fix oidc, add test

coder · coadler · Oct 31, 2024 · Oct 30, 2024 · Oct 30, 2024 · Oct 30, 2024
commit 6fdb233058523c7cee71e0f96e7477326928e40f
diff --git a/coderd/audit/fields.go b/coderd/audit/fields.go
@@ -13,11 +13,15 @@ const (
 	BackgroundSubsystemDormancy BackgroundSubsystem = "dormancy"
 )
 
-func BackgroundTaskFields(ctx context.Context, logger slog.Logger, subsystem BackgroundSubsystem) []byte {
-	af := map[string]string{
+func BackgroundTaskFields(subsystem BackgroundSubsystem) map[string]string {
+	return map[string]string{
 		"automatic_actor":     "coder",
 		"automatic_subsystem": string(subsystem),
 	}
+}
+
+func BackgroundTaskFieldsBytes(ctx context.Context, logger slog.Logger, subsystem BackgroundSubsystem) []byte {
+	af := BackgroundTaskFields(subsystem)
 
 	wriBytes, err := json.Marshal(af)
 	if err != nil {

diff --git a/coderd/userauth.go b/coderd/userauth.go
@@ -613,15 +613,19 @@ func ActivateDormantUser(logger slog.Logger, auditor *atomic.Pointer[audit.Audit
 			return user, xerrors.Errorf("update user status: %w", err)
 		}
 
+		oldAuditUser := user
+		newAuditUser := user
+		newAuditUser.Status = database.UserStatusActive
+
 		audit.BackgroundAudit(ctx, &audit.BackgroundAuditParams[database.User]{
 			Audit:            *auditor.Load(),
 			Log:              logger,
 			UserID:           user.ID,
 			Action:           database.AuditActionWrite,
-			Old:              user,
-			New:              newUser,
+			Old:              oldAuditUser,
+			New:              newAuditUser,
 			Status:           http.StatusOK,
-			AdditionalFields: audit.BackgroundTaskFields(ctx, logger, audit.BackgroundSubsystemDormancy),
+			AdditionalFields: audit.BackgroundTaskFieldsBytes(ctx, logger, audit.BackgroundSubsystemDormancy),
 		})
 
 		return newUser, nil
@@ -1420,11 +1424,12 @@ func (api *API) oauthLogin(r *http.Request, params *oauthLoginParams) ([]*http.C
 		dormantConvertAudit  *audit.Request[database.User]
 		initDormantAuditOnce = sync.OnceFunc(func() {
 			dormantConvertAudit = params.initAuditRequest(&audit.RequestParams{
-				Audit:          auditor,
-				Log:            api.Logger,
-				Request:        r,
-				Action:         database.AuditActionWrite,
-				OrganizationID: uuid.Nil,
+				Audit:            auditor,
+				Log:              api.Logger,
+				Request:          r,
+				Action:           database.AuditActionWrite,
+				OrganizationID:   uuid.Nil,
+				AdditionalFields: audit.BackgroundTaskFields(audit.BackgroundSubsystemDormancy),
 			})
 		})
 	)
@@ -1543,6 +1548,7 @@ func (api *API) oauthLogin(r *http.Request, params *oauthLoginParams) ([]*http.C
 			// This is necessary because transactions can be retried, and we
 			// only want to add the audit log a single time.
 			initDormantAuditOnce()
+			dormantConvertAudit.UserID = user.ID
 			dormantConvertAudit.Old = user
 			//nolint:gocritic // System needs to update status of the user account (dormant -> active).
 			user, err = tx.UpdateUserStatus(dbauthz.AsSystemRestricted(ctx), database.UpdateUserStatusParams{

diff --git a/coderd/userauth_test.go b/coderd/userauth_test.go
@@ -1285,7 +1285,7 @@ func TestUserOIDC(t *testing.T) {
 				tc.AssertResponse(t, resp)
 			}
 
-			ctx := testutil.Context(t, testutil.WaitLong)
+			ctx := testutil.Context(t, testutil.WaitShort)
 
 			if tc.AssertUser != nil {
 				user, err := client.User(ctx, "me")
@@ -1300,6 +1300,49 @@ func TestUserOIDC(t *testing.T) {
 		})
 	}
 
+	t.Run("OIDCDormancy", func(t *testing.T) {
+		t.Parallel()
+		ctx := testutil.Context(t, testutil.WaitShort)
+
+		auditor := audit.NewMock()
+		fake := oidctest.NewFakeIDP(t,
+			oidctest.WithRefresh(func(_ string) error {
+				return xerrors.New("refreshing token should never occur")
+			}),
+			oidctest.WithServing(),
+		)
+		cfg := fake.OIDCConfig(t, nil, func(cfg *coderd.OIDCConfig) {
+			cfg.AllowSignups = true
+		})
+
+		logger := slogtest.Make(t, &slogtest.Options{IgnoreErrors: true}).Leveled(slog.LevelDebug)
+		owner, db := coderdtest.NewWithDatabase(t, &coderdtest.Options{
+			Auditor:    auditor,
+			OIDCConfig: cfg,
+			Logger:     &logger,
+		})
+
+		user := dbgen.User(t, db, database.User{
+			LoginType: database.LoginTypeOIDC,
+			Status:    database.UserStatusDormant,
+		})
+		auditor.ResetLogs()
+
+		client, resp := fake.AttemptLogin(t, owner, jwt.MapClaims{
+			"email": user.Email,
+		})
+		require.Equal(t, http.StatusOK, resp.StatusCode)
+
+		auditor.Contains(t, database.AuditLog{
+			ResourceType:     database.ResourceTypeUser,
+			AdditionalFields: json.RawMessage(`{"automatic_actor":"coder","automatic_subsystem":"dormancy"}`),
+		})
+		me, err := client.User(ctx, "me")
+		require.NoError(t, err)
+
+		require.Equal(t, codersdk.UserStatusActive, me.Status)
+	})
+
 	t.Run("OIDCConvert", func(t *testing.T) {
 		t.Parallel()
 

diff --git a/enterprise/coderd/dormancy/dormantusersjob.go b/enterprise/coderd/dormancy/dormantusersjob.go
@@ -59,7 +59,7 @@ func CheckInactiveUsersWithOptions(ctx context.Context, logger slog.Logger, clk
 				Old:              database.User{ID: u.ID, Username: u.Username, Status: database.UserStatusActive},
 				New:              database.User{ID: u.ID, Username: u.Username, Status: database.UserStatusDormant},
 				Status:           http.StatusOK,
-				AdditionalFields: audit.BackgroundTaskFields(ctx, logger, audit.BackgroundSubsystemDormancy),
+				AdditionalFields: audit.BackgroundTaskFieldsBytes(ctx, logger, audit.BackgroundSubsystemDormancy),
 			})
 		}
 		logger.Debug(ctx, "checking user accounts is done", slog.F("num_dormant_accounts", len(updatedUsers)), slog.F("execution_time", time.Since(startTime)))