Nov 14, 2024 · Nov 13, 2024 · Nov 13, 2024 · Nov 13, 2024 · Nov 13, 2024 · Nov 13, 2024
diff --git a/coderd/coderdtest/oidctest/helper.go b/coderd/coderdtest/oidctest/helper.go
 import (
 "context"
 "database/sql"
 "encoding/json"
 "net/http"
 "net/url"
 "testing"
 OAuthExpiry:            time.Now().Add(time.Hour * -1),
 UserID:                 link.UserID,
 LoginType:              link.LoginType,
 DebugContext:json.RawMessage("{}"),
 Claims:      database.UserLinkClaims{},
 })
 require.NoError(t, err, "expire user link")

diff --git a/coderd/database/dbauthz/dbauthz_test.go b/coderd/database/dbauthz/dbauthz_test.go
 OAuthExpiry:       link.OAuthExpiry,
 UserID:            link.UserID,
 LoginType:         link.LoginType,
 DebugContext:json.RawMessage("{}"),
 Claims:      database.UserLinkClaims{},
 }).Asserts(rbac.ResourceUserObject(link.UserID), policy.ActionUpdatePersonal).Returns(link)
 }))
 s.Run("UpdateUserRoles", s.Subtest(func(db database.Store, check *expects) {
diff --git a/coderd/database/dbgen/dbgen.go b/coderd/database/dbgen/dbgen.go
 OAuthRefreshToken:      takeFirst(orig.OAuthRefreshToken, uuid.NewString()),
 OAuthRefreshTokenKeyID: takeFirst(orig.OAuthRefreshTokenKeyID, sql.NullString{}),
 OAuthExpiry:            takeFirst(orig.OAuthExpiry, dbtime.Now().Add(time.Hour*24)),
 DebugContext:takeFirstSlice(orig.DebugContext, json.RawMessage("{}")),
 Claims:orig.Claims,
 })

 require.NoError(t, err, "insert link")
diff --git a/coderd/database/dbmem/dbmem.go b/coderd/database/dbmem/dbmem.go
 OAuthRefreshToken:      args.OAuthRefreshToken,
 OAuthRefreshTokenKeyID: args.OAuthRefreshTokenKeyID,
 OAuthExpiry:            args.OAuthExpiry,
 DebugContext:           args.DebugContext,
 Claims:args.Claims,
 }

 q.userLinks = append(q.userLinks, link)
 link.OAuthRefreshToken = params.OAuthRefreshToken
 link.OAuthRefreshTokenKeyID = params.OAuthRefreshTokenKeyID
 link.OAuthExpiry = params.OAuthExpiry
 link.DebugContext = params.DebugContext
 link.Claims = params.Claims

 q.userLinks[i] = link
 return link, nil
diff --git a/coderd/database/dump.sql b/coderd/database/dump.sql
diff --git a/coderd/database/migrations/000274_rename_user_link_claims.down.sql b/coderd/database/migrations/000274_rename_user_link_claims.down.sql
 ALTER TABLE user_links RENAME COLUMN claims TO debug_context;

 COMMENT ON COLUMN user_links.debug_context IS 'Debug information includes information like id_token and userinfo claims.';
diff --git a/coderd/database/migrations/000274_rename_user_link_claims.up.sql b/coderd/database/migrations/000274_rename_user_link_claims.up.sql
 ALTER TABLE user_links RENAME COLUMN debug_context TO claims;

 COMMENT ON COLUMN user_links.claims IS 'Claims from the IDP for the linked user. Includes both id_token and userinfo claims. ';
diff --git a/coderd/database/models.go b/coderd/database/models.go
diff --git a/coderd/database/queries.sql.go b/coderd/database/queries.sql.go
diff --git a/coderd/database/queries/user_links.sql b/coderd/database/queries/user_links.sql
 oauth_refresh_token,
 oauth_refresh_token_key_id,
 oauth_expiry,
    debug_context
 claims
 )
 VALUES
 ( $1, $2, $3, $4, $5, $6, $7, $8, $9 ) RETURNING *;
 oauth_refresh_token = $3,
 oauth_refresh_token_key_id = $4,
 oauth_expiry = $5,
 debug_context = $6
 claims = $6
 WHERE
 user_id = $7 AND login_type = $8 RETURNING *;
diff --git a/coderd/database/sqlc.yaml b/coderd/database/sqlc.yaml
          - column: "provisioner_job_stats.*_secs"
            go_type:
              type: "float64"
          - column: "user_links.claims"
            go_type:
              type: "UserLinkClaims"
        rename:
          group_member: GroupMemberTable
          group_members_expanded: GroupMember
diff --git a/coderd/database/types.go b/coderd/database/types.go
 func (p AgentIDNamePair) Value() (driver.Value, error) {
 return fmt.Sprintf(`(%s,%s)`, p.ID.String(), p.Name), nil
 }

 // UserLinkClaims is the returned IDP claims for a given user link.
 // These claims are fetched at login time. These are the claims that were
 // used for IDP sync.
 type UserLinkClaims struct {
 IDTokenClaims  map[string]interface{} `json:"id_token_claims"`
 UserInfoClaims map[string]interface{} `json:"user_info_claims"`
 }

 func (a *UserLinkClaims) Scan(src interface{}) error {
 switch v := src.(type) {
 case string:
 return json.Unmarshal([]byte(v), &a)
 case []byte:
 return json.Unmarshal(v, &a)
 }
 return xerrors.Errorf("unexpected type %T", src)
 }

 func (a UserLinkClaims) Value() (driver.Value, error) {
 return json.Marshal(a)
 }
diff --git a/coderd/httpmw/apikey.go b/coderd/httpmw/apikey.go
 OAuthExpiry:            link.OAuthExpiry,
 // Refresh should keep the same debug context because we use
 // the original claims for the group/role sync.
 DebugContext: link.DebugContext,
 Claims: link.Claims,
 })
 if err != nil {
 return write(http.StatusInternalServerError, codersdk.Response{
diff --git a/coderd/provisionerdserver/provisionerdserver.go b/coderd/provisionerdserver/provisionerdserver.go
 OAuthRefreshToken:link.OAuthRefreshToken,
 OAuthRefreshTokenKeyID: sql.NullString{},// set by dbcrypt if required
 OAuthExpiry:link.OAuthExpiry,
 DebugContext:link.DebugContext,
 Claims:link.Claims,
 })
 iferr!=nil {
 return"",xerrors.Errorf("update user link: %w",err)
diff --git a/coderd/userauth.go b/coderd/userauth.go
 import (
 "context"
 "database/sql"
 "encoding/json"
 "errors"
 "fmt"
 "net/http"
 Username:     username,
 AvatarURL:    ghUser.GetAvatarURL(),
 Name:         normName,
 DebugContext: OauthDebugContext{},
 UserClaims:   database.UserLinkClaims{},
 GroupSync: idpsync.GroupParams{
 SyncEntitled: false,
 },
 OrganizationSync: orgSync,
 GroupSync:        groupSync,
 RoleSync:         roleSync,
 DebugContext: OauthDebugContext{
 UserClaims: database.UserLinkClaims{
 IDTokenClaims:  idtokenClaims,
 UserInfoClaims: userInfoClaims,
 },
 GroupSync        idpsync.GroupParams
 RoleSync         idpsync.RoleParams

 DebugContext OauthDebugContext
 // UserClaims should only be populated for OIDC logins.
 // It is used to save the user's claims on login.
 UserClaims database.UserLinkClaims

 commitLock       sync.Mutex
 initAuditRequest func(params *audit.RequestParams) *audit.Request[database.User]
 dormantConvertAudit.New = user
 }

 debugContext, err := json.Marshal(params.DebugContext)
 if err != nil {
 return xerrors.Errorf("marshal debug context: %w", err)
 }

 if link.UserID == uuid.Nil {
 //nolint:gocritic // System needs to insert the user link (linked_id, oauth_token, oauth_expiry).
 link, err = tx.InsertUserLink(dbauthz.AsSystemRestricted(ctx), database.InsertUserLinkParams{
 OAuthRefreshToken:      params.State.Token.RefreshToken,
 OAuthRefreshTokenKeyID: sql.NullString{}, // set by dbcrypt if required
 OAuthExpiry:            params.State.Token.Expiry,
 DebugContext:debugContext,
 Claims:      params.UserClaims,
 })
 if err != nil {
 return xerrors.Errorf("insert user link: %w", err)
 OAuthRefreshToken:      params.State.Token.RefreshToken,
 OAuthRefreshTokenKeyID: sql.NullString{}, // set by dbcrypt if required
 OAuthExpiry:            params.State.Token.Expiry,
 DebugContext:debugContext,
 Claims:      params.UserClaims,
 })
 if err != nil {
 return xerrors.Errorf("update user link: %w", err)
Original file line number	Diff line number	Diff line change
Expand Up		@@ -3,7 +3,6 @@ package oidctest
		import (
		"context"
		"database/sql"
		"encoding/json"
		"net/http"
		"net/url"
		"testing"
Expand DownExpand Up		@@ -89,7 +88,7 @@ func (LoginHelper) ExpireOauthToken(t testing.T, db database.Store, user *code
		OAuthExpiry: time.Now().Add(time.Hour * -1),
		UserID: link.UserID,
		LoginType: link.LoginType,
		DebugContext:json.RawMessage("{}"),
		Claims: database.UserLinkClaims{},
		})
		require.NoError(t, err, "expire user link")

Expand Down
Original file line number	Diff line number	Diff line change
Expand Up		@@ -1281,7 +1281,7 @@ func (s *MethodTestSuite) TestUser() {
		OAuthExpiry: link.OAuthExpiry,
		UserID: link.UserID,
		LoginType: link.LoginType,
		DebugContext:json.RawMessage("{}"),
		Claims: database.UserLinkClaims{},
		}).Asserts(rbac.ResourceUserObject(link.UserID), policy.ActionUpdatePersonal).Returns(link)
		}))
		s.Run("UpdateUserRoles", s.Subtest(func(db database.Store, check *expects) {
Expand Down
Original file line number	Diff line number	Diff line change
Expand Up		@@ -726,7 +726,7 @@ func UserLink(t testing.TB, db database.Store, orig database.UserLink) database.
		OAuthRefreshToken: takeFirst(orig.OAuthRefreshToken, uuid.NewString()),
		OAuthRefreshTokenKeyID: takeFirst(orig.OAuthRefreshTokenKeyID, sql.NullString{}),
		OAuthExpiry: takeFirst(orig.OAuthExpiry, dbtime.Now().Add(time.Hour*24)),
		DebugContext:takeFirstSlice(orig.DebugContext, json.RawMessage("{}")),
		Claims:orig.Claims,
		})

		require.NoError(t, err, "insert link")
Expand Down
Original file line number	Diff line number	Diff line change
Expand Up		@@ -7857,7 +7857,7 @@ func (q *FakeQuerier) InsertUserLink(_ context.Context, args database.InsertUser
		OAuthRefreshToken: args.OAuthRefreshToken,
		OAuthRefreshTokenKeyID: args.OAuthRefreshTokenKeyID,
		OAuthExpiry: args.OAuthExpiry,
		DebugContext: args.DebugContext,
		Claims:args.Claims,
		}

		q.userLinks = append(q.userLinks, link)
Expand DownExpand Up		@@ -9318,7 +9318,7 @@ func (q *FakeQuerier) UpdateUserLink(_ context.Context, params database.UpdateUs
		link.OAuthRefreshToken = params.OAuthRefreshToken
		link.OAuthRefreshTokenKeyID = params.OAuthRefreshTokenKeyID
		link.OAuthExpiry = params.OAuthExpiry
		link.DebugContext = params.DebugContext
		link.Claims = params.Claims

		q.userLinks[i] = link
		return link, nil
Expand Down
Original file line number	Diff line number	Diff line change
		@@ -0,0 +1,3 @@
		ALTER TABLE user_links RENAME COLUMN claims TO debug_context;

		COMMENT ON COLUMN user_links.debug_context IS 'Debug information includes information like id_token and userinfo claims.';
Original file line number	Diff line number	Diff line change
		@@ -0,0 +1,3 @@
		ALTER TABLE user_links RENAME COLUMN debug_context TO claims;

		COMMENT ON COLUMN user_links.claims IS 'Claims from the IDP for the linked user. Includes both id_token and userinfo claims. ';
Original file line number	Diff line number	Diff line change
Expand Up		@@ -32,7 +32,7 @@ INSERT INTO
		oauth_refresh_token,
		oauth_refresh_token_key_id,
		oauth_expiry,
		debug_context
		claims
		)
		VALUES
		( $1, $2, $3, $4, $5, $6, $7, $8, $9 ) RETURNING *;
Expand All		@@ -54,6 +54,6 @@ SET
		oauth_refresh_token = $3,
		oauth_refresh_token_key_id = $4,
		oauth_expiry = $5,
		debug_context = $6
		claims = $6
		WHERE
		user_id = $7 AND login_type = $8 RETURNING *;
Original file line number	Diff line number	Diff line change
Expand Up		@@ -79,6 +79,9 @@ sql:
		- column: "provisioner_job_stats.*_secs"
		go_type:
		type: "float64"
		- column: "user_links.claims"
		go_type:
		type: "UserLinkClaims"
		rename:
		group_member: GroupMemberTable
		group_members_expanded: GroupMember
Expand Down
Original file line number	Diff line number	Diff line change
Expand Up		@@ -207,3 +207,25 @@ func (p *AgentIDNamePair) Scan(src interface{}) error {
		func (p AgentIDNamePair) Value() (driver.Value, error) {
		return fmt.Sprintf(`(%s,%s)`, p.ID.String(), p.Name), nil
		}

		// UserLinkClaims is the returned IDP claims for a given user link.
		// These claims are fetched at login time. These are the claims that were
		// used for IDP sync.
		type UserLinkClaims struct {
		IDTokenClaims map[string]interface{} `json:"id_token_claims"`
		UserInfoClaims map[string]interface{} `json:"user_info_claims"`
		}

		func (a *UserLinkClaims) Scan(src interface{}) error {
		switch v := src.(type) {
		case string:
		return json.Unmarshal([]byte(v), &a)
		case []byte:
		return json.Unmarshal(v, &a)
		}
		return xerrors.Errorf("unexpected type %T", src)
		}

		func (a UserLinkClaims) Value() (driver.Value, error) {
		return json.Marshal(a)
		}
Original file line number	Diff line number	Diff line change
Expand Up		@@ -377,7 +377,7 @@ func ExtractAPIKey(rw http.ResponseWriter, r *http.Request, cfg ExtractAPIKeyCon
		OAuthExpiry: link.OAuthExpiry,
		// Refresh should keep the same debug context because we use
		// the original claims for the group/role sync.
		DebugContext: link.DebugContext,
		Claims: link.Claims,
		})
		if err != nil {
		return write(http.StatusInternalServerError, codersdk.Response{
Expand Down