Authn: Refactor user sync and org sync as post auth hooks (#60504)
* add user sync * add org user sync * add client params * merge remaining conflicts * remove change to report.go * update comments * add basic tests for user ID population * add tests for auth ID find * add tests for user sync create and update * add tests for orgsync * satisfy lint * add userID guards
This commit is contained in:
Jo
@@ -0,0 +1,116 @@
|
||||
package usersync
|
||||
|
||||
import (
|
||||
"context"
|
||||
"errors"
|
||||
"fmt"
|
||||
|
||||
"github.com/grafana/grafana/pkg/cmd/grafana-cli/logger"
|
||||
"github.com/grafana/grafana/pkg/infra/log"
|
||||
"github.com/grafana/grafana/pkg/models"
|
||||
"github.com/grafana/grafana/pkg/services/accesscontrol"
|
||||
"github.com/grafana/grafana/pkg/services/authn"
|
||||
"github.com/grafana/grafana/pkg/services/org"
|
||||
"github.com/grafana/grafana/pkg/services/user"
|
||||
)
|
||||
|
||||
type OrgSync struct {
|
||||
userService user.Service
|
||||
orgService org.Service
|
||||
accessControl accesscontrol.Service
|
||||
|
||||
log log.Logger
|
||||
}
|
||||
|
||||
func (s *OrgSync) SyncOrgUser(ctx context.Context, clientParams *authn.ClientParams, id *authn.Identity) error {
|
||||
if !clientParams.SyncUser {
|
||||
s.log.Debug("Not syncing org user", "auth_module", id.AuthModule, "auth_id", id.AuthID)
|
||||
return nil
|
||||
}
|
||||
|
||||
namespace, userID := id.NamespacedID()
|
||||
if namespace != "user" && userID <= 0 {
|
||||
return fmt.Errorf("invalid namespace %q for user ID %q", namespace, userID)
|
||||
}
|
||||
|
||||
s.log.Debug("Syncing organization roles", "id", userID, "extOrgRoles", id.OrgRoles)
|
||||
// don't sync org roles if none is specified
|
||||
if len(id.OrgRoles) == 0 {
|
||||
s.log.Debug("Not syncing organization roles since external user doesn't have any")
|
||||
return nil
|
||||
}
|
||||
|
||||
orgsQuery := &org.GetUserOrgListQuery{UserID: userID}
|
||||
result, err := s.orgService.GetUserOrgList(ctx, orgsQuery)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
handledOrgIds := map[int64]bool{}
|
||||
deleteOrgIds := []int64{}
|
||||
|
||||
// update existing org roles
|
||||
for _, orga := range result {
|
||||
handledOrgIds[orga.OrgID] = true
|
||||
|
||||
extRole := id.OrgRoles[orga.OrgID]
|
||||
if extRole == "" {
|
||||
deleteOrgIds = append(deleteOrgIds, orga.OrgID)
|
||||
} else if extRole != orga.Role {
|
||||
// update role
|
||||
cmd := &org.UpdateOrgUserCommand{OrgID: orga.OrgID, UserID: userID, Role: extRole}
|
||||
if err := s.orgService.UpdateOrgUser(ctx, cmd); err != nil {
|
||||
return err
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// add any new org roles
|
||||
for orgId, orgRole := range id.OrgRoles {
|
||||
if _, exists := handledOrgIds[orgId]; exists {
|
||||
continue
|
||||
}
|
||||
|
||||
// add role
|
||||
cmd := &org.AddOrgUserCommand{UserID: userID, Role: orgRole, OrgID: orgId}
|
||||
err := s.orgService.AddOrgUser(ctx, cmd)
|
||||
if err != nil && !errors.Is(err, models.ErrOrgNotFound) {
|
||||
return err
|
||||
}
|
||||
}
|
||||
|
||||
// delete any removed org roles
|
||||
for _, orgId := range deleteOrgIds {
|
||||
s.log.Debug("Removing user's organization membership as part of syncing with OAuth login",
|
||||
"userId", userID, "orgId", orgId)
|
||||
cmd := &org.RemoveOrgUserCommand{OrgID: orgId, UserID: userID}
|
||||
if err := s.orgService.RemoveOrgUser(ctx, cmd); err != nil {
|
||||
if errors.Is(err, models.ErrLastOrgAdmin) {
|
||||
logger.Error(err.Error(), "userId", cmd.UserID, "orgId", cmd.OrgID)
|
||||
continue
|
||||
}
|
||||
|
||||
return err
|
||||
}
|
||||
|
||||
if err := s.accessControl.DeleteUserPermissions(ctx, orgId, cmd.UserID); err != nil {
|
||||
logger.Error("failed to delete permissions for user", "error", err, "userID", cmd.UserID, "orgID", orgId)
|
||||
return err
|
||||
}
|
||||
}
|
||||
|
||||
// update user's default org if needed
|
||||
if _, ok := id.OrgRoles[id.OrgID]; !ok {
|
||||
for orgId := range id.OrgRoles {
|
||||
id.OrgID = orgId
|
||||
break
|
||||
}
|
||||
|
||||
return s.userService.SetUsingOrg(ctx, &user.SetUsingOrgCommand{
|
||||
UserID: userID,
|
||||
OrgID: id.OrgID,
|
||||
})
|
||||
}
|
||||
|
||||
return nil
|
||||
}
|
||||
@@ -0,0 +1,123 @@
|
||||
package usersync
|
||||
|
||||
import (
|
||||
"context"
|
||||
"testing"
|
||||
|
||||
"github.com/grafana/grafana/pkg/infra/log"
|
||||
"github.com/grafana/grafana/pkg/models"
|
||||
"github.com/grafana/grafana/pkg/models/roletype"
|
||||
"github.com/grafana/grafana/pkg/services/accesscontrol"
|
||||
"github.com/grafana/grafana/pkg/services/accesscontrol/actest"
|
||||
"github.com/grafana/grafana/pkg/services/authn"
|
||||
"github.com/grafana/grafana/pkg/services/org"
|
||||
"github.com/grafana/grafana/pkg/services/org/orgtest"
|
||||
"github.com/grafana/grafana/pkg/services/user"
|
||||
"github.com/grafana/grafana/pkg/services/user/usertest"
|
||||
"github.com/stretchr/testify/assert"
|
||||
)
|
||||
|
||||
func TestOrgSync_SyncOrgUser(t *testing.T) {
|
||||
orgService := &orgtest.FakeOrgService{ExpectedUserOrgDTO: []*org.UserOrgDTO{
|
||||
{
|
||||
OrgID: 1,
|
||||
Role: org.RoleEditor,
|
||||
},
|
||||
{
|
||||
OrgID: 3,
|
||||
Role: org.RoleViewer,
|
||||
},
|
||||
},
|
||||
ExpectedOrgListResponse: orgtest.OrgListResponse{
|
||||
{
|
||||
OrgID: 3,
|
||||
Response: nil,
|
||||
},
|
||||
},
|
||||
}
|
||||
acService := &actest.FakeService{}
|
||||
userService := &usertest.FakeUserService{ExpectedUser: &user.User{
|
||||
ID: 1,
|
||||
Login: "test",
|
||||
Name: "test",
|
||||
Email: "test",
|
||||
}}
|
||||
|
||||
type fields struct {
|
||||
userService user.Service
|
||||
orgService org.Service
|
||||
accessControl accesscontrol.Service
|
||||
log log.Logger
|
||||
}
|
||||
type args struct {
|
||||
ctx context.Context
|
||||
clientParams *authn.ClientParams
|
||||
id *authn.Identity
|
||||
}
|
||||
tests := []struct {
|
||||
name string
|
||||
fields fields
|
||||
args args
|
||||
wantErr bool
|
||||
wantID *authn.Identity
|
||||
}{
|
||||
{
|
||||
name: "add user to multiple orgs",
|
||||
fields: fields{
|
||||
userService: userService,
|
||||
orgService: orgService,
|
||||
accessControl: acService,
|
||||
log: log.NewNopLogger(),
|
||||
},
|
||||
args: args{
|
||||
ctx: context.Background(),
|
||||
clientParams: &authn.ClientParams{
|
||||
SyncUser: true,
|
||||
},
|
||||
id: &authn.Identity{
|
||||
ID: "user:1",
|
||||
Login: "test",
|
||||
Name: "test",
|
||||
Email: "test",
|
||||
OrgRoles: map[int64]roletype.RoleType{1: org.RoleAdmin, 2: org.RoleEditor},
|
||||
IsGrafanaAdmin: ptrBool(false),
|
||||
LookUpParams: models.UserLookupParams{
|
||||
UserID: nil,
|
||||
Email: ptrString("test"),
|
||||
Login: nil,
|
||||
},
|
||||
},
|
||||
},
|
||||
wantID: &authn.Identity{
|
||||
ID: "user:1",
|
||||
Login: "test",
|
||||
Name: "test",
|
||||
Email: "test",
|
||||
OrgRoles: map[int64]roletype.RoleType{1: org.RoleAdmin, 2: org.RoleEditor},
|
||||
OrgID: 1, //set using org
|
||||
IsGrafanaAdmin: ptrBool(false),
|
||||
LookUpParams: models.UserLookupParams{
|
||||
UserID: nil,
|
||||
Email: ptrString("test"),
|
||||
Login: nil,
|
||||
},
|
||||
},
|
||||
wantErr: false,
|
||||
},
|
||||
}
|
||||
for _, tt := range tests {
|
||||
t.Run(tt.name, func(t *testing.T) {
|
||||
s := &OrgSync{
|
||||
userService: tt.fields.userService,
|
||||
orgService: tt.fields.orgService,
|
||||
accessControl: tt.fields.accessControl,
|
||||
log: tt.fields.log,
|
||||
}
|
||||
if err := s.SyncOrgUser(tt.args.ctx, tt.args.clientParams, tt.args.id); (err != nil) != tt.wantErr {
|
||||
t.Errorf("OrgSync.SyncOrgUser() error = %v, wantErr %v", err, tt.wantErr)
|
||||
}
|
||||
|
||||
assert.EqualValues(t, tt.wantID, tt.args.id)
|
||||
})
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,248 @@
|
||||
package usersync
|
||||
|
||||
import (
|
||||
"context"
|
||||
"errors"
|
||||
"fmt"
|
||||
|
||||
"github.com/grafana/grafana/pkg/infra/log"
|
||||
"github.com/grafana/grafana/pkg/models"
|
||||
"github.com/grafana/grafana/pkg/services/authn"
|
||||
"github.com/grafana/grafana/pkg/services/login"
|
||||
"github.com/grafana/grafana/pkg/services/quota"
|
||||
"github.com/grafana/grafana/pkg/services/user"
|
||||
)
|
||||
|
||||
type UserSync struct {
|
||||
userService user.Service
|
||||
authInfoService login.AuthInfoService
|
||||
quotaService quota.Service
|
||||
log log.Logger
|
||||
}
|
||||
|
||||
// SyncUser syncs a user with the database
|
||||
func (s *UserSync) SyncUser(ctx context.Context, clientParams *authn.ClientParams, id *authn.Identity) error {
|
||||
if !clientParams.SyncUser {
|
||||
s.log.Debug("Not syncing user", "auth_module", id.AuthModule, "auth_id", id.AuthID)
|
||||
return nil
|
||||
}
|
||||
|
||||
// Does user exist in the database?
|
||||
usr, errUserInDB := s.UserInDB(ctx, &id.AuthModule, &id.AuthID, id.LookUpParams)
|
||||
if errUserInDB != nil && !errors.Is(errUserInDB, user.ErrUserNotFound) {
|
||||
return errUserInDB
|
||||
}
|
||||
|
||||
if errors.Is(errUserInDB, user.ErrUserNotFound) {
|
||||
if !clientParams.AllowSignUp {
|
||||
s.log.Warn("Not allowing login, user not found in internal user database and allow signup = false",
|
||||
"auth_module", id.AuthModule)
|
||||
return login.ErrSignupNotAllowed
|
||||
}
|
||||
|
||||
// create user
|
||||
var errCreate error
|
||||
usr, errCreate = s.createUser(ctx, id)
|
||||
if errCreate != nil {
|
||||
return errCreate
|
||||
}
|
||||
}
|
||||
|
||||
// update user
|
||||
if errUpdate := s.updateUserAttributes(ctx, clientParams, usr, id); errUpdate != nil {
|
||||
return errUpdate
|
||||
}
|
||||
|
||||
syncUserToIdentity(usr, id)
|
||||
|
||||
// persist latest auth info token
|
||||
if errAuthInfo := s.updateAuthInfo(ctx, id); errAuthInfo != nil {
|
||||
return errAuthInfo
|
||||
}
|
||||
|
||||
return nil
|
||||
}
|
||||
|
||||
// syncUserToIdentity syncs a user to an identity.
|
||||
// This is used to update the identity with the latest user information.
|
||||
func syncUserToIdentity(usr *user.User, id *authn.Identity) {
|
||||
id.ID = fmt.Sprintf("user:%d", usr.ID)
|
||||
id.Login = usr.Login
|
||||
id.Email = usr.Email
|
||||
id.Name = usr.Name
|
||||
id.IsGrafanaAdmin = &usr.IsAdmin
|
||||
}
|
||||
|
||||
func (s *UserSync) updateAuthInfo(ctx context.Context, id *authn.Identity) error {
|
||||
if id.AuthModule != "" && id.OAuthToken != nil && id.AuthID != "" {
|
||||
return nil
|
||||
}
|
||||
|
||||
namespace, userID := id.NamespacedID()
|
||||
if namespace != "user" && userID <= 0 { // FIXME: constant namespace
|
||||
return fmt.Errorf("invalid namespace %q for user ID %q", namespace, userID)
|
||||
}
|
||||
|
||||
updateCmd := &models.UpdateAuthInfoCommand{
|
||||
AuthModule: id.AuthModule,
|
||||
AuthId: id.AuthID,
|
||||
UserId: userID,
|
||||
OAuthToken: id.OAuthToken,
|
||||
}
|
||||
|
||||
s.log.Debug("Updating user_auth info", "user_id", userID)
|
||||
return s.authInfoService.UpdateAuthInfo(ctx, updateCmd)
|
||||
}
|
||||
|
||||
func (s *UserSync) updateUserAttributes(ctx context.Context, clientParams *authn.ClientParams, usr *user.User, id *authn.Identity) error {
|
||||
// sync user info
|
||||
updateCmd := &user.UpdateUserCommand{
|
||||
UserID: usr.ID,
|
||||
}
|
||||
|
||||
needsUpdate := false
|
||||
if id.Login != "" && id.Login != usr.Login {
|
||||
updateCmd.Login = id.Login
|
||||
usr.Login = id.Login
|
||||
needsUpdate = true
|
||||
}
|
||||
|
||||
if id.Email != "" && id.Email != usr.Email {
|
||||
updateCmd.Email = id.Email
|
||||
usr.Email = id.Email
|
||||
needsUpdate = true
|
||||
}
|
||||
|
||||
if id.Name != "" && id.Name != usr.Name {
|
||||
updateCmd.Name = id.Name
|
||||
usr.Name = id.Name
|
||||
needsUpdate = true
|
||||
}
|
||||
|
||||
if needsUpdate {
|
||||
s.log.Debug("Syncing user info", "id", usr.ID, "update", updateCmd)
|
||||
if err := s.userService.Update(ctx, updateCmd); err != nil {
|
||||
return err
|
||||
}
|
||||
}
|
||||
|
||||
if usr.IsDisabled && clientParams.EnableDisabledUsers {
|
||||
usr.IsDisabled = false
|
||||
if errDisableUser := s.userService.Disable(ctx,
|
||||
&user.DisableUserCommand{
|
||||
UserID: usr.ID, IsDisabled: false}); errDisableUser != nil {
|
||||
return errDisableUser
|
||||
}
|
||||
}
|
||||
|
||||
// Sync isGrafanaAdmin permission
|
||||
if id.IsGrafanaAdmin != nil && *id.IsGrafanaAdmin != usr.IsAdmin {
|
||||
usr.IsAdmin = *id.IsGrafanaAdmin
|
||||
if errPerms := s.userService.UpdatePermissions(ctx, usr.ID, *id.IsGrafanaAdmin); errPerms != nil {
|
||||
return errPerms
|
||||
}
|
||||
}
|
||||
|
||||
return nil
|
||||
}
|
||||
|
||||
func (s *UserSync) createUser(ctx context.Context, id *authn.Identity) (*user.User, error) {
|
||||
isAdmin := false
|
||||
if id.IsGrafanaAdmin != nil {
|
||||
isAdmin = *id.IsGrafanaAdmin
|
||||
}
|
||||
|
||||
// TODO: add quota check
|
||||
usr, errCreateUser := s.userService.Create(ctx, &user.CreateUserCommand{
|
||||
Login: id.Login,
|
||||
Email: id.Email,
|
||||
Name: id.Name,
|
||||
IsAdmin: isAdmin,
|
||||
SkipOrgSetup: len(id.OrgRoles) > 0,
|
||||
})
|
||||
if errCreateUser != nil {
|
||||
return nil, errCreateUser
|
||||
}
|
||||
|
||||
if id.AuthModule != "" && id.AuthID != "" {
|
||||
if errSetAuth := s.authInfoService.SetAuthInfo(ctx, &models.SetAuthInfoCommand{
|
||||
UserId: usr.ID,
|
||||
AuthModule: id.AuthModule,
|
||||
AuthId: id.AuthID,
|
||||
OAuthToken: id.OAuthToken,
|
||||
}); errSetAuth != nil {
|
||||
return nil, errSetAuth
|
||||
}
|
||||
}
|
||||
|
||||
return usr, nil
|
||||
}
|
||||
|
||||
// Does user exist in the database?
|
||||
// Check first authinfo table, then user table
|
||||
// return user id if found, 0 if not found
|
||||
func (s *UserSync) UserInDB(ctx context.Context,
|
||||
authID *string,
|
||||
authModule *string,
|
||||
params models.UserLookupParams) (*user.User, error) {
|
||||
// Check authinfo table
|
||||
if authID != nil && authModule != nil {
|
||||
query := &models.GetAuthInfoQuery{
|
||||
AuthModule: *authModule,
|
||||
AuthId: *authID,
|
||||
}
|
||||
errGetAuthInfo := s.authInfoService.GetAuthInfo(ctx, query)
|
||||
if errGetAuthInfo == nil {
|
||||
usr, errGetByID := s.userService.GetByID(ctx, &user.GetUserByIDQuery{ID: query.Result.UserId})
|
||||
if errGetByID == nil {
|
||||
return usr, nil
|
||||
}
|
||||
|
||||
if !errors.Is(errGetByID, user.ErrUserNotFound) {
|
||||
return nil, errGetByID
|
||||
}
|
||||
}
|
||||
|
||||
if !errors.Is(errGetAuthInfo, user.ErrUserNotFound) {
|
||||
return nil, errGetAuthInfo
|
||||
}
|
||||
}
|
||||
|
||||
// Check user table to grab existing user
|
||||
return s.LookupByOneOf(ctx, ¶ms)
|
||||
}
|
||||
|
||||
func (s *UserSync) LookupByOneOf(ctx context.Context, params *models.UserLookupParams) (*user.User, error) {
|
||||
var usr *user.User
|
||||
var err error
|
||||
|
||||
// If not found, try to find the user by id
|
||||
if params.UserID != nil && *params.UserID != 0 {
|
||||
usr, err = s.userService.GetByID(ctx, &user.GetUserByIDQuery{ID: *params.UserID})
|
||||
if err != nil && !errors.Is(err, user.ErrUserNotFound) {
|
||||
return nil, err
|
||||
}
|
||||
}
|
||||
|
||||
// If not found, try to find the user by email address
|
||||
if usr == nil && params.Email != nil && *params.Email != "" {
|
||||
usr, err = s.userService.GetByEmail(ctx, &user.GetUserByEmailQuery{Email: *params.Email})
|
||||
if err != nil && !errors.Is(err, user.ErrUserNotFound) {
|
||||
return nil, err
|
||||
}
|
||||
}
|
||||
|
||||
// If not found, try to find the user by login
|
||||
if usr == nil && params.Login != nil && *params.Login != "" {
|
||||
usr, err = s.userService.GetByLogin(ctx, &user.GetUserByLoginQuery{LoginOrEmail: *params.Login})
|
||||
if err != nil && !errors.Is(err, user.ErrUserNotFound) {
|
||||
return nil, err
|
||||
}
|
||||
}
|
||||
|
||||
if usr == nil {
|
||||
return nil, user.ErrUserNotFound
|
||||
}
|
||||
|
||||
return usr, nil
|
||||
}
|
||||
@@ -0,0 +1,443 @@
|
||||
package usersync
|
||||
|
||||
import (
|
||||
"context"
|
||||
"testing"
|
||||
|
||||
"github.com/grafana/grafana/pkg/infra/log"
|
||||
"github.com/grafana/grafana/pkg/models"
|
||||
"github.com/grafana/grafana/pkg/services/authn"
|
||||
"github.com/grafana/grafana/pkg/services/login"
|
||||
"github.com/grafana/grafana/pkg/services/login/logintest"
|
||||
"github.com/grafana/grafana/pkg/services/quota"
|
||||
"github.com/grafana/grafana/pkg/services/quota/quotatest"
|
||||
"github.com/grafana/grafana/pkg/services/user"
|
||||
"github.com/grafana/grafana/pkg/services/user/usertest"
|
||||
"github.com/stretchr/testify/require"
|
||||
)
|
||||
|
||||
func ptrString(s string) *string {
|
||||
return &s
|
||||
}
|
||||
|
||||
func ptrBool(b bool) *bool {
|
||||
return &b
|
||||
}
|
||||
|
||||
func ptrInt64(i int64) *int64 {
|
||||
return &i
|
||||
}
|
||||
|
||||
func TestUserSync_SyncUser(t *testing.T) {
|
||||
authFakeNil := &logintest.AuthInfoServiceFake{
|
||||
ExpectedUser: nil,
|
||||
ExpectedError: user.ErrUserNotFound,
|
||||
SetAuthInfoFn: func(ctx context.Context, cmd *models.SetAuthInfoCommand) error {
|
||||
return nil
|
||||
},
|
||||
UpdateAuthInfoFn: func(ctx context.Context, cmd *models.UpdateAuthInfoCommand) error {
|
||||
return nil
|
||||
},
|
||||
}
|
||||
authFakeUserID := &logintest.AuthInfoServiceFake{
|
||||
ExpectedUser: nil,
|
||||
ExpectedError: nil,
|
||||
ExpectedUserAuth: &models.UserAuth{
|
||||
AuthModule: "oauth",
|
||||
AuthId: "2032",
|
||||
UserId: 1,
|
||||
Id: 1}}
|
||||
|
||||
userService := &usertest.FakeUserService{ExpectedUser: &user.User{
|
||||
ID: 1,
|
||||
Login: "test",
|
||||
Name: "test",
|
||||
Email: "test",
|
||||
}}
|
||||
|
||||
userServiceMod := &usertest.FakeUserService{ExpectedUser: &user.User{
|
||||
ID: 3,
|
||||
Login: "test",
|
||||
Name: "test",
|
||||
Email: "test",
|
||||
IsDisabled: true,
|
||||
IsAdmin: false,
|
||||
}}
|
||||
|
||||
userServiceNil := &usertest.FakeUserService{
|
||||
ExpectedUser: nil,
|
||||
ExpectedError: user.ErrUserNotFound,
|
||||
CreateFn: func(ctx context.Context, cmd *user.CreateUserCommand) (*user.User, error) {
|
||||
return &user.User{
|
||||
ID: 2,
|
||||
Login: cmd.Login,
|
||||
Name: cmd.Name,
|
||||
Email: cmd.Email,
|
||||
IsAdmin: cmd.IsAdmin,
|
||||
}, nil
|
||||
},
|
||||
}
|
||||
|
||||
type fields struct {
|
||||
userService user.Service
|
||||
authInfoService login.AuthInfoService
|
||||
quotaService quota.Service
|
||||
log log.Logger
|
||||
}
|
||||
type args struct {
|
||||
ctx context.Context
|
||||
clientParams *authn.ClientParams
|
||||
id *authn.Identity
|
||||
}
|
||||
tests := []struct {
|
||||
name string
|
||||
fields fields
|
||||
args args
|
||||
wantErr bool
|
||||
wantID *authn.Identity
|
||||
}{
|
||||
{
|
||||
name: "no sync",
|
||||
fields: fields{
|
||||
userService: userService,
|
||||
authInfoService: authFakeNil,
|
||||
quotaService: "atest.FakeQuotaService{},
|
||||
log: log.NewNopLogger(),
|
||||
},
|
||||
args: args{
|
||||
ctx: context.Background(),
|
||||
clientParams: &authn.ClientParams{
|
||||
SyncUser: false,
|
||||
AllowSignUp: false,
|
||||
EnableDisabledUsers: false,
|
||||
},
|
||||
id: &authn.Identity{
|
||||
ID: "",
|
||||
Login: "test",
|
||||
Name: "test",
|
||||
Email: "test",
|
||||
LookUpParams: models.UserLookupParams{
|
||||
UserID: nil,
|
||||
Email: ptrString("test"),
|
||||
Login: nil,
|
||||
},
|
||||
},
|
||||
},
|
||||
wantErr: false,
|
||||
wantID: &authn.Identity{
|
||||
ID: "",
|
||||
Login: "test",
|
||||
Name: "test",
|
||||
Email: "test",
|
||||
LookUpParams: models.UserLookupParams{
|
||||
UserID: nil,
|
||||
Email: ptrString("test"),
|
||||
Login: nil,
|
||||
},
|
||||
},
|
||||
},
|
||||
{
|
||||
name: "sync - user found in DB - by email",
|
||||
fields: fields{
|
||||
userService: userService,
|
||||
authInfoService: authFakeNil,
|
||||
quotaService: "atest.FakeQuotaService{},
|
||||
log: log.NewNopLogger(),
|
||||
},
|
||||
args: args{
|
||||
ctx: context.Background(),
|
||||
clientParams: &authn.ClientParams{
|
||||
SyncUser: true,
|
||||
AllowSignUp: false,
|
||||
EnableDisabledUsers: false,
|
||||
},
|
||||
id: &authn.Identity{
|
||||
ID: "",
|
||||
Login: "test",
|
||||
Name: "test",
|
||||
Email: "test",
|
||||
LookUpParams: models.UserLookupParams{
|
||||
UserID: nil,
|
||||
Email: ptrString("test"),
|
||||
Login: nil,
|
||||
},
|
||||
},
|
||||
},
|
||||
wantErr: false,
|
||||
wantID: &authn.Identity{
|
||||
ID: "user:1",
|
||||
Login: "test",
|
||||
Name: "test",
|
||||
Email: "test",
|
||||
IsGrafanaAdmin: ptrBool(false),
|
||||
LookUpParams: models.UserLookupParams{
|
||||
UserID: nil,
|
||||
Email: ptrString("test"),
|
||||
Login: nil,
|
||||
},
|
||||
},
|
||||
},
|
||||
{
|
||||
name: "sync - user found in DB - by login",
|
||||
fields: fields{
|
||||
userService: userService,
|
||||
authInfoService: authFakeNil,
|
||||
quotaService: "atest.FakeQuotaService{},
|
||||
log: log.NewNopLogger(),
|
||||
},
|
||||
args: args{
|
||||
ctx: context.Background(),
|
||||
clientParams: &authn.ClientParams{
|
||||
SyncUser: true,
|
||||
AllowSignUp: false,
|
||||
EnableDisabledUsers: false,
|
||||
},
|
||||
id: &authn.Identity{
|
||||
ID: "",
|
||||
Login: "test",
|
||||
Name: "test",
|
||||
Email: "test",
|
||||
LookUpParams: models.UserLookupParams{
|
||||
UserID: nil,
|
||||
Email: nil,
|
||||
Login: ptrString("test"),
|
||||
},
|
||||
},
|
||||
},
|
||||
wantErr: false,
|
||||
wantID: &authn.Identity{
|
||||
ID: "user:1",
|
||||
Login: "test",
|
||||
Name: "test",
|
||||
Email: "test",
|
||||
IsGrafanaAdmin: ptrBool(false),
|
||||
LookUpParams: models.UserLookupParams{
|
||||
UserID: nil,
|
||||
Email: nil,
|
||||
Login: ptrString("test"),
|
||||
},
|
||||
},
|
||||
},
|
||||
{
|
||||
name: "sync - user found in DB - by ID",
|
||||
fields: fields{
|
||||
userService: userService,
|
||||
authInfoService: authFakeNil,
|
||||
quotaService: "atest.FakeQuotaService{},
|
||||
log: log.NewNopLogger(),
|
||||
},
|
||||
args: args{
|
||||
ctx: context.Background(),
|
||||
clientParams: &authn.ClientParams{
|
||||
SyncUser: true,
|
||||
AllowSignUp: false,
|
||||
EnableDisabledUsers: false,
|
||||
},
|
||||
id: &authn.Identity{
|
||||
ID: "",
|
||||
Login: "test",
|
||||
Name: "test",
|
||||
Email: "test",
|
||||
LookUpParams: models.UserLookupParams{
|
||||
UserID: ptrInt64(1),
|
||||
Email: nil,
|
||||
Login: nil,
|
||||
},
|
||||
},
|
||||
},
|
||||
wantErr: false,
|
||||
wantID: &authn.Identity{
|
||||
ID: "user:1",
|
||||
Login: "test",
|
||||
Name: "test",
|
||||
Email: "test",
|
||||
IsGrafanaAdmin: ptrBool(false),
|
||||
LookUpParams: models.UserLookupParams{
|
||||
UserID: ptrInt64(1),
|
||||
Email: nil,
|
||||
Login: nil,
|
||||
},
|
||||
},
|
||||
},
|
||||
{
|
||||
name: "sync - user found in authInfo",
|
||||
fields: fields{
|
||||
userService: userService,
|
||||
authInfoService: authFakeUserID,
|
||||
quotaService: "atest.FakeQuotaService{},
|
||||
log: log.NewNopLogger(),
|
||||
},
|
||||
args: args{
|
||||
ctx: context.Background(),
|
||||
clientParams: &authn.ClientParams{
|
||||
SyncUser: true,
|
||||
AllowSignUp: false,
|
||||
EnableDisabledUsers: false,
|
||||
},
|
||||
id: &authn.Identity{
|
||||
ID: "",
|
||||
Login: "test",
|
||||
Name: "test",
|
||||
Email: "test",
|
||||
LookUpParams: models.UserLookupParams{
|
||||
UserID: nil,
|
||||
Email: nil,
|
||||
Login: nil,
|
||||
},
|
||||
},
|
||||
},
|
||||
wantErr: false,
|
||||
wantID: &authn.Identity{
|
||||
ID: "user:1",
|
||||
Login: "test",
|
||||
Name: "test",
|
||||
Email: "test",
|
||||
IsGrafanaAdmin: ptrBool(false),
|
||||
LookUpParams: models.UserLookupParams{
|
||||
UserID: nil,
|
||||
Email: nil,
|
||||
Login: nil,
|
||||
},
|
||||
},
|
||||
},
|
||||
{
|
||||
name: "sync - user needs to be created - disabled signup",
|
||||
fields: fields{
|
||||
userService: userService,
|
||||
authInfoService: authFakeNil,
|
||||
quotaService: "atest.FakeQuotaService{},
|
||||
log: log.NewNopLogger(),
|
||||
},
|
||||
args: args{
|
||||
ctx: context.Background(),
|
||||
clientParams: &authn.ClientParams{
|
||||
SyncUser: true,
|
||||
AllowSignUp: false,
|
||||
EnableDisabledUsers: false,
|
||||
},
|
||||
id: &authn.Identity{
|
||||
ID: "",
|
||||
Login: "test",
|
||||
Name: "test",
|
||||
Email: "test",
|
||||
AuthModule: "oauth",
|
||||
AuthID: "2032",
|
||||
LookUpParams: models.UserLookupParams{
|
||||
UserID: nil,
|
||||
Email: nil,
|
||||
Login: nil,
|
||||
},
|
||||
},
|
||||
},
|
||||
wantErr: true,
|
||||
},
|
||||
{
|
||||
name: "sync - user needs to be created - enabled signup",
|
||||
fields: fields{
|
||||
userService: userServiceNil,
|
||||
authInfoService: authFakeNil,
|
||||
quotaService: "atest.FakeQuotaService{},
|
||||
log: log.NewNopLogger(),
|
||||
},
|
||||
args: args{
|
||||
ctx: context.Background(),
|
||||
clientParams: &authn.ClientParams{
|
||||
SyncUser: true,
|
||||
AllowSignUp: true,
|
||||
EnableDisabledUsers: true,
|
||||
},
|
||||
id: &authn.Identity{
|
||||
ID: "",
|
||||
Login: "test_create",
|
||||
Name: "test_create",
|
||||
IsGrafanaAdmin: ptrBool(true),
|
||||
Email: "test_create",
|
||||
AuthModule: "oauth",
|
||||
AuthID: "2032",
|
||||
LookUpParams: models.UserLookupParams{
|
||||
UserID: nil,
|
||||
Email: ptrString("test_create"),
|
||||
Login: nil,
|
||||
},
|
||||
},
|
||||
},
|
||||
wantErr: false,
|
||||
wantID: &authn.Identity{
|
||||
ID: "user:2",
|
||||
Login: "test_create",
|
||||
Name: "test_create",
|
||||
Email: "test_create",
|
||||
AuthModule: "oauth",
|
||||
AuthID: "2032",
|
||||
IsGrafanaAdmin: ptrBool(true),
|
||||
LookUpParams: models.UserLookupParams{
|
||||
UserID: nil,
|
||||
Email: ptrString("test_create"),
|
||||
Login: nil,
|
||||
},
|
||||
},
|
||||
},
|
||||
{
|
||||
name: "sync - needs full update",
|
||||
fields: fields{
|
||||
userService: userServiceMod,
|
||||
authInfoService: authFakeNil,
|
||||
quotaService: "atest.FakeQuotaService{},
|
||||
log: log.NewNopLogger(),
|
||||
},
|
||||
args: args{
|
||||
ctx: context.Background(),
|
||||
clientParams: &authn.ClientParams{
|
||||
SyncUser: true,
|
||||
AllowSignUp: false,
|
||||
EnableDisabledUsers: true,
|
||||
},
|
||||
id: &authn.Identity{
|
||||
ID: "",
|
||||
Login: "test_mod",
|
||||
Name: "test_mod",
|
||||
Email: "test_mod",
|
||||
IsDisabled: false,
|
||||
IsGrafanaAdmin: ptrBool(true),
|
||||
LookUpParams: models.UserLookupParams{
|
||||
UserID: ptrInt64(3),
|
||||
Email: nil,
|
||||
Login: nil,
|
||||
},
|
||||
},
|
||||
},
|
||||
wantErr: false,
|
||||
wantID: &authn.Identity{
|
||||
ID: "user:3",
|
||||
Login: "test_mod",
|
||||
Name: "test_mod",
|
||||
Email: "test_mod",
|
||||
IsDisabled: false,
|
||||
IsGrafanaAdmin: ptrBool(true),
|
||||
LookUpParams: models.UserLookupParams{
|
||||
UserID: ptrInt64(3),
|
||||
Email: nil,
|
||||
Login: nil,
|
||||
},
|
||||
},
|
||||
},
|
||||
}
|
||||
for _, tt := range tests {
|
||||
t.Run(tt.name, func(t *testing.T) {
|
||||
s := &UserSync{
|
||||
userService: tt.fields.userService,
|
||||
authInfoService: tt.fields.authInfoService,
|
||||
quotaService: tt.fields.quotaService,
|
||||
log: tt.fields.log,
|
||||
}
|
||||
err := s.SyncUser(tt.args.ctx, tt.args.clientParams, tt.args.id)
|
||||
if tt.wantErr {
|
||||
require.Error(t, err)
|
||||
return
|
||||
}
|
||||
require.NoError(t, err)
|
||||
|
||||
require.EqualValues(t, tt.wantID, tt.args.id)
|
||||
})
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user