mirror of
https://github.com/netbirdio/netbird.git
synced 2026-10-10 15:39:07 +02:00
f0a40e4395
* implement certificate posture check * log signal address * add keychain and cert store support * read the console user's keychain through a user session helper A root daemon cannot reach a login keychain: securityd is per session and a key ACL needs a session to prompt in, so dropping uid is not enough. The daemon now answers certificate challenges from the System keychain itself, where MDM installs device identities, and launches "netbird posture cert-proof" into the console user's desktop session with launchctl asuser for the login keychain. Only the signature and the chain cross back, never the private key. The console user comes from SCDynamicStoreCopyConsoleUser, bound with purego like the keychain calls. The login window reports no user, root, or "loginwindow", and all three are treated as no keychain to read, so a Mac at the lock screen sends device proofs alone. Adds info logging across the path: the keychain search list, per class query status and item counts, the chain built per candidate, and the verification error for every rejected candidate. A run that sends nothing now says why. README.md documents the trust model, the console user limitation and how to read the logs. * read the signed-in user's certificate store on Windows A service reads LocalMachine\MY, where AD and Intune enrol device certificates. CurrentUser\MY lives in the signed-in user's registry hive with keys protected against their profile, and a service that opens it does not fail: "current user" resolves to HKU\S-1-5-18, so it silently reads the service account's own empty store. The service therefore reads the machine store itself and launches "netbird posture cert-proof" with the session token for the rest, mirroring the macOS console user helper. Windows lets a privileged service assume a user identity, so the token goes straight into the child process and no external tooling is involved. CREATE_NO_WINDOW keeps a console window from flashing on the desktop every sync. In-process impersonation would also work but is per OS thread while goroutines migrate, so the child process avoids that class of bug. Session selection prefers the physical console and falls back to any active session, so remote desktop and VDI hosts are covered. WTSQueryUserToken needs SE_TCB_NAME, so a user-run client skips the helper and reads the machine store alone. SystemStore takes a store location, gaining NewUserStore alongside NewSystemStore and the per candidate logging macOS already had. The request building and proof merging move to helper_spawn.go, shared by both platforms, and helperStore picks what the helper reads per platform. * start TPM support * split goreleaser to support pkcs11 and exclude on docker * update goreleaser * go mod tidy * add tpm pin to netbird config * split cert and key location and allow key lookup on tpm * add unsupported flag for mobile devices * Isolate the cert proof helper from the service environment and cap its output * Read the PKCS#11 token PIN from NB_TPM_PIN instead of the profile config * Bound certificate proof collection so a stuck token or keychain cannot hold the sync loop * Stop retrying a PKCS#11 PIN the token rejected * Log certificate posture details at debug level * Sign only nonces and peer keys of the size management issues * Skip certificate files whose key belongs to another certificate * Bound PKCS#11 driver sizes, pin template values, and log out only a login the session owns * Never pass NULL to CFRelease and skip unreadable keychain identities * Keep the macOS keychain code out of iOS and the PKCS#11 driver out of Android * Find a chain to each challenge's CAs through every intermediate the store holds * Require a token label whenever a PKCS#11 PIN is set * Read user certificates only from the session of the active profile's owner * Collect certificate proofs again when the owner's session changes and report lost proofs * Test the PKCS#11 build against SoftHSM in CI and warn once where the build has no driver * Document where an inline PKCS#11 PIN is stored and how it is protected * Refuse PKCS#11 URIs that this client cannot honour instead of widening the match * Trust certificate and key files only when no other user can write or redirect them * Explain a Windows certificate whose key only a legacy CryptoAPI provider holds * Use platform absolute module paths in tests and add a real owner session test for Windows * Match the Windows profile owner by name instead of resolving it through the domain controller * Keep the certificate stores and TPM library out of the WebAssembly build * [client] Read TSS2 key files on go-tpm, checked against the library it replaces The TSS2 parser was the only reason this repository depended on a crypto suite whose own build tooling it inherits. The replacement sits on go-tpm, which was already a direct dependency and is in fact what that suite calls underneath, so this removes a wrapper rather than porting onto a different library: the load, the derived storage root key and the signing commands are the same calls. Swapping a parser on the one path a customer actually runs is not something to assert, so the two are held side by side for this commit. One test feeds the replacement bytes the old library wrote and requires the same key type, empty auth flag, parent handle, blobs and decoded public key; the other feeds both the fixtures the tests are built on, so those are the shape the format calls for and not merely the shape the new parser reads. The scaffolding goes away with the dependency in the commit that follows. The encoder behind the fixtures is written out separately from the parser under test, so an encoder bug and a decoder bug cannot cancel each other out. * [client] Drop go.step.sm/crypto and the repo-wide upgrades it imposed The TSS2 parser was the only thing in the repository that used this module, and it brought 302 modules into the graph to do it — 35 of them linters, along with Google Cloud KMS and IAM, the AWS SDK and a terminal styling library. Those are the module's own development dependencies, which minimal version selection turns into floors in ours, and they are the whole reason gRPC, protobuf, the AWS SDK, OpenTelemetry, logrus and five x/ packages had moved. Management, signal, relay and proxy inherited every one of them for a feature none of them runs. Removing the import is not enough, because tidy never downgrades: the raised floors stay written in go.mod. Each one is pinned back to the version main had, then tidy is left to raise again whatever something still genuinely needs. It raised nothing: all 43 are back where they were, and go-tpm was already in the graph at the same version, so the certificate feature now costs no new module at all. The differential tests go with it. They existed to check the swap against the library while both were present, and there is nothing left to compare against. * [client] Clear the lint findings only the macOS and Windows runners see golangci-lint analyses one build at a time, so running it on Linux says nothing about the two platforms CI also lints. Against those builds the feature's packages reported eight findings, and the structural one is Config.dir: it is dead on macOS and Windows because neither reads a directory at all, their collectors take the configuration and discard it. Moving the method beside its only callers makes that visible in the layout instead of in a linter, and leaves the gap itself — no file or token store on those platforms — where it belongs, as something to decide rather than something to silence. An absent key file beside a certificate was reported as a nil signer with a nil error, which the caller then had to recognise by its nilness. It is a sentinel now, so the meaning is in the error rather than in the absence of one. The rest follow the standard library: the elliptic coordinates and the private scalar come from the encoding helpers rather than the deprecated big.Int fields, and an error string loses its trailing colon. Lint is clean on linux, darwin and windows; the hardware TPM path was exercised separately against a real device and passes. * Accept the TSS2 emptyAuth boolean OpenSSL writes and persistent parents on 32-bit builds * Count the certificates field in the peer meta store test * Check the store directory before listing it, refuse group-writable files, and reject a URI with two PIN sources * Share a PKCS#11 login between sessions and send each PIN at most once at a time * Collect certificate proofs again when the meta sync carrying them failed * Use no Windows user store when a domainless owner matches accounts of several domains * Use no user certificate store when the active profile's owner cannot be read * Document the PIN sources on CertPKCS11URI and keep the README PIN example off the command line * Test that the PKCS#11 URI stays out of the debug bundle and run the wrong-PIN test only on a disposable token * Refuse a TPM PSS signature request for the maximum salt length * Add the certificate fields to the network map golden data * Retry posture checks whose meta sync timed out instead of dropping them * Start no system info gathering while a timed-out one is still running * Guard the applied posture checks across goroutines and keep refreshing proofs while a pending update times out * Log what a successful certificate proof helper wrote to stderr * Send recollected certificate proofs to management only when the proven chains changed * Explain a macOS keychain key whose access list does not allow netbird * Kill the whole macOS certificate helper process group when it times out * End sudo option parsing before the macOS certificate helper binary * Hold off system info gathering only while a timed-out one is still running * Collect certificate proofs on the posture watcher instead of under the sync lock * Read the certificate store directory and PKCS#11 URI from the daemon environment, not the profile config * Install the RPM sysconfig file readable by root only and show the certificate posture variables * Move the certificate posture README into the package doc and the docs site * Name NB_CERT_PKCS11_URI in the PIN-without-token error * Keep the file check results of the latest-started system info refresh * Give the full import command for a keychain key netbird may not use, and correct the package doc * Restrict the service environment file to root on every package install * Search only the System keychain in the macOS daemon and only the login keychain in the user helper * Let the certificate proof helper read the PKCS#11 token from the environment on Linux * Ask a macOS user's keychain again only after an hour when it proved nothing * Clear the lint findings in certificate posture * Hold off the keychain helper only after a completed or timed-out run, independent of CA order * Keep free functions out of the method lists of PKCS11Store, URI and Challenger * Name the post-install permission helper in snake case and shorten the sysconfig certificate block * Drop the certificate store directory from certproof.Config, which only NB_CERT_STORE_DIR sets * [management] Renew certificate challenge nonces on quiet accounts A certificate challenge nonce is accepted for its own window and the one before it, and it only reaches a peer attached to a network map. An account where nothing changes sends no map, so after a day the peer re-sends the nonce it still holds, verification rejects its whole proof set, and the certificates stored for it are dropped. It fails the certificate check and loses every policy gated on it until some unrelated change happens to push a map. The outage repairs itself in seconds, which is what makes it expensive: it is intermittent, it only hits stable networks, and it is not reproducible on demand. Push the account's peers an update often enough that the nonce they hold is never close to expiring. Only accounts whose posture checks actually ask for a certificate are tracked, so a deployment without the feature does no extra work. The refresh runs from one goroutine over a map of accounts rather than a timer per account: the period is hours, so one pass every few minutes costs nothing next to it, and there is no timer to re-arm when an account that falls due sooner appears. Each account's first run is offset by a hash of its ID, because the challenge window is global and an instance restart would otherwise arm every account in the same moment. The push carries no administrative change, so it is counted as a refresh rather than an update and stays out of the figures that track what was edited. (cherry picked from commit7ad4a0df37) * [management] Make the certificate challenge window one knob to turn Renewal was timed against the window in two different ways: the period derived from it, the sweep interval did not. Shortening the window to watch a renewal in an end-to-end run would have left the refresher still looking for due accounts every quarter of an hour, so nothing would have been renewed in time and the test would have reported the feature broken. Derive the sweep from the period, within bounds that keep a very short window from spinning and a normal one from checking less often than is useful, and allow the window itself to be set through the environment so a run can take seconds instead of half a day. A value that cannot be parsed or falls outside the bounds keeps the default, because a window nobody intended is a security property nobody chose, and an override is logged at warning level since it sets how long a device keeps passing the check after its key is gone. Every instance has to be given the same value: the window is part of the nonce, so instances that disagree reject each other's. (cherry picked from commit0e38fcf409) * [management] Pin the property that makes per-peer nonce state unnecessary A nonce carries the window it was minted in, not the instant, and is accepted for that window and the one before it. So a peer re-stamped at least once per window can never be left holding one outside the accepted pair, whenever it was last served and however much life its own nonce had left. That is the whole reason management tracks nothing per peer, and it was resting on an argument rather than a test. The phases are part of the property, not decoration: accounts are deliberately given a refresh phase of their own, so the guarantee has to hold off the window boundary too. The negative case shows why that matters — a cadence of exactly two windows lands inside the grace window when it is aligned to the boundary and leaves a gap when it is not. (cherry picked from commitdee68facfd) * [management] Renew challenges only for the peers that answer one The refresh pushed an update to every connected peer of the account, while only the peers a certificate check applies to carry a nonce. On an account where a handful of peers sit behind the check and the rest do not, everyone was woken several times a day to be handed a map that changed nothing for them. Push to the sources of the enabled policies whose posture checks include a certificate check, which is exactly the set that is sent a challenge. Resolving the set the other way round than the gRPC layer does is the risk here: a peer the refresh forgets stops being renewed and falls out of its policies silently, which is the failure this whole mechanism exists to prevent. So the selection is held against processPeerPostureChecks, the per-peer rule that decides who receives a challenge in the first place, by a test that asks both the same question and requires the same answer. (cherry picked from commitdc4d0e0274) * [management] Derive certificate challenge nonces from the stored encryption key The nonce secret came from the server's WireGuard key, which is generated afresh in every process and never persisted. A nonce carries no state, so the only thing that lets one instance verify what another issued is deriving the same secret — and that premise, written in the comment above the challenger, was not met: every instance had its own key. A peer reconnecting after a restart therefore presented a nonce minted under the previous secret, verification failed with a mismatch, its whole proof set was rejected and the certificates stored for it were dropped until it signed again. Reproduced three times on the lab, each one logging "nonce was not issued to this peer", which only a changed secret produces. On a single instance it costs seconds of lost policy access per restart; across instances it is not transient at all, because every reconnect that lands elsewhere is rejected the same way. Derive from the data store encryption key instead: it is generated once, written back to the configuration and read by every instance, so it survives restarts and is shared. Where none is configured the secret falls back to the WireGuard key with a warning — degraded but still unpredictable, which is the property that matters most: a peer able to guess it could mint the nonces of future windows, sign them while its key is present and keep passing after it is gone. The challenger is now built once and passed to the two places that need it, rather than re-derived per message. (cherry picked from commit278f2f3807) * [management] Register an account for renewal where its nonce is issued Renewal was armed when a peer connected or when a posture check was saved, both of which ask the store whether the account has a certificate check. That misses the case it most needs to catch: the check is created through one instance while the peers are connected to another, so the instance serving them never learns it has anything to renew and their nonce expires. It also charged a query to every peer connect in every account, including the ones that will never use the feature, which a fleet reconnecting after a restart pays all at once. Register where the nonce is actually stamped instead. A nonce is verified from a shared secret and so travels between instances, but the renewal that keeps it fresh cannot: only the instance holding a peer's stream can push to it. Issuing and renewing now line up by construction — an instance renews exactly the accounts it has issued nonces for — and an instance that never issues one has nothing to renew, so there is no case left to miss. The registration is a map insert with no store access, which is what lets it sit on a path taken by every login and every initial sync. Reported by Viktor Liu, who also proposed registering at the point of issue. (cherry picked from commit 2d16dd7d7cf54762f2e64c5630ea092f32ef63ab) * [management] Register for renewal on pushed updates, not only on connect Registering where the nonce is stamped only covered the login and the initial sync, which both happen when a peer opens a stream. That left out the path the mechanism exists for. On the cloud the network map controller is wrapped so that an update publishes to an event bus instead of pushing locally: an instance handling a REST change broadcasts, and every instance holding a peer of that account pushes to its own. Those pushes stamp a nonce through the update handler, and nothing there registered, so an instance learned about an account only when one of its peers happened to reconnect. For a quiet fleet that is the original bug: the check is created, the peers are told about it, and nobody renews what they were told. Registering on the pushed update closes it, and is the difference between stamping and marking a peer connected — one happens on every push, the other only when a stream opens. Reported by Viktor Liu; the broadcast that makes it work was pointed out by Pascal Fischer. (cherry picked from commit 59efe8d93e53bacdf57cb546f4ab2c19dc4eddab) * [management] Let the challenge refresh loop stop with the manager that owns it The loop was started on a context explicitly detached from the caller's, so nothing could ever stop it. Production is unaffected either way, since BuildManager is called with context.Background(), but a test that builds a manager leaked a sweeping goroutine for the rest of the run, and a shutdown path added later would have had no way to reach it. Take the manager's context as the request buffer built on the line above already does. The test pins the contract the loop offers, so a detached context cannot come back inside Start either. * [management] Bound one account's challenge refresh so it cannot starve the rest Resolving which peers answer a challenge reads the store three times, and the refresher sweeps accounts one after another on a single goroutine. A read that never returns held the sweep for the life of the process, so every other account on the instance stopped being renewed and its peers fell out of the policies gated on the check: one account's bad luck became an outage for all of them. Give each refresh the sweep interval it is allowed to occupy, capped at 30s so a 12-hour window does not grant minutes to a query that should take milliseconds. A refresh that runs out of time keeps its account tracked, since a deadline says nothing about whether that account still has a certificate check. * [management] Send challenge refreshes down the path the rest of management uses The refresh dispatched through UpdateAffectedPeers, the one variant that takes no reason, so it was missing from the update counters and coalesced with nothing. An administrator editing a policy while the sweep ran made the account's network map twice over, and UpdateOperationRefresh, added for exactly this caller, was never referenced. Buffer it with a posture_check/refresh reason instead. The periodic push is now visible in the metrics as what it is, distinct from an edit, and the send detaches from the sweep deadline on its own, so that deadline bounds the store reads it was meant for. * [management] Keep the certificate challenge comments to what the history does not say Four of these ran to three and four times the comment budget, the longest at 992 characters. Most of the excess argued against designs that were never written or explained a bug that no longer exists in the code, which is what the commit that fixed it is for. What is left is the part a reader cannot recover from the code: that the nonce secret has to be persisted and unpredictable, that stamping and renewing are decided together because only the serving instance can push, and that the target rule is the inverse of processPeerPostureChecks. * Keep the newest posture checks pending whatever made their meta sync fail * Report no lost certificate when the engine stops during a proof collection * Share the proof collection single-flight across engine restarts * Close a PKCS#11 module that loads but cannot be used * Fix the pending checks comments * Renew certificate challenges only for the peers streamed to this instance * Ignore a challenge stamp from an older sync stream of the same peer * Kill the Windows certificate proof helper with its whole process tree * Expect the challenge untrack in the session ownership test * Drop an invalid certificate proof without discarding the valid ones * Start a system info gathering beside one that has been stuck for ten timeouts --------- Co-authored-by: pascal <pascal@netbird.io> Co-authored-by: mlsmaycon <mlsmaycon@gmail.com> Co-authored-by: riccardom <riccardomanfrin@gmail.com>
2864 lines
101 KiB
Go
2864 lines
101 KiB
Go
package server
|
|
|
|
import (
|
|
"context"
|
|
"errors"
|
|
"fmt"
|
|
"net"
|
|
"net/netip"
|
|
"os"
|
|
"reflect"
|
|
"regexp"
|
|
"slices"
|
|
"strings"
|
|
"sync"
|
|
"time"
|
|
|
|
cacheStore "github.com/eko/gocache/lib/v4/store"
|
|
"github.com/eko/gocache/store/redis/v4"
|
|
"github.com/rs/xid"
|
|
log "github.com/sirupsen/logrus"
|
|
"github.com/vmihailenco/msgpack/v5"
|
|
"golang.org/x/exp/maps"
|
|
|
|
nbdns "github.com/netbirdio/netbird/dns"
|
|
"github.com/netbirdio/netbird/formatter/hook"
|
|
"github.com/netbirdio/netbird/idp/dex"
|
|
"github.com/netbirdio/netbird/management/internals/controllers/network_map"
|
|
"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/service"
|
|
nbconfig "github.com/netbirdio/netbird/management/internals/server/config"
|
|
"github.com/netbirdio/netbird/management/server/account"
|
|
"github.com/netbirdio/netbird/management/server/activity"
|
|
"github.com/netbirdio/netbird/management/server/affectedpeers"
|
|
nbcache "github.com/netbirdio/netbird/management/server/cache"
|
|
nbcontext "github.com/netbirdio/netbird/management/server/context"
|
|
"github.com/netbirdio/netbird/management/server/geolocation"
|
|
"github.com/netbirdio/netbird/management/server/idp"
|
|
"github.com/netbirdio/netbird/management/server/integrations/integrated_validator"
|
|
"github.com/netbirdio/netbird/management/server/job"
|
|
nbpeer "github.com/netbirdio/netbird/management/server/peer"
|
|
"github.com/netbirdio/netbird/management/server/permissions"
|
|
"github.com/netbirdio/netbird/management/server/permissions/modules"
|
|
"github.com/netbirdio/netbird/management/server/permissions/operations"
|
|
"github.com/netbirdio/netbird/management/server/posture"
|
|
"github.com/netbirdio/netbird/management/server/settings"
|
|
"github.com/netbirdio/netbird/management/server/store"
|
|
"github.com/netbirdio/netbird/management/server/telemetry"
|
|
"github.com/netbirdio/netbird/management/server/types"
|
|
"github.com/netbirdio/netbird/management/server/util"
|
|
"github.com/netbirdio/netbird/route"
|
|
"github.com/netbirdio/netbird/shared/auth"
|
|
nbdomain "github.com/netbirdio/netbird/shared/management/domain"
|
|
"github.com/netbirdio/netbird/shared/management/networkmap/nmdata"
|
|
"github.com/netbirdio/netbird/shared/management/status"
|
|
)
|
|
|
|
const (
|
|
peerSchedulerRetryInterval = 3 * time.Second
|
|
emptyUserID = "empty user ID in claims"
|
|
errorGettingDomainAccIDFmt = "error getting account ID by private domain: %v"
|
|
)
|
|
|
|
type userLoggedInOnce bool
|
|
|
|
func cacheEntryExpiration() time.Duration {
|
|
r := util.RandIntn(int(nbcache.DefaultIDPCacheExpirationMax.Milliseconds()-nbcache.DefaultIDPCacheExpirationMin.Milliseconds())) + int(nbcache.DefaultIDPCacheExpirationMin.Milliseconds())
|
|
return time.Duration(r) * time.Millisecond
|
|
}
|
|
|
|
type DefaultAccountManager struct {
|
|
Store store.Store
|
|
// cacheMux and cacheLoading helps to make sure that only a single cache reload runs at a time per accountID
|
|
cacheMux sync.Mutex
|
|
// cacheLoading keeps the accountIDs that are currently reloading. The accountID has to be removed once cache has been reloaded
|
|
cacheLoading map[string]chan struct{}
|
|
networkMapController network_map.Controller
|
|
jobManager *job.Manager
|
|
idpManager idp.Manager
|
|
cacheManager *nbcache.AccountUserDataCache
|
|
externalCacheManager nbcache.UserDataCache
|
|
ctx context.Context
|
|
eventStore activity.Store
|
|
geo geolocation.Geolocation
|
|
|
|
requestBuffer *AccountRequestBuffer
|
|
|
|
settingsManager settings.Manager
|
|
serviceManager service.Manager
|
|
|
|
// config contains the management server configuration
|
|
config *nbconfig.Config
|
|
|
|
// singleAccountMode indicates whether the instance has a single account.
|
|
// If true, then every new user will end up under the same account.
|
|
// This value will be set to false if management service has more than one account.
|
|
singleAccountMode bool
|
|
// singleAccountModeDomain is a domain to use in singleAccountMode setup
|
|
singleAccountModeDomain string
|
|
|
|
peerLoginExpiry Scheduler
|
|
|
|
peerInactivityExpiry Scheduler
|
|
|
|
certChallenges *certChallengeRefresher
|
|
|
|
// userDeleteFromIDPEnabled allows to delete user from IDP when user is deleted from account
|
|
userDeleteFromIDPEnabled bool
|
|
|
|
integratedPeerValidator integrated_validator.IntegratedValidator
|
|
|
|
metrics telemetry.AppMetrics
|
|
|
|
permissionsManager permissions.Manager
|
|
|
|
disableDefaultPolicy bool
|
|
|
|
deletionHooksMu sync.RWMutex
|
|
deletionHooks []account.DeletionHook
|
|
}
|
|
|
|
var _ account.Manager = (*DefaultAccountManager)(nil)
|
|
|
|
func (am *DefaultAccountManager) SetServiceManager(serviceManager service.Manager) {
|
|
am.serviceManager = serviceManager
|
|
}
|
|
|
|
// AddAccountDeletionHook registers hook to run on every account deletion. Hooks run in
|
|
// registration order, and the first one to fail stops the rest and aborts the deletion.
|
|
// It panics on a nil hook: dropping one silently would skip that hook's cleanup on every
|
|
// deletion, so the wiring bug surfaces at startup instead.
|
|
func (am *DefaultAccountManager) AddAccountDeletionHook(hook account.DeletionHook) {
|
|
if hook == nil {
|
|
panic("nil account deletion hook")
|
|
}
|
|
am.deletionHooksMu.Lock()
|
|
defer am.deletionHooksMu.Unlock()
|
|
am.deletionHooks = append(am.deletionHooks, hook)
|
|
}
|
|
|
|
func (am *DefaultAccountManager) runAccountDeletionHooks(ctx context.Context, accountID string) error {
|
|
am.deletionHooksMu.RLock()
|
|
hooks := slices.Clone(am.deletionHooks)
|
|
am.deletionHooksMu.RUnlock()
|
|
|
|
for _, hook := range hooks {
|
|
if err := hook(ctx, accountID); err != nil {
|
|
return fmt.Errorf("account deletion hook: %w", err)
|
|
}
|
|
}
|
|
return nil
|
|
}
|
|
|
|
func isUniqueConstraintError(err error) bool {
|
|
switch {
|
|
case strings.Contains(err.Error(), "(SQLSTATE 23505)"),
|
|
strings.Contains(err.Error(), "Error 1062 (23000)"),
|
|
strings.Contains(err.Error(), "UNIQUE constraint failed"):
|
|
return true
|
|
|
|
default:
|
|
return false
|
|
}
|
|
}
|
|
|
|
// getJWTGroupsChanges calculates the changes needed to sync a user's JWT groups.
|
|
// Returns a bool indicating if there are changes in the JWT group membership, the updated user AutoGroups,
|
|
// newly groups to create and an error if any occurred.
|
|
func (am *DefaultAccountManager) getJWTGroupsChanges(user *types.User, groups []*types.Group, groupNames []string) (bool, []string, []*types.Group, error) {
|
|
existedGroupsByName := make(map[string]*types.Group)
|
|
for _, group := range groups {
|
|
existedGroupsByName[group.Name] = group
|
|
}
|
|
|
|
newUserAutoGroups, jwtGroupsMap := separateGroups(user.AutoGroups, groups)
|
|
|
|
groupsToAdd := util.Difference(groupNames, maps.Keys(jwtGroupsMap))
|
|
groupsToRemove := util.Difference(maps.Keys(jwtGroupsMap), groupNames)
|
|
|
|
// If no groups are added or removed, we should not sync account
|
|
if len(groupsToAdd) == 0 && len(groupsToRemove) == 0 {
|
|
return false, nil, nil, nil
|
|
}
|
|
|
|
newGroupsToCreate := make([]*types.Group, 0)
|
|
|
|
var modified bool
|
|
for _, name := range groupsToAdd {
|
|
group, exists := existedGroupsByName[name]
|
|
if !exists {
|
|
group = &types.Group{
|
|
ID: xid.New().String(),
|
|
AccountID: user.AccountID,
|
|
Name: name,
|
|
Issued: types.GroupIssuedJWT,
|
|
}
|
|
newGroupsToCreate = append(newGroupsToCreate, group)
|
|
}
|
|
if group.Issued == types.GroupIssuedJWT {
|
|
newUserAutoGroups = append(newUserAutoGroups, group.ID)
|
|
modified = true
|
|
}
|
|
}
|
|
|
|
for name, id := range jwtGroupsMap {
|
|
if !slices.Contains(groupsToRemove, name) {
|
|
newUserAutoGroups = append(newUserAutoGroups, id)
|
|
continue
|
|
}
|
|
modified = true
|
|
}
|
|
|
|
return modified, newUserAutoGroups, newGroupsToCreate, nil
|
|
}
|
|
|
|
// BuildManager creates a new DefaultAccountManager with all dependencies.
|
|
func BuildManager(
|
|
ctx context.Context,
|
|
config *nbconfig.Config,
|
|
store store.Store,
|
|
networkMapController network_map.Controller,
|
|
jobManager *job.Manager,
|
|
idpManager idp.Manager,
|
|
singleAccountModeDomain string,
|
|
eventStore activity.Store,
|
|
geo geolocation.Geolocation,
|
|
userDeleteFromIDPEnabled bool,
|
|
integratedPeerValidator integrated_validator.IntegratedValidator,
|
|
metrics telemetry.AppMetrics,
|
|
settingsManager settings.Manager,
|
|
permissionsManager permissions.Manager,
|
|
disableDefaultPolicy bool,
|
|
sharedCacheStore cacheStore.StoreInterface,
|
|
) (*DefaultAccountManager, error) {
|
|
start := time.Now()
|
|
defer func() {
|
|
log.WithContext(ctx).Debugf("took %v to instantiate account manager", time.Since(start))
|
|
}()
|
|
|
|
am := &DefaultAccountManager{
|
|
Store: store,
|
|
config: config,
|
|
geo: geo,
|
|
networkMapController: networkMapController,
|
|
jobManager: jobManager,
|
|
idpManager: idpManager,
|
|
ctx: context.Background(),
|
|
cacheMux: sync.Mutex{},
|
|
cacheLoading: map[string]chan struct{}{},
|
|
eventStore: eventStore,
|
|
peerLoginExpiry: NewDefaultScheduler(),
|
|
peerInactivityExpiry: NewDefaultScheduler(),
|
|
userDeleteFromIDPEnabled: userDeleteFromIDPEnabled,
|
|
integratedPeerValidator: integratedPeerValidator,
|
|
metrics: metrics,
|
|
requestBuffer: NewAccountRequestBuffer(ctx, store),
|
|
settingsManager: settingsManager,
|
|
permissionsManager: permissionsManager,
|
|
disableDefaultPolicy: disableDefaultPolicy,
|
|
}
|
|
|
|
am.certChallenges = newCertChallengeRefresher(am.refreshCertificateChallenges)
|
|
am.certChallenges.Start(ctx)
|
|
|
|
am.networkMapController.StartWarmup(ctx)
|
|
|
|
accountsCounter, err := store.GetAccountsCounter(ctx)
|
|
if err != nil {
|
|
log.WithContext(ctx).Error(err)
|
|
}
|
|
|
|
if IsEmbeddedIdp(idpManager) && accountsCounter > 1 {
|
|
log.WithContext(ctx).Warnf("embedded IdP requires a single account, found %d", accountsCounter)
|
|
}
|
|
|
|
// enable single account mode only if configured by user and number of existing accounts is not grater than 1
|
|
am.singleAccountMode = singleAccountModeDomain != "" && accountsCounter <= 1
|
|
if am.singleAccountMode {
|
|
if !nbdomain.IsValidDomainNoWildcard(singleAccountModeDomain) {
|
|
return nil, status.Errorf(status.InvalidArgument, "invalid domain \"%s\" provided for a single account mode. Please review your input for --single-account-mode-domain", singleAccountModeDomain)
|
|
}
|
|
am.singleAccountModeDomain = singleAccountModeDomain
|
|
log.WithContext(ctx).Infof("single account mode enabled, accounts number %d", accountsCounter)
|
|
} else {
|
|
log.WithContext(ctx).Infof("single account mode disabled, accounts number %d", accountsCounter)
|
|
}
|
|
|
|
am.externalCacheManager = nbcache.NewUserDataCache(sharedCacheStore)
|
|
am.cacheManager = nbcache.NewAccountUserDataCache(am.loadAccount, sharedCacheStore)
|
|
|
|
if !isNil(am.idpManager) && !IsEmbeddedIdp(am.idpManager) {
|
|
go func() {
|
|
err := am.warmupIDPCache(ctx, sharedCacheStore)
|
|
if err != nil {
|
|
log.WithContext(ctx).Warnf("failed warming up cache due to error: %v", err)
|
|
// todo retry?
|
|
return
|
|
}
|
|
}()
|
|
}
|
|
|
|
am.integratedPeerValidator.SetPeerInvalidationListener(func(accountID string, peerIDs []string) {
|
|
am.onPeersInvalidated(ctx, accountID, peerIDs)
|
|
})
|
|
|
|
return am, nil
|
|
}
|
|
|
|
func (am *DefaultAccountManager) GetExternalCacheManager() account.ExternalCacheManager {
|
|
return am.externalCacheManager
|
|
}
|
|
|
|
func (am *DefaultAccountManager) GetIdpManager() idp.Manager {
|
|
return am.idpManager
|
|
}
|
|
|
|
// UpdateAccountSettings updates Account settings.
|
|
// Only users with role UserRoleAdmin can update the account.
|
|
// User that performs the update has to belong to the account.
|
|
// Returns an updated Settings
|
|
func (am *DefaultAccountManager) UpdateAccountSettings(ctx context.Context, accountID, userID string, newSettings *types.Settings) (*types.Settings, error) {
|
|
allowed, ctx, err := am.permissionsManager.ValidateUserPermissions(ctx, accountID, userID, modules.Settings, operations.Update)
|
|
if err != nil {
|
|
return nil, fmt.Errorf("failed to validate user permissions: %w", err)
|
|
}
|
|
|
|
if !allowed {
|
|
return nil, status.NewPermissionDeniedError()
|
|
}
|
|
|
|
// Canonicalize the incoming range so a caller-supplied prefix with host bits
|
|
// (e.g. 100.64.1.1/16) compares equal to the masked form stored on network.Net.
|
|
newSettings.NetworkRange = newSettings.NetworkRange.Masked()
|
|
|
|
var oldSettings *types.Settings
|
|
var updateAccountPeers bool
|
|
var groupChangesAffectPeers bool
|
|
var reloadReverseProxy bool
|
|
var effectiveOldNetworkRange netip.Prefix
|
|
var ipv6Changed bool
|
|
var ipv6Snap *affectedpeers.Snapshot
|
|
var ipv6Change affectedpeers.Change
|
|
|
|
err = am.Store.ExecuteInTransaction(ctx, func(transaction store.Store) error {
|
|
var groupsUpdated bool
|
|
|
|
oldSettings, err = transaction.GetAccountSettings(ctx, store.LockingStrengthUpdate, accountID)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
|
|
if err = am.validateSettingsUpdate(ctx, transaction, newSettings, oldSettings, userID, accountID); err != nil {
|
|
return err
|
|
}
|
|
|
|
// No lock: the transaction already holds Settings(Update), and network.Net is
|
|
// only mutated by reallocateAccountPeerIPs, which is reachable only through
|
|
// this same code path. A Share lock here would extend an unnecessary row lock
|
|
// and complicate ordering against updatePeerIPv6InTransaction.
|
|
network, err := transaction.GetAccountNetwork(ctx, store.LockingStrengthNone, accountID)
|
|
if err != nil {
|
|
return fmt.Errorf("get account network: %w", err)
|
|
}
|
|
effectiveOldNetworkRange = prefixFromIPNet(network.Net)
|
|
|
|
if oldSettings.Extra != nil && newSettings.Extra != nil &&
|
|
oldSettings.Extra.PeerApprovalEnabled && !newSettings.Extra.PeerApprovalEnabled {
|
|
approvedCount, err := transaction.ApproveAccountPeers(ctx, accountID)
|
|
if err != nil {
|
|
return fmt.Errorf("failed to approve pending peers: %w", err)
|
|
}
|
|
|
|
if approvedCount > 0 {
|
|
log.WithContext(ctx).Debugf("approved %d pending peers in account %s", approvedCount, accountID)
|
|
updateAccountPeers = true
|
|
}
|
|
}
|
|
|
|
if newSettings.NetworkRange.IsValid() && newSettings.NetworkRange != effectiveOldNetworkRange {
|
|
if err = am.reallocateAccountPeerIPs(ctx, transaction, accountID, newSettings.NetworkRange); err != nil {
|
|
return err
|
|
}
|
|
reloadReverseProxy = true
|
|
updateAccountPeers = true
|
|
}
|
|
|
|
if ipv6SettingsChanged(oldSettings, newSettings) {
|
|
if ipv6Change, err = am.applyIPv6SettingsChange(ctx, transaction, accountID, oldSettings, newSettings); err != nil {
|
|
return err
|
|
}
|
|
ipv6Changed = true
|
|
}
|
|
|
|
if oldSettings.RoutingPeerDNSResolutionEnabled != newSettings.RoutingPeerDNSResolutionEnabled ||
|
|
oldSettings.LazyConnectionEnabled != newSettings.LazyConnectionEnabled ||
|
|
oldSettings.DNSDomain != newSettings.DNSDomain ||
|
|
oldSettings.AutoUpdateVersion != newSettings.AutoUpdateVersion ||
|
|
oldSettings.AutoUpdateAlways != newSettings.AutoUpdateAlways ||
|
|
oldSettings.PeerLoginExpirationEnabled != newSettings.PeerLoginExpirationEnabled ||
|
|
oldSettings.PeerLoginExpiration != newSettings.PeerLoginExpiration ||
|
|
oldSettings.MetricsPushEnabled != newSettings.MetricsPushEnabled {
|
|
// Session deadline is derived from LastLogin + PeerLoginExpiration
|
|
// on every Login/Sync response. Without a fan-out push, connected
|
|
// peers keep the deadline they received at login time and only see
|
|
// the new value after the next unrelated NetworkMap change. Add
|
|
// these two fields to the trigger list so admin-side expiry tweaks
|
|
// (e.g. shortening from 24h to 1h) reach every connected peer
|
|
// within seconds, which is what the proactive-warning feature
|
|
// relies on (see client/internal/auth/sessionwatch).
|
|
updateAccountPeers = true
|
|
}
|
|
|
|
if oldSettings.GroupsPropagationEnabled != newSettings.GroupsPropagationEnabled && newSettings.GroupsPropagationEnabled {
|
|
groupsUpdated, groupChangesAffectPeers, err = am.propagateUserGroupMemberships(ctx, transaction, accountID)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
}
|
|
|
|
if newSettings.Extra == nil {
|
|
newSettings.Extra = oldSettings.Extra
|
|
}
|
|
|
|
if err = transaction.SaveAccountSettings(ctx, accountID, newSettings); err != nil {
|
|
return err
|
|
}
|
|
|
|
if updateAccountPeers || groupsUpdated || ipv6Changed {
|
|
if err = transaction.IncrementNetworkSerial(ctx, accountID); err != nil {
|
|
return err
|
|
}
|
|
}
|
|
|
|
// A full account refresh already covers the IPv6 change, so the affected-peers
|
|
// snapshot is only needed when nothing account-wide changed.
|
|
if ipv6Changed && !updateAccountPeers && !groupChangesAffectPeers {
|
|
if ipv6Snap, err = affectedpeers.Load(ctx, transaction, accountID, ipv6Change); err != nil {
|
|
return fmt.Errorf("load affected peers: %w", err)
|
|
}
|
|
}
|
|
|
|
return nil
|
|
})
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
extraSettingsChanged, err := am.settingsManager.UpdateExtraSettings(ctx, accountID, userID, newSettings.Extra)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
am.handleRoutingPeerDNSResolutionSettings(ctx, oldSettings, newSettings, userID, accountID)
|
|
am.handleLazyConnectionSettings(ctx, oldSettings, newSettings, userID, accountID)
|
|
am.handlePeerLoginExpirationSettings(ctx, oldSettings, newSettings, userID, accountID)
|
|
am.handleGroupsPropagationSettings(ctx, oldSettings, newSettings, userID, accountID)
|
|
am.handleAutoUpdateVersionSettings(ctx, oldSettings, newSettings, userID, accountID)
|
|
am.handleAutoUpdateAlwaysSettings(ctx, oldSettings, newSettings, userID, accountID)
|
|
am.handlePeerExposeSettings(ctx, oldSettings, newSettings, userID, accountID)
|
|
am.handleMetricsPushSettings(ctx, oldSettings, newSettings, userID, accountID)
|
|
if err = am.handleInactivityExpirationSettings(ctx, oldSettings, newSettings, userID, accountID); err != nil {
|
|
return nil, err
|
|
}
|
|
if err = am.handleLocalMfaSettings(ctx, oldSettings, newSettings, userID, accountID); err != nil {
|
|
return nil, err
|
|
}
|
|
if oldSettings.DNSDomain != newSettings.DNSDomain {
|
|
eventMeta := map[string]any{
|
|
"old_dns_domain": oldSettings.DNSDomain,
|
|
"new_dns_domain": newSettings.DNSDomain,
|
|
}
|
|
am.StoreEvent(ctx, userID, accountID, accountID, activity.AccountDNSDomainUpdated, eventMeta)
|
|
}
|
|
if newSettings.NetworkRange.IsValid() && newSettings.NetworkRange != effectiveOldNetworkRange {
|
|
eventMeta := map[string]any{
|
|
"old_network_range": effectiveOldNetworkRange.String(),
|
|
"new_network_range": newSettings.NetworkRange.String(),
|
|
}
|
|
am.StoreEvent(ctx, userID, accountID, accountID, activity.AccountNetworkRangeUpdated, eventMeta)
|
|
}
|
|
oldIPv6On := len(oldSettings.IPv6EnabledGroups) > 0
|
|
newIPv6On := len(newSettings.IPv6EnabledGroups) > 0
|
|
if oldIPv6On != newIPv6On {
|
|
if newIPv6On {
|
|
am.StoreEvent(ctx, userID, accountID, accountID, activity.AccountIPv6Enabled, nil)
|
|
} else {
|
|
am.StoreEvent(ctx, userID, accountID, accountID, activity.AccountIPv6Disabled, nil)
|
|
}
|
|
}
|
|
if oldSettings.NetworkRangeV6 != newSettings.NetworkRangeV6 {
|
|
eventMeta := map[string]any{
|
|
"old_network_range_v6": oldSettings.NetworkRangeV6.String(),
|
|
"new_network_range_v6": newSettings.NetworkRangeV6.String(),
|
|
}
|
|
am.StoreEvent(ctx, userID, accountID, accountID, activity.AccountNetworkRangeUpdated, eventMeta)
|
|
}
|
|
if reloadReverseProxy {
|
|
if err = am.serviceManager.ReloadAllServicesForAccount(ctx, accountID); err != nil {
|
|
log.WithContext(ctx).Warnf("failed to reload all services for account %s: %v", accountID, err)
|
|
}
|
|
}
|
|
|
|
switch {
|
|
case updateAccountPeers || extraSettingsChanged || groupChangesAffectPeers:
|
|
go am.UpdateAccountPeers(context.WithoutCancel(ctx), accountID, types.UpdateReason{Resource: types.UpdateResourceAccountSettings, Operation: types.UpdateOperationUpdate})
|
|
case ipv6Snap != nil:
|
|
am.ExpandAndUpdateAffected(ctx, accountID, ipv6Snap, ipv6Change)
|
|
}
|
|
|
|
return newSettings, nil
|
|
}
|
|
|
|
// applyIPv6SettingsChange reconciles peer IPv6 addresses for new IPv6 settings and
|
|
// returns the affected-peers change: peers whose address changed refresh together
|
|
// with every peer that reaches them. On a range change every peer holding an address
|
|
// also refreshes itself, since its interface prefix comes from the account range even
|
|
// when its address stays inside the new one.
|
|
func (am *DefaultAccountManager) applyIPv6SettingsChange(ctx context.Context, transaction store.Store, accountID string, oldSettings, newSettings *types.Settings) (affectedpeers.Change, error) {
|
|
result, err := am.updatePeerIPv6Addresses(ctx, transaction, accountID, newSettings)
|
|
if err != nil {
|
|
return affectedpeers.Change{}, err
|
|
}
|
|
|
|
change := affectedpeers.Change{ChangedPeerIDs: result.changed}
|
|
if oldSettings.NetworkRangeV6 != newSettings.NetworkRangeV6 {
|
|
change.OutputPeerIDs = result.withIPv6
|
|
}
|
|
return change, nil
|
|
}
|
|
|
|
func ipv6SettingsChanged(old, updated *types.Settings) bool {
|
|
if old.NetworkRangeV6 != updated.NetworkRangeV6 {
|
|
return true
|
|
}
|
|
oldGroups := slices.Clone(old.IPv6EnabledGroups)
|
|
newGroups := slices.Clone(updated.IPv6EnabledGroups)
|
|
slices.Sort(oldGroups)
|
|
slices.Sort(newGroups)
|
|
return !slices.Equal(oldGroups, newGroups)
|
|
}
|
|
|
|
// prefixFromIPNet returns the overlay prefix actually allocated on the account
|
|
// network, or an invalid prefix if none is set. Settings.NetworkRange is a
|
|
// user-facing override that is empty on legacy accounts, so the effective
|
|
// range must be read from network.Net to compare against an incoming update.
|
|
func prefixFromIPNet(ipNet net.IPNet) netip.Prefix {
|
|
if ipNet.IP == nil {
|
|
return netip.Prefix{}
|
|
}
|
|
addr, ok := netip.AddrFromSlice(ipNet.IP)
|
|
if !ok {
|
|
return netip.Prefix{}
|
|
}
|
|
ones, _ := ipNet.Mask.Size()
|
|
return netip.PrefixFrom(addr.Unmap(), ones)
|
|
}
|
|
|
|
func (am *DefaultAccountManager) validateSettingsUpdate(ctx context.Context, transaction store.Store, newSettings, oldSettings *types.Settings, userID, accountID string) error {
|
|
halfYearLimit := 180 * 24 * time.Hour
|
|
if newSettings.PeerLoginExpiration > halfYearLimit {
|
|
return status.Errorf(status.InvalidArgument, "peer login expiration can't be larger than 180 days")
|
|
}
|
|
|
|
if newSettings.PeerLoginExpiration < time.Hour {
|
|
return status.Errorf(status.InvalidArgument, "peer login expiration can't be smaller than one hour")
|
|
}
|
|
|
|
if newSettings.DNSDomain != "" && !nbdomain.IsValidDomainNoWildcard(newSettings.DNSDomain) {
|
|
return status.Errorf(status.InvalidArgument, "invalid domain \"%s\" provided for DNS domain", newSettings.DNSDomain)
|
|
}
|
|
|
|
if newSettings.DNSDomain != oldSettings.DNSDomain && newSettings.DNSDomain != "" {
|
|
existingZone, err := transaction.GetZoneByDomain(ctx, accountID, newSettings.DNSDomain)
|
|
if err != nil {
|
|
if sErr, ok := status.FromError(err); !ok || sErr.Type() != status.NotFound {
|
|
return fmt.Errorf("failed to check existing zone: %w", err)
|
|
}
|
|
}
|
|
if existingZone != nil {
|
|
return status.Errorf(status.InvalidArgument, "peer DNS domain %s conflicts with existing custom DNS zone", newSettings.DNSDomain)
|
|
}
|
|
}
|
|
|
|
if err := validateIPv6EnabledGroups(ctx, transaction, accountID, newSettings.IPv6EnabledGroups); err != nil {
|
|
return err
|
|
}
|
|
|
|
return am.integratedPeerValidator.ValidateExtraSettings(ctx, newSettings.Extra, oldSettings.Extra, userID, accountID)
|
|
}
|
|
|
|
// validateIPv6EnabledGroups checks that all referenced IPv6-enabled group IDs exist in the account.
|
|
func validateIPv6EnabledGroups(ctx context.Context, transaction store.Store, accountID string, groupIDs []string) error {
|
|
if len(groupIDs) == 0 {
|
|
return nil
|
|
}
|
|
|
|
groups, err := transaction.GetAccountGroups(ctx, store.LockingStrengthNone, accountID)
|
|
if err != nil {
|
|
return fmt.Errorf("get groups for IPv6 validation: %w", err)
|
|
}
|
|
|
|
existing := make(map[string]struct{}, len(groups))
|
|
for _, g := range groups {
|
|
existing[g.ID] = struct{}{}
|
|
}
|
|
|
|
for _, gid := range groupIDs {
|
|
if _, ok := existing[gid]; !ok {
|
|
return status.Errorf(status.InvalidArgument, "IPv6 enabled group %s does not exist", gid)
|
|
}
|
|
}
|
|
|
|
return nil
|
|
}
|
|
|
|
func (am *DefaultAccountManager) handleRoutingPeerDNSResolutionSettings(ctx context.Context, oldSettings, newSettings *types.Settings, userID, accountID string) {
|
|
if oldSettings.RoutingPeerDNSResolutionEnabled != newSettings.RoutingPeerDNSResolutionEnabled {
|
|
if newSettings.RoutingPeerDNSResolutionEnabled {
|
|
am.StoreEvent(ctx, userID, accountID, accountID, activity.AccountRoutingPeerDNSResolutionEnabled, nil)
|
|
} else {
|
|
am.StoreEvent(ctx, userID, accountID, accountID, activity.AccountRoutingPeerDNSResolutionDisabled, nil)
|
|
}
|
|
}
|
|
}
|
|
|
|
func (am *DefaultAccountManager) handleLazyConnectionSettings(ctx context.Context, oldSettings, newSettings *types.Settings, userID, accountID string) {
|
|
if oldSettings.LazyConnectionEnabled != newSettings.LazyConnectionEnabled {
|
|
if newSettings.LazyConnectionEnabled {
|
|
am.StoreEvent(ctx, userID, accountID, accountID, activity.AccountLazyConnectionEnabled, nil)
|
|
} else {
|
|
am.StoreEvent(ctx, userID, accountID, accountID, activity.AccountLazyConnectionDisabled, nil)
|
|
}
|
|
}
|
|
}
|
|
|
|
func (am *DefaultAccountManager) handleMetricsPushSettings(ctx context.Context, oldSettings, newSettings *types.Settings, userID, accountID string) {
|
|
if oldSettings.MetricsPushEnabled != newSettings.MetricsPushEnabled {
|
|
if newSettings.MetricsPushEnabled {
|
|
am.StoreEvent(ctx, userID, accountID, accountID, activity.AccountMetricsPushEnabled, nil)
|
|
} else {
|
|
am.StoreEvent(ctx, userID, accountID, accountID, activity.AccountMetricsPushDisabled, nil)
|
|
}
|
|
}
|
|
}
|
|
|
|
func (am *DefaultAccountManager) handlePeerLoginExpirationSettings(ctx context.Context, oldSettings, newSettings *types.Settings, userID, accountID string) {
|
|
if oldSettings.PeerLoginExpirationEnabled != newSettings.PeerLoginExpirationEnabled {
|
|
event := activity.AccountPeerLoginExpirationEnabled
|
|
if !newSettings.PeerLoginExpirationEnabled {
|
|
event = activity.AccountPeerLoginExpirationDisabled
|
|
am.peerLoginExpiry.Cancel(ctx, []string{accountID})
|
|
} else {
|
|
am.schedulePeerLoginExpiration(ctx, accountID)
|
|
}
|
|
am.StoreEvent(ctx, userID, accountID, accountID, event, nil)
|
|
}
|
|
|
|
if oldSettings.PeerLoginExpiration != newSettings.PeerLoginExpiration {
|
|
am.StoreEvent(ctx, userID, accountID, accountID, activity.AccountPeerLoginExpirationDurationUpdated, nil)
|
|
am.peerLoginExpiry.Cancel(ctx, []string{accountID})
|
|
am.schedulePeerLoginExpiration(ctx, accountID)
|
|
}
|
|
}
|
|
|
|
func (am *DefaultAccountManager) handleGroupsPropagationSettings(ctx context.Context, oldSettings, newSettings *types.Settings, userID, accountID string) {
|
|
if oldSettings.GroupsPropagationEnabled != newSettings.GroupsPropagationEnabled {
|
|
if newSettings.GroupsPropagationEnabled {
|
|
am.StoreEvent(ctx, userID, accountID, accountID, activity.UserGroupPropagationEnabled, nil)
|
|
} else {
|
|
am.StoreEvent(ctx, userID, accountID, accountID, activity.UserGroupPropagationDisabled, nil)
|
|
}
|
|
}
|
|
}
|
|
|
|
func (am *DefaultAccountManager) handleAutoUpdateVersionSettings(ctx context.Context, oldSettings, newSettings *types.Settings, userID, accountID string) {
|
|
if oldSettings.AutoUpdateVersion != newSettings.AutoUpdateVersion {
|
|
am.StoreEvent(ctx, userID, accountID, accountID, activity.AccountAutoUpdateVersionUpdated, map[string]any{
|
|
"version": newSettings.AutoUpdateVersion,
|
|
})
|
|
}
|
|
}
|
|
|
|
func (am *DefaultAccountManager) handleAutoUpdateAlwaysSettings(ctx context.Context, oldSettings, newSettings *types.Settings, userID, accountID string) {
|
|
if oldSettings.AutoUpdateAlways != newSettings.AutoUpdateAlways {
|
|
if newSettings.AutoUpdateAlways {
|
|
am.StoreEvent(ctx, userID, accountID, accountID, activity.AccountAutoUpdateAlwaysEnabled, nil)
|
|
} else {
|
|
am.StoreEvent(ctx, userID, accountID, accountID, activity.AccountAutoUpdateAlwaysDisabled, nil)
|
|
}
|
|
}
|
|
}
|
|
|
|
func (am *DefaultAccountManager) handlePeerExposeSettings(ctx context.Context, oldSettings, newSettings *types.Settings, userID, accountID string) {
|
|
oldEnabled := oldSettings.PeerExposeEnabled
|
|
newEnabled := newSettings.PeerExposeEnabled
|
|
|
|
if oldEnabled == newEnabled {
|
|
return
|
|
}
|
|
|
|
event := activity.AccountPeerExposeEnabled
|
|
if !newEnabled {
|
|
event = activity.AccountPeerExposeDisabled
|
|
}
|
|
am.StoreEvent(ctx, userID, accountID, accountID, event, nil)
|
|
}
|
|
|
|
func (am *DefaultAccountManager) handleInactivityExpirationSettings(ctx context.Context, oldSettings, newSettings *types.Settings, userID, accountID string) error {
|
|
if newSettings.PeerInactivityExpirationEnabled {
|
|
if oldSettings.PeerInactivityExpiration != newSettings.PeerInactivityExpiration {
|
|
am.StoreEvent(ctx, userID, accountID, accountID, activity.AccountPeerInactivityExpirationDurationUpdated, nil)
|
|
am.checkAndSchedulePeerInactivityExpiration(ctx, accountID)
|
|
}
|
|
} else {
|
|
if oldSettings.PeerInactivityExpirationEnabled != newSettings.PeerInactivityExpirationEnabled {
|
|
event := activity.AccountPeerInactivityExpirationEnabled
|
|
if !newSettings.PeerInactivityExpirationEnabled {
|
|
event = activity.AccountPeerInactivityExpirationDisabled
|
|
am.peerInactivityExpiry.Cancel(ctx, []string{accountID})
|
|
} else {
|
|
am.checkAndSchedulePeerInactivityExpiration(ctx, accountID)
|
|
}
|
|
am.StoreEvent(ctx, userID, accountID, accountID, event, nil)
|
|
}
|
|
}
|
|
|
|
return nil
|
|
}
|
|
|
|
func (am *DefaultAccountManager) handleLocalMfaSettings(ctx context.Context, oldSettings, newSettings *types.Settings, userID, accountID string) error {
|
|
if oldSettings.LocalMfaEnabled == newSettings.LocalMfaEnabled {
|
|
return nil
|
|
}
|
|
|
|
embeddedIdp, ok := am.idpManager.(*idp.EmbeddedIdPManager)
|
|
if !ok {
|
|
return nil
|
|
}
|
|
|
|
if err := embeddedIdp.SetMFAEnabled(ctx, newSettings.LocalMfaEnabled); err != nil {
|
|
return fmt.Errorf("failed to toggle MFA: %w", err)
|
|
}
|
|
|
|
if newSettings.LocalMfaEnabled {
|
|
am.StoreEvent(ctx, userID, accountID, accountID, activity.AccountLocalMfaEnabled, nil)
|
|
} else {
|
|
am.StoreEvent(ctx, userID, accountID, accountID, activity.AccountLocalMfaDisabled, nil)
|
|
}
|
|
|
|
return nil
|
|
}
|
|
|
|
func (am *DefaultAccountManager) peerLoginExpirationJob(ctx context.Context, accountID string) func() (time.Duration, bool) {
|
|
return func() (time.Duration, bool) {
|
|
//nolint
|
|
ctx := context.WithValue(ctx, nbcontext.AccountIDKey, accountID)
|
|
//nolint
|
|
ctx = context.WithValue(ctx, hook.ExecutionContextKey, fmt.Sprintf("%s-PEER-EXPIRATION", hook.SystemSource))
|
|
|
|
expiredPeers, err := am.getExpiredPeers(ctx, accountID)
|
|
if err != nil {
|
|
return peerSchedulerRetryInterval, true
|
|
}
|
|
|
|
var peerIDs []string
|
|
for _, peer := range expiredPeers {
|
|
peerIDs = append(peerIDs, peer.ID)
|
|
}
|
|
|
|
log.WithContext(ctx).Debugf("discovered %d peers to expire for account %s", len(peerIDs), accountID)
|
|
|
|
if err := am.expireAndUpdatePeers(ctx, accountID, expiredPeers, peerExpirationSessionExpired); err != nil {
|
|
log.WithContext(ctx).Errorf("failed updating account peers while expiring peers for account %s", accountID)
|
|
return peerSchedulerRetryInterval, true
|
|
}
|
|
|
|
return am.getNextPeerExpiration(ctx, accountID)
|
|
}
|
|
}
|
|
|
|
func (am *DefaultAccountManager) schedulePeerLoginExpiration(ctx context.Context, accountID string) {
|
|
if am.peerLoginExpiry.IsSchedulerRunning(accountID) {
|
|
log.WithContext(ctx).Tracef("peer login expiration job for account %s is already scheduled", accountID)
|
|
return
|
|
}
|
|
// The job outlives the request that arms it, so it must not inherit the request's cancellation.
|
|
jobCtx := context.WithoutCancel(ctx)
|
|
if nextRun, ok := am.getNextPeerExpiration(ctx, accountID); ok {
|
|
go am.peerLoginExpiry.Schedule(jobCtx, nextRun, accountID, am.peerLoginExpirationJob(jobCtx, accountID))
|
|
}
|
|
}
|
|
|
|
// peerInactivityExpirationJob marks login expired for all inactive peers and returns the minimum duration in which the next peer of the account will expire by inactivity if found
|
|
func (am *DefaultAccountManager) peerInactivityExpirationJob(ctx context.Context, accountID string) func() (time.Duration, bool) {
|
|
return func() (time.Duration, bool) {
|
|
inactivePeers, err := am.getInactivePeers(ctx, accountID)
|
|
if err != nil {
|
|
log.WithContext(ctx).Errorf("failed getting inactive peers for account %s", accountID)
|
|
return peerSchedulerRetryInterval, true
|
|
}
|
|
|
|
var peerIDs []string
|
|
for _, peer := range inactivePeers {
|
|
peerIDs = append(peerIDs, peer.ID)
|
|
}
|
|
|
|
log.Debugf("discovered %d peers to expire for account %s", len(peerIDs), accountID)
|
|
|
|
if err := am.expireAndUpdatePeers(ctx, accountID, inactivePeers, peerExpirationInactivity); err != nil {
|
|
log.Errorf("failed updating account peers while expiring peers for account %s", accountID)
|
|
return peerSchedulerRetryInterval, true
|
|
}
|
|
|
|
return am.getNextInactivePeerExpiration(ctx, accountID)
|
|
}
|
|
}
|
|
|
|
// checkAndSchedulePeerInactivityExpiration periodically checks for inactive peers to end their sessions
|
|
func (am *DefaultAccountManager) checkAndSchedulePeerInactivityExpiration(ctx context.Context, accountID string) {
|
|
am.peerInactivityExpiry.Cancel(ctx, []string{accountID})
|
|
jobCtx := context.WithoutCancel(ctx)
|
|
if nextRun, ok := am.getNextInactivePeerExpiration(ctx, accountID); ok {
|
|
go am.peerInactivityExpiry.Schedule(jobCtx, nextRun, accountID, am.peerInactivityExpirationJob(jobCtx, accountID))
|
|
}
|
|
}
|
|
|
|
// newAccount creates a new Account with a generated ID and generated default setup keys.
|
|
// If ID is already in use (due to collision) we try one more time before returning error
|
|
func (am *DefaultAccountManager) newAccount(ctx context.Context, userID, domain, email, name string) (*types.Account, error) {
|
|
for i := 0; i < 2; i++ {
|
|
accountId := xid.New().String()
|
|
|
|
_, err := am.Store.GetAccount(ctx, accountId)
|
|
statusErr, _ := status.FromError(err)
|
|
switch {
|
|
case err == nil:
|
|
log.WithContext(ctx).Warnf("an account with ID already exists, retrying...")
|
|
continue
|
|
case statusErr.Type() == status.NotFound:
|
|
newAccount := newAccountWithId(ctx, accountId, userID, domain, email, name, am.disableDefaultPolicy)
|
|
am.StoreEvent(ctx, userID, newAccount.Id, accountId, activity.AccountCreated, nil)
|
|
return newAccount, nil
|
|
default:
|
|
return nil, err
|
|
}
|
|
}
|
|
|
|
return nil, status.Errorf(status.Internal, "error while creating new account")
|
|
}
|
|
|
|
func (am *DefaultAccountManager) warmupIDPCache(ctx context.Context, store cacheStore.StoreInterface) error {
|
|
cold, err := am.isCacheCold(ctx, store)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
|
|
if !cold {
|
|
log.WithContext(ctx).Debug("cache already populated, skipping warm up")
|
|
return nil
|
|
}
|
|
|
|
if delayStr, ok := os.LookupEnv("NB_IDP_CACHE_WARMUP_DELAY"); ok {
|
|
delay, err := time.ParseDuration(delayStr)
|
|
if err != nil {
|
|
return fmt.Errorf("invalid IDP warmup delay: %w", err)
|
|
}
|
|
time.Sleep(delay)
|
|
}
|
|
|
|
userData, err := am.idpManager.GetAllAccounts(ctx)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
log.WithContext(ctx).Infof("%d entries received from IdP management", len(userData))
|
|
|
|
// If the Identity Provider does not support writing AppMetadata,
|
|
// in cases like this, we expect it to return all users in an "unset" field.
|
|
// We iterate over the users in the "unset" field, look up their AccountID in our store, and
|
|
// update their AppMetadata with the AccountID.
|
|
if unsetData, ok := userData[idp.UnsetAccountID]; ok {
|
|
for _, user := range unsetData {
|
|
accountID, err := am.Store.GetAccountByUser(ctx, user.ID)
|
|
if err == nil {
|
|
data := userData[accountID.Id]
|
|
if data == nil {
|
|
data = make([]*idp.UserData, 0, 1)
|
|
}
|
|
|
|
user.AppMetadata.WTAccountID = accountID.Id
|
|
|
|
userData[accountID.Id] = append(data, user)
|
|
}
|
|
}
|
|
}
|
|
delete(userData, idp.UnsetAccountID)
|
|
|
|
rcvdUsers := 0
|
|
for accountID, users := range userData {
|
|
rcvdUsers += len(users)
|
|
err = am.cacheManager.Set(am.ctx, accountID, users, cacheEntryExpiration())
|
|
if err != nil {
|
|
return err
|
|
}
|
|
}
|
|
log.WithContext(ctx).Infof("warmed up IDP cache with %d entries for %d accounts", rcvdUsers, len(userData))
|
|
return nil
|
|
}
|
|
|
|
// isCacheCold checks if the cache needs warming up.
|
|
func (am *DefaultAccountManager) isCacheCold(ctx context.Context, store cacheStore.StoreInterface) (bool, error) {
|
|
if store.GetType() != redis.RedisType {
|
|
return true, nil
|
|
}
|
|
|
|
accountID, err := am.Store.GetAnyAccountID(ctx)
|
|
if err != nil {
|
|
if sErr, ok := status.FromError(err); ok && sErr.Type() == status.NotFound {
|
|
return true, nil
|
|
}
|
|
return false, err
|
|
}
|
|
|
|
_, err = store.Get(ctx, accountID)
|
|
if err == nil {
|
|
return false, nil
|
|
}
|
|
|
|
if notFoundErr := new(cacheStore.NotFound); errors.As(err, ¬FoundErr) {
|
|
return true, nil
|
|
}
|
|
|
|
return false, fmt.Errorf("failed to check cache: %w", err)
|
|
}
|
|
|
|
// DeleteAccount deletes an account and all its users from local store and from the remote IDP if the requester is an admin and account owner
|
|
func (am *DefaultAccountManager) DeleteAccount(ctx context.Context, accountID, userID string) error {
|
|
account, err := am.Store.GetAccount(ctx, accountID)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
|
|
allowed, ctx, err := am.permissionsManager.ValidateUserPermissions(ctx, accountID, userID, modules.Accounts, operations.Delete)
|
|
if err != nil {
|
|
return fmt.Errorf("failed to validate user permissions: %w", err)
|
|
}
|
|
|
|
if !allowed {
|
|
return status.Errorf(status.PermissionDenied, "user is not allowed to delete account. Only account owner can delete account")
|
|
}
|
|
|
|
userInfosMap, err := am.BuildUserInfosForAccount(ctx, accountID, userID, maps.Values(account.Users))
|
|
if err != nil {
|
|
return status.Errorf(status.Internal, "failed to build user infos for account %s: %v", accountID, err)
|
|
}
|
|
|
|
if err = am.runAccountDeletionHooks(ctx, accountID); err != nil {
|
|
return err
|
|
}
|
|
|
|
if err = am.deleteAccountUsers(ctx, accountID, userID, account.Users, userInfosMap); err != nil {
|
|
return err
|
|
}
|
|
|
|
err = am.Store.DeleteAccount(ctx, account)
|
|
if err != nil {
|
|
log.WithContext(ctx).Errorf("failed deleting account %s. error: %s", accountID, err)
|
|
return err
|
|
}
|
|
// cancel peer login expiry job
|
|
am.peerLoginExpiry.Cancel(ctx, []string{account.Id})
|
|
am.certChallenges.Forget(account.Id)
|
|
|
|
meta := map[string]any{"account_id": account.Id, "domain": account.Domain, "created_at": account.CreatedAt}
|
|
am.StoreEvent(ctx, userID, accountID, accountID, activity.AccountDeleted, meta)
|
|
|
|
log.WithContext(ctx).Debugf("account %s deleted", accountID)
|
|
return nil
|
|
}
|
|
|
|
func (am *DefaultAccountManager) deleteAccountUsers(ctx context.Context, accountID, initiatorUserID string, users map[string]*types.User, userInfosMap map[string]*types.UserInfo) error {
|
|
for _, otherUser := range users {
|
|
if otherUser.Id == initiatorUserID {
|
|
continue
|
|
}
|
|
|
|
if otherUser.IsServiceUser {
|
|
if err := am.deleteServiceUser(ctx, accountID, initiatorUserID, otherUser); err != nil {
|
|
return err
|
|
}
|
|
continue
|
|
}
|
|
|
|
userInfo, ok := userInfosMap[otherUser.Id]
|
|
if !ok {
|
|
return status.Errorf(status.NotFound, "user info not found for user %s", otherUser.Id)
|
|
}
|
|
|
|
if _, err := am.deleteRegularUser(ctx, accountID, initiatorUserID, userInfo); err != nil {
|
|
return err
|
|
}
|
|
}
|
|
|
|
userInfo, ok := userInfosMap[initiatorUserID]
|
|
if ok {
|
|
if _, err := am.deleteRegularUser(ctx, accountID, initiatorUserID, userInfo); err != nil {
|
|
log.WithContext(ctx).Errorf("failed deleting user %s. error: %s", initiatorUserID, err)
|
|
return err
|
|
}
|
|
}
|
|
|
|
return nil
|
|
}
|
|
|
|
// AccountExists checks if an account exists.
|
|
func (am *DefaultAccountManager) AccountExists(ctx context.Context, accountID string) (bool, error) {
|
|
return am.Store.AccountExists(ctx, store.LockingStrengthNone, accountID)
|
|
}
|
|
|
|
// GetAccountIDByUserID retrieves the account ID based on the userID provided.
|
|
// If user does have an account, it returns the user's account ID.
|
|
// If the user doesn't have an account, it creates one using the provided domain.
|
|
// Returns the account ID or an error if none is found or created.
|
|
func (am *DefaultAccountManager) GetAccountIDByUserID(ctx context.Context, userAuth auth.UserAuth) (string, error) {
|
|
if userAuth.UserId == "" {
|
|
return "", status.Errorf(status.NotFound, "no valid userID provided")
|
|
}
|
|
|
|
accountID, err := am.Store.GetAccountIDByUserID(ctx, store.LockingStrengthNone, userAuth.UserId)
|
|
if err != nil {
|
|
if s, ok := status.FromError(err); ok && s.Type() == status.NotFound {
|
|
acc, err := am.GetOrCreateAccountByUser(ctx, userAuth)
|
|
if err != nil {
|
|
return "", status.Errorf(status.NotFound, "account not found or created for user id: %s", userAuth.UserId)
|
|
}
|
|
|
|
if err = am.addAccountIDToIDPAppMeta(ctx, userAuth.UserId, acc.Id); err != nil {
|
|
return "", err
|
|
}
|
|
return acc.Id, nil
|
|
}
|
|
return "", err
|
|
}
|
|
return accountID, nil
|
|
}
|
|
|
|
func isNil(i idp.Manager) bool {
|
|
return i == nil || reflect.ValueOf(i).IsNil()
|
|
}
|
|
|
|
// IsEmbeddedIdp checks if the IDP manager is an embedded IDP (data stored locally in DB).
|
|
// When true, user cache should be skipped and data fetched directly from the IDP manager.
|
|
func IsEmbeddedIdp(i idp.Manager) bool {
|
|
if isNil(i) {
|
|
return false
|
|
}
|
|
_, ok := i.(*idp.EmbeddedIdPManager)
|
|
return ok
|
|
}
|
|
|
|
// IsLocalAuthDisabled checks if local (email/password) authentication is disabled.
|
|
// Returns true only when using embedded IDP with local auth disabled in config.
|
|
func IsLocalAuthDisabled(ctx context.Context, i idp.Manager) bool {
|
|
if isNil(i) {
|
|
return false
|
|
}
|
|
embeddedIdp, ok := i.(*idp.EmbeddedIdPManager)
|
|
if !ok {
|
|
return false
|
|
}
|
|
return embeddedIdp.IsLocalAuthDisabled()
|
|
}
|
|
|
|
// addAccountIDToIDPAppMeta update user's app metadata in idp manager
|
|
func (am *DefaultAccountManager) addAccountIDToIDPAppMeta(ctx context.Context, userID string, accountID string) error {
|
|
if !isNil(am.idpManager) && !IsEmbeddedIdp(am.idpManager) {
|
|
// user can be nil if it wasn't found (e.g., just created)
|
|
user, err := am.lookupUserInCache(ctx, userID, accountID)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
|
|
if user != nil && user.AppMetadata.WTAccountID == accountID {
|
|
// it was already set, so we skip the unnecessary update
|
|
log.WithContext(ctx).Debugf("skipping IDP App Meta update because accountID %s has been already set for user %s",
|
|
accountID, userID)
|
|
return nil
|
|
}
|
|
|
|
err = am.idpManager.UpdateUserAppMetadata(ctx, userID, idp.AppMetadata{WTAccountID: accountID})
|
|
if err != nil {
|
|
return status.Errorf(status.Internal, "updating user's app metadata failed with: %v", err)
|
|
}
|
|
// refresh cache to reflect the update
|
|
_, err = am.refreshCache(ctx, accountID)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
}
|
|
return nil
|
|
}
|
|
|
|
func (am *DefaultAccountManager) loadAccount(ctx context.Context, accountID any) (any, []cacheStore.Option, error) {
|
|
log.WithContext(ctx).Debugf("account %s not found in cache, reloading", accountID)
|
|
accountIDString := fmt.Sprintf("%v", accountID)
|
|
|
|
if ctx == nil {
|
|
ctx = context.Background()
|
|
}
|
|
|
|
// nolint:staticcheck
|
|
ctx = context.WithValue(ctx, nbcontext.AccountIDKey, accountID)
|
|
|
|
accountUsers, err := am.Store.GetAccountUsers(ctx, store.LockingStrengthNone, accountIDString)
|
|
if err != nil {
|
|
return nil, nil, err
|
|
}
|
|
|
|
userData, err := am.idpManager.GetAccount(ctx, accountIDString)
|
|
if err != nil {
|
|
return nil, nil, err
|
|
}
|
|
log.WithContext(ctx).Debugf("%d entries received from IdP management for account %s", len(userData), accountIDString)
|
|
|
|
dataMap := make(map[string]*idp.UserData, len(userData))
|
|
for _, datum := range userData {
|
|
dataMap[datum.ID] = datum
|
|
}
|
|
|
|
matchedUserData := make([]*idp.UserData, 0)
|
|
for _, user := range accountUsers {
|
|
if user.IsServiceUser {
|
|
continue
|
|
}
|
|
datum, ok := dataMap[user.Id]
|
|
if !ok {
|
|
log.WithContext(ctx).Warnf("user %s not found in IDP", user.Id)
|
|
continue
|
|
}
|
|
matchedUserData = append(matchedUserData, datum)
|
|
}
|
|
|
|
data, err := msgpack.Marshal(matchedUserData)
|
|
if err != nil {
|
|
return nil, nil, err
|
|
}
|
|
|
|
return data, []cacheStore.Option{cacheStore.WithExpiration(cacheEntryExpiration())}, nil
|
|
}
|
|
|
|
func (am *DefaultAccountManager) lookupUserInCacheByEmail(ctx context.Context, email string, accountID string) (*idp.UserData, error) {
|
|
data, err := am.getAccountFromCache(ctx, accountID, false)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
for _, datum := range data {
|
|
if datum.Email == email {
|
|
return datum, nil
|
|
}
|
|
}
|
|
|
|
return nil, nil //nolint:nilnil
|
|
}
|
|
|
|
// lookupUserInCache looks up user in the IdP cache and returns it. If the user wasn't found, the function returns nil
|
|
func (am *DefaultAccountManager) lookupUserInCache(ctx context.Context, userID string, accountID string) (*idp.UserData, error) {
|
|
accountUsers, err := am.Store.GetAccountUsers(ctx, store.LockingStrengthNone, accountID)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
users := make(map[string]userLoggedInOnce, len(accountUsers))
|
|
// ignore service users and users provisioned by integrations than are never logged in
|
|
for _, user := range accountUsers {
|
|
if user.IsServiceUser {
|
|
continue
|
|
}
|
|
if user.Issued == types.UserIssuedIntegration {
|
|
continue
|
|
}
|
|
users[user.Id] = userLoggedInOnce(!user.GetLastLogin().IsZero())
|
|
}
|
|
log.WithContext(ctx).Debugf("looking up user %s of account %s in cache", userID, accountID)
|
|
userData, err := am.lookupCache(ctx, users, accountID)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
for _, datum := range userData {
|
|
if datum.ID == userID {
|
|
return datum, nil
|
|
}
|
|
}
|
|
|
|
// add extra check on external cache manager. We may get to this point when the user is not yet findable in IDP,
|
|
// or it didn't have its metadata updated with am.addAccountIDToIDPAppMeta
|
|
user, err := am.Store.GetUserByUserID(ctx, store.LockingStrengthNone, userID)
|
|
if err != nil {
|
|
log.WithContext(ctx).Errorf("failed finding user %s in account %s", userID, accountID)
|
|
return nil, err
|
|
}
|
|
|
|
key := user.IntegrationReference.CacheKey(accountID, userID)
|
|
ud, err := am.externalCacheManager.Get(am.ctx, key)
|
|
if err != nil {
|
|
log.WithContext(ctx).Debugf("failed to get externalCache for key: %s, error: %s", key, err)
|
|
}
|
|
|
|
return ud, nil
|
|
}
|
|
|
|
func (am *DefaultAccountManager) refreshCache(ctx context.Context, accountID string) ([]*idp.UserData, error) {
|
|
return am.getAccountFromCache(ctx, accountID, true)
|
|
}
|
|
|
|
// getAccountFromCache returns user data for a given account ensuring that cache load happens only once
|
|
func (am *DefaultAccountManager) getAccountFromCache(ctx context.Context, accountID string, forceReload bool) ([]*idp.UserData, error) {
|
|
am.cacheMux.Lock()
|
|
loadingChan := am.cacheLoading[accountID]
|
|
if loadingChan == nil {
|
|
loadingChan = make(chan struct{})
|
|
am.cacheLoading[accountID] = loadingChan
|
|
am.cacheMux.Unlock()
|
|
|
|
defer func() {
|
|
am.cacheMux.Lock()
|
|
delete(am.cacheLoading, accountID)
|
|
close(loadingChan)
|
|
am.cacheMux.Unlock()
|
|
}()
|
|
|
|
if forceReload {
|
|
err := am.cacheManager.Delete(am.ctx, accountID)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
}
|
|
|
|
return am.cacheManager.Get(am.ctx, accountID)
|
|
}
|
|
am.cacheMux.Unlock()
|
|
|
|
log.WithContext(ctx).Debugf("one request to get account %s is already running", accountID)
|
|
|
|
select {
|
|
case <-loadingChan:
|
|
// channel has been closed meaning cache was loaded => simply return from cache
|
|
return am.cacheManager.Get(am.ctx, accountID)
|
|
case <-time.After(5 * time.Second):
|
|
return nil, fmt.Errorf("timeout while waiting for account %s cache to reload", accountID)
|
|
}
|
|
}
|
|
|
|
func (am *DefaultAccountManager) lookupCache(ctx context.Context, accountUsers map[string]userLoggedInOnce, accountID string) ([]*idp.UserData, error) {
|
|
var data []*idp.UserData
|
|
var err error
|
|
|
|
maxAttempts := 2
|
|
|
|
data, err = am.getAccountFromCache(ctx, accountID, false)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
for attempt := 1; attempt <= maxAttempts; attempt++ {
|
|
if am.isCacheFresh(ctx, accountUsers, data) {
|
|
return data, nil
|
|
}
|
|
|
|
if attempt > 1 {
|
|
time.Sleep(200 * time.Millisecond)
|
|
}
|
|
|
|
log.WithContext(ctx).Infof("refreshing cache for account %s", accountID)
|
|
data, err = am.refreshCache(ctx, accountID)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
if attempt == maxAttempts {
|
|
log.WithContext(ctx).Warnf("cache for account %s reached maximum refresh attempts (%d)", accountID, maxAttempts)
|
|
}
|
|
}
|
|
|
|
return data, nil
|
|
}
|
|
|
|
// isCacheFresh checks if the cache is refreshed already by comparing the accountUsers with the cache data by user count and user invite status
|
|
func (am *DefaultAccountManager) isCacheFresh(ctx context.Context, accountUsers map[string]userLoggedInOnce, data []*idp.UserData) bool {
|
|
userDataMap := make(map[string]*idp.UserData, len(data))
|
|
for _, datum := range data {
|
|
userDataMap[datum.ID] = datum
|
|
}
|
|
|
|
// the accountUsers ID list of non integration users from store, we check if cache has all of them
|
|
// as result of for loop knownUsersCount will have number of users are not presented in the cashed
|
|
knownUsersCount := len(accountUsers)
|
|
for user, loggedInOnce := range accountUsers {
|
|
if datum, ok := userDataMap[user]; ok {
|
|
// check if the matching user data has a pending invite and if the user has logged in once, forcing the cache to be refreshed
|
|
if datum.AppMetadata.WTPendingInvite != nil && *datum.AppMetadata.WTPendingInvite && loggedInOnce == true { //nolint
|
|
log.WithContext(ctx).Infof("user %s has a pending invite and has logged in once, cache invalid", user)
|
|
return false
|
|
}
|
|
knownUsersCount--
|
|
continue
|
|
}
|
|
log.WithContext(ctx).Debugf("cache doesn't know about %s user", user)
|
|
}
|
|
|
|
// if we know users that are not yet in cache more likely cache is outdated
|
|
if knownUsersCount > 0 {
|
|
log.WithContext(ctx).Infof("cache invalid. Users unknown to the cache: %d", knownUsersCount)
|
|
return false
|
|
}
|
|
|
|
return true
|
|
}
|
|
|
|
func (am *DefaultAccountManager) removeUserFromCache(ctx context.Context, accountID, userID string) error {
|
|
if IsEmbeddedIdp(am.idpManager) {
|
|
return nil
|
|
}
|
|
data, err := am.getAccountFromCache(ctx, accountID, false)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
|
|
for i, datum := range data {
|
|
if datum.ID == userID {
|
|
data = append(data[:i], data[i+1:]...)
|
|
break
|
|
}
|
|
}
|
|
|
|
return am.cacheManager.Set(am.ctx, accountID, data, cacheEntryExpiration())
|
|
}
|
|
|
|
// updateAccountDomainAttributesIfNotUpToDate updates the account domain attributes if they are not up to date and then, saves the account changes
|
|
func (am *DefaultAccountManager) updateAccountDomainAttributesIfNotUpToDate(ctx context.Context, accountID string, userAuth auth.UserAuth,
|
|
primaryDomain bool,
|
|
) error {
|
|
if userAuth.Domain == "" {
|
|
log.WithContext(ctx).Errorf("claims don't contain a valid domain, skipping domain attributes update. Received claims: %v", userAuth)
|
|
return nil
|
|
}
|
|
|
|
accountDomain, domainCategory, err := am.Store.GetAccountDomainAndCategory(ctx, store.LockingStrengthNone, accountID)
|
|
if err != nil {
|
|
log.WithContext(ctx).Errorf("error getting account domain and category: %v", err)
|
|
return err
|
|
}
|
|
|
|
if domainIsUpToDate(accountDomain, domainCategory, userAuth) {
|
|
return nil
|
|
}
|
|
|
|
user, err := am.Store.GetUserByUserID(ctx, store.LockingStrengthNone, userAuth.UserId)
|
|
if err != nil {
|
|
log.WithContext(ctx).Errorf("error getting user: %v", err)
|
|
return err
|
|
}
|
|
|
|
newDomain := accountDomain
|
|
newCategoty := domainCategory
|
|
|
|
lowerDomain := strings.ToLower(userAuth.Domain)
|
|
if accountDomain != lowerDomain && user.HasAdminPower() {
|
|
newDomain = lowerDomain
|
|
}
|
|
|
|
if accountDomain == lowerDomain {
|
|
newCategoty = userAuth.DomainCategory
|
|
}
|
|
|
|
return am.Store.UpdateAccountDomainAttributes(ctx, accountID, newDomain, newCategoty, primaryDomain)
|
|
}
|
|
|
|
// handleExistingUserAccount handles existing User accounts and update its domain attributes.
|
|
// If there is no primary domain account yet, we set the account as primary for the domain. Otherwise,
|
|
// we compare the account's ID with the domain account ID, and if they don't match, we set the account as
|
|
// non-primary account for the domain. We don't merge accounts at this stage, because of cases when a domain
|
|
// was previously unclassified or classified as public so N users that logged int that time, has they own account
|
|
// and peers that shouldn't be lost.
|
|
func (am *DefaultAccountManager) handleExistingUserAccount(
|
|
ctx context.Context,
|
|
userAccountID string,
|
|
domainAccountID string,
|
|
userAuth auth.UserAuth,
|
|
) error {
|
|
primaryDomain := domainAccountID == "" || userAccountID == domainAccountID
|
|
err := am.updateAccountDomainAttributesIfNotUpToDate(ctx, userAccountID, userAuth, primaryDomain)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
|
|
// we should register the account ID to this user's metadata in our IDP manager
|
|
err = am.addAccountIDToIDPAppMeta(ctx, userAuth.UserId, userAccountID)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
|
|
return nil
|
|
}
|
|
|
|
// addNewPrivateAccount validates if there is an existing primary account for the domain, if so it adds the new user to that account,
|
|
// otherwise it will create a new account and make it primary account for the domain.
|
|
func (am *DefaultAccountManager) addNewPrivateAccount(ctx context.Context, domainAccountID string, userAuth auth.UserAuth) (string, error) {
|
|
if userAuth.UserId == "" {
|
|
return "", fmt.Errorf("user ID is empty")
|
|
}
|
|
|
|
lowerDomain := strings.ToLower(userAuth.Domain)
|
|
|
|
newAccount, err := am.newAccount(ctx, userAuth.UserId, lowerDomain, userAuth.Email, userAuth.Name)
|
|
if err != nil {
|
|
return "", err
|
|
}
|
|
|
|
newAccount.Domain = lowerDomain
|
|
newAccount.DomainCategory = userAuth.DomainCategory
|
|
newAccount.IsDomainPrimaryAccount = true
|
|
|
|
err = am.Store.SaveAccount(ctx, newAccount)
|
|
if err != nil {
|
|
return "", err
|
|
}
|
|
|
|
err = am.addAccountIDToIDPAppMeta(ctx, userAuth.UserId, newAccount.Id)
|
|
if err != nil {
|
|
return "", err
|
|
}
|
|
|
|
am.StoreEvent(ctx, userAuth.UserId, userAuth.UserId, newAccount.Id, activity.UserJoined, nil)
|
|
|
|
return newAccount.Id, nil
|
|
}
|
|
|
|
func (am *DefaultAccountManager) addNewUserToDomainAccount(ctx context.Context, domainAccountID string, userAuth auth.UserAuth) (string, error) {
|
|
newUser := types.NewRegularUser(userAuth.UserId, userAuth.Email, userAuth.Name)
|
|
newUser.AccountID = domainAccountID
|
|
|
|
settings, err := am.Store.GetAccountSettings(ctx, store.LockingStrengthNone, domainAccountID)
|
|
if err != nil {
|
|
return "", err
|
|
}
|
|
|
|
if settings != nil && settings.Extra != nil && settings.Extra.UserApprovalRequired {
|
|
newUser.Blocked = true
|
|
newUser.PendingApproval = true
|
|
}
|
|
|
|
err = am.Store.SaveUser(ctx, newUser)
|
|
if err != nil {
|
|
return "", err
|
|
}
|
|
|
|
err = am.addAccountIDToIDPAppMeta(ctx, userAuth.UserId, domainAccountID)
|
|
if err != nil {
|
|
return "", err
|
|
}
|
|
|
|
if newUser.PendingApproval {
|
|
am.StoreEvent(ctx, userAuth.UserId, userAuth.UserId, domainAccountID, activity.UserJoined, map[string]any{"pending_approval": true})
|
|
} else {
|
|
am.StoreEvent(ctx, userAuth.UserId, userAuth.UserId, domainAccountID, activity.UserJoined, nil)
|
|
}
|
|
|
|
return domainAccountID, nil
|
|
}
|
|
|
|
// redeemInvite checks whether user has been invited and redeems the invite
|
|
func (am *DefaultAccountManager) redeemInvite(ctx context.Context, accountID string, userID string) error {
|
|
// only possible with the enabled IdP manager
|
|
if am.idpManager == nil {
|
|
log.WithContext(ctx).Warnf("invites only work with enabled IdP manager")
|
|
return nil
|
|
}
|
|
|
|
user, err := am.lookupUserInCache(ctx, userID, accountID)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
|
|
if user == nil {
|
|
return status.Errorf(status.NotFound, "user %s not found in the IdP", userID)
|
|
}
|
|
|
|
if user.AppMetadata.WTPendingInvite != nil && *user.AppMetadata.WTPendingInvite {
|
|
log.WithContext(ctx).Infof("redeeming invite for user %s account %s", userID, accountID)
|
|
// User has already logged in, meaning that IdP should have set wt_pending_invite to false.
|
|
// Our job is to just reload cache.
|
|
go func() {
|
|
_, err = am.refreshCache(ctx, accountID)
|
|
if err != nil {
|
|
log.WithContext(ctx).Warnf("failed reloading cache when redeeming user %s under account %s", userID, accountID)
|
|
return
|
|
}
|
|
log.WithContext(ctx).Debugf("user %s of account %s redeemed invite", user.ID, accountID)
|
|
am.StoreEvent(ctx, userID, userID, accountID, activity.UserJoined, nil)
|
|
}()
|
|
}
|
|
|
|
return nil
|
|
}
|
|
|
|
// GetAccount returns an account associated with this account ID.
|
|
func (am *DefaultAccountManager) GetAccount(ctx context.Context, accountID string) (*types.Account, error) {
|
|
return am.Store.GetAccount(ctx, accountID)
|
|
}
|
|
|
|
// GetAccountByID returns an account associated with this account ID.
|
|
func (am *DefaultAccountManager) GetAccountByID(ctx context.Context, accountID string, userID string) (*types.Account, error) {
|
|
allowed, ctx, err := am.permissionsManager.ValidateUserPermissions(ctx, accountID, userID, modules.Accounts, operations.Read)
|
|
if err != nil {
|
|
return nil, status.NewPermissionValidationError(err)
|
|
}
|
|
if !allowed {
|
|
return nil, status.NewPermissionDeniedError()
|
|
}
|
|
|
|
return am.Store.GetAccount(ctx, accountID)
|
|
}
|
|
|
|
// GetAccountMeta returns the account metadata associated with this account ID.
|
|
func (am *DefaultAccountManager) GetAccountMeta(ctx context.Context, accountID string, userID string) (*types.AccountMeta, error) {
|
|
allowed, ctx, err := am.permissionsManager.ValidateUserPermissions(ctx, accountID, userID, modules.Accounts, operations.Read)
|
|
if err != nil {
|
|
return nil, status.NewPermissionValidationError(err)
|
|
}
|
|
if !allowed {
|
|
return nil, status.NewPermissionDeniedError()
|
|
}
|
|
|
|
return am.Store.GetAccountMeta(ctx, store.LockingStrengthNone, accountID)
|
|
}
|
|
|
|
// GetAccountOnboarding retrieves the onboarding information for a specific account.
|
|
func (am *DefaultAccountManager) GetAccountOnboarding(ctx context.Context, accountID string, userID string) (*types.AccountOnboarding, error) {
|
|
allowed, ctx, err := am.permissionsManager.ValidateUserPermissions(ctx, accountID, userID, modules.Accounts, operations.Read)
|
|
if err != nil {
|
|
return nil, status.NewPermissionValidationError(err)
|
|
}
|
|
|
|
if !allowed {
|
|
return nil, status.NewPermissionDeniedError()
|
|
}
|
|
|
|
onboarding, err := am.Store.GetAccountOnboarding(ctx, accountID)
|
|
if err != nil && err.Error() != status.NewAccountOnboardingNotFoundError(accountID).Error() {
|
|
log.Errorf("failed to get account onboarding for account %s: %v", accountID, err)
|
|
return nil, err
|
|
}
|
|
|
|
if onboarding == nil {
|
|
onboarding = &types.AccountOnboarding{
|
|
AccountID: accountID,
|
|
}
|
|
}
|
|
|
|
return onboarding, nil
|
|
}
|
|
|
|
func (am *DefaultAccountManager) UpdateAccountOnboarding(ctx context.Context, accountID, userID string, newOnboarding *types.AccountOnboarding) (*types.AccountOnboarding, error) {
|
|
allowed, ctx, err := am.permissionsManager.ValidateUserPermissions(ctx, accountID, userID, modules.Settings, operations.Update)
|
|
if err != nil {
|
|
return nil, fmt.Errorf("failed to validate user permissions: %w", err)
|
|
}
|
|
|
|
if !allowed {
|
|
return nil, status.NewPermissionDeniedError()
|
|
}
|
|
|
|
oldOnboarding, err := am.Store.GetAccountOnboarding(ctx, accountID)
|
|
if err != nil && err.Error() != status.NewAccountOnboardingNotFoundError(accountID).Error() {
|
|
return nil, fmt.Errorf("failed to get account onboarding: %w", err)
|
|
}
|
|
|
|
if oldOnboarding == nil {
|
|
oldOnboarding = &types.AccountOnboarding{
|
|
AccountID: accountID,
|
|
}
|
|
}
|
|
|
|
if newOnboarding == nil {
|
|
return oldOnboarding, nil
|
|
}
|
|
|
|
if oldOnboarding.IsEqual(*newOnboarding) {
|
|
log.WithContext(ctx).Debugf("no changes in onboarding for account %s", accountID)
|
|
return oldOnboarding, nil
|
|
}
|
|
|
|
newOnboarding.AccountID = accountID
|
|
err = am.Store.SaveAccountOnboarding(ctx, newOnboarding)
|
|
if err != nil {
|
|
return nil, fmt.Errorf("failed to update account onboarding: %w", err)
|
|
}
|
|
|
|
return newOnboarding, nil
|
|
}
|
|
|
|
func (am *DefaultAccountManager) GetAccountIDFromUserAuth(ctx context.Context, userAuth auth.UserAuth) (string, string, error) {
|
|
if userAuth.UserId == "" {
|
|
return "", "", errors.New(emptyUserID)
|
|
}
|
|
if am.singleAccountMode && am.singleAccountModeDomain != "" {
|
|
// This section is mostly related to self-hosted installations.
|
|
// We override incoming domain claims to group users under a single account.
|
|
err := am.updateUserAuthWithSingleMode(ctx, &userAuth)
|
|
if err != nil {
|
|
return "", "", err
|
|
}
|
|
}
|
|
|
|
accountID, err := am.getAccountIDWithAuthorizationClaims(ctx, userAuth)
|
|
if err != nil {
|
|
return "", "", err
|
|
}
|
|
|
|
user, err := am.Store.GetUserByUserID(ctx, store.LockingStrengthNone, userAuth.UserId)
|
|
if err != nil {
|
|
// this is not really possible because we got an account by user ID
|
|
log.Errorf("failed to get user by ID %s: %v", userAuth.UserId, err)
|
|
return "", "", status.Errorf(status.NotFound, "user %s not found", userAuth.UserId)
|
|
}
|
|
|
|
if userAuth.IsChild {
|
|
return accountID, user.Id, nil
|
|
}
|
|
|
|
ctx, err = am.permissionsManager.ValidateAccountAccess(ctx, accountID, user, false)
|
|
if err != nil {
|
|
return "", "", err
|
|
}
|
|
|
|
if !user.IsServiceUser && userAuth.Invited {
|
|
err = am.redeemInvite(ctx, accountID, user.Id)
|
|
if err != nil {
|
|
return "", "", err
|
|
}
|
|
}
|
|
|
|
return accountID, user.Id, nil
|
|
}
|
|
|
|
// updateUserAuthWithSingleMode modifies the userAuth with the single account domain, or if there is an existing account, with the domain of that account
|
|
func (am *DefaultAccountManager) updateUserAuthWithSingleMode(ctx context.Context, userAuth *auth.UserAuth) error {
|
|
userAuth.DomainCategory = types.PrivateCategory
|
|
userAuth.Domain = am.singleAccountModeDomain
|
|
|
|
accountID, err := am.Store.GetAnyAccountID(ctx)
|
|
if err != nil {
|
|
if e, ok := status.FromError(err); !ok || e.Type() != status.NotFound {
|
|
return err
|
|
}
|
|
log.WithContext(ctx).Debugf("using singleAccountModeDomain to override JWT Domain and DomainCategory claims in single account mode")
|
|
return nil
|
|
}
|
|
|
|
if accountID == "" {
|
|
log.WithContext(ctx).Debugf("using singleAccountModeDomain to override JWT Domain and DomainCategory claims in single account mode")
|
|
return nil
|
|
}
|
|
|
|
domain, _, err := am.Store.GetAccountDomainAndCategory(ctx, store.LockingStrengthNone, accountID)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
// Keep the configured single account domain when the existing account has none
|
|
if domain != "" {
|
|
userAuth.Domain = domain
|
|
}
|
|
|
|
log.WithContext(ctx).Debugf("overriding JWT Domain and DomainCategory claims since single account mode is enabled")
|
|
return nil
|
|
}
|
|
|
|
// syncJWTGroups processes the JWT groups for a user, updates the account based on the groups,
|
|
// and propagates changes to peers if group propagation is enabled.
|
|
// requires userAuth to have been ValidateAndParseToken and EnsureUserAccessByJWTGroups by the AuthManager
|
|
func (am *DefaultAccountManager) SyncUserJWTGroups(ctx context.Context, userAuth auth.UserAuth) error {
|
|
// Child accounts and PAT-authenticated requests do not sync JWT groups.
|
|
// Embedded-Dex local users also skip sync because local password authentication
|
|
// does not provide external IdP group claims.
|
|
if userAuth.IsChild || userAuth.IsPAT || dex.IsLocalUserID(userAuth.UserId) {
|
|
return nil
|
|
}
|
|
|
|
settings, err := am.Store.GetAccountSettings(ctx, store.LockingStrengthNone, userAuth.AccountId)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
|
|
if settings == nil || !settings.JWTGroupsEnabled {
|
|
return nil
|
|
}
|
|
|
|
if settings.JWTGroupsClaimName == "" {
|
|
log.WithContext(ctx).Debugf("JWT groups are enabled but no claim name is set")
|
|
return nil
|
|
}
|
|
|
|
var addNewGroups []string
|
|
var removeOldGroups []string
|
|
var hasChanges bool
|
|
var user *types.User
|
|
var change affectedpeers.Change
|
|
var snap *affectedpeers.Snapshot
|
|
err = am.Store.ExecuteInTransaction(ctx, func(transaction store.Store) error {
|
|
user, err = transaction.GetUserByUserID(ctx, store.LockingStrengthNone, userAuth.UserId)
|
|
if err != nil {
|
|
return fmt.Errorf("error getting user: %w", err)
|
|
}
|
|
|
|
groups, err := transaction.GetAccountGroups(ctx, store.LockingStrengthNone, userAuth.AccountId)
|
|
if err != nil {
|
|
return fmt.Errorf("error getting account groups: %w", err)
|
|
}
|
|
|
|
changed, updatedAutoGroups, newGroupsToCreate, err := am.getJWTGroupsChanges(user, groups, userAuth.Groups)
|
|
if err != nil {
|
|
return fmt.Errorf("error getting JWT groups changes: %w", err)
|
|
}
|
|
|
|
hasChanges = changed
|
|
// skip update if no changes
|
|
if !changed {
|
|
return nil
|
|
}
|
|
|
|
for _, g := range newGroupsToCreate {
|
|
g.PublicID = xid.New().String()
|
|
}
|
|
|
|
if err = transaction.CreateGroups(ctx, userAuth.AccountId, newGroupsToCreate); err != nil {
|
|
return fmt.Errorf("error saving groups: %w", err)
|
|
}
|
|
|
|
addNewGroups = util.Difference(updatedAutoGroups, user.AutoGroups)
|
|
removeOldGroups = util.Difference(user.AutoGroups, updatedAutoGroups)
|
|
|
|
user.AutoGroups = updatedAutoGroups
|
|
if err = transaction.SaveUser(ctx, user); err != nil {
|
|
return fmt.Errorf("error saving user: %w", err)
|
|
}
|
|
|
|
allGroupChanges := slices.Concat(addNewGroups, removeOldGroups)
|
|
// The user's auto-groups changed, so the SSH rules authorizing them ship a new
|
|
// group -> user mapping even when no peer moves between groups.
|
|
change.UserGroupIDs = allGroupChanges
|
|
|
|
// The user's peers are the changed entity in every scenario the sync can
|
|
// produce — group membership, IPv6 assignment, SSH mappings — so they refresh
|
|
// together with every peer they can connect to, like on a regular peer update.
|
|
userPeers, err := transaction.GetUserPeers(ctx, store.LockingStrengthNone, userAuth.AccountId, userAuth.UserId)
|
|
if err != nil {
|
|
return fmt.Errorf("error getting user peers: %w", err)
|
|
}
|
|
for _, peer := range userPeers {
|
|
change.ChangedPeerIDs = append(change.ChangedPeerIDs, peer.ID)
|
|
}
|
|
|
|
// Propagate changes to peers if group propagation is enabled
|
|
if settings.GroupsPropagationEnabled {
|
|
for _, peer := range userPeers {
|
|
for _, g := range addNewGroups {
|
|
if err := transaction.AddPeerToGroup(ctx, userAuth.AccountId, peer.ID, g); err != nil {
|
|
return fmt.Errorf("error adding peer %s to group %s: %w", peer.ID, g, err)
|
|
}
|
|
}
|
|
for _, g := range removeOldGroups {
|
|
if err := transaction.RemovePeerFromGroup(ctx, peer.ID, g); err != nil {
|
|
return fmt.Errorf("error removing peer %s from group %s: %w", peer.ID, g, err)
|
|
}
|
|
}
|
|
}
|
|
|
|
change.LinkGroups = allGroupChanges
|
|
|
|
ipv6Changed, err := am.reconcileIPv6ForGroupChanges(ctx, transaction, userAuth.AccountId, allGroupChanges)
|
|
if err != nil {
|
|
return fmt.Errorf("reconcile IPv6 for group changes: %w", err)
|
|
}
|
|
change.ChangedPeerIDs = append(change.ChangedPeerIDs, ipv6Changed...)
|
|
|
|
if err = transaction.IncrementNetworkSerial(ctx, userAuth.AccountId); err != nil {
|
|
return fmt.Errorf("error incrementing network serial: %w", err)
|
|
}
|
|
}
|
|
|
|
if snap, err = affectedpeers.Load(ctx, transaction, userAuth.AccountId, change); err != nil {
|
|
return err
|
|
}
|
|
|
|
return nil
|
|
})
|
|
if err != nil {
|
|
return err
|
|
}
|
|
|
|
if !hasChanges {
|
|
return nil
|
|
}
|
|
|
|
for _, g := range addNewGroups {
|
|
group, err := am.Store.GetGroupByID(ctx, store.LockingStrengthNone, userAuth.AccountId, g)
|
|
if err != nil {
|
|
log.WithContext(ctx).Debugf("group %s not found while saving user activity event of account %s", g, userAuth.AccountId)
|
|
} else {
|
|
meta := map[string]any{
|
|
"group": group.Name, "group_id": group.ID,
|
|
"is_service_user": user.IsServiceUser, "user_name": user.ServiceUserName,
|
|
}
|
|
am.StoreEvent(ctx, user.Id, user.Id, userAuth.AccountId, activity.GroupAddedToUser, meta)
|
|
}
|
|
}
|
|
|
|
for _, g := range removeOldGroups {
|
|
group, err := am.Store.GetGroupByID(ctx, store.LockingStrengthNone, userAuth.AccountId, g)
|
|
if err != nil {
|
|
log.WithContext(ctx).Debugf("group %s not found while saving user activity event of account %s", g, userAuth.AccountId)
|
|
} else {
|
|
meta := map[string]any{
|
|
"group": group.Name, "group_id": group.ID,
|
|
"is_service_user": user.IsServiceUser, "user_name": user.ServiceUserName,
|
|
}
|
|
am.StoreEvent(ctx, user.Id, user.Id, userAuth.AccountId, activity.GroupRemovedFromUser, meta)
|
|
}
|
|
}
|
|
|
|
log.WithContext(ctx).Tracef("user %s: JWT group membership changed, updating affected peers", userAuth.UserId)
|
|
bgCtx := context.WithoutCancel(ctx)
|
|
go func() {
|
|
affectedPeerIDs := snap.Expand(bgCtx, userAuth.AccountId, change)
|
|
if len(affectedPeerIDs) == 0 {
|
|
return
|
|
}
|
|
if err := am.networkMapController.BufferUpdateAffectedPeers(bgCtx, userAuth.AccountId, affectedPeerIDs, types.UpdateReason{Resource: types.UpdateResourceUser, Operation: types.UpdateOperationUpdate}); err != nil {
|
|
log.WithContext(bgCtx).Errorf("failed to update affected peers after JWT group sync for account %s: %v", userAuth.AccountId, err)
|
|
}
|
|
}()
|
|
|
|
return nil
|
|
}
|
|
|
|
// getAccountIDWithAuthorizationClaims retrieves an account ID using JWT Claims.
|
|
// if domain is not private or domain is invalid, it will return the account ID by user ID.
|
|
// if domain is of the PrivateCategory category, it will evaluate
|
|
// if account is new, existing or if there is another account with the same domain
|
|
//
|
|
// Use cases:
|
|
//
|
|
// New user + New account + New domain -> create account, user role = owner (if private domain, index domain)
|
|
//
|
|
// New user + New account + Existing Private Domain -> add user to the existing account, user role = user (not admin)
|
|
//
|
|
// New user + New account + Existing Public Domain -> create account, user role = owner
|
|
//
|
|
// Existing user + Existing account + Existing Domain -> Nothing changes (if private, index domain)
|
|
//
|
|
// Existing user + Existing account + Existing Indexed Domain -> Nothing changes
|
|
//
|
|
// Existing user + Existing account + Existing domain reclassified Domain as private -> Nothing changes (index domain)
|
|
//
|
|
// UserAuth IsChild -> checks that account exists
|
|
func (am *DefaultAccountManager) getAccountIDWithAuthorizationClaims(ctx context.Context, userAuth auth.UserAuth) (string, error) {
|
|
log.WithContext(ctx).Tracef("getting account with authorization claims. User ID: \"%s\", Account ID: \"%s\", Domain: \"%s\", Domain Category: \"%s\"",
|
|
userAuth.UserId, userAuth.AccountId, userAuth.Domain, userAuth.DomainCategory)
|
|
|
|
if userAuth.UserId == "" {
|
|
return "", errors.New(emptyUserID)
|
|
}
|
|
|
|
if userAuth.IsChild {
|
|
exists, err := am.Store.AccountExists(ctx, store.LockingStrengthNone, userAuth.AccountId)
|
|
if err != nil || !exists {
|
|
return "", err
|
|
}
|
|
return userAuth.AccountId, nil
|
|
}
|
|
|
|
if userAuth.DomainCategory != types.PrivateCategory || !isDomainValid(userAuth.Domain) {
|
|
return am.GetAccountIDByUserID(ctx, userAuth)
|
|
}
|
|
|
|
if userAuth.AccountId != "" {
|
|
return am.handlePrivateAccountWithIDFromClaim(ctx, userAuth)
|
|
}
|
|
|
|
// We checked if the domain has a primary account already
|
|
domainAccountID, cancel, err := am.getPrivateDomainWithGlobalLock(ctx, userAuth.Domain)
|
|
if cancel != nil {
|
|
defer cancel()
|
|
}
|
|
if err != nil {
|
|
return "", err
|
|
}
|
|
|
|
userAccountID, err := am.Store.GetAccountIDByUserID(ctx, store.LockingStrengthNone, userAuth.UserId)
|
|
if handleNotFound(err) != nil {
|
|
log.WithContext(ctx).Errorf("error getting account ID by user ID: %v", err)
|
|
return "", err
|
|
}
|
|
|
|
if userAccountID != "" {
|
|
if err = am.handleExistingUserAccount(ctx, userAccountID, domainAccountID, userAuth); err != nil {
|
|
return "", err
|
|
}
|
|
|
|
return userAccountID, nil
|
|
}
|
|
|
|
if domainAccountID != "" {
|
|
return am.addNewUserToDomainAccount(ctx, domainAccountID, userAuth)
|
|
}
|
|
|
|
return am.addNewPrivateAccount(ctx, domainAccountID, userAuth)
|
|
}
|
|
|
|
func (am *DefaultAccountManager) getPrivateDomainWithGlobalLock(ctx context.Context, domain string) (string, context.CancelFunc, error) {
|
|
domainAccountID, err := am.Store.GetAccountIDByPrivateDomain(ctx, store.LockingStrengthNone, domain)
|
|
if handleNotFound(err) != nil {
|
|
|
|
log.WithContext(ctx).Errorf(errorGettingDomainAccIDFmt, err)
|
|
return "", nil, err
|
|
}
|
|
|
|
if domainAccountID != "" {
|
|
return domainAccountID, nil, nil
|
|
}
|
|
|
|
log.WithContext(ctx).Debugf("no primary account found for domain %s, acquiring global lock", domain)
|
|
cancel := am.Store.AcquireGlobalLock(ctx)
|
|
|
|
// check again if the domain has a primary account because of simultaneous requests
|
|
domainAccountID, err = am.Store.GetAccountIDByPrivateDomain(ctx, store.LockingStrengthNone, domain)
|
|
if handleNotFound(err) != nil {
|
|
cancel()
|
|
log.WithContext(ctx).Errorf(errorGettingDomainAccIDFmt, err)
|
|
return "", nil, err
|
|
}
|
|
|
|
return domainAccountID, cancel, nil
|
|
}
|
|
|
|
func (am *DefaultAccountManager) handlePrivateAccountWithIDFromClaim(ctx context.Context, userAuth auth.UserAuth) (string, error) {
|
|
userAccountID, err := am.Store.GetAccountIDByUserID(ctx, store.LockingStrengthNone, userAuth.UserId)
|
|
if err != nil {
|
|
log.WithContext(ctx).Errorf("error getting account ID by user ID: %v", err)
|
|
return "", err
|
|
}
|
|
|
|
if userAccountID != userAuth.AccountId {
|
|
return "", fmt.Errorf("user %s is not part of the account id %s", userAuth.UserId, userAuth.AccountId)
|
|
}
|
|
|
|
accountDomain, domainCategory, err := am.Store.GetAccountDomainAndCategory(ctx, store.LockingStrengthNone, userAuth.AccountId)
|
|
if handleNotFound(err) != nil {
|
|
log.WithContext(ctx).Errorf("error getting account domain and category: %v", err)
|
|
return "", err
|
|
}
|
|
|
|
if domainIsUpToDate(accountDomain, domainCategory, userAuth) {
|
|
return userAuth.AccountId, nil
|
|
}
|
|
|
|
// We checked if the domain has a primary account already
|
|
domainAccountID, err := am.Store.GetAccountIDByPrivateDomain(ctx, store.LockingStrengthNone, userAuth.Domain)
|
|
if handleNotFound(err) != nil {
|
|
log.WithContext(ctx).Errorf(errorGettingDomainAccIDFmt, err)
|
|
return "", err
|
|
}
|
|
|
|
err = am.handleExistingUserAccount(ctx, userAuth.AccountId, domainAccountID, userAuth)
|
|
if err != nil {
|
|
return "", err
|
|
}
|
|
|
|
return userAuth.AccountId, nil
|
|
}
|
|
|
|
func handleNotFound(err error) error {
|
|
if err == nil {
|
|
return nil
|
|
}
|
|
|
|
e, ok := status.FromError(err)
|
|
if !ok || e.Type() != status.NotFound {
|
|
return err
|
|
}
|
|
return nil
|
|
}
|
|
|
|
func domainIsUpToDate(domain string, domainCategory string, userAuth auth.UserAuth) bool {
|
|
return domainCategory == types.PrivateCategory || userAuth.DomainCategory != types.PrivateCategory || domain != userAuth.Domain
|
|
}
|
|
|
|
// SyncAndMarkPeer is the per-Sync entry point: it refreshes the peer's
|
|
// network map and then marks the peer connected with a session token
|
|
// derived from syncTime (the moment the gRPC stream opened). Any
|
|
// concurrent stream that started earlier loses the optimistic-lock race
|
|
// in MarkPeerConnected and bails without writing.
|
|
func (am *DefaultAccountManager) SyncAndMarkPeer(ctx context.Context, accountID string, peerPubKey string, meta nbpeer.PeerSystemMeta, realIP net.IP, syncTime time.Time) (*nbpeer.Peer, *types.NetworkMap, []*nmdata.PostureChecks, int64, error) {
|
|
peer, netMap, postureChecks, dnsfwdPort, err := am.SyncPeer(ctx, types.PeerSync{WireGuardPubKey: peerPubKey, Meta: meta, RealIP: realIP}, accountID)
|
|
if err != nil {
|
|
return nil, nil, nil, 0, fmt.Errorf("error syncing peer: %w", err)
|
|
}
|
|
|
|
if err := am.MarkPeerConnected(ctx, peerPubKey, accountID, syncTime.UnixNano(), netMap); err != nil {
|
|
log.WithContext(ctx).Warnf("failed marking peer as connected %s %v", peerPubKey, err)
|
|
}
|
|
|
|
return peer, netMap, postureChecks, dnsfwdPort, nil
|
|
}
|
|
|
|
// OnPeerDisconnected is invoked when a sync stream ends. It marks the
|
|
// peer disconnected only when the stored SessionStartedAt matches the
|
|
// nanosecond token derived from streamStartTime — i.e. only when this
|
|
// is the stream that currently owns the peer's session. A mismatch
|
|
// means a newer stream has already replaced us, so the disconnect is
|
|
// dropped.
|
|
func (am *DefaultAccountManager) OnPeerDisconnected(ctx context.Context, accountID string, peerPubKey string, streamStartTime time.Time) error {
|
|
if err := am.MarkPeerDisconnected(ctx, peerPubKey, accountID, streamStartTime.UnixNano()); err != nil {
|
|
log.WithContext(ctx).Warnf("failed marking peer as disconnected %s %v", peerPubKey, err)
|
|
}
|
|
return nil
|
|
}
|
|
|
|
func (am *DefaultAccountManager) SyncPeerMeta(ctx context.Context, peerPubKey string, meta nbpeer.PeerSystemMeta, realIP net.IP) error {
|
|
accountID, err := am.Store.GetAccountIDByPeerPubKey(ctx, peerPubKey)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
|
|
_, _, _, _, err = am.SyncPeer(ctx, types.PeerSync{WireGuardPubKey: peerPubKey, Meta: meta, RealIP: realIP, UpdateAccountPeers: true}, accountID)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
return nil
|
|
}
|
|
|
|
// isDomainValid validates public/IDP domains using stricter rules than internal DNS domains.
|
|
// Requires at least 2-char alphabetic TLD and no single-label domains.
|
|
var publicDomainRegexp = regexp.MustCompile(`^([a-z0-9]+(-[a-z0-9]+)*\.)+[a-z]{2,}$`)
|
|
|
|
func isDomainValid(domain string) bool {
|
|
return publicDomainRegexp.MatchString(domain)
|
|
}
|
|
|
|
func (am *DefaultAccountManager) onPeersInvalidated(ctx context.Context, accountID string, peerIDs []string) {
|
|
peers := []*nbpeer.Peer{}
|
|
log.WithContext(ctx).Debugf("invalidating peers %v for account %s", peerIDs, accountID)
|
|
for _, peerID := range peerIDs {
|
|
peer, err := am.GetPeer(ctx, accountID, peerID, activity.SystemInitiator)
|
|
if err != nil {
|
|
log.WithContext(ctx).Errorf("failed to get invalidated peer %s for account %s: %v", peerID, accountID, err)
|
|
continue
|
|
}
|
|
if peer.UserID != "" {
|
|
peers = append(peers, peer)
|
|
}
|
|
}
|
|
if len(peers) > 0 {
|
|
err := am.expireAndUpdatePeers(ctx, accountID, peers, peerExpirationValidationFailed)
|
|
if err != nil {
|
|
log.WithContext(ctx).Errorf("failed to expire and update invalidated peers for account %s: %v", accountID, err)
|
|
return
|
|
}
|
|
} else {
|
|
log.WithContext(ctx).Debugf("running invalidation with no invalid peers")
|
|
}
|
|
log.WithContext(ctx).Debugf("invalidated peers have been expired for account %s", accountID)
|
|
}
|
|
|
|
func (am *DefaultAccountManager) FindExistingPostureCheck(accountID string, checks *posture.ChecksDefinition) (*posture.Checks, error) {
|
|
return am.Store.GetPostureCheckByChecksDefinition(accountID, checks)
|
|
}
|
|
|
|
func (am *DefaultAccountManager) GetAccountIDForPeerKey(ctx context.Context, peerKey string) (string, error) {
|
|
return am.Store.GetAccountIDByPeerPubKey(ctx, peerKey)
|
|
}
|
|
|
|
func (am *DefaultAccountManager) handleUserPeer(ctx context.Context, transaction store.Store, peer *nbpeer.Peer, settings *types.Settings) (bool, error) {
|
|
user, err := transaction.GetUserByUserID(ctx, store.LockingStrengthNone, peer.UserID)
|
|
if err != nil {
|
|
return false, err
|
|
}
|
|
|
|
err = checkIfPeerOwnerIsBlocked(peer, user)
|
|
if err != nil {
|
|
return false, err
|
|
}
|
|
|
|
if peerLoginExpired(ctx, peer, settings) {
|
|
err = am.handleExpiredPeer(ctx, transaction, user, peer)
|
|
if err != nil {
|
|
return false, err
|
|
}
|
|
return true, nil
|
|
}
|
|
|
|
return false, nil
|
|
}
|
|
|
|
func (am *DefaultAccountManager) GetAccountSettings(ctx context.Context, accountID string, userID string) (*types.Settings, error) {
|
|
allowed, ctx, err := am.permissionsManager.ValidateUserPermissions(ctx, accountID, userID, modules.Settings, operations.Read)
|
|
if err != nil {
|
|
return nil, status.NewPermissionValidationError(err)
|
|
}
|
|
if !allowed {
|
|
return nil, status.NewPermissionDeniedError()
|
|
}
|
|
return am.Store.GetAccountSettings(ctx, store.LockingStrengthNone, accountID)
|
|
}
|
|
|
|
// newAccountWithId creates a new Account with a default SetupKey (doesn't store in a Store) and provided id
|
|
func newAccountWithId(ctx context.Context, accountID, userID, domain, email, name string, disableDefaultPolicy bool) *types.Account {
|
|
log.WithContext(ctx).Debugf("creating new account")
|
|
|
|
network := types.NewNetwork()
|
|
peers := make(map[string]*nbpeer.Peer)
|
|
users := make(map[string]*types.User)
|
|
routes := make(map[route.ID]*route.Route)
|
|
setupKeys := map[string]*types.SetupKey{}
|
|
nameServersGroups := make(map[string]*nbdns.NameServerGroup)
|
|
|
|
owner := types.NewOwnerUser(userID, email, name)
|
|
owner.AccountID = accountID
|
|
users[userID] = owner
|
|
|
|
dnsSettings := types.DNSSettings{
|
|
DisabledManagementGroups: make([]string, 0),
|
|
}
|
|
log.WithContext(ctx).Debugf("created new account %s", accountID)
|
|
|
|
acc := &types.Account{
|
|
Id: accountID,
|
|
CreatedAt: time.Now().UTC(),
|
|
SetupKeys: setupKeys,
|
|
Network: network,
|
|
Peers: peers,
|
|
Users: users,
|
|
CreatedBy: userID,
|
|
Domain: domain,
|
|
Routes: routes,
|
|
NameServerGroups: nameServersGroups,
|
|
DNSSettings: dnsSettings,
|
|
Settings: &types.Settings{
|
|
PeerLoginExpirationEnabled: true,
|
|
PeerLoginExpiration: types.DefaultPeerLoginExpiration,
|
|
GroupsPropagationEnabled: true,
|
|
RegularUsersViewBlocked: true,
|
|
|
|
PeerInactivityExpirationEnabled: false,
|
|
PeerInactivityExpiration: types.DefaultPeerInactivityExpiration,
|
|
RoutingPeerDNSResolutionEnabled: true,
|
|
Extra: &types.ExtraSettings{
|
|
UserApprovalRequired: true,
|
|
},
|
|
LazyConnectionEnabled: true,
|
|
},
|
|
Onboarding: types.AccountOnboarding{
|
|
OnboardingFlowPending: true,
|
|
SignupFormPending: true,
|
|
},
|
|
}
|
|
|
|
if err := acc.AddAllGroup(disableDefaultPolicy); err != nil {
|
|
log.WithContext(ctx).Errorf("error adding all group to account %s: %v", acc.Id, err)
|
|
}
|
|
|
|
if allGroup, err := acc.GetGroupAll(); err == nil {
|
|
acc.Settings.IPv6EnabledGroups = []string{allGroup.ID}
|
|
}
|
|
|
|
return acc
|
|
}
|
|
|
|
// separateGroups separates user's auto groups into non-JWT and JWT groups.
|
|
// Returns the list of standard auto groups and a map of JWT auto groups,
|
|
// where the keys are the group names and the values are the group IDs.
|
|
func separateGroups(autoGroups []string, allGroups []*types.Group) ([]string, map[string]string) {
|
|
newAutoGroups := make([]string, 0)
|
|
jwtAutoGroups := make(map[string]string) // map of group name to group ID
|
|
|
|
allGroupsMap := make(map[string]*types.Group, len(allGroups))
|
|
for _, group := range allGroups {
|
|
allGroupsMap[group.ID] = group
|
|
}
|
|
|
|
for _, id := range autoGroups {
|
|
if group, ok := allGroupsMap[id]; ok {
|
|
if group.Issued == types.GroupIssuedJWT {
|
|
jwtAutoGroups[group.Name] = id
|
|
} else {
|
|
newAutoGroups = append(newAutoGroups, id)
|
|
}
|
|
}
|
|
}
|
|
|
|
return newAutoGroups, jwtAutoGroups
|
|
}
|
|
|
|
func (am *DefaultAccountManager) GetStore() store.Store {
|
|
return am.Store
|
|
}
|
|
|
|
func (am *DefaultAccountManager) GetOrCreateAccountByPrivateDomain(ctx context.Context, initiatorId, domain string) (*types.Account, bool, error) {
|
|
cancel := am.Store.AcquireGlobalLock(ctx)
|
|
defer cancel()
|
|
|
|
existingPrimaryAccountID, err := am.Store.GetAccountIDByPrivateDomain(ctx, store.LockingStrengthNone, domain)
|
|
if handleNotFound(err) != nil {
|
|
return nil, false, err
|
|
}
|
|
|
|
// a primary account already exists for this private domain
|
|
if err == nil {
|
|
existingAccount, err := am.Store.GetAccount(ctx, existingPrimaryAccountID)
|
|
if err != nil {
|
|
return nil, false, err
|
|
}
|
|
|
|
return existingAccount, false, nil
|
|
}
|
|
|
|
// create a new account for this private domain
|
|
// retry twice for new ID clashes
|
|
for range 2 {
|
|
accountId := xid.New().String()
|
|
|
|
exists, err := am.Store.AccountExists(ctx, store.LockingStrengthNone, accountId)
|
|
if err != nil || exists {
|
|
continue
|
|
}
|
|
|
|
network := types.NewNetwork()
|
|
peers := make(map[string]*nbpeer.Peer)
|
|
users := make(map[string]*types.User)
|
|
routes := make(map[route.ID]*route.Route)
|
|
setupKeys := map[string]*types.SetupKey{}
|
|
nameServersGroups := make(map[string]*nbdns.NameServerGroup)
|
|
|
|
dnsSettings := types.DNSSettings{
|
|
DisabledManagementGroups: make([]string, 0),
|
|
}
|
|
|
|
newAccount := &types.Account{
|
|
Id: accountId,
|
|
CreatedAt: time.Now().UTC(),
|
|
SetupKeys: setupKeys,
|
|
Network: network,
|
|
Peers: peers,
|
|
Users: users,
|
|
// @todo check if using the MSP owner id here is ok
|
|
CreatedBy: initiatorId,
|
|
Domain: strings.ToLower(domain),
|
|
DomainCategory: types.PrivateCategory,
|
|
IsDomainPrimaryAccount: false,
|
|
Routes: routes,
|
|
NameServerGroups: nameServersGroups,
|
|
DNSSettings: dnsSettings,
|
|
Settings: &types.Settings{
|
|
PeerLoginExpirationEnabled: true,
|
|
PeerLoginExpiration: types.DefaultPeerLoginExpiration,
|
|
GroupsPropagationEnabled: true,
|
|
RegularUsersViewBlocked: true,
|
|
|
|
PeerInactivityExpirationEnabled: false,
|
|
PeerInactivityExpiration: types.DefaultPeerInactivityExpiration,
|
|
RoutingPeerDNSResolutionEnabled: true,
|
|
Extra: &types.ExtraSettings{
|
|
UserApprovalRequired: true,
|
|
},
|
|
},
|
|
}
|
|
|
|
if err := newAccount.AddAllGroup(am.disableDefaultPolicy); err != nil {
|
|
return nil, false, status.Errorf(status.Internal, "failed to add all group to new account by private domain")
|
|
}
|
|
|
|
if allGroup, err := newAccount.GetGroupAll(); err == nil {
|
|
newAccount.Settings.IPv6EnabledGroups = []string{allGroup.ID}
|
|
}
|
|
|
|
if err := am.Store.SaveAccount(ctx, newAccount); err != nil {
|
|
log.WithContext(ctx).WithFields(log.Fields{
|
|
"accountId": newAccount.Id,
|
|
"domain": domain,
|
|
}).Errorf("failed to create new account: %v", err)
|
|
return nil, false, err
|
|
}
|
|
|
|
am.StoreEvent(ctx, initiatorId, newAccount.Id, accountId, activity.AccountCreated, nil)
|
|
return newAccount, true, nil
|
|
}
|
|
|
|
return nil, false, status.Errorf(status.Internal, "failed to get or create new account by private domain")
|
|
}
|
|
|
|
func (am *DefaultAccountManager) UpdateToPrimaryAccount(ctx context.Context, accountId string) error {
|
|
err := am.Store.ExecuteInTransaction(ctx, func(transaction store.Store) error {
|
|
var err error
|
|
ok, domain, err := transaction.IsPrimaryAccount(ctx, accountId)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
|
|
if ok {
|
|
return nil
|
|
}
|
|
|
|
existingPrimaryAccountID, err := transaction.GetAccountIDByPrivateDomain(ctx, store.LockingStrengthNone, domain)
|
|
|
|
// error is not a not found error
|
|
if handleNotFound(err) != nil {
|
|
return err
|
|
}
|
|
|
|
// a primary account already exists for this private domain
|
|
if err == nil {
|
|
log.WithContext(ctx).WithFields(log.Fields{
|
|
"accountId": accountId,
|
|
"existingAccountId": existingPrimaryAccountID,
|
|
}).Errorf("cannot update account to primary, another account already exists as primary for the same domain")
|
|
return status.Errorf(status.Internal, "cannot update account to primary")
|
|
}
|
|
|
|
if err := transaction.MarkAccountPrimary(ctx, accountId); err != nil {
|
|
log.WithContext(ctx).WithFields(log.Fields{
|
|
"accountId": accountId,
|
|
}).Errorf("failed to update account to primary: %v", err)
|
|
return status.Errorf(status.Internal, "failed to update account to primary")
|
|
}
|
|
|
|
return nil
|
|
})
|
|
if err != nil {
|
|
return err
|
|
}
|
|
|
|
return nil
|
|
}
|
|
|
|
// propagateUserGroupMemberships propagates all account users' group memberships to their peers.
|
|
// Returns true if any groups were modified, true if those updates affect peers and an error.
|
|
func (am *DefaultAccountManager) propagateUserGroupMemberships(ctx context.Context, transaction store.Store, accountID string) (groupsUpdated bool, peersAffected bool, err error) {
|
|
users, err := transaction.GetAccountUsers(ctx, store.LockingStrengthNone, accountID)
|
|
if err != nil {
|
|
return false, false, err
|
|
}
|
|
|
|
accountGroupPeers, err := transaction.GetAccountGroupPeers(ctx, store.LockingStrengthNone, accountID)
|
|
if err != nil {
|
|
return false, false, fmt.Errorf("error getting account group peers: %w", err)
|
|
}
|
|
|
|
accountGroups, err := transaction.GetAccountGroups(ctx, store.LockingStrengthNone, accountID)
|
|
if err != nil {
|
|
return false, false, fmt.Errorf("error getting account groups: %w", err)
|
|
}
|
|
|
|
for _, group := range accountGroups {
|
|
if _, exists := accountGroupPeers[group.ID]; !exists {
|
|
accountGroupPeers[group.ID] = make(map[string]struct{})
|
|
}
|
|
}
|
|
|
|
updatedGroups, err := propagateAutoGroupsForUsers(ctx, transaction, accountID, users, accountGroupPeers)
|
|
if err != nil {
|
|
return false, false, err
|
|
}
|
|
|
|
ipv6Changed, err := am.reconcileIPv6ForGroupChanges(ctx, transaction, accountID, updatedGroups)
|
|
if err != nil {
|
|
return false, false, fmt.Errorf("reconcile IPv6 for group changes: %w", err)
|
|
}
|
|
|
|
peersAffected, err = areGroupChangesAffectPeers(ctx, transaction, accountID, updatedGroups)
|
|
if err != nil {
|
|
return false, false, fmt.Errorf("error checking if group changes affect peers: %w", err)
|
|
}
|
|
|
|
return len(updatedGroups) > 0, peersAffected || len(ipv6Changed) > 0, nil
|
|
}
|
|
|
|
// propagateAutoGroupsForUsers adds each user's peers to their AutoGroups where not already present.
|
|
// Returns the list of group IDs that were modified.
|
|
func propagateAutoGroupsForUsers(ctx context.Context, transaction store.Store, accountID string, users []*types.User, accountGroupPeers map[string]map[string]struct{}) ([]string, error) {
|
|
var updatedGroups []string
|
|
for _, user := range users {
|
|
userPeers, err := transaction.GetUserPeers(ctx, store.LockingStrengthNone, accountID, user.Id)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
for _, peer := range userPeers {
|
|
for _, groupID := range user.AutoGroups {
|
|
if _, exists := accountGroupPeers[groupID]; !exists {
|
|
log.WithContext(ctx).Warnf("group %s does not exist for user group propagation", groupID)
|
|
continue
|
|
}
|
|
if _, exists := accountGroupPeers[groupID][peer.ID]; exists {
|
|
continue
|
|
}
|
|
if err := transaction.AddPeerToGroup(ctx, accountID, peer.ID, groupID); err != nil {
|
|
return nil, fmt.Errorf("error adding peer %s to group %s: %w", peer.ID, groupID, err)
|
|
}
|
|
updatedGroups = append(updatedGroups, groupID)
|
|
}
|
|
}
|
|
}
|
|
return updatedGroups, nil
|
|
}
|
|
|
|
// reallocateAccountPeerIPs re-allocates all peer IPs when the network range changes
|
|
func (am *DefaultAccountManager) reallocateAccountPeerIPs(ctx context.Context, transaction store.Store, accountID string, newNetworkRange netip.Prefix) error {
|
|
if !newNetworkRange.IsValid() {
|
|
return nil
|
|
}
|
|
|
|
newIPNet := net.IPNet{
|
|
IP: newNetworkRange.Masked().Addr().AsSlice(),
|
|
Mask: net.CIDRMask(newNetworkRange.Bits(), newNetworkRange.Addr().BitLen()),
|
|
}
|
|
|
|
err := transaction.UpdateAccountNetwork(ctx, accountID, newIPNet)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
|
|
peers, err := transaction.GetAccountPeers(ctx, store.LockingStrengthUpdate, accountID, "", "", "")
|
|
if err != nil {
|
|
return err
|
|
}
|
|
|
|
var takenIPs []netip.Addr
|
|
|
|
for _, peer := range peers {
|
|
newIP, err := types.AllocatePeerIP(newNetworkRange, takenIPs)
|
|
if err != nil {
|
|
return status.Errorf(status.Internal, "allocate IP for peer %s: %v", peer.ID, err)
|
|
}
|
|
|
|
log.WithContext(ctx).Infof("reallocating peer %s IP from %s to %s due to network range change",
|
|
peer.ID, peer.IP.String(), newIP.String())
|
|
|
|
peer.IP = newIP
|
|
takenIPs = append(takenIPs, newIP)
|
|
}
|
|
|
|
for _, peer := range peers {
|
|
if err = transaction.SavePeer(ctx, accountID, peer); err != nil {
|
|
return status.Errorf(status.Internal, "save updated peer %s: %v", peer.ID, err)
|
|
}
|
|
}
|
|
|
|
log.WithContext(ctx).Infof("successfully re-allocated IPs for %d peers in account %s to network range %s",
|
|
len(peers), accountID, newNetworkRange.String())
|
|
|
|
return nil
|
|
}
|
|
|
|
// updatePeerIPv6Addresses assigns or removes IPv6 addresses for all peers
|
|
// based on the current IPv6 settings. When IPv6 is enabled, peers without a
|
|
// v6 address get one allocated. When disabled, all v6 addresses are cleared.
|
|
// When the v6 range changes, all v6 addresses are reallocated.
|
|
func (am *DefaultAccountManager) checkIPv6Collision(ctx context.Context, transaction store.Store, accountID, peerID string, newIPv6 netip.Addr) error {
|
|
peers, err := transaction.GetAccountPeers(ctx, store.LockingStrengthShare, accountID, "", "", "")
|
|
if err != nil {
|
|
return fmt.Errorf("get peers: %w", err)
|
|
}
|
|
for _, p := range peers {
|
|
if p.ID != peerID && p.IPv6.IsValid() && p.IPv6 == newIPv6 {
|
|
return status.Errorf(status.InvalidArgument, "IPv6 %s is already assigned to peer %s", newIPv6, p.Name)
|
|
}
|
|
}
|
|
return nil
|
|
}
|
|
|
|
// ipv6Reassignment reports the outcome of an IPv6 address reconciliation.
|
|
type ipv6Reassignment struct {
|
|
// changed are the peers whose IPv6 address was assigned, removed or reallocated.
|
|
changed []string
|
|
// withIPv6 are all peers holding an IPv6 address after the reconciliation.
|
|
withIPv6 []string
|
|
}
|
|
|
|
func (am *DefaultAccountManager) updatePeerIPv6Addresses(ctx context.Context, transaction store.Store, accountID string, settings *types.Settings) (ipv6Reassignment, error) {
|
|
peers, err := transaction.GetAccountPeers(ctx, store.LockingStrengthUpdate, accountID, "", "", "")
|
|
if err != nil {
|
|
return ipv6Reassignment{}, fmt.Errorf("get peers: %w", err)
|
|
}
|
|
|
|
network, err := transaction.GetAccountNetwork(ctx, store.LockingStrengthUpdate, accountID)
|
|
if err != nil {
|
|
return ipv6Reassignment{}, fmt.Errorf("get network: %w", err)
|
|
}
|
|
|
|
if err := am.ensureIPv6Subnet(ctx, transaction, accountID, settings, network); err != nil {
|
|
return ipv6Reassignment{}, err
|
|
}
|
|
|
|
allowedPeers, err := am.buildIPv6AllowedPeers(ctx, transaction, accountID, settings)
|
|
if err != nil {
|
|
return ipv6Reassignment{}, err
|
|
}
|
|
|
|
v6Prefix, err := netip.ParsePrefix(network.NetV6.String())
|
|
if err != nil {
|
|
return ipv6Reassignment{}, fmt.Errorf("parse IPv6 prefix: %w", err)
|
|
}
|
|
|
|
changed, err := am.assignPeerIPv6Addresses(ctx, transaction, accountID, peers, network, allowedPeers, v6Prefix)
|
|
if err != nil {
|
|
return ipv6Reassignment{}, err
|
|
}
|
|
|
|
result := ipv6Reassignment{changed: changed}
|
|
for _, peer := range peers {
|
|
if peer.IPv6.IsValid() {
|
|
result.withIPv6 = append(result.withIPv6, peer.ID)
|
|
}
|
|
}
|
|
|
|
log.WithContext(ctx).Infof("updated IPv6 addresses for %d of %d peers in account %s (groups=%d)",
|
|
len(changed), len(peers), accountID, len(settings.IPv6EnabledGroups))
|
|
|
|
return result, nil
|
|
}
|
|
|
|
// reconcileIPv6ForGroupChanges checks whether the given group IDs overlap with
|
|
// the account's IPv6EnabledGroups. If they do, it runs a full IPv6 address
|
|
// reconciliation so that peers gaining or losing membership in an IPv6-enabled
|
|
// group get their addresses assigned or removed. It returns the peers whose IPv6
|
|
// address changed, which callers pass as changed peers so every peer that can
|
|
// reach them refreshes.
|
|
func (am *DefaultAccountManager) reconcileIPv6ForGroupChanges(ctx context.Context, transaction store.Store, accountID string, groupIDs []string) ([]string, error) {
|
|
settings, err := transaction.GetAccountSettings(ctx, store.LockingStrengthNone, accountID)
|
|
if err != nil {
|
|
return nil, fmt.Errorf("get account settings: %w", err)
|
|
}
|
|
|
|
if !ipv6ReconcileNeeded(settings, groupIDs) {
|
|
return nil, nil
|
|
}
|
|
|
|
result, err := am.updatePeerIPv6Addresses(ctx, transaction, accountID, settings)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
return result.changed, nil
|
|
}
|
|
|
|
// ipv6ReconcileNeeded reports whether changes to the given groups trigger an IPv6
|
|
// reconciliation.
|
|
func ipv6ReconcileNeeded(settings *types.Settings, groupIDs []string) bool {
|
|
for _, groupID := range groupIDs {
|
|
if slices.Contains(settings.IPv6EnabledGroups, groupID) {
|
|
return true
|
|
}
|
|
}
|
|
return false
|
|
}
|
|
|
|
func (am *DefaultAccountManager) ensureIPv6Subnet(ctx context.Context, transaction store.Store, accountID string, settings *types.Settings, network *types.Network) error {
|
|
if settings.NetworkRangeV6.IsValid() {
|
|
network.NetV6 = net.IPNet{
|
|
IP: settings.NetworkRangeV6.Masked().Addr().AsSlice(),
|
|
Mask: net.CIDRMask(settings.NetworkRangeV6.Bits(), 128),
|
|
}
|
|
return transaction.UpdateAccountNetworkV6(ctx, accountID, network.NetV6)
|
|
}
|
|
if network.NetV6.IP == nil {
|
|
network.NetV6 = types.AllocateIPv6Subnet()
|
|
|
|
// Sync settings to match the allocated subnet so SaveAccountSettings persists it.
|
|
ones, _ := network.NetV6.Mask.Size()
|
|
addr, _ := netip.AddrFromSlice(network.NetV6.IP)
|
|
settings.NetworkRangeV6 = netip.PrefixFrom(addr.Unmap(), ones)
|
|
|
|
return transaction.UpdateAccountNetworkV6(ctx, accountID, network.NetV6)
|
|
}
|
|
return nil
|
|
}
|
|
|
|
func (am *DefaultAccountManager) assignPeerIPv6Addresses(
|
|
ctx context.Context, transaction store.Store, accountID string,
|
|
peers []*nbpeer.Peer, network *types.Network,
|
|
allowedPeers map[string]struct{}, v6Prefix netip.Prefix,
|
|
) ([]string, error) {
|
|
takenV6 := make(map[netip.Addr]struct{})
|
|
for _, peer := range peers {
|
|
if _, ok := allowedPeers[peer.ID]; ok && peer.IPv6.IsValid() && network.NetV6.Contains(peer.IPv6.AsSlice()) {
|
|
takenV6[peer.IPv6] = struct{}{}
|
|
}
|
|
}
|
|
|
|
var changed []string
|
|
for _, peer := range peers {
|
|
_, allowed := allowedPeers[peer.ID]
|
|
oldIPv6 := peer.IPv6
|
|
|
|
if !allowed {
|
|
peer.IPv6 = netip.Addr{}
|
|
} else if !peer.IPv6.IsValid() || !network.NetV6.Contains(peer.IPv6.AsSlice()) {
|
|
newIP, err := allocateIPv6WithRetry(v6Prefix, takenV6, peer.ID)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
peer.IPv6 = newIP
|
|
}
|
|
|
|
if peer.IPv6 == oldIPv6 {
|
|
continue
|
|
}
|
|
|
|
if err := transaction.SavePeer(ctx, accountID, peer); err != nil {
|
|
return nil, fmt.Errorf("save peer %s: %w", peer.ID, err)
|
|
}
|
|
changed = append(changed, peer.ID)
|
|
}
|
|
return changed, nil
|
|
}
|
|
|
|
func allocateIPv6WithRetry(prefix netip.Prefix, taken map[netip.Addr]struct{}, peerID string) (netip.Addr, error) {
|
|
for attempts := 0; attempts < 10; attempts++ {
|
|
newIP, err := types.AllocateRandomPeerIPv6(prefix)
|
|
if err != nil {
|
|
return netip.Addr{}, fmt.Errorf("allocate v6 for peer %s: %w", peerID, err)
|
|
}
|
|
if _, ok := taken[newIP]; !ok {
|
|
taken[newIP] = struct{}{}
|
|
return newIP, nil
|
|
}
|
|
}
|
|
return netip.Addr{}, fmt.Errorf("allocate v6 for peer %s: exhausted 10 attempts", peerID)
|
|
}
|
|
|
|
func (am *DefaultAccountManager) buildIPv6AllowedPeers(ctx context.Context, transaction store.Store, accountID string, settings *types.Settings) (map[string]struct{}, error) {
|
|
if len(settings.IPv6EnabledGroups) == 0 {
|
|
return make(map[string]struct{}), nil
|
|
}
|
|
|
|
groups, err := transaction.GetAccountGroups(ctx, store.LockingStrengthNone, accountID)
|
|
if err != nil {
|
|
return nil, fmt.Errorf("get groups: %w", err)
|
|
}
|
|
|
|
enabledSet := make(map[string]struct{}, len(settings.IPv6EnabledGroups))
|
|
for _, gid := range settings.IPv6EnabledGroups {
|
|
enabledSet[gid] = struct{}{}
|
|
}
|
|
|
|
allowedPeers := make(map[string]struct{})
|
|
for _, group := range groups {
|
|
if _, ok := enabledSet[group.ID]; !ok {
|
|
continue
|
|
}
|
|
for _, peerID := range group.Peers {
|
|
allowedPeers[peerID] = struct{}{}
|
|
}
|
|
}
|
|
|
|
// Embedded proxy peers sit outside regular group membership but must
|
|
// participate in any v6-enabled overlay to reach v6-only peers.
|
|
peers, err := transaction.GetAccountPeers(ctx, store.LockingStrengthNone, accountID, "", "", "")
|
|
if err != nil {
|
|
return nil, fmt.Errorf("get peers: %w", err)
|
|
}
|
|
for _, p := range peers {
|
|
if p.ProxyMeta.Embedded {
|
|
allowedPeers[p.ID] = struct{}{}
|
|
}
|
|
}
|
|
return allowedPeers, nil
|
|
}
|
|
|
|
func (am *DefaultAccountManager) validateIPForUpdate(account *types.Account, peers []*nbpeer.Peer, peerID string, newIP netip.Addr) error {
|
|
if !account.Network.Net.Contains(newIP.AsSlice()) {
|
|
return status.Errorf(status.InvalidArgument, "IP %s is not within the account network range %s", newIP.String(), account.Network.Net.String())
|
|
}
|
|
|
|
for _, peer := range peers {
|
|
if peer.ID != peerID && peer.IP == newIP {
|
|
return status.Errorf(status.InvalidArgument, "IP %s is already assigned to peer %s", newIP.String(), peer.ID)
|
|
}
|
|
}
|
|
return nil
|
|
}
|
|
|
|
func (am *DefaultAccountManager) UpdatePeerIP(ctx context.Context, accountID, userID, peerID string, newIP netip.Addr) error {
|
|
allowed, ctx, err := am.permissionsManager.ValidateUserPermissions(ctx, accountID, userID, modules.Peers, operations.Update)
|
|
if err != nil {
|
|
return fmt.Errorf("validate user permissions: %w", err)
|
|
}
|
|
if !allowed {
|
|
return status.NewPermissionDeniedError()
|
|
}
|
|
|
|
updateNetworkMap, err := am.updatePeerIPInTransaction(ctx, accountID, userID, peerID, newIP)
|
|
if err != nil {
|
|
return fmt.Errorf("update peer IP transaction: %w", err)
|
|
}
|
|
|
|
if updateNetworkMap {
|
|
peer, err := am.Store.GetPeerByID(ctx, store.LockingStrengthNone, accountID, peerID)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
changedPeerIDs := []string{peerID}
|
|
affectedPeerIDs := am.resolveAffectedPeersForPeerChanges(ctx, am.Store, accountID, changedPeerIDs)
|
|
err = am.networkMapController.OnPeersUpdated(ctx, peer.AccountID, changedPeerIDs, affectedPeerIDs)
|
|
if err != nil {
|
|
return fmt.Errorf("notify network map controller of peer update: %w", err)
|
|
}
|
|
}
|
|
return nil
|
|
}
|
|
|
|
func (am *DefaultAccountManager) updatePeerIPInTransaction(ctx context.Context, accountID, userID, peerID string, newIP netip.Addr) (bool, error) {
|
|
var updateNetworkMap bool
|
|
err := am.Store.ExecuteInTransaction(ctx, func(transaction store.Store) error {
|
|
account, err := transaction.GetAccount(ctx, accountID)
|
|
if err != nil {
|
|
return fmt.Errorf("get account: %w", err)
|
|
}
|
|
|
|
existingPeer, err := transaction.GetPeerByID(ctx, store.LockingStrengthNone, accountID, peerID)
|
|
if err != nil {
|
|
return fmt.Errorf("get peer: %w", err)
|
|
}
|
|
|
|
if existingPeer.IP == newIP {
|
|
return nil
|
|
}
|
|
|
|
peers, err := transaction.GetAccountPeers(ctx, store.LockingStrengthShare, accountID, "", "", "")
|
|
if err != nil {
|
|
return fmt.Errorf("get account peers: %w", err)
|
|
}
|
|
|
|
if err := am.validateIPForUpdate(account, peers, peerID, newIP); err != nil {
|
|
return err
|
|
}
|
|
|
|
if err := am.savePeerIPUpdate(ctx, transaction, accountID, userID, existingPeer, newIP); err != nil {
|
|
return err
|
|
}
|
|
|
|
updateNetworkMap = true
|
|
return nil
|
|
})
|
|
return updateNetworkMap, err
|
|
}
|
|
|
|
func (am *DefaultAccountManager) savePeerIPUpdate(ctx context.Context, transaction store.Store, accountID, userID string, peer *nbpeer.Peer, newIP netip.Addr) error {
|
|
log.WithContext(ctx).Infof("updating peer %s IP from %s to %s", peer.ID, peer.IP, newIP)
|
|
|
|
settings, err := transaction.GetAccountSettings(ctx, store.LockingStrengthNone, accountID)
|
|
if err != nil {
|
|
return fmt.Errorf("get account settings: %w", err)
|
|
}
|
|
dnsDomain := am.networkMapController.GetDNSDomain(settings)
|
|
|
|
eventMeta := peer.EventMeta(dnsDomain)
|
|
oldIP := peer.IP.String()
|
|
|
|
peer.IP = newIP
|
|
err = transaction.SavePeer(ctx, accountID, peer)
|
|
if err != nil {
|
|
return fmt.Errorf("save peer: %w", err)
|
|
}
|
|
|
|
eventMeta["old_ip"] = oldIP
|
|
eventMeta["ip"] = newIP.String()
|
|
am.StoreEvent(ctx, userID, peer.ID, accountID, activity.PeerIPUpdated, eventMeta)
|
|
|
|
return nil
|
|
}
|
|
|
|
// UpdatePeerIPv6 updates the IPv6 overlay address of a peer, validating it's
|
|
// within the account's v6 network range and not already taken.
|
|
func (am *DefaultAccountManager) UpdatePeerIPv6(ctx context.Context, accountID, userID, peerID string, newIPv6 netip.Addr) error {
|
|
allowed, ctx, err := am.permissionsManager.ValidateUserPermissions(ctx, accountID, userID, modules.Peers, operations.Update)
|
|
if err != nil {
|
|
return fmt.Errorf("validate user permissions: %w", err)
|
|
}
|
|
if !allowed {
|
|
return status.NewPermissionDeniedError()
|
|
}
|
|
|
|
var updateNetworkMap bool
|
|
err = am.Store.ExecuteInTransaction(ctx, func(transaction store.Store) error {
|
|
var txErr error
|
|
updateNetworkMap, txErr = am.updatePeerIPv6InTransaction(ctx, transaction, accountID, peerID, newIPv6)
|
|
return txErr
|
|
})
|
|
if err != nil {
|
|
return err
|
|
}
|
|
|
|
if updateNetworkMap {
|
|
changedPeerIDs := []string{peerID}
|
|
affectedPeerIDs := am.resolveAffectedPeersForPeerChanges(ctx, am.Store, accountID, changedPeerIDs)
|
|
if err := am.networkMapController.OnPeersUpdated(ctx, accountID, changedPeerIDs, affectedPeerIDs); err != nil {
|
|
return fmt.Errorf("notify network map controller: %w", err)
|
|
}
|
|
}
|
|
return nil
|
|
}
|
|
|
|
// updatePeerIPv6InTransaction validates and applies an IPv6 address change within a store transaction.
|
|
func (am *DefaultAccountManager) updatePeerIPv6InTransaction(ctx context.Context, transaction store.Store, accountID, peerID string, newIPv6 netip.Addr) (bool, error) {
|
|
network, err := transaction.GetAccountNetwork(ctx, store.LockingStrengthShare, accountID)
|
|
if err != nil {
|
|
return false, fmt.Errorf("get network: %w", err)
|
|
}
|
|
|
|
if network.NetV6.IP == nil {
|
|
return false, status.Errorf(status.PreconditionFailed, "IPv6 is not configured for this account")
|
|
}
|
|
|
|
if !network.NetV6.Contains(newIPv6.AsSlice()) {
|
|
return false, status.Errorf(status.InvalidArgument, "IP %s is not within the account IPv6 range %s", newIPv6, network.NetV6.String())
|
|
}
|
|
|
|
settings, err := transaction.GetAccountSettings(ctx, store.LockingStrengthShare, accountID)
|
|
if err != nil {
|
|
return false, fmt.Errorf("get settings: %w", err)
|
|
}
|
|
|
|
allowedPeers, err := am.buildIPv6AllowedPeers(ctx, transaction, accountID, settings)
|
|
if err != nil {
|
|
return false, err
|
|
}
|
|
if _, ok := allowedPeers[peerID]; !ok {
|
|
return false, status.Errorf(status.PreconditionFailed, "peer is not in any IPv6-enabled group")
|
|
}
|
|
|
|
peer, err := transaction.GetPeerByID(ctx, store.LockingStrengthUpdate, accountID, peerID)
|
|
if err != nil {
|
|
return false, fmt.Errorf("get peer: %w", err)
|
|
}
|
|
|
|
if peer.IPv6.IsValid() && peer.IPv6 == newIPv6 {
|
|
return false, nil
|
|
}
|
|
|
|
if err := am.checkIPv6Collision(ctx, transaction, accountID, peerID, newIPv6); err != nil {
|
|
return false, err
|
|
}
|
|
|
|
peer.IPv6 = newIPv6
|
|
if err := transaction.SavePeer(ctx, accountID, peer); err != nil {
|
|
return false, fmt.Errorf("save peer: %w", err)
|
|
}
|
|
|
|
return true, nil
|
|
}
|
|
|
|
func (am *DefaultAccountManager) GetUserIDByPeerKey(ctx context.Context, peerKey string) (string, error) {
|
|
return am.Store.GetUserIDByPeerKey(ctx, store.LockingStrengthNone, peerKey)
|
|
}
|