypeCustomRole ResourceType = "custom_role"
35+
ResourceTypeOrganizationMember ResourceType = "organization_member"
36+
ResourceTypeNotificationTemplate ResourceType = "notification_template"
37+
ResourceTypeIdpSyncSettingsOrganization ResourceType = "idp_sync_settings_organization"
38+
ResourceTypeIdpSyncSettingsGroup ResourceType = "idp_sync_settings_group"
39+
ResourceTypeIdpSyncSettingsRole ResourceType = "idp_sync_settings_role"
3740
)
3841

3942
func (r ResourceType) FriendlyString() string {
@@ -78,6 +81,12 @@ func (r ResourceType) FriendlyString() string {
7881
return "organization member"
7982
case ResourceTypeNotificationTemplate:
8083
return "notification template"
84+
case ResourceTypeIdpSyncSettingsOrganization:
85+
return "settings"
86+
case ResourceTypeIdpSyncSettingsGroup:
87+
return "settings"
88+
case ResourceTypeIdpSyncSettingsRole:
89+
return "settings"
8190
default:
8291
return "unknown"
8392
}

0 commit comments

Comments
 (0)