chore: include merged claims into the database (#15570)

Emyrk · web-flow · commit 4fedc7cf3dae · 2024-11-18T11:58:19.000-06:00
Merging happens before IDP sync. Storing this will make some SQL queries
much simplier.
diff --git a/coderd/database/types.go b/coderd/database/types.go
@@ -214,6 +214,9 @@ func (p AgentIDNamePair) Value() (driver.Value, error) {
 type UserLinkClaims struct {
 	IDTokenClaims  map[string]interface{} `json:"id_token_claims"`
 	UserInfoClaims map[string]interface{} `json:"user_info_claims"`
+	// MergeClaims are computed in Golang. It is the result of merging
+	// the IDTokenClaims and UserInfoClaims. UserInfoClaims take precedence.
+	MergedClaims map[string]interface{} `json:"merged_claims"`
 }
 
 func (a *UserLinkClaims) Scan(src interface{}) error {
diff --git a/coderd/userauth.go b/coderd/userauth.go
@@ -1326,6 +1326,7 @@ func (api *API) userOIDC(rw http.ResponseWriter, r *http.Request) {
 		UserClaims: database.UserLinkClaims{
 			IDTokenClaims:  idtokenClaims,
 			UserInfoClaims: userInfoClaims,
+			MergedClaims:   mergedClaims,
 		},
 	}).SetInitAuditRequest(func(params *audit.RequestParams) (*audit.Request[database.User], func()) {
 		return audit.InitRequest[database.User](rw, params)
diff --git a/enterprise/dbcrypt/dbcrypt_internal_test.go b/enterprise/dbcrypt/dbcrypt_internal_test.go
@@ -64,6 +64,16 @@ func TestUserLinks(t *testing.T) {
 					"number": float64(2),
 				},
 			},
+			MergedClaims: map[string]interface{}{
+				"sub": "123",
+				"groups": []interface{}{
+					"foo", "bar",
+				},
+				"number": float64(2),
+				"struct": map[string]interface{}{
+					"number": float64(2),
+				},
+			},
 		}
 
 		updated, err := crypt.UpdateUserLink(ctx, database.UpdateUserLinkParams{

Original file line number	Diff line number	Diff line change
`@@ -214,6 +214,9 @@ func (p AgentIDNamePair) Value() (driver.Value, error) {`
`214`	`214`	`type UserLinkClaims struct {`
`215`	`215`	IDTokenClaims map[string]interface{} `json:"id_token_claims"`
`216`	`216`	UserInfoClaims map[string]interface{} `json:"user_info_claims"`
	`217`	`+ // MergeClaims are computed in Golang. It is the result of merging`
	`218`	`+ // the IDTokenClaims and UserInfoClaims. UserInfoClaims take precedence.`
	`219`	+ MergedClaims map[string]interface{} `json:"merged_claims"`
`217`	`220`	`}`
`218`	`221`
`219`	`222`	`func (a *UserLinkClaims) Scan(src interface{}) error {`