fix(scim): ensure scim users aren't created with their own org

coadler · coadler · commit e2681d74af18 · 2023-05-18T21:39:05.000Z
diff --git a/coderd/users.go b/coderd/users.go
@@ -128,7 +128,8 @@ func (api *API) postFirstUser(rw http.ResponseWriter, r *http.Request) {
 			// Create an org for the first user.
 			OrganizationID: uuid.Nil,
 		},
-		LoginType: database.LoginTypePassword,
+		CreateOrganization: true,
+		LoginType:          database.LoginTypePassword,
 	})
 	if err != nil {
 		httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{
@@ -313,19 +314,38 @@ func (api *API) postUser(rw http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	_, err = api.Database.GetOrganizationByID(ctx, req.OrganizationID)
-	if httpapi.Is404Error(err) {
-		httpapi.Write(ctx, rw, http.StatusNotFound, codersdk.Response{
-			Message: fmt.Sprintf("Organization does not exist with the provided id %q.", req.OrganizationID),
-		})
-		return
-	}
-	if err != nil {
-		httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{
-			Message: "Internal error fetching organization.",
-			Detail:  err.Error(),
-		})
-		return
+	if req.OrganizationID != uuid.Nil {
+		_, err := api.Database.GetOrganizationByID(ctx, req.OrganizationID)
+		if err != nil {
+			if httpapi.Is404Error(err) {
+				httpapi.Write(ctx, rw, http.StatusNotFound, codersdk.Response{
+					Message: fmt.Sprintf("Organization does not exist with the provided id %q.", req.OrganizationID),
+				})
+				return
+			}
+
+			httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{
+				Message: "Internal error fetching organization.",
+				Detail:  err.Error(),
+			})
+			return
+		}
+	} else {
+		organizations, err := api.Database.GetOrganizations(ctx)
+		if err != nil {
+			httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{
+				Message: "Internal error fetching user.",
+				Detail:  err.Error(),
+			})
+			return
+		}
+
+		if len(organizations) > 0 {
+			// Add the user to the first organization. Once multi-organization
+			// support is added, we should enable a configuration map of user
+			// email to organization.
+			req.OrganizationID = organizations[0].ID
+		}
 	}
 
 	err = userpassword.Validate(req.Password)
@@ -955,7 +975,8 @@ func (api *API) organizationByUserAndName(rw http.ResponseWriter, r *http.Reques
 
 type CreateUserRequest struct {
 	codersdk.CreateUserRequest
-	LoginType database.LoginType
+	CreateOrganization bool
+	LoginType          database.LoginType
 }
 
 func (api *API) CreateUser(ctx context.Context, store database.Store, req CreateUserRequest) (database.User, uuid.UUID, error) {
@@ -964,6 +985,10 @@ func (api *API) CreateUser(ctx context.Context, store database.Store, req Create
 		orgRoles := make([]string, 0)
 		// If no organization is provided, create a new one for the user.
 		if req.OrganizationID == uuid.Nil {
+			if !req.CreateOrganization {
+				return xerrors.Errorf("organization ID must be provided")
+			}
+
 			organization, err := tx.InsertOrganization(ctx, database.InsertOrganizationParams{
 				ID:        uuid.New(),
 				Name:      req.Username,
diff --git a/enterprise/coderd/scim.go b/enterprise/coderd/scim.go
@@ -156,11 +156,27 @@ func (api *API) scimPostUser(rw http.ResponseWriter, r *http.Request) {
 		return
 	}
 
+	var organizationID uuid.UUID
+	//nolint:gocritic
+	organizations, err := api.Database.GetOrganizations(dbauthz.AsSystemRestricted(ctx))
+	if err != nil {
+		_ = handlerutil.WriteError(rw, err)
+		return
+	}
+
+	if len(organizations) > 0 {
+		// Add the user to the first organization. Once multi-organization
+		// support is added, we should enable a configuration map of user
+		// email to organization.
+		organizationID = organizations[0].ID
+	}
+
 	//nolint:gocritic // needed for SCIM
 	user, _, err := api.AGPL.CreateUser(dbauthz.AsSystemRestricted(ctx), api.Database, agpl.CreateUserRequest{
 		CreateUserRequest: codersdk.CreateUserRequest{
-			Username: sUser.UserName,
-			Email:    email,
+			Username:       sUser.UserName,
+			Email:          email,
+			OrganizationID: organizationID,
 		},
 		LoginType: database.LoginTypeOIDC,
 	})
