mirror of
https://github.com/coder/coder.git
synced 2026-10-16 14:48:56 +08:00
Bobby Ho
7bb049f24c
PLAT-492: Log OAuth2 provider state at startup Log whether the OAuth2 provider is enabled and name CODER_OAUTH2_PROVIDER_ENABLE. When disabled, warn if OAuth2 applications are still registered and tell admins how to re-enable the provider. Startup continues if the application lookup fails. Add tests for enabled, disabled, registered-app, and query-error cases. Manually verified upgrade behavior, route gating, token preservation, dashboard visibility, and all supported flag forms.
38 lines
1.6 KiB
Go
38 lines
1.6 KiB
Go
package coderd
|
|
|
|
import (
|
|
"context"
|
|
|
|
"cdr.dev/slog/v3"
|
|
"github.com/coder/coder/v2/coderd/database"
|
|
"github.com/coder/coder/v2/coderd/database/dbauthz"
|
|
"github.com/coder/coder/v2/codersdk"
|
|
)
|
|
|
|
const oauth2ProviderDisabledWithAppsMessage = "The OAuth2 provider is disabled but OAuth2 applications are registered. Existing applications, secrets and user authorizations are preserved, and new authorizations and token exchanges are blocked, but already-issued access tokens are not invalidated and remain usable until they expire or are revoked. Set CODER_OAUTH2_PROVIDER_ENABLE=true to re-enable the provider."
|
|
|
|
// LogOAuth2ProviderState logs whether the OAuth2 provider is enabled so
|
|
// every start leaves one line recording the value of
|
|
// CODER_OAUTH2_PROVIDER_ENABLE. When the provider is disabled it also warns
|
|
// if applications are still registered. Errors are logged and startup
|
|
// continues.
|
|
func LogOAuth2ProviderState(ctx context.Context, logger slog.Logger, db database.Store, cfg codersdk.OAuth2ProviderConfig) {
|
|
flagField := slog.F("flag", "CODER_OAUTH2_PROVIDER_ENABLE")
|
|
if cfg.Enable.Value() {
|
|
logger.Info(ctx, "oauth2 provider enabled", flagField)
|
|
return
|
|
}
|
|
logger.Info(ctx, "oauth2 provider disabled", flagField)
|
|
|
|
//nolint:gocritic // Startup-only read; no user actor is present.
|
|
apps, err := db.GetOAuth2ProviderApps(dbauthz.AsSystemRestricted(ctx))
|
|
if err != nil {
|
|
logger.Warn(ctx, "oauth2 provider: list registered applications", slog.Error(err))
|
|
return
|
|
}
|
|
if len(apps) == 0 {
|
|
return
|
|
}
|
|
logger.Warn(ctx, oauth2ProviderDisabledWithAppsMessage, flagField, slog.F("count", len(apps)))
|
|
}
|