Skip to content

Commit f74532f

Browse files
code-ashercode-asher
authored
feat: audit oauth2 app management (coder#12275)
* Audit oauth2 app management * Use 201 for creating secrets
1 parent 6b866b3 commit f74532f

File tree

16 files changed

+212
-59
lines changed

16 files changed

+212
-59
lines changed

‎coderd/apidoc/docs.go

Lines changed: 6 additions & 2 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎coderd/apidoc/swagger.json

Lines changed: 6 additions & 2 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎coderd/audit.go

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -333,6 +333,22 @@ func (api *API) auditLogIsResourceDeleted(ctx context.Context, alog database.Get
333333
api.Logger.Error(ctx, "unable to fetch workspace", slog.Error(err))
334334
}
335335
return workspace.Deleted
336+
case database.ResourceTypeOauth2ProviderApp:
337+
_, err := api.Database.GetOAuth2ProviderAppByID(ctx, alog.ResourceID)
338+
if xerrors.Is(err, sql.ErrNoRows) {
339+
return true
340+
} else if err != nil {
341+
api.Logger.Error(ctx, "unable to fetch oauth2 app", slog.Error(err))
342+
}
343+
return false
344+
case database.ResourceTypeOauth2ProviderAppSecret:
345+
_, err := api.Database.GetOAuth2ProviderAppSecretByID(ctx, alog.ResourceID)
346+
if xerrors.Is(err, sql.ErrNoRows) {
347+
return true
348+
} else if err != nil {
349+
api.Logger.Error(ctx, "unable to fetch oauth2 app secret", slog.Error(err))
350+
}
351+
return false
336352
default:
337353
return false
338354
}
@@ -379,6 +395,16 @@ func (api *API) auditLogResourceLink(ctx context.Context, alog database.GetAudit
379395
return fmt.Sprintf("/@%s/%s/builds/%s",
380396
workspaceOwner.Username, additionalFields.WorkspaceName, additionalFields.BuildNumber)
381397

398+
case database.ResourceTypeOauth2ProviderApp:
399+
return fmt.Sprintf("/deployment/oauth2-provider/apps/%s", alog.ResourceID)
400+
401+
case database.ResourceTypeOauth2ProviderAppSecret:
402+
secret, err := api.Database.GetOAuth2ProviderAppSecretByID(ctx, alog.ResourceID)
403+
if err != nil {
404+
return ""
405+
}
406+
return fmt.Sprintf("/deployment/oauth2-provider/apps/%s", secret.AppID)
407+
382408
default:
383409
return ""
384410
}

‎coderd/audit/diff.go

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,9 @@ type Auditable interface {
1919
database.License |
2020
database.WorkspaceProxy |
2121
database.AuditOAuthConvertState |
22-
database.HealthSettings
22+
database.HealthSettings |
23+
database.OAuth2ProviderApp |
24+
database.OAuth2ProviderAppSecret
2325
}
2426

2527
// Map is a map of changed fields in an audited resource. It maps field names to

‎coderd/audit/request.go

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -99,6 +99,10 @@ func ResourceTarget[T Auditable](tgt T) string {
9999
return string(typed.ToLoginType)
100100
case database.HealthSettings:
101101
return "" // no target?
102+
case database.OAuth2ProviderApp:
103+
return typed.Name
104+
case database.OAuth2ProviderAppSecret:
105+
return typed.DisplaySecret
102106
default:
103107
panic(fmt.Sprintf("unknown resource %T for ResourceTarget", tgt))
104108
}
@@ -132,6 +136,10 @@ func ResourceID[T Auditable](tgt T) uuid.UUID {
132136
case database.HealthSettings:
133137
// Artificial ID for auditing purposes
134138
return typed.ID
139+
case database.OAuth2ProviderApp:
140+
return typed.ID
141+
case database.OAuth2ProviderAppSecret:
142+
return typed.ID
135143
default:
136144
panic(fmt.Sprintf("unknown resource %T for ResourceID", tgt))
137145
}
@@ -163,6 +171,10 @@ func ResourceType[T Auditable](tgt T) database.ResourceType {
163171
return database.ResourceTypeConvertLogin
164172
case database.HealthSettings:
165173
return database.ResourceTypeHealthSettings
174+
case database.OAuth2ProviderApp:
175+
return database.ResourceTypeOauth2ProviderApp
176+
case database.OAuth2ProviderAppSecret:
177+
return database.ResourceTypeOauth2ProviderAppSecret
166178
default:
167179
panic(fmt.Sprintf("unknown resource %T for ResourceType", typed))
168180
}
@@ -195,6 +207,10 @@ func ResourceRequiresOrgID[T Auditable]() bool {
195207
case database.HealthSettings:
196208
// Artificial ID for auditing purposes
197209
return false
210+
case database.OAuth2ProviderApp:
211+
return false
212+
case database.OAuth2ProviderAppSecret:
213+
return false
198214
default:
199215
panic(fmt.Sprintf("unknown resource %T for ResourceRequiresOrgID", tgt))
200216
}

‎coderd/database/dump.sql

Lines changed: 3 additions & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎coderd/database/migrations/000197_oauth2_provider_app_audit.down.sql

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
-- It is not possible to drop enum values from enum types, so the UPs on
2+
-- resource_type have "IF NOT EXISTS".

‎coderd/database/migrations/000197_oauth2_provider_app_audit.up.sql

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
ALTER TYPE resource_type ADD VALUE IF NOT EXISTS 'oauth2_provider_app';
2+
ALTER TYPE resource_type ADD VALUE IF NOT EXISTS 'oauth2_provider_app_secret';

‎coderd/database/models.go

Lines changed: 20 additions & 14 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎codersdk/audit.go

Lines changed: 20 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -14,19 +14,22 @@ import (
1414
type ResourceType string
1515

1616
const (
17-
ResourceTypeTemplate ResourceType = "template"
18-
ResourceTypeTemplateVersion ResourceType = "template_version"
19-
ResourceTypeUser ResourceType = "user"
20-
ResourceTypeWorkspace ResourceType = "workspace"
21-
ResourceTypeWorkspaceBuild ResourceType = "workspace_build"
22-
ResourceTypeGitSSHKey ResourceType = "git_ssh_key"
23-
ResourceTypeAPIKey ResourceType = "api_key"
24-
ResourceTypeGroup ResourceType = "group"
25-
ResourceTypeLicense ResourceType = "license"
26-
ResourceTypeConvertLogin ResourceType = "convert_login"
27-
ResourceTypeHealthSettings ResourceType = "health_settings"
28-
ResourceTypeWorkspaceProxy ResourceType = "workspace_proxy"
29-
ResourceTypeOrganization ResourceType = "organization"
17+
ResourceTypeTemplate ResourceType = "template"
18+
ResourceTypeTemplateVersion ResourceType = "template_version"
19+
ResourceTypeUser ResourceType = "user"
20+
ResourceTypeWorkspace ResourceType = "workspace"
21+
ResourceTypeWorkspaceBuild ResourceType = "workspace_build"
22+
ResourceTypeGitSSHKey ResourceType = "git_ssh_key"
23+
ResourceTypeAPIKey ResourceType = "api_key"
24+
ResourceTypeGroup ResourceType = "group"
25+
ResourceTypeLicense ResourceType = "license"
26+
ResourceTypeConvertLogin ResourceType = "convert_login"
27+
ResourceTypeHealthSettings ResourceType = "health_settings"
28+
ResourceTypeWorkspaceProxy ResourceType = "workspace_proxy"
29+
ResourceTypeOrganization ResourceType = "organization"
30+
ResourceTypeOAuth2ProviderApp ResourceType = "oauth2_provider_app"
31+
// nolint:gosec // This is not a secret.
32+
ResourceTypeOAuth2ProviderAppSecret ResourceType = "oauth2_provider_app_secret"
3033
)
3134

3235
func (r ResourceType) FriendlyString() string {
@@ -59,6 +62,10 @@ func (r ResourceType) FriendlyString() string {
5962
return "organization"
6063
case ResourceTypeHealthSettings:
6164
return "health_settings"
65+
case ResourceTypeOAuth2ProviderApp:
66+
return "oauth2 app"
67+
case ResourceTypeOAuth2ProviderAppSecret:
68+
return "oauth2 app secret"
6269
default:
6370
return "unknown"
6471
}

‎codersdk/oauth2.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -159,7 +159,7 @@ func (c *Client) PostOAuth2ProviderAppSecret(ctx context.Context, appID uuid.UUI
159159
return OAuth2ProviderAppSecretFull{}, err
160160
}
161161
defer res.Body.Close()
162-
if res.StatusCode != http.StatusOK {
162+
if res.StatusCode != http.StatusCreated {
163163
return OAuth2ProviderAppSecretFull{}, ReadBodyAsError(res)
164164
}
165165
var resp OAuth2ProviderAppSecretFull

0 commit comments

Comments
 (0)