local-it/vikunja-api
Archived
0
0
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity

add groups to claims and assign user as no admin

Browse source
This commit is contained in:
viehlieb 2022-10-12 12:17:04 +02:00
parent c2104a3374
commit 1b935868b6
3 changed files with 150 additions and 90 deletions
Download patch file Download diff file Expand all files Collapse all files

73
pkg/modules/auth/openid/openid.go
View file

@ -52,16 +52,18 @@ type Provider struct {
OriginalAuthURL string `json:"-"`
AuthURL string `json:"auth_url"`
ClientID string `json:"client_id"`
Scope string `json:"scope"`
ClientSecret string `json:"-"`
openIDProvider *oidc.Provider
Oauth2Config *oauth2.Config `json:"-"`
}
type claims struct {
Email string `json:"email"`
Name string `json:"name"`
PreferredUsername string `json:"preferred_username"`
Nickname string `json:"nickname"`
Email string `json:"email"`
Name string `json:"name"`
PreferredUsername string `json:"preferred_username"`
Nickname string `json:"nickname"`
Group []string `json:"groups"`
}
func init() {
@ -188,22 +190,83 @@ func HandleCallback(c echo.Context) error {
// Check if we have seen this user before
u, err := getOrCreateUser(s, cl, idToken.Issuer, idToken.Subject)
log.Errorf("Issuer %s: %v", idToken.Issuer, err)
if err != nil {
_ = s.Rollback()
log.Errorf("Error creating new user for provider %s: %v", provider.Name, err)
return handler.HandleHTTPError(err, c)
}
// Check if we have seen this user before
teams := GetOrCreateTeamsByNames(s, cl.Group, u)
if err != nil {
log.Errorf("Error verifying team for name %v, got %v", cl.Name, teams, err)
return err
} else {
for _, team := range teams {
tm := models.TeamMember{TeamID: team.ID, Username: u.Username}
if err = tm.Create(s, u); err != nil {
switch t := err.(type) {
case *models.ErrUserIsMemberOfTeam:
log.Errorf("ErrUserIsMemberOfTeam", t)
break
default:
log.Errorf("Error assigning User to team", t)
}
}
}
}
err = s.Commit()
if err != nil {
return handler.HandleHTTPError(err, c)
}
// Create token
return auth.NewUserAuthTokenResponse(u, c, false)
}
func GetOrCreateTeamsByNames(s *xorm.Session, teamNames []string, u *user.User) (te []models.Team) {
// Check if a team with given name exists should be after user creation
//TODO: 1. Create team if not exist
te = []models.Team{}
for _, t := range teamNames {
team, err := models.GetTeamsByName(s, t)
if models.IsErrTeamsDoNotExist(err) {
log.Errorf("No such Team: %v, got %v", t, team, err)
tea := &models.Team{
Name: t,
}
// TODO: here the user who creates the Team is automatically admin. That shoud not be the case..?
err := tea.CreateNoAdmin(s, u)
if err != nil {
log.Errorf("Teams: %v, err: %v", tea, err)
} else {
te = append(te, *tea)
}
} else {
// if multiple teams with same name are found,
if len(team) == 1 {
te = append(te, *team[len(team)-1])
} else {
log.Errorf("Multiple Teams have the same name: %v, ", team[len(team)-1].Name)
}
}
}
return te
}
// assign user to team
// remove user from team if not in group
// if multiple teams found with same name -> do nothing
// optional: assign by id
//
func getOrCreateUser(s *xorm.Session, cl *claims, issuer, subject string) (u *user.User, err error) {
// Check if the user exists for that issuer and subject
u, err = user.GetUserWithEmail(s, &user.User{
Issuer: issuer,