coder/coderd/authlink/authlink.go

package authlink

import (
	"context"
	"encoding/json"
	"fmt"
	"io"
	"net/http"
	"net/url"
	"sort"

	"golang.org/x/xerrors"

	"github.com/coder/coder/v2/coderd/database"
)

// OIDCLinkAnalysis contains the results of analyzing OIDC user links
// grouped by their issuer prefix.
type OIDCLinkAnalysis struct {
	Total            int            // Total OIDC user links
	Unlinked         int            // linked_id == ""
	CorrectIssuer    int            // linked_id starts with expectedIssuer||
	MismatchedCounts map[string]int // issuer -> count for non-matching issuers
}

// MismatchedTotal returns the total number of links with a non-matching issuer.
func (a OIDCLinkAnalysis) MismatchedTotal() int {
	total := 0
	for _, count := range a.MismatchedCounts {
		total += count
	}
	return total
}

// AnalyzeOIDCLinks queries OIDC user links grouped by issuer prefix and
// categorizes them relative to expectedIssuer.
func AnalyzeOIDCLinks(ctx context.Context, db database.Store, expectedIssuer string) (OIDCLinkAnalysis, error) {
	rows, err := db.CountOIDCLinkedIDsByIssuer(ctx)
	if err != nil {
		return OIDCLinkAnalysis{}, xerrors.Errorf("count OIDC linked IDs by issuer: %w", err)
	}

	analysis := OIDCLinkAnalysis{
		MismatchedCounts: make(map[string]int),
	}
	for _, row := range rows {
		count := int(row.Count)
		analysis.Total += count
		switch {
		case row.IssuerPrefix == "":
			analysis.Unlinked += count
		case row.IssuerPrefix == expectedIssuer:
			analysis.CorrectIssuer += count
		default:
			analysis.MismatchedCounts[row.IssuerPrefix] += count
		}
	}
	return analysis, nil
}

// ResetMismatchedOIDCLinks resets linked_id to empty for all OIDC links whose
// issuer prefix does not match expectedIssuer. Returns the number of rows
// affected.
func ResetMismatchedOIDCLinks(ctx context.Context, db database.Store, expectedIssuer string) (int64, error) {
	prefix := expectedIssuer + "||"
	count, err := db.UnlinkOIDCUsersByIssuerMismatch(ctx, prefix)
	if err != nil {
		return 0, xerrors.Errorf("unlink OIDC users by issuer mismatch: %w", err)
	}
	return count, nil
}

// UnmatchableIssuer is a synthetic issuer value that no real OIDC linked_id
// will ever start with. Passing it to AnalyzeOIDCLinks or
// ResetMismatchedOIDCLinks causes every link to be treated as "mismatched",
// which effectively resets all of them.
const UnmatchableIssuer = "00000000-0000-0000-0000-000000000000"

// ResolveIssuer uses OIDC discovery to fetch the canonical issuer string
// from the provider's .well-known/openid-configuration endpoint.
// This does not require OIDC client credentials.
//
// This works the same as `oidc.NewProvider`. The `oidc` package does not
// expose a method to extract the Issuer. So we have to manually make the
// http request.
func ResolveIssuer(ctx context.Context, cli *http.Client, issuerURL string) (string, error) {
	wellKnownURL, err := url.JoinPath(issuerURL, "/.well-known/openid-configuration")
	if err != nil {
		return "", xerrors.Errorf("resolve issuer URL: %w", err)
	}

	req, err := http.NewRequestWithContext(ctx, http.MethodGet, wellKnownURL, nil)
	if err != nil {
		return "", xerrors.Errorf("create discovery request: %w", err)
	}

	resp, err := cli.Do(req)
	if err != nil {
		return "", xerrors.Errorf("fetch OIDC discovery document: %w", err)
	}
	defer resp.Body.Close()

	if resp.StatusCode != http.StatusOK {
		return "", xerrors.Errorf("OIDC discovery returned HTTP %d", resp.StatusCode)
	}

	var discovery struct {
		Issuer string `json:"issuer"`
	}
	if err := json.NewDecoder(resp.Body).Decode(&discovery); err != nil {
		return "", xerrors.Errorf("decode OIDC discovery document: %w", err)
	}
	if discovery.Issuer == "" {
		return "", xerrors.New("OIDC discovery document has empty issuer field")
	}
	return discovery.Issuer, nil
}

// PrintAnalysis writes a human-readable summary of the OIDC link analysis.
// Used for the cli command and debugging.
func PrintAnalysis(w io.Writer, analysis OIDCLinkAnalysis, issuer string) {
	_, _ = fmt.Fprintf(w, "OIDC Link Analysis (issuer: %s)\n", issuer)
	_, _ = fmt.Fprintf(w, "  Total OIDC users:            %d\n", analysis.Total)
	_, _ = fmt.Fprintf(w, "  Correctly linked:            %d\n", analysis.CorrectIssuer)
	_, _ = fmt.Fprintf(w, "  Unlinked (empty linked_id):  %d\n", analysis.Unlinked)

	mismatchedTotal := analysis.MismatchedTotal()
	_, _ = fmt.Fprintf(w, "  Linked to other issuers:     %d\n", mismatchedTotal)

	if mismatchedTotal > 0 {
		// Sort issuer keys for deterministic output.
		issuers := make([]string, 0, len(analysis.MismatchedCounts))
		for issuer := range analysis.MismatchedCounts {
			issuers = append(issuers, issuer)
		}
		sort.Strings(issuers)
		for _, iss := range issuers {
			_, _ = fmt.Fprintf(w, "    %s: %d\n", iss, analysis.MismatchedCounts[iss])
		}
	}
}