Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

feat: remove user from groups on org membership delete#14701

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to ourterms of service andprivacy statement. We’ll occasionally send you account related emails.

Already on GitHub?Sign in to your account

Merged
Emyrk merged 3 commits intomainfromstevenmasley/remove_groups_on_member
Sep 18, 2024
Merged
Show file tree
Hide file tree
Changes fromall commits
Commits
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 11 additions & 1 deletioncoderd/database/dbmem/dbmem.go
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -1944,7 +1944,7 @@ func (q *FakeQuerier) DeleteOrganization(_ context.Context, id uuid.UUID) error
return sql.ErrNoRows
}

func (q *FakeQuerier) DeleteOrganizationMember(_ context.Context, arg database.DeleteOrganizationMemberParams) error {
func (q *FakeQuerier) DeleteOrganizationMember(ctx context.Context, arg database.DeleteOrganizationMemberParams) error {
err := validateDatabaseType(arg)
if err != nil {
return err
Expand All@@ -1959,6 +1959,16 @@ func (q *FakeQuerier) DeleteOrganizationMember(_ context.Context, arg database.D
if len(deleted) == 0 {
return sql.ErrNoRows
}

// Delete group member trigger
q.groupMembers = slices.DeleteFunc(q.groupMembers, func(member database.GroupMemberTable) bool {
if member.UserID != arg.UserID {
return false
}
g, _ := q.getGroupByIDNoLock(ctx, member.GroupID)
return g.OrganizationID == arg.OrganizationID
})

return nil
}

Expand Down
21 changes: 21 additions & 0 deletionscoderd/database/dump.sql
View file
Open in desktop

Some generated files are not rendered by default. Learn more abouthow customized files appear on GitHub.

View file
Open in desktop
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
DROP TRIGGER IF EXISTS trigger_delete_group_members_on_org_member_delete ON organization_members;
DROP FUNCTION IF EXISTS delete_group_members_on_org_member_delete;
23 changes: 23 additions & 0 deletionscoderd/database/migrations/000252_group_member_trigger.up.sql
View file
Open in desktop
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
CREATE FUNCTION delete_group_members_on_org_member_delete() RETURNS TRIGGER
LANGUAGE plpgsql
AS $$
DECLARE
BEGIN
-- Remove the user from all groups associated with the same
-- organization as the organization_member being deleted.
DELETE FROM group_members
WHERE
user_id = OLD.user_id
AND group_id IN (
SELECT id
FROM groups
WHERE organization_id = OLD.organization_id
);
RETURN OLD;
END;
$$;

CREATE TRIGGER trigger_delete_group_members_on_org_member_delete
BEFORE DELETE ON organization_members
FOR EACH ROW
EXECUTE PROCEDURE delete_group_members_on_org_member_delete();
97 changes: 97 additions & 0 deletionscoderd/database/querier_test.go
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -1216,6 +1216,103 @@ func TestExpectOne(t *testing.T) {
})
}

funcTestGroupRemovalTrigger(t*testing.T) {
t.Parallel()

db,_:=dbtestutil.NewDB(t)

orgA:=dbgen.Organization(t,db, database.Organization{})
_,err:=db.InsertAllUsersGroup(context.Background(),orgA.ID)
require.NoError(t,err)

orgB:=dbgen.Organization(t,db, database.Organization{})
_,err=db.InsertAllUsersGroup(context.Background(),orgB.ID)
require.NoError(t,err)

orgs:= []database.Organization{orgA,orgB}

user:=dbgen.User(t,db, database.User{})
extra:=dbgen.User(t,db, database.User{})
users:= []database.User{user,extra}

groupA1:=dbgen.Group(t,db, database.Group{
OrganizationID:orgA.ID,
})
groupA2:=dbgen.Group(t,db, database.Group{
OrganizationID:orgA.ID,
})

groupB1:=dbgen.Group(t,db, database.Group{
OrganizationID:orgB.ID,
})
groupB2:=dbgen.Group(t,db, database.Group{
OrganizationID:orgB.ID,
})

groups:= []database.Group{groupA1,groupA2,groupB1,groupB2}

// Add users to all organizations
for_,u:=rangeusers {
for_,o:=rangeorgs {
dbgen.OrganizationMember(t,db, database.OrganizationMember{
OrganizationID:o.ID,
UserID:u.ID,
})
}
}

// Add users to all groups
for_,u:=rangeusers {
for_,g:=rangegroups {
dbgen.GroupMember(t,db, database.GroupMemberTable{
GroupID:g.ID,
UserID:u.ID,
})
}
}

// Verify user is in all groups
ctx:=testutil.Context(t,testutil.WaitLong)
onlyGroupIDs:=func(row database.GetGroupsRow) uuid.UUID {
returnrow.Group.ID
}
userGroups,err:=db.GetGroups(ctx, database.GetGroupsParams{
HasMemberID:user.ID,
})
require.NoError(t,err)
require.ElementsMatch(t, []uuid.UUID{
orgA.ID,orgB.ID,// Everyone groups
groupA1.ID,groupA2.ID,groupB1.ID,groupB2.ID,// Org groups
},db2sdk.List(userGroups,onlyGroupIDs))

// Remove the user from org A
err=db.DeleteOrganizationMember(ctx, database.DeleteOrganizationMemberParams{
OrganizationID:orgA.ID,
UserID:user.ID,
})
require.NoError(t,err)

// Verify user is no longer in org A groups
userGroups,err=db.GetGroups(ctx, database.GetGroupsParams{
HasMemberID:user.ID,
})
require.NoError(t,err)
require.ElementsMatch(t, []uuid.UUID{
orgB.ID,// Everyone group
groupB1.ID,groupB2.ID,// Org groups
},db2sdk.List(userGroups,onlyGroupIDs))

// Verify extra user is unchanged
extraUserGroups,err:=db.GetGroups(ctx, database.GetGroupsParams{
HasMemberID:extra.ID,
})
require.NoError(t,err)
require.ElementsMatch(t, []uuid.UUID{
orgA.ID,orgB.ID,// Everyone groups
groupA1.ID,groupA2.ID,groupB1.ID,groupB2.ID,// Org groups
},db2sdk.List(extraUserGroups,onlyGroupIDs))
}

funcrequireUsersMatch(t testing.TB,expected []database.User,found []database.GetUsersRow,msgstring) {
t.Helper()
require.ElementsMatch(t,expected,database.ConvertUserRows(found),msg)
Expand Down
42 changes: 42 additions & 0 deletionsenterprise/members_test.go
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -29,6 +29,7 @@ func TestEnterpriseMembers(t *testing.T) {
LicenseOptions: &coderdenttest.LicenseOptions{
Features: license.Features{
codersdk.FeatureMultipleOrganizations: 1,
codersdk.FeatureTemplateRBAC: 1,
},
},
})
Expand All@@ -39,6 +40,21 @@ func TestEnterpriseMembers(t *testing.T) {
_, user := coderdtest.CreateAnotherUser(t, owner, secondOrg.ID)

ctx := testutil.Context(t, testutil.WaitMedium)

// Groups exist to ensure a user removed from the org loses their
// group access.
g1, err := orgAdminClient.CreateGroup(ctx, secondOrg.ID, codersdk.CreateGroupRequest{
Name: "foo",
DisplayName: "Foo",
})
require.NoError(t, err)

g2, err := orgAdminClient.CreateGroup(ctx, secondOrg.ID, codersdk.CreateGroupRequest{
Name: "bar",
DisplayName: "Bar",
})
require.NoError(t, err)

// Verify the org of 3 members
members, err := orgAdminClient.OrganizationMembers(ctx, secondOrg.ID)
require.NoError(t, err)
Expand All@@ -47,6 +63,25 @@ func TestEnterpriseMembers(t *testing.T) {
[]uuid.UUID{first.UserID, user.ID, orgAdmin.ID},
db2sdk.List(members, onlyIDs))

// Add the member to some groups
_, err = orgAdminClient.PatchGroup(ctx, g1.ID, codersdk.PatchGroupRequest{
AddUsers: []string{user.ID.String()},
})
require.NoError(t, err)

_, err = orgAdminClient.PatchGroup(ctx, g2.ID, codersdk.PatchGroupRequest{
AddUsers: []string{user.ID.String()},
})
require.NoError(t, err)

// Verify group membership
userGroups, err := orgAdminClient.Groups(ctx, codersdk.GroupArguments{
HasMember: user.ID.String(),
})
require.NoError(t, err)
// Everyone group + 2 groups
require.Len(t, userGroups, 3)

// Delete a member
err = orgAdminClient.DeleteOrganizationMember(ctx, secondOrg.ID, user.Username)
require.NoError(t, err)
Expand All@@ -57,6 +92,13 @@ func TestEnterpriseMembers(t *testing.T) {
require.ElementsMatch(t,
[]uuid.UUID{first.UserID, orgAdmin.ID},
db2sdk.List(members, onlyIDs))

// User should now belong to 0 groups
userGroups, err = orgAdminClient.Groups(ctx, codersdk.GroupArguments{
HasMember: user.ID.String(),
})
require.NoError(t, err)
require.Len(t, userGroups, 0)
})

t.Run("PostUser", func(t *testing.T) {
Expand Down
Loading
[8]ページ先頭
©2009-2025 Movatter.jp