opensource/coder
3
0
Fork 0
mirror of https://github.com/coder/coder.git synced 2026-09-24 15:04:27 +08:00
Code Issues Packages Projects Releases Wiki Activity

chore: rename git_auth to external_auth in our schema (#9935)

Browse Source 
* chore: rename `git_auth` to `external_auth` in our schema

We're changing Git auth to be external auth. It will support
any OAuth2 or OIDC provider.

To split up the larger change I want to contribute the schema
changes first, and I'll add the feature itself in another PR.

* Fix names

* Fix outdated view

* Rename some additional places

* Fix sort order

* Fix template versions auth route

* Fix types

* Fix dbauthz
This commit is contained in:
Kyle Carberry
2023-09-29 19:13:20 +00:00
committed by GitHub
parent 2b5428e95f
commit 8abca9bea7
67 changed files with 1441 additions and 1363 deletions
Download Patch File Download Diff File Expand all files Collapse all files
enterprise/audit/table.go
+13 -13
View File
@@ -86,19 +86,19 @@ var auditableResourcesTypes = map[any]map[string]Action{
"time_til_dormant_autodelete": ActionTrack,
},
&database.TemplateVersion{}: {
"id": ActionTrack,
"template_id": ActionTrack,
"organization_id": ActionIgnore, // Never changes.
"created_at": ActionIgnore, // Never changes, but is implicit and not helpful in a diff.
"updated_at": ActionIgnore, // Changes, but is implicit and not helpful in a diff.
"name": ActionTrack,
"message": ActionIgnore, // Never changes after creation.
"readme": ActionTrack,
"job_id": ActionIgnore, // Not helpful in a diff because jobs aren't tracked in audit logs.
"created_by": ActionTrack,
"git_auth_providers": ActionIgnore, // Not helpful because this can only change when new versions are added.
"created_by_avatar_url": ActionIgnore,
"created_by_username": ActionIgnore,
"id": ActionTrack,
"template_id": ActionTrack,
"organization_id": ActionIgnore, // Never changes.
"created_at": ActionIgnore, // Never changes, but is implicit and not helpful in a diff.
"updated_at": ActionIgnore, // Changes, but is implicit and not helpful in a diff.
"name": ActionTrack,
"message": ActionIgnore, // Never changes after creation.
"readme": ActionTrack,
"job_id": ActionIgnore, // Not helpful in a diff because jobs aren't tracked in audit logs.
"created_by": ActionTrack,
"external_auth_providers": ActionIgnore, // Not helpful because this can only change when new versions are added.
"created_by_avatar_url": ActionIgnore,
"created_by_username": ActionIgnore,
},
&database.User{}: {
"id": ActionTrack,
enterprise/cli/server_dbcrypt_test.go
+3 -3
View File
@@ -195,7 +195,7 @@ func TestServerDBCrypt(t *testing.T) {
userLinks, err := db.GetUserLinksByUserID(ctx, usr.ID)
require.NoError(t, err, "failed to get user links for user %s", usr.ID)
require.Empty(t, userLinks)
gitAuthLinks, err := db.GetGitAuthLinksByUserID(ctx, usr.ID)
gitAuthLinks, err := db.GetExternalAuthLinksByUserID(ctx, usr.ID)
require.NoError(t, err, "failed to get git auth links for user %s", usr.ID)
require.Empty(t, gitAuthLinks)
}
@@ -222,7 +222,7 @@ func genData(t *testing.T, db database.Store) []database.User {
Status: status,
Deleted: deleted,
})
_ = dbgen.GitAuthLink(t, db, database.GitAuthLink{
_ = dbgen.ExternalAuthLink(t, db, database.ExternalAuthLink{
UserID: usr.ID,
ProviderID: "fake",
OAuthAccessToken: "access-" + usr.ID.String(),
@@ -277,7 +277,7 @@ func requireEncryptedWithCipher(ctx context.Context, t *testing.T, db database.S
require.Equal(t, c.HexDigest(), ul.OAuthAccessTokenKeyID.String)
require.Equal(t, c.HexDigest(), ul.OAuthRefreshTokenKeyID.String)
}
gitAuthLinks, err := db.GetGitAuthLinksByUserID(ctx, userID)
gitAuthLinks, err := db.GetExternalAuthLinksByUserID(ctx, userID)
require.NoError(t, err, "failed to get git auth links for user %s", userID)
for _, gal := range gitAuthLinks {
requireEncryptedEquals(t, c, "access-"+userID.String(), gal.OAuthAccessToken)
enterprise/coderd/coderd.go
+2 -2
View File
@@ -460,12 +460,12 @@ func (api *API) updateEntitlements(ctx context.Context) error {
entitlements, err := license.Entitlements(
ctx, api.Database,
api.Logger, len(api.replicaManager.AllPrimary()), len(api.GitAuthConfigs), api.LicenseKeys, map[codersdk.FeatureName]bool{
api.Logger, len(api.replicaManager.AllPrimary()), len(api.ExternalAuthConfigs), api.LicenseKeys, map[codersdk.FeatureName]bool{
codersdk.FeatureAuditLog: api.AuditLogging,
codersdk.FeatureBrowserOnly: api.BrowserOnly,
codersdk.FeatureSCIM: len(api.SCIMAPIKey) != 0,
codersdk.FeatureHighAvailability: api.DERPServerRelayAddress != "",
codersdk.FeatureMultipleGitAuth: len(api.GitAuthConfigs) > 1,
codersdk.FeatureMultipleGitAuth: len(api.ExternalAuthConfigs) > 1,
codersdk.FeatureTemplateRBAC: api.RBAC,
codersdk.FeatureExternalTokenEncryption: len(api.ExternalTokenEncryption) > 0,
codersdk.FeatureExternalProvisionerDaemons: true,
enterprise/coderd/provisionerdaemons.go
+2 -2
View File
@@ -259,8 +259,8 @@ func (api *API) provisionerDaemonServe(rw http.ResponseWriter, r *http.Request)
api.AGPL.UserQuietHoursScheduleStore,
api.DeploymentValues,
provisionerdserver.Options{
GitAuthConfigs: api.GitAuthConfigs,
OIDCConfig: api.OIDCConfig,
ExternalAuthConfigs: api.ExternalAuthConfigs,
OIDCConfig: api.OIDCConfig,
},
)
if err != nil {
enterprise/dbcrypt/cliutil.go
+5 -5
View File
@@ -46,7 +46,7 @@ func Rotate(ctx context.Context, log slog.Logger, sqlDB *sql.DB, ciphers []Ciphe
}
}
gitAuthLinks, err := tx.GetGitAuthLinksByUserID(ctx, uid)
gitAuthLinks, err := tx.GetExternalAuthLinksByUserID(ctx, uid)
if err != nil {
return xerrors.Errorf("get git auth links for user: %w", err)
}
@@ -55,7 +55,7 @@ func Rotate(ctx context.Context, log slog.Logger, sqlDB *sql.DB, ciphers []Ciphe
log.Debug(ctx, "skipping git auth link", slog.F("user_id", uid), slog.F("current", idx+1), slog.F("cipher", ciphers[0].HexDigest()))
continue
}
if _, err := tx.UpdateGitAuthLink(ctx, database.UpdateGitAuthLinkParams{
if _, err := tx.UpdateExternalAuthLink(ctx, database.UpdateExternalAuthLinkParams{
ProviderID: gitAuthLink.ProviderID,
UserID: uid,
UpdatedAt: gitAuthLink.UpdatedAt,
@@ -130,7 +130,7 @@ func Decrypt(ctx context.Context, log slog.Logger, sqlDB *sql.DB, ciphers []Ciph
}
}
gitAuthLinks, err := tx.GetGitAuthLinksByUserID(ctx, uid)
gitAuthLinks, err := tx.GetExternalAuthLinksByUserID(ctx, uid)
if err != nil {
return xerrors.Errorf("get git auth links for user: %w", err)
}
@@ -139,7 +139,7 @@ func Decrypt(ctx context.Context, log slog.Logger, sqlDB *sql.DB, ciphers []Ciph
log.Debug(ctx, "skipping git auth link", slog.F("user_id", uid), slog.F("current", idx+1))
continue
}
if _, err := tx.UpdateGitAuthLink(ctx, database.UpdateGitAuthLinkParams{
if _, err := tx.UpdateExternalAuthLink(ctx, database.UpdateExternalAuthLinkParams{
ProviderID: gitAuthLink.ProviderID,
UserID: uid,
UpdatedAt: gitAuthLink.UpdatedAt,
@@ -177,7 +177,7 @@ BEGIN;
DELETE FROM user_links
WHERE oauth_access_token_key_id IS NOT NULL
OR oauth_refresh_token_key_id IS NOT NULL;
DELETE FROM git_auth_links
DELETE FROM external_auth_links
WHERE oauth_access_token_key_id IS NOT NULL
OR oauth_refresh_token_key_id IS NOT NULL;
COMMIT;
enterprise/dbcrypt/dbcrypt.go
+21 -21
View File
@@ -191,42 +191,42 @@ func (db *dbCrypt) UpdateUserLink(ctx context.Context, params database.UpdateUse
return link, nil
}
func (db *dbCrypt) InsertGitAuthLink(ctx context.Context, params database.InsertGitAuthLinkParams) (database.GitAuthLink, error) {
func (db *dbCrypt) InsertExternalAuthLink(ctx context.Context, params database.InsertExternalAuthLinkParams) (database.ExternalAuthLink, error) {
if err := db.encryptField(&params.OAuthAccessToken, &params.OAuthAccessTokenKeyID); err != nil {
return database.GitAuthLink{}, err
return database.ExternalAuthLink{}, err
}
if err := db.encryptField(&params.OAuthRefreshToken, &params.OAuthRefreshTokenKeyID); err != nil {
return database.GitAuthLink{}, err
return database.ExternalAuthLink{}, err
}
link, err := db.Store.InsertGitAuthLink(ctx, params)
link, err := db.Store.InsertExternalAuthLink(ctx, params)
if err != nil {
return database.GitAuthLink{}, err
return database.ExternalAuthLink{}, err
}
if err := db.decryptField(&link.OAuthAccessToken, link.OAuthAccessTokenKeyID); err != nil {
return database.GitAuthLink{}, err
return database.ExternalAuthLink{}, err
}
if err := db.decryptField(&link.OAuthRefreshToken, link.OAuthRefreshTokenKeyID); err != nil {
return database.GitAuthLink{}, err
return database.ExternalAuthLink{}, err
}
return link, nil
}
func (db *dbCrypt) GetGitAuthLink(ctx context.Context, params database.GetGitAuthLinkParams) (database.GitAuthLink, error) {
link, err := db.Store.GetGitAuthLink(ctx, params)
func (db *dbCrypt) GetExternalAuthLink(ctx context.Context, params database.GetExternalAuthLinkParams) (database.ExternalAuthLink, error) {
link, err := db.Store.GetExternalAuthLink(ctx, params)
if err != nil {
return database.GitAuthLink{}, err
return database.ExternalAuthLink{}, err
}
if err := db.decryptField(&link.OAuthAccessToken, link.OAuthAccessTokenKeyID); err != nil {
return database.GitAuthLink{}, err
return database.ExternalAuthLink{}, err
}
if err := db.decryptField(&link.OAuthRefreshToken, link.OAuthRefreshTokenKeyID); err != nil {
return database.GitAuthLink{}, err
return database.ExternalAuthLink{}, err
}
return link, nil
}
func (db *dbCrypt) GetGitAuthLinksByUserID(ctx context.Context, userID uuid.UUID) ([]database.GitAuthLink, error) {
links, err := db.Store.GetGitAuthLinksByUserID(ctx, userID)
func (db *dbCrypt) GetExternalAuthLinksByUserID(ctx context.Context, userID uuid.UUID) ([]database.ExternalAuthLink, error) {
links, err := db.Store.GetExternalAuthLinksByUserID(ctx, userID)
if err != nil {
return nil, err
}
@@ -241,22 +241,22 @@ func (db *dbCrypt) GetGitAuthLinksByUserID(ctx context.Context, userID uuid.UUID
return links, nil
}
func (db *dbCrypt) UpdateGitAuthLink(ctx context.Context, params database.UpdateGitAuthLinkParams) (database.GitAuthLink, error) {
func (db *dbCrypt) UpdateExternalAuthLink(ctx context.Context, params database.UpdateExternalAuthLinkParams) (database.ExternalAuthLink, error) {
if err := db.encryptField(&params.OAuthAccessToken, &params.OAuthAccessTokenKeyID); err != nil {
return database.GitAuthLink{}, err
return database.ExternalAuthLink{}, err
}
if err := db.encryptField(&params.OAuthRefreshToken, &params.OAuthRefreshTokenKeyID); err != nil {
return database.GitAuthLink{}, err
return database.ExternalAuthLink{}, err
}
link, err := db.Store.UpdateGitAuthLink(ctx, params)
link, err := db.Store.UpdateExternalAuthLink(ctx, params)
if err != nil {
return database.GitAuthLink{}, err
return database.ExternalAuthLink{}, err
}
if err := db.decryptField(&link.OAuthAccessToken, link.OAuthAccessTokenKeyID); err != nil {
return database.GitAuthLink{}, err
return database.ExternalAuthLink{}, err
}
if err := db.decryptField(&link.OAuthRefreshToken, link.OAuthRefreshTokenKeyID); err != nil {
return database.GitAuthLink{}, err
return database.ExternalAuthLink{}, err
}
return link, nil
}
enterprise/dbcrypt/dbcrypt_internal_test.go
+19 -19
View File
@@ -220,21 +220,21 @@ func TestUserLinks(t *testing.T) {
})
}
func TestGitAuthLinks(t *testing.T) {
func TestExternalAuthLinks(t *testing.T) {
t.Parallel()
ctx := context.Background()
t.Run("InsertGitAuthLink", func(t *testing.T) {
t.Run("InsertExternalAuthLink", func(t *testing.T) {
t.Parallel()
db, crypt, ciphers := setup(t)
link := dbgen.GitAuthLink(t, crypt, database.GitAuthLink{
link := dbgen.ExternalAuthLink(t, crypt, database.ExternalAuthLink{
OAuthAccessToken: "access",
OAuthRefreshToken: "refresh",
})
require.Equal(t, "access", link.OAuthAccessToken)
require.Equal(t, "refresh", link.OAuthRefreshToken)
link, err := db.GetGitAuthLink(ctx, database.GetGitAuthLinkParams{
link, err := db.GetExternalAuthLink(ctx, database.GetExternalAuthLinkParams{
ProviderID: link.ProviderID,
UserID: link.UserID,
})
@@ -243,11 +243,11 @@ func TestGitAuthLinks(t *testing.T) {
requireEncryptedEquals(t, ciphers[0], link.OAuthRefreshToken, "refresh")
})
t.Run("UpdateGitAuthLink", func(t *testing.T) {
t.Run("UpdateExternalAuthLink", func(t *testing.T) {
t.Parallel()
db, crypt, ciphers := setup(t)
link := dbgen.GitAuthLink(t, crypt, database.GitAuthLink{})
updated, err := crypt.UpdateGitAuthLink(ctx, database.UpdateGitAuthLinkParams{
link := dbgen.ExternalAuthLink(t, crypt, database.ExternalAuthLink{})
updated, err := crypt.UpdateExternalAuthLink(ctx, database.UpdateExternalAuthLinkParams{
ProviderID: link.ProviderID,
UserID: link.UserID,
OAuthAccessToken: "access",
@@ -257,7 +257,7 @@ func TestGitAuthLinks(t *testing.T) {
require.Equal(t, "access", updated.OAuthAccessToken)
require.Equal(t, "refresh", updated.OAuthRefreshToken)
link, err = db.GetGitAuthLink(ctx, database.GetGitAuthLinkParams{
link, err = db.GetExternalAuthLink(ctx, database.GetExternalAuthLinkParams{
ProviderID: link.ProviderID,
UserID: link.UserID,
})
@@ -266,15 +266,15 @@ func TestGitAuthLinks(t *testing.T) {
requireEncryptedEquals(t, ciphers[0], link.OAuthRefreshToken, "refresh")
})
t.Run("GetGitAuthLink", func(t *testing.T) {
t.Run("GetExternalAuthLink", func(t *testing.T) {
t.Run("OK", func(t *testing.T) {
t.Parallel()
db, crypt, ciphers := setup(t)
link := dbgen.GitAuthLink(t, crypt, database.GitAuthLink{
link := dbgen.ExternalAuthLink(t, crypt, database.ExternalAuthLink{
OAuthAccessToken: "access",
OAuthRefreshToken: "refresh",
})
link, err := db.GetGitAuthLink(ctx, database.GetGitAuthLinkParams{
link, err := db.GetExternalAuthLink(ctx, database.GetExternalAuthLinkParams{
UserID: link.UserID,
ProviderID: link.ProviderID,
})
@@ -285,14 +285,14 @@ func TestGitAuthLinks(t *testing.T) {
t.Run("DecryptErr", func(t *testing.T) {
t.Parallel()
db, crypt, ciphers := setup(t)
link := dbgen.GitAuthLink(t, db, database.GitAuthLink{
link := dbgen.ExternalAuthLink(t, db, database.ExternalAuthLink{
OAuthAccessToken: fakeBase64RandomData(t, 32),
OAuthRefreshToken: fakeBase64RandomData(t, 32),
OAuthAccessTokenKeyID: sql.NullString{String: ciphers[0].HexDigest(), Valid: true},
OAuthRefreshTokenKeyID: sql.NullString{String: ciphers[0].HexDigest(), Valid: true},
})
_, err := crypt.GetGitAuthLink(ctx, database.GetGitAuthLinkParams{
_, err := crypt.GetExternalAuthLink(ctx, database.GetExternalAuthLinkParams{
UserID: link.UserID,
ProviderID: link.ProviderID,
})
@@ -302,19 +302,19 @@ func TestGitAuthLinks(t *testing.T) {
})
})
t.Run("GetGitAuthLinksByUserID", func(t *testing.T) {
t.Run("GetExternalAuthLinksByUserID", func(t *testing.T) {
t.Parallel()
t.Run("OK", func(t *testing.T) {
t.Parallel()
db, crypt, ciphers := setup(t)
user := dbgen.User(t, crypt, database.User{})
link := dbgen.GitAuthLink(t, crypt, database.GitAuthLink{
link := dbgen.ExternalAuthLink(t, crypt, database.ExternalAuthLink{
UserID: user.ID,
OAuthAccessToken: "access",
OAuthRefreshToken: "refresh",
})
links, err := crypt.GetGitAuthLinksByUserID(ctx, link.UserID)
links, err := crypt.GetExternalAuthLinksByUserID(ctx, link.UserID)
require.NoError(t, err)
require.Len(t, links, 1)
require.Equal(t, "access", links[0].OAuthAccessToken)
@@ -322,7 +322,7 @@ func TestGitAuthLinks(t *testing.T) {
require.Equal(t, ciphers[0].HexDigest(), links[0].OAuthAccessTokenKeyID.String)
require.Equal(t, ciphers[0].HexDigest(), links[0].OAuthRefreshTokenKeyID.String)
rawLinks, err := db.GetGitAuthLinksByUserID(ctx, link.UserID)
rawLinks, err := db.GetExternalAuthLinksByUserID(ctx, link.UserID)
require.NoError(t, err)
require.Len(t, rawLinks, 1)
requireEncryptedEquals(t, ciphers[0], rawLinks[0].OAuthAccessToken, "access")
@@ -332,14 +332,14 @@ func TestGitAuthLinks(t *testing.T) {
t.Run("DecryptErr", func(t *testing.T) {
db, crypt, ciphers := setup(t)
user := dbgen.User(t, db, database.User{})
link := dbgen.GitAuthLink(t, db, database.GitAuthLink{
link := dbgen.ExternalAuthLink(t, db, database.ExternalAuthLink{
UserID: user.ID,
OAuthAccessToken: fakeBase64RandomData(t, 32),
OAuthRefreshToken: fakeBase64RandomData(t, 32),
OAuthAccessTokenKeyID: sql.NullString{String: ciphers[0].HexDigest(), Valid: true},
OAuthRefreshTokenKeyID: sql.NullString{String: ciphers[0].HexDigest(), Valid: true},
})
_, err := crypt.GetGitAuthLinksByUserID(ctx, link.UserID)
_, err := crypt.GetExternalAuthLinksByUserID(ctx, link.UserID)
require.Error(t, err, "expected an error")
var derr *DecryptFailedError
require.ErrorAs(t, err, &derr, "expected a decrypt error")