dnoulet/go-loose
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

roles

Browse source
This commit is contained in:
Daniel Noulet 2026-10-04 16:57:30 +02:00
parent 6319da650c
commit 3fdc8cb489
26 changed files with 2245 additions and 488 deletions
Download patch file Download diff file Expand all files Collapse all files

168
internal/store/clientauth.go
View file

@ -16,6 +16,7 @@ type ManagedUser struct {
Email string `json:"email"`
DisplayName string `json:"display_name"`
Role string `json:"role"`
RoleID string `json:"role_id"`
Permissions []string `json:"permissions"`
Status string `json:"status"`
ApplicationIDs []string `json:"application_ids"`
@ -46,7 +47,9 @@ type ClientUser struct {
// Role is the membership role in the tenant owning the application. A user
// without a membership is reported as User so clients always see the least
// privileged role.
Role string `json:"role"`
Role string `json:"role"`
// Permissions is read from the role's own rows. A user without a membership
// gets the permissions of the built-in User role.
Permissions []string `json:"permissions"`
// AvatarKey is the stored locator; the server expands it into AvatarURL.
AvatarKey *string `json:"-"`
@ -55,9 +58,13 @@ type ClientUser struct {
func (s *Store) ListManagedUsers(ctx context.Context, administratorID string) ([]ManagedUser, error) {
rows, err := s.db.QueryContext(ctx, `
SELECT u.id, m.tenant_id, u.email, u.display_name, m.role,
SELECT u.id, m.tenant_id, u.email, u.display_name, r.slug, m.role_id,
CASE WHEN u.subject LIKE 'invited:%' THEN 'invited' ELSE 'active' END,
u.avatar_key,
COALESCE((
SELECT json_agg(rp.permission ORDER BY rp.permission)
FROM role_permissions rp WHERE rp.role_id = m.role_id
), '[]'::json),
COALESCE((
SELECT json_agg(ua.application_id ORDER BY ua.application_id)
FROM user_application_access ua
@ -66,12 +73,9 @@ func (s *Store) ListManagedUsers(ctx context.Context, administratorID string) ([
), '[]'::json)
FROM users u
JOIN memberships m ON m.user_id = u.id
WHERE EXISTS (
SELECT 1 FROM memberships own
WHERE own.tenant_id = m.tenant_id AND own.user_id = $1
AND own.role = ANY($2)
)
ORDER BY u.email, m.tenant_id`, administratorID, role.Grants(role.ManageUsers))
JOIN roles r ON r.id = m.role_id
WHERE `+permissionPredicate("m.tenant_id", "$1", "$2")+`
ORDER BY u.email, m.tenant_id`, administratorID, string(role.ManageUsers))
if err != nil {
return nil, err
}
@ -79,37 +83,42 @@ func (s *Store) ListManagedUsers(ctx context.Context, administratorID string) ([
result := make([]ManagedUser, 0)
for rows.Next() {
var user ManagedUser
var applicationIDs []byte
var permissions, applicationIDs []byte
if err := rows.Scan(&user.ID, &user.TenantID, &user.Email, &user.DisplayName, &user.Role,
&user.Status, &user.AvatarKey, &applicationIDs); err != nil {
&user.RoleID, &user.Status, &user.AvatarKey, &permissions, &applicationIDs); err != nil {
return nil, err
}
if err := json.Unmarshal(permissions, &user.Permissions); err != nil {
return nil, err
}
if err := json.Unmarshal(applicationIDs, &user.ApplicationIDs); err != nil {
return nil, err
}
user.Permissions = role.Role(user.Role).Permissions()
result = append(result, user)
}
return result, rows.Err()
}
func (s *Store) InviteUser(ctx context.Context, administratorID, tenantID, email, displayName, membershipRole, passwordHash string) (ManagedUser, error) {
// InviteUser adds a member to a tenant or, when the email already exists,
// re-invites them. The caller must hold users.manage in that tenant and may only
// hand out a role whose permissions they hold themselves.
func (s *Store) InviteUser(ctx context.Context, administratorID, tenantID, email, displayName, roleID string, passwordHash string) (ManagedUser, error) {
tx, err := s.db.BeginTx(ctx, nil)
if err != nil {
return ManagedUser{}, err
}
defer tx.Rollback()
var permitted bool
if err := tx.QueryRowContext(ctx, `
SELECT EXISTS(
SELECT 1 FROM memberships
WHERE tenant_id = $1 AND user_id = $2 AND role = ANY($3)
)`, tenantID, administratorID, role.Grants(role.ManageUsers)).Scan(&permitted); err != nil {
held, err := heldPermissions(ctx, tx, administratorID, tenantID)
if err != nil {
return ManagedUser{}, err
}
if !permitted {
if !within([]string{string(role.ManageUsers)}, held) {
return ManagedUser{}, ErrNotFound
}
resolved, err := resolveRoleID(ctx, tx, tenantID, roleID, held)
if err != nil {
return ManagedUser{}, err
}
var user ManagedUser
err = tx.QueryRowContext(ctx, `
INSERT INTO users(subject, email, display_name, password_hash, password_changed_at)
@ -125,37 +134,65 @@ func (s *Store) InviteUser(ctx context.Context, administratorID, tenantID, email
return ManagedUser{}, err
}
if _, err := tx.ExecContext(ctx, `
INSERT INTO memberships(tenant_id, user_id, role) VALUES ($1, $2, $3)
ON CONFLICT (tenant_id, user_id) DO UPDATE SET role = EXCLUDED.role`,
tenantID, user.ID, membershipRole); err != nil {
INSERT INTO memberships(tenant_id, user_id, role_id) VALUES ($1, $2, $3)
ON CONFLICT (tenant_id, user_id) DO UPDATE SET role_id = EXCLUDED.role_id`,
tenantID, user.ID, resolved); err != nil {
return ManagedUser{}, err
}
if err := tx.Commit(); err != nil {
return ManagedUser{}, err
}
user.TenantID, user.Role, user.ApplicationIDs = tenantID, membershipRole, []string{}
user.Permissions = role.Role(membershipRole).Permissions()
granted, err := roleGrants(ctx, s.db, resolved)
if err != nil {
return ManagedUser{}, err
}
user.TenantID, user.RoleID, user.ApplicationIDs = tenantID, resolved, []string{}
if err := s.db.QueryRowContext(ctx, `SELECT slug FROM roles WHERE id = $1`, resolved).Scan(&user.Role); err != nil {
return ManagedUser{}, err
}
user.Permissions = granted
return user, nil
}
func (s *Store) SetUserAccess(ctx context.Context, administratorID, tenantID, userID, membershipRole string, applicationIDs []string) error {
// SetUserAccess changes a member's role and replaces their application grants.
func (s *Store) SetUserAccess(ctx context.Context, administratorID, tenantID, userID, roleID string, applicationIDs []string) error {
tx, err := s.db.BeginTx(ctx, nil)
if err != nil {
return err
}
defer tx.Rollback()
held, err := heldPermissions(ctx, tx, administratorID, tenantID)
if err != nil {
return err
}
if !within([]string{string(role.ManageUsers)}, held) {
return ErrNotFound
}
resolved, err := resolveRoleID(ctx, tx, tenantID, roleID, held)
if err != nil {
return err
}
if err := ensureTenantKeepsAnOwner(ctx, tx, tenantID, userID, resolved); err != nil {
return err
}
result, err := tx.ExecContext(ctx, `
UPDATE memberships target SET role = $4
FROM memberships administrator
WHERE target.tenant_id = $1 AND target.user_id = $2
AND administrator.tenant_id = target.tenant_id
AND administrator.user_id = $3 AND administrator.role = ANY($5)`,
tenantID, userID, administratorID, membershipRole, role.Grants(role.ManageUsers))
UPDATE memberships SET role_id = $3
WHERE tenant_id = $1 AND user_id = $2 AND role_id IS DISTINCT FROM $3`,
tenantID, userID, resolved)
if err != nil {
return err
}
if count, _ := result.RowsAffected(); count == 0 {
return ErrNotFound
// Either the membership does not exist or the role is unchanged.
var exists bool
if err := tx.QueryRowContext(ctx, `
SELECT EXISTS(SELECT 1 FROM memberships WHERE tenant_id = $1 AND user_id = $2)`,
tenantID, userID).Scan(&exists); err != nil {
return err
}
if !exists {
return ErrNotFound
}
}
if _, err := tx.ExecContext(ctx, `
DELETE FROM user_application_access ua
@ -179,17 +216,49 @@ func (s *Store) SetUserAccess(ctx context.Context, administratorID, tenantID, us
return tx.Commit()
}
// ErrLastOwner is returned when a change would leave a tenant without an owner.
var ErrLastOwner = errors.New("a tenant must keep at least one owner")
// ensureTenantKeepsAnOwner blocks demoting or moving away the only membership
// that still holds the owner role. Without this a tenant administrator could
// lock every administrator out of their own tenant with a single edit.
func ensureTenantKeepsAnOwner(ctx context.Context, tx *sql.Tx, tenantID, userID, newRoleID string) error {
var losesOwner bool
if err := tx.QueryRowContext(ctx, `
SELECT EXISTS(
SELECT 1 FROM memberships m
JOIN roles r ON r.id = m.role_id
WHERE m.tenant_id = $1 AND m.user_id = $2 AND r.slug = 'owner' AND m.role_id <> $3
)`, tenantID, userID, newRoleID).Scan(&losesOwner); err != nil {
return err
}
if !losesOwner {
return nil
}
var remaining int
if err := tx.QueryRowContext(ctx, `
SELECT count(*)
FROM memberships m
JOIN roles r ON r.id = m.role_id
WHERE m.tenant_id = $1 AND r.slug = 'owner' AND m.user_id <> $2`,
tenantID, userID).Scan(&remaining); err != nil {
return err
}
if remaining == 0 {
return ErrLastOwner
}
return nil
}
func (s *Store) ConfigureClient(ctx context.Context, administratorID, applicationID string, redirectURIs []string, secretHash []byte) (Application, error) {
var app Application
var encoded []byte
err := s.db.QueryRowContext(ctx, `
UPDATE applications a
SET redirect_uris = $4, client_secret_hash = $5, updated_at = now()
FROM memberships m
WHERE a.id = $1 AND m.tenant_id = a.tenant_id AND m.user_id = $2
AND m.role = ANY($3)
WHERE a.id = $1 AND `+permissionPredicate("a.tenant_id", "$2", "$3")+`
RETURNING a.id, a.client_id, to_json(a.redirect_uris), true`,
applicationID, administratorID, role.Grants(role.ManageApplications), redirectURIs, secretHash).
applicationID, administratorID, string(role.ManageApplications), redirectURIs, secretHash).
Scan(&app.ID, &app.ClientID, &encoded, &app.ClientReady)
if errors.Is(err, sql.ErrNoRows) {
return Application{}, ErrNotFound
@ -263,6 +332,7 @@ func (s *Store) ExchangeAuthorizationCode(ctx context.Context, clientID, redirec
}
defer tx.Rollback()
var user ClientUser
var permissions []byte
err = tx.QueryRowContext(ctx, `
UPDATE client_authorization_codes c SET used_at = now()
FROM applications a
@ -270,21 +340,25 @@ func (s *Store) ExchangeAuthorizationCode(ctx context.Context, clientID, redirec
JOIN user_application_access ua ON ua.application_id = a.id
JOIN users u ON u.id = ua.user_id
LEFT JOIN memberships m ON m.tenant_id = t.id AND m.user_id = u.id
LEFT JOIN roles r ON r.id = m.role_id
WHERE c.code_hash = $1 AND c.used_at IS NULL AND c.expires_at > now()
AND c.redirect_uri = $2 AND a.id = c.application_id
AND ua.user_id = c.user_id AND ua.application_id = a.id
AND a.client_id = $3 AND a.client_secret_hash = $4
RETURNING u.id, u.email, u.display_name, t.id, t.slug, a.id, a.slug,
COALESCE(m.role, $5), u.avatar_key`,
codeHash, redirectURI, clientID, secretHash, role.User).
COALESCE(r.slug, 'user'), `+clientPermissions+`, u.avatar_key`,
codeHash, redirectURI, clientID, secretHash).
Scan(&user.ID, &user.Email, &user.DisplayName, &user.TenantID, &user.TenantSlug,
&user.ApplicationID, &user.Application, &user.Role, &user.AvatarKey)
&user.ApplicationID, &user.Application, &user.Role, &permissions, &user.AvatarKey)
if errors.Is(err, sql.ErrNoRows) {
return ClientUser{}, time.Time{}, ErrNotFound
}
if err != nil {
return ClientUser{}, time.Time{}, err
}
if err := json.Unmarshal(permissions, &user.Permissions); err != nil {
return ClientUser{}, time.Time{}, err
}
expiresAt := time.Now().UTC().Add(12 * time.Hour)
if _, err := tx.ExecContext(ctx, `
INSERT INTO client_user_sessions(token_hash, application_id, user_id, expires_at)
@ -296,6 +370,7 @@ func (s *Store) ExchangeAuthorizationCode(ctx context.Context, clientID, redirec
func (s *Store) ClientUserByToken(ctx context.Context, tokenHash []byte) (ClientUser, error) {
var user ClientUser
var permissions []byte
err := s.db.QueryRowContext(ctx, `
UPDATE client_user_sessions s SET last_used_at = now()
FROM applications a
@ -303,17 +378,24 @@ func (s *Store) ClientUserByToken(ctx context.Context, tokenHash []byte) (Client
JOIN user_application_access ua ON ua.application_id = a.id
JOIN users u ON u.id = ua.user_id
LEFT JOIN memberships m ON m.tenant_id = t.id AND m.user_id = u.id
LEFT JOIN roles r ON r.id = m.role_id
WHERE s.token_hash = $1 AND s.revoked_at IS NULL AND s.expires_at > now()
AND a.id = s.application_id AND ua.user_id = s.user_id
RETURNING u.id, u.email, u.display_name, t.id, t.slug, a.id, a.slug,
COALESCE(m.role, $2), u.avatar_key`,
tokenHash, role.User).
COALESCE(r.slug, 'user'), `+clientPermissions+`, u.avatar_key`,
tokenHash).
Scan(&user.ID, &user.Email, &user.DisplayName, &user.TenantID, &user.TenantSlug,
&user.ApplicationID, &user.Application, &user.Role, &user.AvatarKey)
&user.ApplicationID, &user.Application, &user.Role, &permissions, &user.AvatarKey)
if errors.Is(err, sql.ErrNoRows) {
return ClientUser{}, ErrNotFound
}
return user, err
if err != nil {
return ClientUser{}, err
}
if err := json.Unmarshal(permissions, &user.Permissions); err != nil {
return ClientUser{}, err
}
return user, nil
}
func (s *Store) RevokeClientSession(ctx context.Context, tokenHash []byte) error {