Skip to content

Commit 73ec6b2

Browse files
EmyrkEmyrk
authored
chore: audit log entries for all idp sync changes (#15919)
1 parent 761a196 commit 73ec6b2

File tree

18 files changed

+259
-64
lines changed

18 files changed

+259
-64
lines changed

‎coderd/apidoc/docs.go

Lines changed: 12 additions & 2 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎coderd/apidoc/swagger.json

Lines changed: 12 additions & 2 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎coderd/audit/diff.go

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@ package audit
22

33
import (
44
"github.com/coder/coder/v2/coderd/database"
5+
"github.com/coder/coder/v2/coderd/idpsync"
56
)
67

78
// Auditable is mostly a marker interface. It contains a definitive list of all
@@ -26,7 +27,10 @@ type Auditable interface {
2627
database.CustomRole |
2728
database.AuditableOrganizationMember |
2829
database.Organization |
29-
database.NotificationTemplate
30+
database.NotificationTemplate |
31+
idpsync.OrganizationSyncSettings |
32+
idpsync.GroupSyncSettings |
33+
idpsync.RoleSyncSettings
3034
}
3135

3236
// Map is a map of changed fields in an audited resource. It maps field names to

‎coderd/audit/request.go

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,7 @@ import (
2020
"github.com/coder/coder/v2/coderd/database"
2121
"github.com/coder/coder/v2/coderd/database/dbtime"
2222
"github.com/coder/coder/v2/coderd/httpmw"
23+
"github.com/coder/coder/v2/coderd/idpsync"
2324
"github.com/coder/coder/v2/coderd/tracing"
2425
)
2526

@@ -121,11 +122,22 @@ func ResourceTarget[T Auditable](tgt T) string {
121122
return typed.Name
122123
case database.NotificationTemplate:
123124
return typed.Name
125+
case idpsync.OrganizationSyncSettings:
126+
return "Organization Sync"
127+
case idpsync.GroupSyncSettings:
128+
return "Organization Group Sync"
129+
case idpsync.RoleSyncSettings:
130+
return "Organization Role Sync"
124131
default:
125132
panic(fmt.Sprintf("unknown resource %T for ResourceTarget", tgt))
126133
}
127134
}
128135

136+
// noID can be used for resources that do not have an uuid.
137+
// An example is singleton configuration resources.
138+
// 51A51C = "Static"
139+
var noID = uuid.MustParse("51A51C00-0000-0000-0000-000000000000")
140+
129141
func ResourceID[T Auditable](tgt T) uuid.UUID {
130142
switch typed := any(tgt).(type) {
131143
case database.Template:
@@ -169,6 +181,12 @@ func ResourceID[T Auditable](tgt T) uuid.UUID {
169181
return typed.ID
170182
case database.NotificationTemplate:
171183
return typed.ID
184+
case idpsync.OrganizationSyncSettings:
185+
return noID // Deployment all uses the same org sync settings
186+
case idpsync.GroupSyncSettings:
187+
return noID // Org field on audit log has org id
188+
case idpsync.RoleSyncSettings:
189+
return noID // Org field on audit log has org id
172190
default:
173191
panic(fmt.Sprintf("unknown resource %T for ResourceID", tgt))
174192
}
@@ -214,6 +232,12 @@ func ResourceType[T Auditable](tgt T) database.ResourceType {
214232
return database.ResourceTypeOrganization
215233
case database.NotificationTemplate:
216234
return database.ResourceTypeNotificationTemplate
235+
case idpsync.OrganizationSyncSettings:
236+
return database.ResourceTypeIdpSyncSettingsOrganization
237+
case idpsync.RoleSyncSettings:
238+
return database.ResourceTypeIdpSyncSettingsRole
239+
case idpsync.GroupSyncSettings:
240+
return database.ResourceTypeIdpSyncSettingsGroup
217241
default:
218242
panic(fmt.Sprintf("unknown resource %T for ResourceType", typed))
219243
}
@@ -261,6 +285,12 @@ func ResourceRequiresOrgID[T Auditable]() bool {
261285
return true
262286
case database.NotificationTemplate:
263287
return false
288+
case idpsync.OrganizationSyncSettings:
289+
return false
290+
case idpsync.GroupSyncSettings:
291+
return true
292+
case idpsync.RoleSyncSettings:
293+
return true
264294
default:
265295
panic(fmt.Sprintf("unknown resource %T for ResourceRequiresOrgID", tgt))
266296
}

‎coderd/database/dump.sql

Lines changed: 4 additions & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎coderd/database/migrations/000281_idpsync_settings.down.sql

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
-- Nothing to do

‎coderd/database/migrations/000281_idpsync_settings.up.sql

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
-- Allow modifications to notification templates to be audited.
2+
ALTER TYPE resource_type ADD VALUE IF NOT EXISTS 'idp_sync_settings_organization';
3+
ALTER TYPE resource_type ADD VALUE IF NOT EXISTS 'idp_sync_settings_group';
4+
ALTER TYPE resource_type ADD VALUE IF NOT EXISTS 'idp_sync_settings_role';

‎coderd/database/models.go

Lines changed: 29 additions & 20 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎coderd/idpsync/organization.go

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -149,13 +149,13 @@ type OrganizationSyncSettings struct {
149149
// Field selects the claim field to be used as the created user's
150150
// organizations. If the field is the empty string, then no organization updates
151151
// will ever come from the OIDC provider.
152-
Field string
152+
Field string `json:"field"`
153153
// Mapping controls how organizations returned by the OIDC provider get mapped
154-
Mapping map[string][]uuid.UUID
154+
Mapping map[string][]uuid.UUID `json:"mapping"`
155155
// AssignDefault will ensure all users that authenticate will be
156156
// placed into the default organization. This is mostly a hack to support
157157
// legacy deployments.
158-
AssignDefault bool
158+
AssignDefault bool `json:"assign_default"`
159159
}
160160

161161
func (s *OrganizationSyncSettings) Set(v string) error {

‎codersdk/audit.go

Lines changed: 13 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -30,10 +30,13 @@ const (
3030
ResourceTypeOrganization ResourceType = "organization"
3131
ResourceTypeOAuth2ProviderApp ResourceType = "oauth2_provider_app"
3232
// nolint:gosec // This is not a secret.
33-
ResourceTypeOAuth2ProviderAppSecret ResourceType = "oauth2_provider_app_secret"
34-
ResourceTypeCustomRole ResourceType = "custom_role"
35-
ResourceTypeOrganizationMember = "organization_member"
36-
ResourceTypeNotificationTemplate = "notification_template"
33+
ResourceTypeOAuth2ProviderAppSecret ResourceType = "oauth2_provider_app_secret"
34+
ResourceTypeCustomRole ResourceType = "custom_role"
35+
ResourceTypeOrganizationMember ResourceType = "organization_member"
36+
ResourceTypeNotificationTemplate ResourceType = "notification_template"
37+
ResourceTypeIdpSyncSettingsOrganization ResourceType = "idp_sync_settings_organization"
38+
ResourceTypeIdpSyncSettingsGroup ResourceType = "idp_sync_settings_group"
39+
ResourceTypeIdpSyncSettingsRole ResourceType = "idp_sync_settings_role"
3740
)
3841

3942
func (r ResourceType) FriendlyString() string {
@@ -78,6 +81,12 @@ func (r ResourceType) FriendlyString() string {
7881
return "organization member"
7982
case ResourceTypeNotificationTemplate:
8083
return "notification template"
84+
case ResourceTypeIdpSyncSettingsOrganization:
85+
return "settings"
86+
case ResourceTypeIdpSyncSettingsGroup:
87+
return "settings"
88+
case ResourceTypeIdpSyncSettingsRole:
89+
return "settings"
8190
default:
8291
return "unknown"
8392
}

0 commit comments

Comments
 (0)
pFad - Phonifier reborn

Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.

Note: This service is not intended for secure transactions such as banking, social media, email, or purchasing. Use at your own risk. We assume no liability whatsoever for broken pages.


Alternative Proxies:

Alternative Proxy

pFad Proxy

pFad v3 Proxy

pFad v4 Proxy