Nov 18, 2024 · Nov 14, 2024 · Nov 14, 2024 · Nov 14, 2024 · Nov 14, 2024 · Nov 14, 2024
diff --git a/coderd/apidoc/docs.go b/coderd/apidoc/docs.go
diff --git a/coderd/apidoc/swagger.json b/coderd/apidoc/swagger.json
diff --git a/coderd/database/dbauthz/dbauthz.go b/coderd/database/dbauthz/dbauthz.go
 return q.db.ListWorkspaceAgentPortShares(ctx, workspaceID)
 }

 func (q *querier) OIDCClaimFields(ctx context.Context, organizationID uuid.UUID) ([]string, error) {
 resource := rbac.ResourceIdpsyncSettings
 if organizationID != uuid.Nil {
 resource = resource.InOrg(organizationID)
 }

 if err := q.authorizeContext(ctx, policy.ActionRead, resource); err != nil {
 return nil, err
 }
 return q.db.OIDCClaimFields(ctx, organizationID)
 }

 func (q *querier) OrganizationMembers(ctx context.Context, arg database.OrganizationMembersParams) ([]database.OrganizationMembersRow, error) {
 return fetchWithPostFilter(q.auth, policy.ActionRead, q.db.OrganizationMembers)(ctx, arg)
 }
diff --git a/coderd/database/dbauthz/dbauthz_test.go b/coderd/database/dbauthz/dbauthz_test.go
 }

 func (s *MethodTestSuite) TestOrganization() {
 s.Run("Deployment/OIDCClaimFields", s.Subtest(func(db database.Store, check *expects) {
 check.Args(uuid.Nil).Asserts(rbac.ResourceIdpsyncSettings, policy.ActionRead).Returns([]string{})
 }))
 s.Run("Organization/OIDCClaimFields", s.Subtest(func(db database.Store, check *expects) {
 id := uuid.New()
 check.Args(id).Asserts(rbac.ResourceIdpsyncSettings.InOrg(id), policy.ActionRead).Returns([]string{})
 }))
 s.Run("ByOrganization/GetGroups", s.Subtest(func(db database.Store, check *expects) {
 o := dbgen.Organization(s.T(), db, database.Organization{})
 a := dbgen.Group(s.T(), db, database.Group{OrganizationID: o.ID})
diff --git a/coderd/database/dbmem/dbmem.go b/coderd/database/dbmem/dbmem.go
 return shares, nil
 }

 func (q *FakeQuerier) OIDCClaimFields(_ context.Context, organizationID uuid.UUID) ([]string, error) {
 orgMembers := q.getOrganizationMemberNoLock(organizationID)

 var fields []string
 for _, link := range q.userLinks {
 if organizationID != uuid.Nil {
 inOrg := slices.ContainsFunc(orgMembers, func(organizationMember database.OrganizationMember) bool {
 return organizationMember.UserID == link.UserID
 })
 if !inOrg {
 continue
 }
 }

 if link.LoginType != database.LoginTypeOIDC {
 continue
 }

 for k := range link.Claims.IDTokenClaims {
 fields = append(fields, k)
 }
 for k := range link.Claims.UserInfoClaims {
 fields = append(fields, k)
 }
 }

 return slice.Unique(fields), nil
 }

 func (q *FakeQuerier) OrganizationMembers(_ context.Context, arg database.OrganizationMembersParams) ([]database.OrganizationMembersRow, error) {
 if err := validateDatabaseType(arg); err != nil {
 return []database.OrganizationMembersRow{}, err
diff --git a/coderd/database/dbmetrics/querymetrics.go b/coderd/database/dbmetrics/querymetrics.go
diff --git a/coderd/database/dbmock/dbmock.go b/coderd/database/dbmock/dbmock.go
diff --git a/coderd/database/modelqueries.go b/coderd/database/modelqueries.go
 import (
 "context"
 "database/sql"
 "encoding/json"
 "fmt"
 "strings"

 filtered := strings.Replace(query, authorizedQueryPlaceholder, replaceWith, 1)
 return filtered, nil
 }

 // UpdateUserLinkRawJSON is a custom query for unit testing. Do not ever expose this
 func (q *sqlQuerier) UpdateUserLinkRawJSON(ctx context.Context, userID uuid.UUID, data json.RawMessage) error {
 _, err := q.sdb.ExecContext(ctx, "UPDATE user_links SET claims = $2 WHERE user_id = $1", userID, data)
 return err
 }
Original file line number	Diff line number	Diff line change
Expand Up		@@ -3283,6 +3283,18 @@ func (q *querier) ListWorkspaceAgentPortShares(ctx context.Context, workspaceID
		return q.db.ListWorkspaceAgentPortShares(ctx, workspaceID)
		}

		func (q *querier) OIDCClaimFields(ctx context.Context, organizationID uuid.UUID) ([]string, error) {
		resource := rbac.ResourceIdpsyncSettings
		if organizationID != uuid.Nil {
		resource = resource.InOrg(organizationID)
		}

		if err := q.authorizeContext(ctx, policy.ActionRead, resource); err != nil {
		return nil, err
		}
		return q.db.OIDCClaimFields(ctx, organizationID)
		}

		func (q *querier) OrganizationMembers(ctx context.Context, arg database.OrganizationMembersParams) ([]database.OrganizationMembersRow, error) {
		return fetchWithPostFilter(q.auth, policy.ActionRead, q.db.OrganizationMembers)(ctx, arg)
		}
Expand Down
Original file line number	Diff line number	Diff line change
Expand Up		@@ -626,6 +626,13 @@ func (s *MethodTestSuite) TestLicense() {
		}

		func (s *MethodTestSuite) TestOrganization() {
		s.Run("Deployment/OIDCClaimFields", s.Subtest(func(db database.Store, check *expects) {
		check.Args(uuid.Nil).Asserts(rbac.ResourceIdpsyncSettings, policy.ActionRead).Returns([]string{})
		}))
		s.Run("Organization/OIDCClaimFields", s.Subtest(func(db database.Store, check *expects) {
		id := uuid.New()
		check.Args(id).Asserts(rbac.ResourceIdpsyncSettings.InOrg(id), policy.ActionRead).Returns([]string{})
		}))
		s.Run("ByOrganization/GetGroups", s.Subtest(func(db database.Store, check *expects) {
		o := dbgen.Organization(s.T(), db, database.Organization{})
		a := dbgen.Group(s.T(), db, database.Group{OrganizationID: o.ID})
Expand Down
Original file line number	Diff line number	Diff line change
Expand Up		@@ -8409,6 +8409,35 @@ func (q *FakeQuerier) ListWorkspaceAgentPortShares(_ context.Context, workspaceI
		return shares, nil
		}

		func (q *FakeQuerier) OIDCClaimFields(_ context.Context, organizationID uuid.UUID) ([]string, error) {
		orgMembers := q.getOrganizationMemberNoLock(organizationID)

		var fields []string
		for _, link := range q.userLinks {
		if organizationID != uuid.Nil {
		inOrg := slices.ContainsFunc(orgMembers, func(organizationMember database.OrganizationMember) bool {
		return organizationMember.UserID == link.UserID
		})
		if !inOrg {
		continue
		}
		}

		if link.LoginType != database.LoginTypeOIDC {
		continue
		}

		for k := range link.Claims.IDTokenClaims {
		fields = append(fields, k)
		}
		for k := range link.Claims.UserInfoClaims {
		fields = append(fields, k)
		}
		}

		return slice.Unique(fields), nil
		}

		func (q *FakeQuerier) OrganizationMembers(_ context.Context, arg database.OrganizationMembersParams) ([]database.OrganizationMembersRow, error) {
		if err := validateDatabaseType(arg); err != nil {
		return []database.OrganizationMembersRow{}, err
Expand Down
Original file line number	Diff line number	Diff line change
Expand Up		@@ -3,6 +3,7 @@ package database
		import (
		"context"
		"database/sql"
		"encoding/json"
		"fmt"
		"strings"

Expand DownExpand Up		@@ -527,3 +528,9 @@ func insertAuthorizedFilter(query string, replaceWith string) (string, error) {
		filtered := strings.Replace(query, authorizedQueryPlaceholder, replaceWith, 1)
		return filtered, nil
		}

		// UpdateUserLinkRawJSON is a custom query for unit testing. Do not ever expose this
		func (q *sqlQuerier) UpdateUserLinkRawJSON(ctx context.Context, userID uuid.UUID, data json.RawMessage) error {
		_, err := q.sdb.ExecContext(ctx, "UPDATE user_links SET claims = $2 WHERE user_id = $1", userID, data)
		return err
		}