Skip to content

chore: support multi-org group sync with runtime configuration #14578

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 38 commits into from
Sep 11, 2024
Merged
Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
38 commits
Select commit Hold shift + click to select a range
99c97c2
wip
Emyrk Sep 3, 2024
bfddeb6
begin group sync main work
Emyrk Sep 3, 2024
f2857c6
initial implementation of group sync
Emyrk Sep 3, 2024
791a059
work on moving to the manager
Emyrk Sep 4, 2024
4326e9d
fixup compile issues
Emyrk Sep 4, 2024
6d3ed2e
fixup some tests
Emyrk Sep 4, 2024
0803619
handle allow list
Emyrk Sep 4, 2024
596e7b4
WIP unit test for group sync
Emyrk Sep 4, 2024
b9476ac
fixup tests, account for existing groups
Emyrk Sep 4, 2024
ee8e4e4
fix compile issues
Emyrk Sep 5, 2024
d5ff0f7
add comment for test helper
Emyrk Sep 5, 2024
86c0f6f
handle legacy params
Emyrk Sep 5, 2024
2f03e18
make gen
Emyrk Sep 5, 2024
ec8092d
cleanup
Emyrk Sep 5, 2024
d63727d
add unit test for legacy behavior
Emyrk Sep 5, 2024
2a1769c
work on batching removal by name or id
Emyrk Sep 5, 2024
640e86e
group sync adjustments
Emyrk Sep 5, 2024
c544a29
test legacy params
Emyrk Sep 5, 2024
476be45
add unit test for ApplyGroupDifference
Emyrk Sep 5, 2024
164aeac
chore: remove old group sync code
Emyrk Sep 5, 2024
986498d
switch oidc test config to deployment values
Emyrk Sep 5, 2024
290cfa5
fix err name
Emyrk Sep 6, 2024
c563b10
some linting cleanup
Emyrk Sep 6, 2024
d2c247f
dbauthz test for new query
Emyrk Sep 6, 2024
12685bd
fixup comments
Emyrk Sep 6, 2024
bf0d4ed
fixup compile issues from rebase
Emyrk Sep 6, 2024
f95128e
add test for disabled sync
Emyrk Sep 6, 2024
88b0ad9
linting
Emyrk Sep 6, 2024
6491f6a
chore: handle db conflicts gracefully
Emyrk Sep 6, 2024
bd23288
test expected group equality
Emyrk Sep 6, 2024
a390ec4
cleanup comments
Emyrk Sep 6, 2024
a0a1c53
spelling mistake
Emyrk Sep 6, 2024
a86ba83
linting:
Emyrk Sep 6, 2024
0df7f28
add interface method to allow api crud
Emyrk Sep 9, 2024
7a802a9
Remove testable example
Emyrk Sep 11, 2024
611f1e3
fix formatting of sql, add a comment
Emyrk Sep 11, 2024
7f28a53
remove function only used in 1 place
Emyrk Sep 11, 2024
41994d2
make fmt
Emyrk Sep 11, 2024
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
cleanup
  • Loading branch information
Emyrk committed Sep 9, 2024
commit ec8092d25c3fe8c81edef30afb2af9790c9117a1
2 changes: 1 addition & 1 deletion coderd/coderdtest/uuids_test.go
Original file line number Diff line number Diff line change
Expand Up @@ -26,7 +26,7 @@ func ExampleNewDeterministicUUIDGenerator() {

for _, tc := range testCases {
tc := tc
var _ = tc
_ = tc
// Do the test with CreateUsers as the setup, and the expected IDs
// will match.
}
Expand Down
6 changes: 5 additions & 1 deletion coderd/database/dbauthz/dbauthz.go
Original file line number Diff line number Diff line change
Expand Up @@ -3109,7 +3109,11 @@ func (q *querier) RemoveUserFromAllGroups(ctx context.Context, userID uuid.UUID)
}

func (q *querier) RemoveUserFromGroups(ctx context.Context, arg database.RemoveUserFromGroupsParams) ([]uuid.UUID, error) {
panic("not implemented")
// This is a system function to clear user groups in group sync.
if err := q.authorizeContext(ctx, policy.ActionUpdate, rbac.ResourceSystem); err != nil {
return nil, err
}
return q.db.RemoveUserFromGroups(ctx, arg)
}

func (q *querier) RevokeDBCryptKey(ctx context.Context, activeKeyDigest string) error {
Expand Down
4 changes: 2 additions & 2 deletions coderd/database/dbmem/dbmem.go
Original file line number Diff line number Diff line change
Expand Up @@ -7015,7 +7015,7 @@ func (q *FakeQuerier) InsertUser(_ context.Context, arg database.InsertUserParam
return user, nil
}

func (q *FakeQuerier) InsertUserGroupsByID(ctx context.Context, arg database.InsertUserGroupsByIDParams) ([]uuid.UUID, error) {
func (q *FakeQuerier) InsertUserGroupsByID(_ context.Context, arg database.InsertUserGroupsByIDParams) ([]uuid.UUID, error) {
err := validateDatabaseType(arg)
if err != nil {
return nil, err
Expand Down Expand Up @@ -7637,7 +7637,7 @@ func (q *FakeQuerier) RemoveUserFromAllGroups(_ context.Context, userID uuid.UUI
return nil
}

func (q *FakeQuerier) RemoveUserFromGroups(ctx context.Context, arg database.RemoveUserFromGroupsParams) ([]uuid.UUID, error) {
func (q *FakeQuerier) RemoveUserFromGroups(_ context.Context, arg database.RemoveUserFromGroupsParams) ([]uuid.UUID, error) {
err := validateDatabaseType(arg)
if err != nil {
return nil, err
Expand Down
8 changes: 7 additions & 1 deletion coderd/idpsync/group.go
Original file line number Diff line number Diff line change
Expand Up @@ -54,7 +54,7 @@ func (s AGPLIDPSync) SyncGroups(ctx context.Context, db database.Store, user dat
// nolint:gocritic // all syncing is done as a system user
ctx = dbauthz.AsSystemRestricted(ctx)

db.InTx(func(tx database.Store) error {
err := db.InTx(func(tx database.Store) error {
userGroups, err := tx.GetGroups(ctx, database.GetGroupsParams{
HasMemberID: user.ID,
})
Expand Down Expand Up @@ -188,6 +188,10 @@ func (s AGPLIDPSync) SyncGroups(ctx context.Context, db database.Store, user dat
return nil
}, nil)

if err != nil {
return err
}

return nil
}

Expand All @@ -208,13 +212,15 @@ type GroupSyncSettings struct {
func (s *GroupSyncSettings) Set(v string) error {
return json.Unmarshal([]byte(v), s)
}

func (s *GroupSyncSettings) String() string {
v, err := json.Marshal(s)
if err != nil {
return "decode failed: " + err.Error()
}
return string(v)
}

func (s *GroupSyncSettings) Type() string {
return "GroupSyncSettings"
}
Expand Down
1 change: 0 additions & 1 deletion coderd/idpsync/idpsync.go
Original file line number Diff line number Diff line change
Expand Up @@ -100,7 +100,6 @@ func FromDeploymentValues(dv *codersdk.DeploymentValues) DeploymentSyncSettings
CreateMissingGroups: dv.OIDC.GroupAutoCreate.Value(),
},
}

}

type SyncSettings struct {
Expand Down
6 changes: 3 additions & 3 deletions enterprise/coderd/enidpsync/groups_test.go
Original file line number Diff line number Diff line change
Expand Up @@ -30,7 +30,7 @@ func TestEnterpriseParseGroupClaims(t *testing.T) {
t.Parallel()

s := enidpsync.NewSync(slogtest.Make(t, &slogtest.Options{}),
runtimeconfig.NewNoopManager(),
runtimeconfig.NewStoreManager(),
entitlements.New(),
idpsync.DeploymentSyncSettings{})

Expand All @@ -46,7 +46,7 @@ func TestEnterpriseParseGroupClaims(t *testing.T) {
t.Parallel()

s := enidpsync.NewSync(slogtest.Make(t, &slogtest.Options{}),
runtimeconfig.NewNoopManager(),
runtimeconfig.NewStoreManager(),
entitled,
idpsync.DeploymentSyncSettings{
GroupField: "groups",
Expand Down Expand Up @@ -74,7 +74,7 @@ func TestEnterpriseParseGroupClaims(t *testing.T) {
t.Parallel()

s := enidpsync.NewSync(slogtest.Make(t, &slogtest.Options{}),
runtimeconfig.NewNoopManager(),
runtimeconfig.NewStoreManager(),
entitled,
idpsync.DeploymentSyncSettings{
GroupField: "groups",
Expand Down