Chungus 2.0

server/private/routers/orgIdp/createOrgOidcIdp.ts

@@ -0,0 +1,185 @@
+/*
+ * This file is part of a proprietary work.
+ *
+ * Copyright (c) 2025 Fossorial, Inc.
+ * All rights reserved.
+ *
+ * This file is licensed under the Fossorial Commercial License.
+ * You may not use this file except in compliance with the License.
+ * Unauthorized use, copying, modification, or distribution is strictly prohibited.
+ *
+ * This file is not licensed under the AGPLv3.
+ */
+
+import { Request, Response, NextFunction } from "express";
+import { z } from "zod";
+import { db } from "@server/db";
+import response from "@server/lib/response";
+import HttpCode from "@server/types/HttpCode";
+import createHttpError from "http-errors";
+import logger from "@server/logger";
+import { fromError } from "zod-validation-error";
+import { OpenAPITags, registry } from "@server/openApi";
+import { idp, idpOidcConfig, idpOrg, orgs } from "@server/db";
+import { generateOidcRedirectUrl } from "@server/lib/idp/generateRedirectUrl";
+import { encrypt } from "@server/lib/crypto";
+import config from "@server/lib/config";
+import { build } from "@server/build";
+import { getOrgTierData } from "#private/lib/billing";
+import { TierId } from "@server/lib/billing/tiers";
+
+const paramsSchema = z.object({ orgId: z.string().nonempty() }).strict();
+
+const bodySchema = z
+    .object({
+        name: z.string().nonempty(),
+        clientId: z.string().nonempty(),
+        clientSecret: z.string().nonempty(),
+        authUrl: z.string().url(),
+        tokenUrl: z.string().url(),
+        identifierPath: z.string().nonempty(),
+        emailPath: z.string().optional(),
+        namePath: z.string().optional(),
+        scopes: z.string().nonempty(),
+        autoProvision: z.boolean().optional(),
+        variant: z.enum(["oidc", "google", "azure"]).optional().default("oidc"),
+        roleMapping: z.string().optional()
+    })
+    .strict();
+
+export type CreateOrgIdpResponse = {
+    idpId: number;
+    redirectUrl: string;
+};
+
+// registry.registerPath({
+//     method: "put",
+//     path: "/idp/oidc",
+//     description: "Create an OIDC IdP.",
+//     tags: [OpenAPITags.Idp],
+//     request: {
+//         body: {
+//             content: {
+//                 "application/json": {
+//                     schema: bodySchema
+//                 }
+//             }
+//         }
+//     },
+//     responses: {}
+// });
+
+export async function createOrgOidcIdp(
+    req: Request,
+    res: Response,
+    next: NextFunction
+): Promise<any> {
+    try {
+        const parsedParams = paramsSchema.safeParse(req.params);
+        if (!parsedParams.success) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    fromError(parsedParams.error).toString()
+                )
+            );
+        }
+
+        const { orgId } = parsedParams.data;
+
+        const parsedBody = bodySchema.safeParse(req.body);
+        if (!parsedBody.success) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    fromError(parsedBody.error).toString()
+                )
+            );
+        }
+
+        const {
+            clientId,
+            clientSecret,
+            authUrl,
+            tokenUrl,
+            scopes,
+            identifierPath,
+            emailPath,
+            namePath,
+            name,
+            autoProvision,
+            variant,
+            roleMapping
+        } = parsedBody.data;
+
+        if (build === "saas") {
+            const { tier, active } = await getOrgTierData(orgId);
+            const subscribed = tier === TierId.STANDARD;
+            if (!subscribed) {
+                return next(
+                    createHttpError(
+                        HttpCode.FORBIDDEN,
+                        "This organization's current plan does not support this feature."
+                    )
+                );
+            }
+        }
+
+        const key = config.getRawConfig().server.secret!;
+
+        const encryptedSecret = encrypt(clientSecret, key);
+        const encryptedClientId = encrypt(clientId, key);
+
+        let idpId: number | undefined;
+        await db.transaction(async (trx) => {
+            const [idpRes] = await trx
+                .insert(idp)
+                .values({
+                    name,
+                    autoProvision,
+                    type: "oidc"
+                })
+                .returning();
+
+            idpId = idpRes.idpId;
+
+            await trx.insert(idpOidcConfig).values({
+                idpId: idpRes.idpId,
+                clientId: encryptedClientId,
+                clientSecret: encryptedSecret,
+                authUrl,
+                tokenUrl,
+                scopes,
+                identifierPath,
+                emailPath,
+                namePath,
+                variant
+            });
+
+            await trx.insert(idpOrg).values({
+                idpId: idpRes.idpId,
+                orgId: orgId,
+                roleMapping: roleMapping || null,
+                orgMapping: `'${orgId}'`
+            });
+        });
+
+        const redirectUrl = await generateOidcRedirectUrl(idpId as number, orgId);
+
+        return response<CreateOrgIdpResponse>(res, {
+            data: {
+                idpId: idpId as number,
+                redirectUrl
+            },
+            success: true,
+            error: false,
+            message: "Org Idp created successfully",
+            status: HttpCode.CREATED
+        });
+    } catch (error) {
+        logger.error(error);
+        return next(
+            createHttpError(HttpCode.INTERNAL_SERVER_ERROR, "An error occurred")
+        );
+    }
+}

server/private/routers/orgIdp/deleteOrgIdp.ts

@@ -0,0 +1,108 @@
+/*
+ * This file is part of a proprietary work.
+ *
+ * Copyright (c) 2025 Fossorial, Inc.
+ * All rights reserved.
+ *
+ * This file is licensed under the Fossorial Commercial License.
+ * You may not use this file except in compliance with the License.
+ * Unauthorized use, copying, modification, or distribution is strictly prohibited.
+ *
+ * This file is not licensed under the AGPLv3.
+ */
+
+import { Request, Response, NextFunction } from "express";
+import { z } from "zod";
+import { db } from "@server/db";
+import response from "@server/lib/response";
+import HttpCode from "@server/types/HttpCode";
+import createHttpError from "http-errors";
+import logger from "@server/logger";
+import { fromError } from "zod-validation-error";
+import { idp, idpOidcConfig, idpOrg } from "@server/db";
+import { eq } from "drizzle-orm";
+import { OpenAPITags, registry } from "@server/openApi";
+
+const paramsSchema = z
+    .object({
+        orgId: z.string().optional(), // Optional; used with org idp in saas
+        idpId: z.coerce.number()
+    })
+    .strict();
+
+registry.registerPath({
+    method: "delete",
+    path: "/idp/{idpId}",
+    description: "Delete IDP.",
+    tags: [OpenAPITags.Idp],
+    request: {
+        params: paramsSchema
+    },
+    responses: {}
+});
+
+export async function deleteOrgIdp(
+    req: Request,
+    res: Response,
+    next: NextFunction
+): Promise<any> {
+    try {
+        const parsedParams = paramsSchema.safeParse(req.params);
+        if (!parsedParams.success) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    fromError(parsedParams.error).toString()
+                )
+            );
+        }
+
+        const { idpId } = parsedParams.data;
+
+        // Check if IDP exists
+        const [existingIdp] = await db
+            .select()
+            .from(idp)
+            .where(eq(idp.idpId, idpId));
+
+        if (!existingIdp) {
+            return next(
+                createHttpError(
+                    HttpCode.NOT_FOUND,
+                    "IdP not found"
+                )
+            );
+        }
+
+        // Delete the IDP and its related records in a transaction
+        await db.transaction(async (trx) => {
+            // Delete OIDC config if it exists
+            await trx
+                .delete(idpOidcConfig)
+                .where(eq(idpOidcConfig.idpId, idpId));
+
+            // Delete IDP-org mappings
+            await trx
+                .delete(idpOrg)
+                .where(eq(idpOrg.idpId, idpId));
+
+            // Delete the IDP itself
+            await trx
+                .delete(idp)
+                .where(eq(idp.idpId, idpId));
+        });
+
+        return response<null>(res, {
+            data: null,
+            success: true,
+            error: false,
+            message: "IdP deleted successfully",
+            status: HttpCode.OK
+        });
+    } catch (error) {
+        logger.error(error);
+        return next(
+            createHttpError(HttpCode.INTERNAL_SERVER_ERROR, "An error occurred")
+        );
+    }
+}

server/private/routers/orgIdp/getOrgIdp.ts

@@ -0,0 +1,117 @@
+/*
+ * This file is part of a proprietary work.
+ *
+ * Copyright (c) 2025 Fossorial, Inc.
+ * All rights reserved.
+ *
+ * This file is licensed under the Fossorial Commercial License.
+ * You may not use this file except in compliance with the License.
+ * Unauthorized use, copying, modification, or distribution is strictly prohibited.
+ *
+ * This file is not licensed under the AGPLv3.
+ */
+
+import { Request, Response, NextFunction } from "express";
+import { z } from "zod";
+import { db, idpOrg, loginPage, loginPageOrg } from "@server/db";
+import { idp, idpOidcConfig } from "@server/db";
+import { eq, and } from "drizzle-orm";
+import response from "@server/lib/response";
+import HttpCode from "@server/types/HttpCode";
+import createHttpError from "http-errors";
+import logger from "@server/logger";
+import { fromError } from "zod-validation-error";
+import { OpenAPITags, registry } from "@server/openApi";
+import config from "@server/lib/config";
+import { decrypt } from "@server/lib/crypto";
+import { generateOidcRedirectUrl } from "@server/lib/idp/generateRedirectUrl";
+
+const paramsSchema = z
+    .object({
+        orgId: z.string().nonempty(),
+        idpId: z.coerce.number()
+    })
+    .strict();
+
+async function query(idpId: number, orgId: string) {
+    const [res] = await db
+        .select()
+        .from(idp)
+        .where(eq(idp.idpId, idpId))
+        .leftJoin(idpOidcConfig, eq(idpOidcConfig.idpId, idp.idpId))
+        .leftJoin(
+            idpOrg,
+            and(eq(idpOrg.idpId, idp.idpId), eq(idpOrg.orgId, orgId))
+        )
+        .limit(1);
+    return res;
+}
+
+export type GetOrgIdpResponse = NonNullable<
+    Awaited<ReturnType<typeof query>>
+> & { redirectUrl: string };
+
+// registry.registerPath({
+//     method: "get",
+//     path: "/idp/{idpId}",
+//     description: "Get an IDP by its IDP ID.",
+//     tags: [OpenAPITags.Idp],
+//     request: {
+//         params: paramsSchema
+//     },
+//     responses: {}
+// });
+
+export async function getOrgIdp(
+    req: Request,
+    res: Response,
+    next: NextFunction
+): Promise<any> {
+    try {
+        const parsedParams = paramsSchema.safeParse(req.params);
+        if (!parsedParams.success) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    fromError(parsedParams.error).toString()
+                )
+            );
+        }
+
+        const { idpId, orgId } = parsedParams.data;
+
+        const idpRes = await query(idpId, orgId);
+
+        if (!idpRes) {
+            return next(createHttpError(HttpCode.NOT_FOUND, "Idp not found"));
+        }
+
+        const key = config.getRawConfig().server.secret!;
+
+        if (idpRes.idp.type === "oidc") {
+            const clientSecret = idpRes.idpOidcConfig!.clientSecret;
+            const clientId = idpRes.idpOidcConfig!.clientId;
+
+            idpRes.idpOidcConfig!.clientSecret = decrypt(clientSecret, key);
+            idpRes.idpOidcConfig!.clientId = decrypt(clientId, key);
+        }
+
+        const redirectUrl = await generateOidcRedirectUrl(idpRes.idp.idpId, orgId);
+
+        return response<GetOrgIdpResponse>(res, {
+            data: {
+                ...idpRes,
+                redirectUrl
+            },
+            success: true,
+            error: false,
+            message: "Org Idp retrieved successfully",
+            status: HttpCode.OK
+        });
+    } catch (error) {
+        logger.error(error);
+        return next(
+            createHttpError(HttpCode.INTERNAL_SERVER_ERROR, "An error occurred")
+        );
+    }
+}

server/private/routers/orgIdp/index.ts

@@ -0,0 +1,18 @@
+/*
+ * This file is part of a proprietary work.
+ *
+ * Copyright (c) 2025 Fossorial, Inc.
+ * All rights reserved.
+ *
+ * This file is licensed under the Fossorial Commercial License.
+ * You may not use this file except in compliance with the License.
+ * Unauthorized use, copying, modification, or distribution is strictly prohibited.
+ *
+ * This file is not licensed under the AGPLv3.
+ */
+
+export * from "./createOrgOidcIdp";
+export * from "./getOrgIdp";
+export * from "./listOrgIdps";
+export * from "./updateOrgOidcIdp";
+export * from "./deleteOrgIdp";

server/private/routers/orgIdp/listOrgIdps.ts

@@ -0,0 +1,142 @@
+/*
+ * This file is part of a proprietary work.
+ *
+ * Copyright (c) 2025 Fossorial, Inc.
+ * All rights reserved.
+ *
+ * This file is licensed under the Fossorial Commercial License.
+ * You may not use this file except in compliance with the License.
+ * Unauthorized use, copying, modification, or distribution is strictly prohibited.
+ *
+ * This file is not licensed under the AGPLv3.
+ */
+
+import { Request, Response, NextFunction } from "express";
+import { z } from "zod";
+import { db, idpOidcConfig } from "@server/db";
+import { idp, idpOrg } from "@server/db";
+import response from "@server/lib/response";
+import HttpCode from "@server/types/HttpCode";
+import createHttpError from "http-errors";
+import { eq, sql } from "drizzle-orm";
+import logger from "@server/logger";
+import { fromError } from "zod-validation-error";
+import { OpenAPITags, registry } from "@server/openApi";
+
+const querySchema = z
+    .object({
+        limit: z
+            .string()
+            .optional()
+            .default("1000")
+            .transform(Number)
+            .pipe(z.number().int().nonnegative()),
+        offset: z
+            .string()
+            .optional()
+            .default("0")
+            .transform(Number)
+            .pipe(z.number().int().nonnegative())
+    })
+    .strict();
+
+const paramsSchema = z
+    .object({
+        orgId: z.string().nonempty()
+    })
+    .strict();
+
+async function query(orgId: string, limit: number, offset: number) {
+    const res = await db
+        .select({
+            idpId: idp.idpId,
+            orgId: idpOrg.orgId,
+            name: idp.name,
+            type: idp.type,
+            variant: idpOidcConfig.variant
+        })
+        .from(idpOrg)
+        .where(eq(idpOrg.orgId, orgId))
+        .innerJoin(idp, eq(idp.idpId, idpOrg.idpId))
+        .innerJoin(idpOidcConfig, eq(idpOidcConfig.idpId, idpOrg.idpId))
+        .orderBy(sql`idp.name DESC`)
+        .limit(limit)
+        .offset(offset);
+    return res;
+}
+
+export type ListOrgIdpsResponse = {
+    idps: Awaited<ReturnType<typeof query>>;
+    pagination: {
+        total: number;
+        limit: number;
+        offset: number;
+    };
+};
+
+// registry.registerPath({
+//     method: "get",
+//     path: "/idp",
+//     description: "List all IDP in the system.",
+//     tags: [OpenAPITags.Idp],
+//     request: {
+//         query: querySchema
+//     },
+//     responses: {}
+// });
+
+export async function listOrgIdps(
+    req: Request,
+    res: Response,
+    next: NextFunction
+): Promise<any> {
+    try {
+        const parsedParams = paramsSchema.safeParse(req.params);
+        if (!parsedParams.success) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    fromError(parsedParams.error).toString()
+                )
+            );
+        }
+        const { orgId } = parsedParams.data;
+
+        const parsedQuery = querySchema.safeParse(req.query);
+        if (!parsedQuery.success) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    fromError(parsedQuery.error).toString()
+                )
+            );
+        }
+        const { limit, offset } = parsedQuery.data;
+
+        const list = await query(orgId, limit, offset);
+
+        const [{ count }] = await db
+            .select({ count: sql<number>`count(*)` })
+            .from(idp);
+
+        return response<ListOrgIdpsResponse>(res, {
+            data: {
+                idps: list,
+                pagination: {
+                    total: count,
+                    limit,
+                    offset
+                }
+            },
+            success: true,
+            error: false,
+            message: "Org Idps retrieved successfully",
+            status: HttpCode.OK
+        });
+    } catch (error) {
+        logger.error(error);
+        return next(
+            createHttpError(HttpCode.INTERNAL_SERVER_ERROR, "An error occurred")
+        );
+    }
+}

server/private/routers/orgIdp/updateOrgOidcIdp.ts

@@ -0,0 +1,236 @@
+/*
+ * This file is part of a proprietary work.
+ *
+ * Copyright (c) 2025 Fossorial, Inc.
+ * All rights reserved.
+ *
+ * This file is licensed under the Fossorial Commercial License.
+ * You may not use this file except in compliance with the License.
+ * Unauthorized use, copying, modification, or distribution is strictly prohibited.
+ *
+ * This file is not licensed under the AGPLv3.
+ */
+
+import { Request, Response, NextFunction } from "express";
+import { z } from "zod";
+import { db, idpOrg } from "@server/db";
+import response from "@server/lib/response";
+import HttpCode from "@server/types/HttpCode";
+import createHttpError from "http-errors";
+import logger from "@server/logger";
+import { fromError } from "zod-validation-error";
+import { OpenAPITags, registry } from "@server/openApi";
+import { idp, idpOidcConfig } from "@server/db";
+import { eq, and } from "drizzle-orm";
+import { encrypt } from "@server/lib/crypto";
+import config from "@server/lib/config";
+import { build } from "@server/build";
+import { getOrgTierData } from "#private/lib/billing";
+import { TierId } from "@server/lib/billing/tiers";
+
+const paramsSchema = z
+    .object({
+        orgId: z.string().nonempty(),
+        idpId: z.coerce.number()
+    })
+    .strict();
+
+const bodySchema = z
+    .object({
+        name: z.string().optional(),
+        clientId: z.string().optional(),
+        clientSecret: z.string().optional(),
+        authUrl: z.string().optional(),
+        tokenUrl: z.string().optional(),
+        identifierPath: z.string().optional(),
+        emailPath: z.string().optional(),
+        namePath: z.string().optional(),
+        scopes: z.string().optional(),
+        autoProvision: z.boolean().optional(),
+        roleMapping: z.string().optional()
+    })
+    .strict();
+
+export type UpdateOrgIdpResponse = {
+    idpId: number;
+};
+
+// registry.registerPath({
+//     method: "post",
+//     path: "/idp/{idpId}/oidc",
+//     description: "Update an OIDC IdP.",
+//     tags: [OpenAPITags.Idp],
+//     request: {
+//         params: paramsSchema,
+//         body: {
+//             content: {
+//                 "application/json": {
+//                     schema: bodySchema
+//                 }
+//             }
+//         }
+//     },
+//     responses: {}
+// });
+
+export async function updateOrgOidcIdp(
+    req: Request,
+    res: Response,
+    next: NextFunction
+): Promise<any> {
+    try {
+        const parsedParams = paramsSchema.safeParse(req.params);
+        if (!parsedParams.success) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    fromError(parsedParams.error).toString()
+                )
+            );
+        }
+
+        const parsedBody = bodySchema.safeParse(req.body);
+        if (!parsedBody.success) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    fromError(parsedBody.error).toString()
+                )
+            );
+        }
+
+        const { idpId, orgId } = parsedParams.data;
+        const {
+            clientId,
+            clientSecret,
+            authUrl,
+            tokenUrl,
+            scopes,
+            identifierPath,
+            emailPath,
+            namePath,
+            name,
+            autoProvision,
+            roleMapping
+        } = parsedBody.data;
+
+        if (build === "saas") {
+            const { tier, active } = await getOrgTierData(orgId);
+            const subscribed = tier === TierId.STANDARD;
+            if (!subscribed) {
+                return next(
+                    createHttpError(
+                        HttpCode.FORBIDDEN,
+                        "This organization's current plan does not support this feature."
+                    )
+                );
+            }
+        }
+
+        // Check if IDP exists and is of type OIDC
+        const [existingIdp] = await db
+            .select()
+            .from(idp)
+            .where(eq(idp.idpId, idpId));
+
+        if (!existingIdp) {
+            return next(createHttpError(HttpCode.NOT_FOUND, "IdP not found"));
+        }
+
+        const [existingIdpOrg] = await db
+            .select()
+            .from(idpOrg)
+            .where(and(eq(idpOrg.orgId, orgId), eq(idpOrg.idpId, idpId)));
+
+        if (!existingIdpOrg) {
+            return next(
+                createHttpError(
+                    HttpCode.NOT_FOUND,
+                    "IdP not found for this organization"
+                )
+            );
+        }
+
+        if (existingIdp.type !== "oidc") {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    "IdP is not an OIDC provider"
+                )
+            );
+        }
+
+        const key = config.getRawConfig().server.secret!;
+        const encryptedSecret = clientSecret
+            ? encrypt(clientSecret, key)
+            : undefined;
+        const encryptedClientId = clientId ? encrypt(clientId, key) : undefined;
+
+        await db.transaction(async (trx) => {
+            const idpData = {
+                name,
+                autoProvision
+            };
+
+            // only update if at least one key is not undefined
+            let keysToUpdate = Object.keys(idpData).filter(
+                (key) => idpData[key as keyof typeof idpData] !== undefined
+            );
+
+            if (keysToUpdate.length > 0) {
+                await trx.update(idp).set(idpData).where(eq(idp.idpId, idpId));
+            }
+
+            const configData = {
+                clientId: encryptedClientId,
+                clientSecret: encryptedSecret,
+                authUrl,
+                tokenUrl,
+                scopes,
+                identifierPath,
+                emailPath,
+                namePath
+            };
+
+            keysToUpdate = Object.keys(configData).filter(
+                (key) =>
+                    configData[key as keyof typeof configData] !== undefined
+            );
+
+            if (keysToUpdate.length > 0) {
+                // Update OIDC config
+                await trx
+                    .update(idpOidcConfig)
+                    .set(configData)
+                    .where(eq(idpOidcConfig.idpId, idpId));
+            }
+
+            if (roleMapping !== undefined) {
+                // Update IdP-org policy
+                await trx
+                    .update(idpOrg)
+                    .set({
+                        roleMapping
+                    })
+                    .where(
+                        and(eq(idpOrg.idpId, idpId), eq(idpOrg.orgId, orgId))
+                    );
+            }
+        });
+
+        return response<UpdateOrgIdpResponse>(res, {
+            data: {
+                idpId
+            },
+            success: true,
+            error: false,
+            message: "Org IdP updated successfully",
+            status: HttpCode.OK
+        });
+    } catch (error) {
+        logger.error(error);
+        return next(
+            createHttpError(HttpCode.INTERNAL_SERVER_ERROR, "An error occurred")
+        );
+    }
+}