Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commita32366f

Browse files
committed
server
1 parent639092f commita32366f

File tree

1 file changed

+107
-41
lines changed

1 file changed

+107
-41
lines changed

‎cli/server.go‎

Lines changed: 107 additions & 41 deletions
Original file line numberDiff line numberDiff line change
@@ -677,24 +677,6 @@ func (r *RootCmd) Server(newAPI func(context.Context, *coderd.Options) (*coderd.
677677
}
678678
}
679679

680-
ifvals.OAuth2.Github.ClientSecret!=""||vals.OAuth2.Github.DeviceFlow.Value() {
681-
options.GithubOAuth2Config,err=configureGithubOAuth2(
682-
oauthInstrument,
683-
vals.AccessURL.Value(),
684-
vals.OAuth2.Github.ClientID.String(),
685-
vals.OAuth2.Github.ClientSecret.String(),
686-
vals.OAuth2.Github.DeviceFlow.Value(),
687-
vals.OAuth2.Github.AllowSignups.Value(),
688-
vals.OAuth2.Github.AllowEveryone.Value(),
689-
vals.OAuth2.Github.AllowedOrgs,
690-
vals.OAuth2.Github.AllowedTeams,
691-
vals.OAuth2.Github.EnterpriseBaseURL.String(),
692-
)
693-
iferr!=nil {
694-
returnxerrors.Errorf("configure github oauth2: %w",err)
695-
}
696-
}
697-
698680
// As OIDC clients can be confidential or public,
699681
// we should only check for a client id being set.
700682
// The underlying library handles the case of no
@@ -782,6 +764,20 @@ func (r *RootCmd) Server(newAPI func(context.Context, *coderd.Options) (*coderd.
782764
returnxerrors.Errorf("set deployment id: %w",err)
783765
}
784766

767+
githubOAuth2ConfigParams,err:=getGithubOAuth2ConfigParams(ctx,options.Database,vals)
768+
iferr!=nil {
769+
returnxerrors.Errorf("get github oauth2 config params: %w",err)
770+
}
771+
ifgithubOAuth2ConfigParams!=nil {
772+
options.GithubOAuth2Config,err=configureGithubOAuth2(
773+
oauthInstrument,
774+
githubOAuth2ConfigParams,
775+
)
776+
iferr!=nil {
777+
returnxerrors.Errorf("configure github oauth2: %w",err)
778+
}
779+
}
780+
785781
options.RuntimeConfig=runtimeconfig.NewManager()
786782

787783
// This should be output before the logs start streaming.
@@ -1832,25 +1828,95 @@ func configureCAPool(tlsClientCAFile string, tlsConfig *tls.Config) error {
18321828
returnnil
18331829
}
18341830

1835-
// TODO: convert the argument list to a struct, it's easy to mix up the order of the arguments
1836-
//
1831+
typegithubOAuth2ConfigParamsstruct {
1832+
accessURL*url.URL
1833+
clientIDstring
1834+
clientSecretstring
1835+
deviceFlowbool
1836+
allowSignupsbool
1837+
allowEveryonebool
1838+
allowOrgs []string
1839+
rawTeams []string
1840+
enterpriseBaseURLstring
1841+
}
1842+
1843+
funcgetGithubOAuth2ConfigParams(ctx context.Context,db database.Store,vals*codersdk.DeploymentValues) (*githubOAuth2ConfigParams,error) {
1844+
params:=githubOAuth2ConfigParams{
1845+
accessURL:vals.AccessURL.Value(),
1846+
clientID:vals.OAuth2.Github.ClientID.String(),
1847+
clientSecret:vals.OAuth2.Github.ClientSecret.String(),
1848+
deviceFlow:vals.OAuth2.Github.DeviceFlow.Value(),
1849+
allowSignups:vals.OAuth2.Github.AllowSignups.Value(),
1850+
allowEveryone:vals.OAuth2.Github.AllowEveryone.Value(),
1851+
allowOrgs:vals.OAuth2.Github.AllowedOrgs.Value(),
1852+
rawTeams:vals.OAuth2.Github.AllowedTeams.Value(),
1853+
enterpriseBaseURL:vals.OAuth2.Github.EnterpriseBaseURL.String(),
1854+
}
1855+
1856+
// If the user manually configured the GitHub OAuth2 provider,
1857+
// we won't add the default configuration.
1858+
ifparams.clientID!=""||params.clientSecret!=""||params.enterpriseBaseURL!="" {
1859+
return&params,nil
1860+
}
1861+
1862+
// Check if the user manually disabled the default GitHub OAuth2 provider.
1863+
if!vals.OAuth2.Github.DefaultProvider.Value() {
1864+
returnnil,nil//nolint:nilnil
1865+
}
1866+
1867+
// Check if the deployment is eligible for the default GitHub OAuth2 provider.
1868+
// We want to enable it only for new deployments, and avoid enabling it
1869+
// if a deployment was upgraded from an older version.
1870+
// nolint:gocritic // Requires system privileges
1871+
defaultEligible,err:=db.GetOAuth2GithubDefaultEligible(dbauthz.AsSystemRestricted(ctx))
1872+
iferr!=nil&&!errors.Is(err,sql.ErrNoRows) {
1873+
returnnil,xerrors.Errorf("get github default eligible: %w",err)
1874+
}
1875+
defaultEligibleNotSet:=errors.Is(err,sql.ErrNoRows)
1876+
1877+
ifdefaultEligibleNotSet {
1878+
// nolint:gocritic // User count requires system privileges
1879+
userCount,err:=db.GetUserCount(dbauthz.AsSystemRestricted(ctx))
1880+
iferr!=nil {
1881+
returnnil,xerrors.Errorf("get user count: %w",err)
1882+
}
1883+
// We check if a deployment is new by checking if it has any users.
1884+
defaultEligible=userCount==0
1885+
// nolint:gocritic // Requires system privileges
1886+
iferr:=db.UpsertOAuth2GithubDefaultEligible(dbauthz.AsSystemRestricted(ctx),defaultEligible);err!=nil {
1887+
returnnil,xerrors.Errorf("upsert github default eligible: %w",err)
1888+
}
1889+
}
1890+
1891+
if!defaultEligible {
1892+
returnnil,nil//nolint:nilnil
1893+
}
1894+
1895+
// TODO: before merging, change this to use Coder's client ID instead of my dev one.
1896+
params.clientID="Iv23liSBHklRMBNx5lk9"
1897+
params.allowEveryone=true
1898+
params.deviceFlow=true
1899+
1900+
return&params,nil
1901+
}
1902+
18371903
//nolint:revive // Ignore flag-parameter: parameter 'allowEveryone' seems to be a control flag, avoid control coupling (revive)
1838-
funcconfigureGithubOAuth2(instrument*promoauth.Factory,accessURL*url.URL,clientID,clientSecretstring,deviceFlow,allowSignups,allowEveryonebool,allowOrgs []string,rawTeams []string,enterpriseBaseURLstring) (*coderd.GithubOAuth2Config,error) {
1839-
redirectURL,err:=accessURL.Parse("/api/v2/users/oauth2/github/callback")
1904+
funcconfigureGithubOAuth2(instrument*promoauth.Factory,params*githubOAuth2ConfigParams) (*coderd.GithubOAuth2Config,error) {
1905+
redirectURL,err:=params.accessURL.Parse("/api/v2/users/oauth2/github/callback")
18401906
iferr!=nil {
18411907
returnnil,xerrors.Errorf("parse github oauth callback url: %w",err)
18421908
}
1843-
ifallowEveryone&&len(allowOrgs)>0 {
1909+
ifparams.allowEveryone&&len(params.allowOrgs)>0 {
18441910
returnnil,xerrors.New("allow everyone and allowed orgs cannot be used together")
18451911
}
1846-
ifallowEveryone&&len(rawTeams)>0 {
1912+
ifparams.allowEveryone&&len(params.rawTeams)>0 {
18471913
returnnil,xerrors.New("allow everyone and allowed teams cannot be used together")
18481914
}
1849-
if!allowEveryone&&len(allowOrgs)==0 {
1915+
if!params.allowEveryone&&len(params.allowOrgs)==0 {
18501916
returnnil,xerrors.New("allowed orgs is empty: must specify at least one org or allow everyone")
18511917
}
1852-
allowTeams:=make([]coderd.GithubOAuth2Team,0,len(rawTeams))
1853-
for_,rawTeam:=rangerawTeams {
1918+
allowTeams:=make([]coderd.GithubOAuth2Team,0,len(params.rawTeams))
1919+
for_,rawTeam:=rangeparams.rawTeams {
18541920
parts:=strings.SplitN(rawTeam,"/",2)
18551921
iflen(parts)!=2 {
18561922
returnnil,xerrors.Errorf("github team allowlist is formatted incorrectly. got %s; wanted <organization>/<team>",rawTeam)
@@ -1862,8 +1928,8 @@ func configureGithubOAuth2(instrument *promoauth.Factory, accessURL *url.URL, cl
18621928
}
18631929

18641930
endpoint:=xgithub.Endpoint
1865-
ifenterpriseBaseURL!="" {
1866-
enterpriseURL,err:=url.Parse(enterpriseBaseURL)
1931+
ifparams.enterpriseBaseURL!="" {
1932+
enterpriseURL,err:=url.Parse(params.enterpriseBaseURL)
18671933
iferr!=nil {
18681934
returnnil,xerrors.Errorf("parse enterprise base url: %w",err)
18691935
}
@@ -1882,8 +1948,8 @@ func configureGithubOAuth2(instrument *promoauth.Factory, accessURL *url.URL, cl
18821948
}
18831949

18841950
instrumentedOauth:=instrument.NewGithub("github-login",&oauth2.Config{
1885-
ClientID:clientID,
1886-
ClientSecret:clientSecret,
1951+
ClientID:params.clientID,
1952+
ClientSecret:params.clientSecret,
18871953
Endpoint:endpoint,
18881954
RedirectURL:redirectURL.String(),
18891955
Scopes: []string{
@@ -1895,17 +1961,17 @@ func configureGithubOAuth2(instrument *promoauth.Factory, accessURL *url.URL, cl
18951961

18961962
createClient:=func(client*http.Client,source promoauth.Oauth2Source) (*github.Client,error) {
18971963
client=instrumentedOauth.InstrumentHTTPClient(client,source)
1898-
ifenterpriseBaseURL!="" {
1899-
returngithub.NewEnterpriseClient(enterpriseBaseURL,"",client)
1964+
ifparams.enterpriseBaseURL!="" {
1965+
returngithub.NewEnterpriseClient(params.enterpriseBaseURL,"",client)
19001966
}
19011967
returngithub.NewClient(client),nil
19021968
}
19031969

19041970
vardeviceAuth*externalauth.DeviceAuth
1905-
ifdeviceFlow {
1971+
ifparams.deviceFlow {
19061972
deviceAuth=&externalauth.DeviceAuth{
19071973
Config:instrumentedOauth,
1908-
ClientID:clientID,
1974+
ClientID:params.clientID,
19091975
TokenURL:endpoint.TokenURL,
19101976
Scopes: []string{"read:user","read:org","user:email"},
19111977
CodeURL:endpoint.DeviceAuthURL,
@@ -1914,9 +1980,9 @@ func configureGithubOAuth2(instrument *promoauth.Factory, accessURL *url.URL, cl
19141980

19151981
return&coderd.GithubOAuth2Config{
19161982
OAuth2Config:instrumentedOauth,
1917-
AllowSignups:allowSignups,
1918-
AllowEveryone:allowEveryone,
1919-
AllowOrganizations:allowOrgs,
1983+
AllowSignups:params.allowSignups,
1984+
AllowEveryone:params.allowEveryone,
1985+
AllowOrganizations:params.allowOrgs,
19201986
AllowTeams:allowTeams,
19211987
AuthenticatedUser:func(ctx context.Context,client*http.Client) (*github.User,error) {
19221988
api,err:=createClient(client,promoauth.SourceGitAPIAuthUser)
@@ -1955,15 +2021,15 @@ func configureGithubOAuth2(instrument *promoauth.Factory, accessURL *url.URL, cl
19552021
team,_,err:=api.Teams.GetTeamMembershipBySlug(ctx,org,teamSlug,username)
19562022
returnteam,err
19572023
},
1958-
DeviceFlowEnabled:deviceFlow,
2024+
DeviceFlowEnabled:params.deviceFlow,
19592025
ExchangeDeviceCode:func(ctx context.Context,deviceCodestring) (*oauth2.Token,error) {
1960-
if!deviceFlow {
2026+
if!params.deviceFlow {
19612027
returnnil,xerrors.New("device flow is not enabled")
19622028
}
19632029
returndeviceAuth.ExchangeDeviceCode(ctx,deviceCode)
19642030
},
19652031
AuthorizeDevice:func(ctx context.Context) (*codersdk.ExternalAuthDevice,error) {
1966-
if!deviceFlow {
2032+
if!params.deviceFlow {
19672033
returnnil,xerrors.New("device flow is not enabled")
19682034
}
19692035
returndeviceAuth.AuthorizeDevice(ctx)

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp