feat: groupsync autos to default org

Emyrk · Emyrk · commit 1f5e72ca236e · 2024-02-15T10:28:08.000-06:00
Groupsync made to work with default org.
diff --git a/coderd/userauth.go b/coderd/userauth.go
@@ -1217,8 +1217,10 @@ type oauthLoginParams struct {
 	// to the Groups provided.
 	UsingGroups         bool
 	CreateMissingGroups bool
-	Groups              map[uuid.UUID][]string
-	GroupFilter         *regexp.Regexp
+	// These are the group names from the IDP. Internally, they will map to
+	// some organization groups.
+	Groups      []string
+	GroupFilter *regexp.Regexp
 	// Is UsingRoles is true, then the user will be assigned
 	// the roles provided.
 	UsingRoles bool
@@ -1301,7 +1303,6 @@ func (api *API) oauthLogin(r *http.Request, params *oauthLoginParams) ([]*http.C
 			link database.UserLink
 			err  error
 		)
-
 		user = params.User
 		link = params.Link
 
@@ -1457,23 +1458,50 @@ func (api *API) oauthLogin(r *http.Request, params *oauthLoginParams) ([]*http.C
 		}
 
 		// Ensure groups are correct.
+		// This places all groups into the default organization.
+		// To go multi-org, we need to add a mapping feature here to know which
+		// groups go to which orgs.
 		if params.UsingGroups {
 			filtered := params.Groups
 			if params.GroupFilter != nil {
-				// For each org, filter the groups.
-				for orgID, groups := range filtered {
-					filteredList := make([]string, 0, len(groups))
-					for _, group := range groups {
-						if params.GroupFilter.MatchString(group) {
-							filteredList = append(filteredList, group)
-						}
+				filtered = make([]string, 0, len(params.Groups))
+				for _, group := range params.Groups {
+					if params.GroupFilter.MatchString(group) {
+						filtered = append(filtered, group)
 					}
-					filtered[orgID] = filteredList
 				}
 			}
 
+			//nolint:gocritic // No user present in the context.
+			defaultOrganization, err := tx.GetDefaultOrganization(dbauthz.AsSystemRestricted(ctx))
+			if err != nil {
+				// If there is no default org, then we can't assign groups.
+				// By default, we assume all groups belong to the default org.
+				return xerrors.Errorf("get default organization: %w", err)
+			}
+
+			//nolint:gocritic // No user present in the context.
+			memberships, err := tx.GetOrganizationMembershipsByUserID(dbauthz.AsSystemRestricted(ctx), user.ID)
+			if err != nil {
+				return xerrors.Errorf("get organization memberships: %w", err)
+			}
+
+			inDefault := false
+			for _, membership := range memberships {
+				if membership.OrganizationID == defaultOrganization.ID {
+					inDefault = true
+					break
+				}
+			}
+
+			if !inDefault {
+				return xerrors.Errorf("user %s is not a member of the default organization, cannot assign to groups in the org", user.ID)
+			}
+
 			//nolint:gocritic
-			err := api.Options.SetUserGroups(dbauthz.AsSystemRestricted(ctx), logger, tx, user.ID, filtered, params.CreateMissingGroups)
+			err = api.Options.SetUserGroups(dbauthz.AsSystemRestricted(ctx), logger, tx, user.ID, map[uuid.UUID][]string{
+				defaultOrganization.ID: filtered,
+			}, params.CreateMissingGroups)
 			if err != nil {
 				return xerrors.Errorf("set user groups: %w", err)
 			}
