sendnrw/netbird
2
0
Fork 0
mirror of https://github.com/netbirdio/netbird.git synced 2026-10-24 06:19:08 +02:00
Code Issues Packages Projects Releases Wiki Activity

refactor jwt groups extractor

Browse Source 
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com>
This commit is contained in:
bcmmbaga
2024-09-17 18:18:59 +03:00
parent 258b30cf48
commit 3cf1b02f31
2 changed files with 42 additions and 54 deletions
Download Patch File Download Diff File Expand all files Collapse all files
management/server/account.go
+40 -54
View File
@@ -1786,68 +1786,54 @@ func (am *DefaultAccountManager) GetAccountFromToken(ctx context.Context, claims
log.WithContext(ctx).Errorf("JWT groups are enabled but no claim name is set") log.WithContext(ctx).Errorf("JWT groups are enabled but no claim name is set")
return account, user, nil return account, user, nil
} }
if claim, ok := claims.Raw[account.Settings.JWTGroupsClaimName]; ok {
if slice, ok := claim.([]interface{}); ok {
var groupsNames []string
for _, item := range slice {
if g, ok := item.(string); ok {
groupsNames = append(groupsNames, g)
} else {
log.WithContext(ctx).Errorf("JWT claim %q is not a string: %v", account.Settings.JWTGroupsClaimName, item)
}
}
oldGroups := make([]string, len(user.AutoGroups)) jwtGroupsNames := extractJWTGroups(ctx, account.Settings.JWTGroupsClaimName, claims)
copy(oldGroups, user.AutoGroups)
// if groups were added or modified, save the account oldGroups := make([]string, len(user.AutoGroups))
if account.SetJWTGroups(claims.UserId, groupsNames) { copy(oldGroups, user.AutoGroups)
if account.Settings.GroupsPropagationEnabled { // if groups were added or modified, save the account
if user, err := account.FindUser(claims.UserId); err == nil { if account.SetJWTGroups(claims.UserId, jwtGroupsNames) {
addNewGroups := difference(user.AutoGroups, oldGroups) if account.Settings.GroupsPropagationEnabled {
removeOldGroups := difference(oldGroups, user.AutoGroups) if user, err := account.FindUser(claims.UserId); err == nil {
account.UserGroupsAddToPeers(claims.UserId, addNewGroups...) addNewGroups := difference(user.AutoGroups, oldGroups)
account.UserGroupsRemoveFromPeers(claims.UserId, removeOldGroups...) removeOldGroups := difference(oldGroups, user.AutoGroups)
account.Network.IncSerial() account.UserGroupsAddToPeers(claims.UserId, addNewGroups...)
if err := am.Store.SaveAccount(ctx, account); err != nil { account.UserGroupsRemoveFromPeers(claims.UserId, removeOldGroups...)
log.WithContext(ctx).Errorf("failed to save account: %v", err) account.Network.IncSerial()
} else { if err := am.Store.SaveAccount(ctx, account); err != nil {
log.WithContext(ctx).Tracef("user %s: JWT group membership changed, updating account peers", claims.UserId) log.WithContext(ctx).Errorf("failed to save account: %v", err)
am.updateAccountPeers(ctx, account) } else {
unlock() log.WithContext(ctx).Tracef("user %s: JWT group membership changed, updating account peers", claims.UserId)
alreadyUnlocked = true am.updateAccountPeers(ctx, account)
for _, g := range addNewGroups { unlock()
if group := account.GetGroup(g); group != nil { alreadyUnlocked = true
am.StoreEvent(ctx, user.Id, user.Id, account.Id, activity.GroupAddedToUser, for _, g := range addNewGroups {
map[string]any{ if group := account.GetGroup(g); group != nil {
"group": group.Name, am.StoreEvent(ctx, user.Id, user.Id, account.Id, activity.GroupAddedToUser,
"group_id": group.ID, map[string]any{
"is_service_user": user.IsServiceUser, "group": group.Name,
"user_name": user.ServiceUserName}) "group_id": group.ID,
} "is_service_user": user.IsServiceUser,
} "user_name": user.ServiceUserName})
for _, g := range removeOldGroups {
if group := account.GetGroup(g); group != nil {
am.StoreEvent(ctx, user.Id, user.Id, account.Id, activity.GroupRemovedFromUser,
map[string]any{
"group": group.Name,
"group_id": group.ID,
"is_service_user": user.IsServiceUser,
"user_name": user.ServiceUserName})
}
}
} }
} }
} else { for _, g := range removeOldGroups {
if err := am.Store.SaveAccount(ctx, account); err != nil { if group := account.GetGroup(g); group != nil {
log.WithContext(ctx).Errorf("failed to save account: %v", err) am.StoreEvent(ctx, user.Id, user.Id, account.Id, activity.GroupRemovedFromUser,
map[string]any{
"group": group.Name,
"group_id": group.ID,
"is_service_user": user.IsServiceUser,
"user_name": user.ServiceUserName})
}
} }
} }
} }
} else { } else {
log.WithContext(ctx).Debugf("JWT claim %q is not a string array", account.Settings.JWTGroupsClaimName) if err := am.Store.SaveAccount(ctx, account); err != nil {
log.WithContext(ctx).Errorf("failed to save account: %v", err)
}
} }
} else {
log.WithContext(ctx).Debugf("JWT claim %q not found", account.Settings.JWTGroupsClaimName)
} }
} }
management/server/user.go
+2
View File
@@ -363,6 +363,8 @@ func (am *DefaultAccountManager) inviteNewUser(ctx context.Context, accountID, u
// GetUserByID looks up a user by provided user id. // GetUserByID looks up a user by provided user id.
func (am *DefaultAccountManager) GetUserByID(ctx context.Context, id string) (*User, error) { func (am *DefaultAccountManager) GetUserByID(ctx context.Context, id string) (*User, error) {
unlock := am.Store.AcquireReadLockByUID(ctx, id)
defer unlock()
return am.Store.GetUserByUserID(ctx, id) return am.Store.GetUserByUserID(ctx, id)
} }