Skip to content

Commit 782214b

Browse files
EmyrkEmyrk
authored
chore: move organizatinon sync to runtime configuration (coder#15431)
Moves the configuration from environment to database backed, to allow configuring organization sync at runtime.
1 parent 7b33ab0 commit 782214b

28 files changed

+882
-279
lines changed

‎cli/testdata/coder_server_--help.golden

Lines changed: 0 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -506,11 +506,6 @@ OIDC OPTIONS:
506506
groups. This filter is applied after the group mapping and before the
507507
regex filter.
508508

509-
--oidc-organization-assign-default bool, $CODER_OIDC_ORGANIZATION_ASSIGN_DEFAULT (default: true)
510-
If set to true, users will always be added to the default
511-
organization. If organization sync is enabled, then the default org is
512-
always added to the user's set of expectedorganizations.
513-
514509
--oidc-auth-url-params struct[map[string]string], $CODER_OIDC_AUTH_URL_PARAMS (default: {"access_type": "offline"})
515510
OIDC auth URL parameters to pass to the upstream provider.
516511

@@ -557,14 +552,6 @@ OIDC OPTIONS:
557552
--oidc-name-field string, $CODER_OIDC_NAME_FIELD (default: name)
558553
OIDC claim field to use as the name.
559554

560-
--oidc-organization-field string, $CODER_OIDC_ORGANIZATION_FIELD
561-
This field must be set if using the organization sync feature. Set to
562-
the claim to be used for organizations.
563-
564-
--oidc-organization-mapping struct[map[string][]uuid.UUID], $CODER_OIDC_ORGANIZATION_MAPPING (default: {})
565-
A map of OIDC claims and the organizations in Coder it should map to.
566-
This is required because organization IDs must be used within Coder.
567-
568555
--oidc-group-regex-filter regexp, $CODER_OIDC_GROUP_REGEX_FILTER (default: .*)
569556
If provided any group name not matching the regex is ignored. This
570557
allows for filtering out groups that are not needed. This filter is

‎coderd/apidoc/docs.go

Lines changed: 109 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎coderd/apidoc/swagger.json

Lines changed: 95 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎coderd/database/dbauthz/dbauthz.go

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -33,9 +33,8 @@ var _ database.Store = (*querier)(nil)
3333

3434
const wrapname = "dbauthz.querier"
3535

36-
// NoActorError wraps ErrNoRows for the api to return a 404. This is the correct
37-
// response when the user is not authorized.
38-
var NoActorError = xerrors.Errorf("no authorization actor in context: %w", sql.ErrNoRows)
36+
// NoActorError is returned if no actor is present in the context.
37+
var NoActorError = xerrors.Errorf("no authorization actor in context")
3938

4039
// NotAuthorizedError is a sentinel error that unwraps to sql.ErrNoRows.
4140
// This allows the internal error to be read by the caller if needed. Otherwise

‎coderd/idpsync/group.go

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -20,12 +20,12 @@ import (
2020
)
2121

2222
type GroupParams struct {
23-
// SyncEnabled if false will skip syncing the user's groups
24-
SyncEnabled bool
23+
// SyncEntitled if false will skip syncing the user's groups
24+
SyncEntitled bool
2525
MergedClaims jwt.MapClaims
2626
}
2727

28-
func (AGPLIDPSync) GroupSyncEnabled() bool {
28+
func (AGPLIDPSync) GroupSyncEntitled() bool {
2929
// AGPL does not support syncing groups.
3030
return false
3131
}
@@ -73,13 +73,13 @@ func (s AGPLIDPSync) GroupSyncSettings(ctx context.Context, orgID uuid.UUID, db
7373

7474
func (s AGPLIDPSync) ParseGroupClaims(_ context.Context, _ jwt.MapClaims) (GroupParams, *HTTPError) {
7575
return GroupParams{
76-
SyncEnabled: s.GroupSyncEnabled(),
76+
SyncEntitled: s.GroupSyncEntitled(),
7777
}, nil
7878
}
7979

8080
func (s AGPLIDPSync) SyncGroups(ctx context.Context, db database.Store, user database.User, params GroupParams) error {
8181
// Nothing happens if sync is not enabled
82-
if !params.SyncEnabled {
82+
if !params.SyncEntitled {
8383
return nil
8484
}
8585

0 commit comments

Comments
 (0)