2021-12-27 13:17:15 +01:00
|
|
|
package server
|
|
|
|
|
|
|
|
import (
|
2022-05-25 18:26:50 +02:00
|
|
|
"fmt"
|
2023-03-01 20:12:04 +01:00
|
|
|
"strings"
|
2023-08-18 19:23:11 +02:00
|
|
|
"time"
|
2023-03-01 20:12:04 +01:00
|
|
|
|
2023-04-22 12:57:51 +02:00
|
|
|
"github.com/google/uuid"
|
2023-03-01 20:12:04 +01:00
|
|
|
log "github.com/sirupsen/logrus"
|
|
|
|
|
2023-01-02 15:11:32 +01:00
|
|
|
"github.com/netbirdio/netbird/management/server/activity"
|
2022-09-22 09:06:32 +02:00
|
|
|
"github.com/netbirdio/netbird/management/server/idp"
|
2023-05-02 16:49:29 +02:00
|
|
|
"github.com/netbirdio/netbird/management/server/jwtclaims"
|
2023-11-28 13:45:26 +01:00
|
|
|
nbpeer "github.com/netbirdio/netbird/management/server/peer"
|
2022-11-11 20:36:45 +01:00
|
|
|
"github.com/netbirdio/netbird/management/server/status"
|
2021-12-27 13:17:15 +01:00
|
|
|
)
|
|
|
|
|
|
|
|
const (
|
2023-12-01 17:24:57 +01:00
|
|
|
UserRoleOwner UserRole = "owner"
|
2022-09-23 14:18:42 +02:00
|
|
|
UserRoleAdmin UserRole = "admin"
|
|
|
|
UserRoleUser UserRole = "user"
|
|
|
|
UserRoleUnknown UserRole = "unknown"
|
2022-10-13 18:26:31 +02:00
|
|
|
|
|
|
|
UserStatusActive UserStatus = "active"
|
|
|
|
UserStatusDisabled UserStatus = "disabled"
|
|
|
|
UserStatusInvited UserStatus = "invited"
|
2023-11-01 11:04:17 +01:00
|
|
|
|
|
|
|
UserIssuedAPI = "api"
|
|
|
|
UserIssuedIntegration = "integration"
|
2021-12-27 13:17:15 +01:00
|
|
|
)
|
|
|
|
|
2022-09-23 14:18:42 +02:00
|
|
|
// StrRoleToUserRole returns UserRole for a given strRole or UserRoleUnknown if the specified role is unknown
|
|
|
|
func StrRoleToUserRole(strRole string) UserRole {
|
|
|
|
switch strings.ToLower(strRole) {
|
2023-12-01 17:24:57 +01:00
|
|
|
case "owner":
|
|
|
|
return UserRoleOwner
|
2022-09-23 14:18:42 +02:00
|
|
|
case "admin":
|
|
|
|
return UserRoleAdmin
|
|
|
|
case "user":
|
|
|
|
return UserRoleUser
|
|
|
|
default:
|
|
|
|
return UserRoleUnknown
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2022-10-13 18:26:31 +02:00
|
|
|
// UserStatus is the status of a User
|
|
|
|
type UserStatus string
|
|
|
|
|
|
|
|
// UserRole is the role of a User
|
2021-12-27 13:17:15 +01:00
|
|
|
type UserRole string
|
|
|
|
|
2023-11-01 11:04:17 +01:00
|
|
|
// IntegrationReference holds the reference to a particular integration
|
|
|
|
type IntegrationReference struct {
|
|
|
|
ID int
|
|
|
|
IntegrationType string
|
|
|
|
}
|
|
|
|
|
|
|
|
func (ir IntegrationReference) String() string {
|
2023-11-13 14:04:18 +01:00
|
|
|
return fmt.Sprintf("%s:%d", ir.IntegrationType, ir.ID)
|
|
|
|
}
|
|
|
|
|
|
|
|
func (ir IntegrationReference) CacheKey(path ...string) string {
|
|
|
|
if len(path) == 0 {
|
|
|
|
return ir.String()
|
|
|
|
}
|
|
|
|
return fmt.Sprintf("%s:%s", ir.String(), strings.Join(path, ":"))
|
2023-11-01 11:04:17 +01:00
|
|
|
}
|
|
|
|
|
2021-12-27 13:17:15 +01:00
|
|
|
// User represents a user of the system
|
|
|
|
type User struct {
|
2023-10-12 15:42:36 +02:00
|
|
|
Id string `gorm:"primaryKey"`
|
|
|
|
// AccountID is a reference to Account that this object belongs
|
|
|
|
AccountID string `json:"-" gorm:"index"`
|
2023-04-22 12:57:51 +02:00
|
|
|
Role UserRole
|
|
|
|
IsServiceUser bool
|
2023-11-15 16:22:00 +01:00
|
|
|
// NonDeletable indicates whether the service user can be deleted
|
|
|
|
NonDeletable bool
|
2023-04-22 12:57:51 +02:00
|
|
|
// ServiceUserName is only set if IsServiceUser is true
|
|
|
|
ServiceUserName string
|
2022-09-22 09:06:32 +02:00
|
|
|
// AutoGroups is a list of Group IDs to auto-assign to peers registered by this user
|
2023-10-12 15:42:36 +02:00
|
|
|
AutoGroups []string `gorm:"serializer:json"`
|
|
|
|
PATs map[string]*PersonalAccessToken `gorm:"-"`
|
|
|
|
PATsG []PersonalAccessToken `json:"-" gorm:"foreignKey:UserID;references:id"`
|
2023-05-11 18:09:36 +02:00
|
|
|
// Blocked indicates whether the user is blocked. Blocked users can't use the system.
|
|
|
|
Blocked bool
|
2023-08-18 19:23:11 +02:00
|
|
|
// LastLogin is the last time the user logged in to IdP
|
|
|
|
LastLogin time.Time
|
2023-11-01 11:04:17 +01:00
|
|
|
|
|
|
|
// Issued of the user
|
|
|
|
Issued string `gorm:"default:api"`
|
|
|
|
|
|
|
|
IntegrationReference IntegrationReference `gorm:"embedded;embeddedPrefix:integration_ref_"`
|
2021-12-27 13:17:15 +01:00
|
|
|
}
|
|
|
|
|
2023-05-11 18:09:36 +02:00
|
|
|
// IsBlocked returns true if the user is blocked, false otherwise
|
|
|
|
func (u *User) IsBlocked() bool {
|
|
|
|
return u.Blocked
|
|
|
|
}
|
|
|
|
|
2023-08-18 19:23:11 +02:00
|
|
|
func (u *User) LastDashboardLoginChanged(LastLogin time.Time) bool {
|
|
|
|
return LastLogin.After(u.LastLogin) && !u.LastLogin.IsZero()
|
|
|
|
}
|
|
|
|
|
2024-01-06 12:57:05 +01:00
|
|
|
func (u *User) updateLastLogin(login time.Time) {
|
|
|
|
u.LastLogin = login
|
|
|
|
}
|
|
|
|
|
2023-12-01 17:24:57 +01:00
|
|
|
// HasAdminPower returns true if the user has admin or owner roles, false otherwise
|
|
|
|
func (u *User) HasAdminPower() bool {
|
|
|
|
return u.Role == UserRoleAdmin || u.Role == UserRoleOwner
|
2022-11-05 10:24:50 +01:00
|
|
|
}
|
|
|
|
|
2023-05-11 18:09:36 +02:00
|
|
|
// ToUserInfo converts a User object to a UserInfo object.
|
|
|
|
func (u *User) ToUserInfo(userData *idp.UserData) (*UserInfo, error) {
|
2022-09-22 09:06:32 +02:00
|
|
|
autoGroups := u.AutoGroups
|
|
|
|
if autoGroups == nil {
|
|
|
|
autoGroups = []string{}
|
|
|
|
}
|
|
|
|
|
|
|
|
if userData == nil {
|
|
|
|
return &UserInfo{
|
2023-04-22 12:57:51 +02:00
|
|
|
ID: u.Id,
|
|
|
|
Email: "",
|
|
|
|
Name: u.ServiceUserName,
|
|
|
|
Role: string(u.Role),
|
|
|
|
AutoGroups: u.AutoGroups,
|
|
|
|
Status: string(UserStatusActive),
|
|
|
|
IsServiceUser: u.IsServiceUser,
|
2023-05-11 18:09:36 +02:00
|
|
|
IsBlocked: u.Blocked,
|
2023-08-18 19:23:11 +02:00
|
|
|
LastLogin: u.LastLogin,
|
2023-11-01 11:04:17 +01:00
|
|
|
Issued: u.Issued,
|
2022-09-22 09:06:32 +02:00
|
|
|
}, nil
|
|
|
|
}
|
|
|
|
if userData.ID != u.Id {
|
|
|
|
return nil, fmt.Errorf("wrong UserData provided for user %s", u.Id)
|
|
|
|
}
|
|
|
|
|
2022-10-13 18:26:31 +02:00
|
|
|
userStatus := UserStatusActive
|
2022-10-19 17:51:41 +02:00
|
|
|
if userData.AppMetadata.WTPendingInvite != nil && *userData.AppMetadata.WTPendingInvite {
|
2022-10-13 18:26:31 +02:00
|
|
|
userStatus = UserStatusInvited
|
|
|
|
}
|
|
|
|
|
2022-09-22 09:06:32 +02:00
|
|
|
return &UserInfo{
|
2023-04-22 12:57:51 +02:00
|
|
|
ID: u.Id,
|
|
|
|
Email: userData.Email,
|
|
|
|
Name: userData.Name,
|
|
|
|
Role: string(u.Role),
|
|
|
|
AutoGroups: autoGroups,
|
|
|
|
Status: string(userStatus),
|
|
|
|
IsServiceUser: u.IsServiceUser,
|
2023-05-11 18:09:36 +02:00
|
|
|
IsBlocked: u.Blocked,
|
2023-08-18 19:23:11 +02:00
|
|
|
LastLogin: u.LastLogin,
|
2023-11-01 11:04:17 +01:00
|
|
|
Issued: u.Issued,
|
2022-09-22 09:06:32 +02:00
|
|
|
}, nil
|
|
|
|
}
|
|
|
|
|
|
|
|
// Copy the user
|
2021-12-27 13:17:15 +01:00
|
|
|
func (u *User) Copy() *User {
|
2023-03-16 11:32:55 +01:00
|
|
|
autoGroups := make([]string, len(u.AutoGroups))
|
|
|
|
copy(autoGroups, u.AutoGroups)
|
2023-03-20 16:14:55 +01:00
|
|
|
pats := make(map[string]*PersonalAccessToken, len(u.PATs))
|
|
|
|
for k, v := range u.PATs {
|
2023-08-22 17:56:39 +02:00
|
|
|
pats[k] = v.Copy()
|
2023-03-20 16:14:55 +01:00
|
|
|
}
|
2021-12-27 13:17:15 +01:00
|
|
|
return &User{
|
2023-11-01 11:04:17 +01:00
|
|
|
Id: u.Id,
|
|
|
|
AccountID: u.AccountID,
|
|
|
|
Role: u.Role,
|
|
|
|
AutoGroups: autoGroups,
|
|
|
|
IsServiceUser: u.IsServiceUser,
|
2023-11-15 16:22:00 +01:00
|
|
|
NonDeletable: u.NonDeletable,
|
2023-11-01 11:04:17 +01:00
|
|
|
ServiceUserName: u.ServiceUserName,
|
|
|
|
PATs: pats,
|
|
|
|
Blocked: u.Blocked,
|
|
|
|
LastLogin: u.LastLogin,
|
|
|
|
Issued: u.Issued,
|
|
|
|
IntegrationReference: u.IntegrationReference,
|
2021-12-27 13:17:15 +01:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
// NewUser creates a new user
|
2023-11-15 16:22:00 +01:00
|
|
|
func NewUser(id string, role UserRole, isServiceUser bool, nonDeletable bool, serviceUserName string, autoGroups []string, issued string) *User {
|
2021-12-27 13:17:15 +01:00
|
|
|
return &User{
|
2023-04-22 12:57:51 +02:00
|
|
|
Id: id,
|
|
|
|
Role: role,
|
|
|
|
IsServiceUser: isServiceUser,
|
2023-11-15 16:22:00 +01:00
|
|
|
NonDeletable: nonDeletable,
|
2023-04-22 12:57:51 +02:00
|
|
|
ServiceUserName: serviceUserName,
|
|
|
|
AutoGroups: autoGroups,
|
2023-11-01 11:04:17 +01:00
|
|
|
Issued: issued,
|
2021-12-27 13:17:15 +01:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2023-04-22 12:57:51 +02:00
|
|
|
// NewRegularUser creates a new user with role UserRoleUser
|
2022-03-01 15:22:18 +01:00
|
|
|
func NewRegularUser(id string) *User {
|
2023-11-15 16:22:00 +01:00
|
|
|
return NewUser(id, UserRoleUser, false, false, "", []string{}, UserIssuedAPI)
|
2022-03-01 15:22:18 +01:00
|
|
|
}
|
|
|
|
|
2021-12-27 13:17:15 +01:00
|
|
|
// NewAdminUser creates a new user with role UserRoleAdmin
|
|
|
|
func NewAdminUser(id string) *User {
|
2023-11-15 16:22:00 +01:00
|
|
|
return NewUser(id, UserRoleAdmin, false, false, "", []string{}, UserIssuedAPI)
|
2023-04-22 12:57:51 +02:00
|
|
|
}
|
|
|
|
|
2023-12-01 17:24:57 +01:00
|
|
|
// NewOwnerUser creates a new user with role UserRoleOwner
|
|
|
|
func NewOwnerUser(id string) *User {
|
|
|
|
return NewUser(id, UserRoleOwner, false, false, "", []string{}, UserIssuedAPI)
|
|
|
|
}
|
|
|
|
|
2023-04-22 12:57:51 +02:00
|
|
|
// createServiceUser creates a new service user under the given account.
|
2023-11-15 16:22:00 +01:00
|
|
|
func (am *DefaultAccountManager) createServiceUser(accountID string, initiatorUserID string, role UserRole, serviceUserName string, nonDeletable bool, autoGroups []string) (*UserInfo, error) {
|
2023-04-22 12:57:51 +02:00
|
|
|
unlock := am.Store.AcquireAccountLock(accountID)
|
|
|
|
defer unlock()
|
|
|
|
|
|
|
|
account, err := am.Store.GetAccount(accountID)
|
|
|
|
if err != nil {
|
|
|
|
return nil, status.Errorf(status.NotFound, "account %s doesn't exist", accountID)
|
|
|
|
}
|
|
|
|
|
2023-05-11 18:09:36 +02:00
|
|
|
executingUser := account.Users[initiatorUserID]
|
2023-04-22 12:57:51 +02:00
|
|
|
if executingUser == nil {
|
|
|
|
return nil, status.Errorf(status.NotFound, "user not found")
|
|
|
|
}
|
2023-12-01 17:24:57 +01:00
|
|
|
if !executingUser.HasAdminPower() {
|
|
|
|
return nil, status.Errorf(status.PermissionDenied, "only users with admin power can create service users")
|
|
|
|
}
|
|
|
|
|
|
|
|
if role == UserRoleOwner {
|
|
|
|
return nil, status.Errorf(status.InvalidArgument, "can't create a service user with owner role")
|
2023-04-22 12:57:51 +02:00
|
|
|
}
|
|
|
|
|
|
|
|
newUserID := uuid.New().String()
|
2023-11-15 16:22:00 +01:00
|
|
|
newUser := NewUser(newUserID, role, true, nonDeletable, serviceUserName, autoGroups, UserIssuedAPI)
|
2023-04-22 12:57:51 +02:00
|
|
|
log.Debugf("New User: %v", newUser)
|
|
|
|
account.Users[newUserID] = newUser
|
|
|
|
|
|
|
|
err = am.Store.SaveAccount(account)
|
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
|
|
|
|
meta := map[string]any{"name": newUser.ServiceUserName}
|
2023-11-08 11:35:37 +01:00
|
|
|
am.StoreEvent(initiatorUserID, newUser.Id, accountID, activity.ServiceUserCreated, meta)
|
2023-04-22 12:57:51 +02:00
|
|
|
|
|
|
|
return &UserInfo{
|
|
|
|
ID: newUser.Id,
|
|
|
|
Email: "",
|
|
|
|
Name: newUser.ServiceUserName,
|
|
|
|
Role: string(newUser.Role),
|
|
|
|
AutoGroups: newUser.AutoGroups,
|
|
|
|
Status: string(UserStatusActive),
|
|
|
|
IsServiceUser: true,
|
2023-08-18 19:23:11 +02:00
|
|
|
LastLogin: time.Time{},
|
2023-11-01 11:04:17 +01:00
|
|
|
Issued: UserIssuedAPI,
|
2023-04-22 12:57:51 +02:00
|
|
|
}, nil
|
2021-12-27 13:17:15 +01:00
|
|
|
}
|
|
|
|
|
2022-10-13 18:26:31 +02:00
|
|
|
// CreateUser creates a new user under the given account. Effectively this is a user invite.
|
2023-04-22 12:57:51 +02:00
|
|
|
func (am *DefaultAccountManager) CreateUser(accountID, userID string, user *UserInfo) (*UserInfo, error) {
|
|
|
|
if user.IsServiceUser {
|
2023-11-15 16:22:00 +01:00
|
|
|
return am.createServiceUser(accountID, userID, StrRoleToUserRole(user.Role), user.Name, user.NonDeletable, user.AutoGroups)
|
2023-04-22 12:57:51 +02:00
|
|
|
}
|
|
|
|
return am.inviteNewUser(accountID, userID, user)
|
|
|
|
}
|
|
|
|
|
|
|
|
// inviteNewUser Invites a USer to a given account and creates reference in datastore
|
|
|
|
func (am *DefaultAccountManager) inviteNewUser(accountID, userID string, invite *UserInfo) (*UserInfo, error) {
|
2022-11-07 17:52:23 +01:00
|
|
|
unlock := am.Store.AcquireAccountLock(accountID)
|
|
|
|
defer unlock()
|
2022-10-13 18:26:31 +02:00
|
|
|
|
|
|
|
if am.idpManager == nil {
|
2022-11-11 20:36:45 +01:00
|
|
|
return nil, status.Errorf(status.PreconditionFailed, "IdP manager must be enabled to send user invites")
|
2022-10-13 18:26:31 +02:00
|
|
|
}
|
|
|
|
|
|
|
|
if invite == nil {
|
|
|
|
return nil, fmt.Errorf("provided user update is nil")
|
|
|
|
}
|
|
|
|
|
2023-12-01 17:24:57 +01:00
|
|
|
invitedRole := StrRoleToUserRole(invite.Role)
|
|
|
|
|
2023-11-28 13:09:33 +01:00
|
|
|
switch {
|
|
|
|
case invite.Name == "":
|
|
|
|
return nil, status.Errorf(status.InvalidArgument, "name can't be empty")
|
|
|
|
case invite.Email == "":
|
|
|
|
return nil, status.Errorf(status.InvalidArgument, "email can't be empty")
|
2023-12-01 17:24:57 +01:00
|
|
|
case invitedRole == UserRoleOwner:
|
|
|
|
return nil, status.Errorf(status.InvalidArgument, "can't invite a user with owner role")
|
2023-11-28 13:09:33 +01:00
|
|
|
default:
|
|
|
|
}
|
|
|
|
|
2022-10-13 18:26:31 +02:00
|
|
|
account, err := am.Store.GetAccount(accountID)
|
|
|
|
if err != nil {
|
2022-11-11 20:36:45 +01:00
|
|
|
return nil, status.Errorf(status.NotFound, "account %s doesn't exist", accountID)
|
2022-10-13 18:26:31 +02:00
|
|
|
}
|
|
|
|
|
2023-10-17 15:54:50 +02:00
|
|
|
initiatorUser, err := account.FindUser(userID)
|
2023-08-16 23:05:22 +02:00
|
|
|
if err != nil {
|
2023-10-17 15:54:50 +02:00
|
|
|
return nil, status.Errorf(status.NotFound, "initiator user with ID %s doesn't exist", userID)
|
|
|
|
}
|
|
|
|
|
|
|
|
inviterID := userID
|
|
|
|
if initiatorUser.IsServiceUser {
|
|
|
|
inviterID = account.CreatedBy
|
|
|
|
}
|
|
|
|
|
|
|
|
// inviterUser is the one who is inviting the new user
|
|
|
|
inviterUser, err := am.lookupUserInCache(inviterID, account)
|
|
|
|
if err != nil || inviterUser == nil {
|
|
|
|
return nil, status.Errorf(status.NotFound, "inviter user with ID %s doesn't exist in IdP", inviterID)
|
2023-08-16 23:05:22 +02:00
|
|
|
}
|
|
|
|
|
2022-10-13 18:26:31 +02:00
|
|
|
// check if the user is already registered with this email => reject
|
|
|
|
user, err := am.lookupUserInCacheByEmail(invite.Email, accountID)
|
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
|
|
|
|
if user != nil {
|
2023-05-11 18:09:36 +02:00
|
|
|
return nil, status.Errorf(status.UserAlreadyExists, "can't invite a user with an existing NetBird account")
|
2022-10-13 18:26:31 +02:00
|
|
|
}
|
|
|
|
|
|
|
|
users, err := am.idpManager.GetUserByEmail(invite.Email)
|
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
|
|
|
|
if len(users) > 0 {
|
2023-05-11 18:09:36 +02:00
|
|
|
return nil, status.Errorf(status.UserAlreadyExists, "can't invite a user with an existing NetBird account")
|
2022-10-13 18:26:31 +02:00
|
|
|
}
|
|
|
|
|
2023-10-17 15:54:50 +02:00
|
|
|
idpUser, err := am.idpManager.CreateUser(invite.Email, invite.Name, accountID, inviterUser.Email)
|
2022-10-13 18:26:31 +02:00
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
|
|
|
|
newUser := &User{
|
2023-11-01 11:04:17 +01:00
|
|
|
Id: idpUser.ID,
|
2023-12-01 17:24:57 +01:00
|
|
|
Role: invitedRole,
|
2023-11-01 11:04:17 +01:00
|
|
|
AutoGroups: invite.AutoGroups,
|
|
|
|
Issued: invite.Issued,
|
|
|
|
IntegrationReference: invite.IntegrationReference,
|
2022-10-13 18:26:31 +02:00
|
|
|
}
|
|
|
|
account.Users[idpUser.ID] = newUser
|
|
|
|
|
|
|
|
err = am.Store.SaveAccount(account)
|
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
|
|
|
|
_, err = am.refreshCache(account.Id)
|
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
|
2023-11-08 11:35:37 +01:00
|
|
|
am.StoreEvent(userID, newUser.Id, accountID, activity.UserInvited, nil)
|
2023-01-02 15:11:32 +01:00
|
|
|
|
2023-05-11 18:09:36 +02:00
|
|
|
return newUser.ToUserInfo(idpUser)
|
|
|
|
}
|
|
|
|
|
|
|
|
// GetUser looks up a user by provided authorization claims.
|
|
|
|
// It will also create an account if didn't exist for this user before.
|
|
|
|
func (am *DefaultAccountManager) GetUser(claims jwtclaims.AuthorizationClaims) (*User, error) {
|
|
|
|
account, _, err := am.GetAccountFromToken(claims)
|
|
|
|
if err != nil {
|
|
|
|
return nil, fmt.Errorf("failed to get account with token claims %v", err)
|
|
|
|
}
|
2022-10-13 18:26:31 +02:00
|
|
|
|
2023-10-23 16:08:21 +02:00
|
|
|
unlock := am.Store.AcquireAccountLock(account.Id)
|
|
|
|
defer unlock()
|
|
|
|
|
|
|
|
account, err = am.Store.GetAccount(account.Id)
|
|
|
|
if err != nil {
|
|
|
|
return nil, fmt.Errorf("failed to get an account from store %v", err)
|
|
|
|
}
|
|
|
|
|
2023-05-11 18:09:36 +02:00
|
|
|
user, ok := account.Users[claims.UserId]
|
|
|
|
if !ok {
|
|
|
|
return nil, status.Errorf(status.NotFound, "user not found")
|
|
|
|
}
|
2023-08-18 19:23:11 +02:00
|
|
|
|
|
|
|
// this code should be outside of the am.GetAccountFromToken(claims) because this method is called also by the gRPC
|
|
|
|
// server when user authenticates a device. And we need to separate the Dashboard login event from the Device login event.
|
|
|
|
newLogin := user.LastDashboardLoginChanged(claims.LastLogin)
|
2023-10-23 16:08:21 +02:00
|
|
|
|
2023-08-18 19:23:11 +02:00
|
|
|
err = am.Store.SaveUserLastLogin(account.Id, claims.UserId, claims.LastLogin)
|
2023-10-23 16:08:21 +02:00
|
|
|
if err != nil {
|
|
|
|
log.Errorf("failed saving user last login: %v", err)
|
|
|
|
}
|
|
|
|
|
2023-08-18 19:23:11 +02:00
|
|
|
if newLogin {
|
|
|
|
meta := map[string]any{"timestamp": claims.LastLogin}
|
2023-11-08 11:35:37 +01:00
|
|
|
am.StoreEvent(claims.UserId, claims.UserId, account.Id, activity.DashboardLogin, meta)
|
2023-08-18 19:23:11 +02:00
|
|
|
}
|
|
|
|
|
2023-05-11 18:09:36 +02:00
|
|
|
return user, nil
|
2022-10-13 18:26:31 +02:00
|
|
|
}
|
|
|
|
|
2023-11-13 14:04:18 +01:00
|
|
|
// ListUsers returns lists of all users under the account.
|
2023-11-14 12:25:21 +01:00
|
|
|
// It doesn't populate user information such as email or name.
|
2023-11-13 14:04:18 +01:00
|
|
|
func (am *DefaultAccountManager) ListUsers(accountID string) ([]*User, error) {
|
|
|
|
unlock := am.Store.AcquireAccountLock(accountID)
|
|
|
|
defer unlock()
|
|
|
|
|
|
|
|
account, err := am.Store.GetAccount(accountID)
|
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
|
|
|
|
users := make([]*User, 0, len(account.Users))
|
|
|
|
for _, item := range account.Users {
|
|
|
|
users = append(users, item)
|
|
|
|
}
|
|
|
|
|
|
|
|
return users, nil
|
|
|
|
}
|
|
|
|
|
2023-10-03 16:46:58 +02:00
|
|
|
func (am *DefaultAccountManager) deleteServiceUser(account *Account, initiatorUserID string, targetUser *User) {
|
|
|
|
meta := map[string]any{"name": targetUser.ServiceUserName}
|
2023-11-08 11:35:37 +01:00
|
|
|
am.StoreEvent(initiatorUserID, targetUser.Id, account.Id, activity.ServiceUserDeleted, meta)
|
2023-10-03 16:46:58 +02:00
|
|
|
delete(account.Users, targetUser.Id)
|
|
|
|
}
|
|
|
|
|
2023-04-22 12:57:51 +02:00
|
|
|
// DeleteUser deletes a user from the given account.
|
2023-05-11 18:09:36 +02:00
|
|
|
func (am *DefaultAccountManager) DeleteUser(accountID, initiatorUserID string, targetUserID string) error {
|
2023-09-23 10:47:49 +02:00
|
|
|
if initiatorUserID == targetUserID {
|
|
|
|
return status.Errorf(status.InvalidArgument, "self deletion is not allowed")
|
|
|
|
}
|
2023-04-22 12:57:51 +02:00
|
|
|
unlock := am.Store.AcquireAccountLock(accountID)
|
|
|
|
defer unlock()
|
|
|
|
|
|
|
|
account, err := am.Store.GetAccount(accountID)
|
|
|
|
if err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
|
2023-05-11 18:09:36 +02:00
|
|
|
executingUser := account.Users[initiatorUserID]
|
2023-04-22 12:57:51 +02:00
|
|
|
if executingUser == nil {
|
|
|
|
return status.Errorf(status.NotFound, "user not found")
|
|
|
|
}
|
2023-12-01 17:24:57 +01:00
|
|
|
if !executingUser.HasAdminPower() {
|
|
|
|
return status.Errorf(status.PermissionDenied, "only users with admin power can delete users")
|
2023-04-22 12:57:51 +02:00
|
|
|
}
|
|
|
|
|
2023-10-03 16:46:58 +02:00
|
|
|
targetUser := account.Users[targetUserID]
|
|
|
|
if targetUser == nil {
|
|
|
|
return status.Errorf(status.NotFound, "target user not found")
|
2023-09-19 18:08:40 +02:00
|
|
|
}
|
|
|
|
|
2023-12-01 17:24:57 +01:00
|
|
|
if targetUser.Role == UserRoleOwner {
|
|
|
|
return status.Errorf(status.PermissionDenied, "unable to delete a user with owner role")
|
|
|
|
}
|
|
|
|
|
2023-11-07 15:02:51 +01:00
|
|
|
// disable deleting integration user if the initiator is not admin service user
|
|
|
|
if targetUser.Issued == UserIssuedIntegration && !executingUser.IsServiceUser {
|
2023-12-01 17:24:57 +01:00
|
|
|
return status.Errorf(status.PermissionDenied, "only integration service user can delete this user")
|
2023-11-01 11:04:17 +01:00
|
|
|
}
|
|
|
|
|
2023-10-03 16:46:58 +02:00
|
|
|
// handle service user first and exit, no need to fetch extra data from IDP, etc
|
|
|
|
if targetUser.IsServiceUser {
|
2023-11-15 16:22:00 +01:00
|
|
|
if targetUser.NonDeletable {
|
|
|
|
return status.Errorf(status.PermissionDenied, "service user is marked as non-deletable")
|
|
|
|
}
|
|
|
|
|
2023-10-03 16:46:58 +02:00
|
|
|
am.deleteServiceUser(account, initiatorUserID, targetUser)
|
|
|
|
return am.Store.SaveAccount(account)
|
2023-10-01 19:51:39 +02:00
|
|
|
}
|
|
|
|
|
2023-10-03 16:46:58 +02:00
|
|
|
return am.deleteRegularUser(account, initiatorUserID, targetUserID)
|
|
|
|
}
|
2023-09-19 18:08:40 +02:00
|
|
|
|
2023-10-03 16:46:58 +02:00
|
|
|
func (am *DefaultAccountManager) deleteRegularUser(account *Account, initiatorUserID, targetUserID string) error {
|
2023-09-23 10:47:49 +02:00
|
|
|
tuEmail, tuName, err := am.getEmailAndNameOfTargetUser(account.Id, initiatorUserID, targetUserID)
|
2023-09-19 18:08:40 +02:00
|
|
|
if err != nil {
|
|
|
|
log.Errorf("failed to resolve email address: %s", err)
|
|
|
|
return err
|
2023-04-22 12:57:51 +02:00
|
|
|
}
|
|
|
|
|
2023-10-03 16:46:58 +02:00
|
|
|
if !isNil(am.idpManager) {
|
2023-11-20 14:56:21 +01:00
|
|
|
// Delete if the user already exists in the IdP.Necessary in cases where a user account
|
|
|
|
// was created where a user account was provisioned but the user did not sign in
|
|
|
|
_, err = am.idpManager.GetUserDataByID(targetUserID, idp.AppMetadata{WTAccountID: account.Id})
|
|
|
|
if err == nil {
|
|
|
|
err = am.deleteUserFromIDP(targetUserID, account.Id)
|
|
|
|
if err != nil {
|
|
|
|
log.Debugf("failed to delete user from IDP: %s", targetUserID)
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
} else {
|
|
|
|
log.Debugf("skipped deleting user %s from IDP, error: %v", targetUserID, err)
|
2023-09-19 18:08:40 +02:00
|
|
|
}
|
|
|
|
}
|
2023-04-22 12:57:51 +02:00
|
|
|
|
2023-10-03 16:46:58 +02:00
|
|
|
err = am.deleteUserPeers(initiatorUserID, targetUserID, account)
|
|
|
|
if err != nil {
|
|
|
|
return err
|
|
|
|
}
|
2023-04-22 12:57:51 +02:00
|
|
|
|
2023-10-03 16:46:58 +02:00
|
|
|
delete(account.Users, targetUserID)
|
2023-04-22 12:57:51 +02:00
|
|
|
err = am.Store.SaveAccount(account)
|
|
|
|
if err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
|
2023-10-03 16:46:58 +02:00
|
|
|
meta := map[string]any{"name": tuName, "email": tuEmail}
|
2023-11-08 11:35:37 +01:00
|
|
|
am.StoreEvent(initiatorUserID, targetUserID, account.Id, activity.UserDeleted, meta)
|
2023-10-03 16:46:58 +02:00
|
|
|
|
2023-10-04 15:08:50 +02:00
|
|
|
am.updateAccountPeers(account)
|
|
|
|
|
|
|
|
return nil
|
2023-10-03 16:46:58 +02:00
|
|
|
}
|
|
|
|
|
|
|
|
func (am *DefaultAccountManager) deleteUserPeers(initiatorUserID string, targetUserID string, account *Account) error {
|
|
|
|
peers, err := account.FindUserPeers(targetUserID)
|
|
|
|
if err != nil {
|
|
|
|
return status.Errorf(status.Internal, "failed to find user peers")
|
|
|
|
}
|
|
|
|
|
|
|
|
peerIDs := make([]string, 0, len(peers))
|
|
|
|
for _, peer := range peers {
|
|
|
|
peerIDs = append(peerIDs, peer.ID)
|
|
|
|
}
|
|
|
|
|
|
|
|
return am.deletePeers(account, peerIDs, initiatorUserID)
|
2023-04-22 12:57:51 +02:00
|
|
|
}
|
|
|
|
|
2023-07-03 12:20:19 +02:00
|
|
|
// InviteUser resend invitations to users who haven't activated their accounts prior to the expiration period.
|
|
|
|
func (am *DefaultAccountManager) InviteUser(accountID string, initiatorUserID string, targetUserID string) error {
|
|
|
|
unlock := am.Store.AcquireAccountLock(accountID)
|
|
|
|
defer unlock()
|
|
|
|
|
|
|
|
if am.idpManager == nil {
|
|
|
|
return status.Errorf(status.PreconditionFailed, "IdP manager must be enabled to send user invites")
|
|
|
|
}
|
|
|
|
|
|
|
|
account, err := am.Store.GetAccount(accountID)
|
|
|
|
if err != nil {
|
|
|
|
return status.Errorf(status.NotFound, "account %s doesn't exist", accountID)
|
|
|
|
}
|
|
|
|
|
|
|
|
// check if the user is already registered with this ID
|
|
|
|
user, err := am.lookupUserInCache(targetUserID, account)
|
|
|
|
if err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
|
|
|
|
if user == nil {
|
|
|
|
return status.Errorf(status.NotFound, "user account %s doesn't exist", targetUserID)
|
|
|
|
}
|
|
|
|
|
|
|
|
// check if user account is already invited and account is not activated
|
|
|
|
pendingInvite := user.AppMetadata.WTPendingInvite
|
|
|
|
if pendingInvite == nil || !*pendingInvite {
|
|
|
|
return status.Errorf(status.PreconditionFailed, "can't invite a user with an activated NetBird account")
|
|
|
|
}
|
|
|
|
|
|
|
|
err = am.idpManager.InviteUserByID(user.ID)
|
|
|
|
if err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
|
2023-11-08 11:35:37 +01:00
|
|
|
am.StoreEvent(initiatorUserID, user.ID, accountID, activity.UserInvited, nil)
|
2023-07-03 12:20:19 +02:00
|
|
|
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
2023-03-30 13:58:44 +02:00
|
|
|
// CreatePAT creates a new PAT for the given user
|
2023-05-11 18:09:36 +02:00
|
|
|
func (am *DefaultAccountManager) CreatePAT(accountID string, initiatorUserID string, targetUserID string, tokenName string, expiresIn int) (*PersonalAccessTokenGenerated, error) {
|
2023-03-16 15:57:44 +01:00
|
|
|
unlock := am.Store.AcquireAccountLock(accountID)
|
|
|
|
defer unlock()
|
|
|
|
|
2023-03-30 13:58:44 +02:00
|
|
|
if tokenName == "" {
|
|
|
|
return nil, status.Errorf(status.InvalidArgument, "token name can't be empty")
|
|
|
|
}
|
|
|
|
|
|
|
|
if expiresIn < 1 || expiresIn > 365 {
|
|
|
|
return nil, status.Errorf(status.InvalidArgument, "expiration has to be between 1 and 365")
|
|
|
|
}
|
|
|
|
|
2023-03-16 15:57:44 +01:00
|
|
|
account, err := am.Store.GetAccount(accountID)
|
|
|
|
if err != nil {
|
2023-03-30 13:58:44 +02:00
|
|
|
return nil, err
|
2023-03-16 15:57:44 +01:00
|
|
|
}
|
|
|
|
|
2023-09-04 17:03:44 +02:00
|
|
|
targetUser, ok := account.Users[targetUserID]
|
|
|
|
if !ok {
|
|
|
|
return nil, status.Errorf(status.NotFound, "user not found")
|
2023-03-16 15:57:44 +01:00
|
|
|
}
|
|
|
|
|
2023-09-04 17:03:44 +02:00
|
|
|
executingUser, ok := account.Users[initiatorUserID]
|
|
|
|
if !ok {
|
2023-04-22 12:57:51 +02:00
|
|
|
return nil, status.Errorf(status.NotFound, "user not found")
|
|
|
|
}
|
|
|
|
|
2023-12-01 17:24:57 +01:00
|
|
|
if !(initiatorUserID == targetUserID || (executingUser.HasAdminPower() && targetUser.IsServiceUser)) {
|
2023-04-22 12:57:51 +02:00
|
|
|
return nil, status.Errorf(status.PermissionDenied, "no permission to create PAT for this user")
|
|
|
|
}
|
|
|
|
|
|
|
|
pat, err := CreateNewPAT(tokenName, expiresIn, executingUser.Id)
|
2023-03-30 13:58:44 +02:00
|
|
|
if err != nil {
|
|
|
|
return nil, status.Errorf(status.Internal, "failed to create PAT: %v", err)
|
|
|
|
}
|
|
|
|
|
|
|
|
targetUser.PATs[pat.ID] = &pat.PersonalAccessToken
|
|
|
|
|
|
|
|
err = am.Store.SaveAccount(account)
|
|
|
|
if err != nil {
|
|
|
|
return nil, status.Errorf(status.Internal, "failed to save account: %v", err)
|
|
|
|
}
|
2023-03-20 16:14:55 +01:00
|
|
|
|
2023-04-22 12:57:51 +02:00
|
|
|
meta := map[string]any{"name": pat.Name, "is_service_user": targetUser.IsServiceUser, "user_name": targetUser.ServiceUserName}
|
2023-11-08 11:35:37 +01:00
|
|
|
am.StoreEvent(initiatorUserID, targetUserID, accountID, activity.PersonalAccessTokenCreated, meta)
|
2023-03-31 17:41:22 +02:00
|
|
|
|
2023-03-30 13:58:44 +02:00
|
|
|
return pat, nil
|
2023-03-20 16:14:55 +01:00
|
|
|
}
|
|
|
|
|
2023-03-20 16:38:17 +01:00
|
|
|
// DeletePAT deletes a specific PAT from a user
|
2023-05-11 18:09:36 +02:00
|
|
|
func (am *DefaultAccountManager) DeletePAT(accountID string, initiatorUserID string, targetUserID string, tokenID string) error {
|
2023-03-20 16:14:55 +01:00
|
|
|
unlock := am.Store.AcquireAccountLock(accountID)
|
|
|
|
defer unlock()
|
|
|
|
|
|
|
|
account, err := am.Store.GetAccount(accountID)
|
|
|
|
if err != nil {
|
2023-03-30 13:58:44 +02:00
|
|
|
return status.Errorf(status.NotFound, "account not found: %s", err)
|
2023-03-20 16:14:55 +01:00
|
|
|
}
|
|
|
|
|
2023-09-04 17:03:44 +02:00
|
|
|
targetUser, ok := account.Users[targetUserID]
|
|
|
|
if !ok {
|
2023-03-20 16:14:55 +01:00
|
|
|
return status.Errorf(status.NotFound, "user not found")
|
|
|
|
}
|
|
|
|
|
2023-09-04 17:03:44 +02:00
|
|
|
executingUser, ok := account.Users[initiatorUserID]
|
|
|
|
if !ok {
|
2023-04-22 12:57:51 +02:00
|
|
|
return status.Errorf(status.NotFound, "user not found")
|
|
|
|
}
|
|
|
|
|
2023-12-01 17:24:57 +01:00
|
|
|
if !(initiatorUserID == targetUserID || (executingUser.HasAdminPower() && targetUser.IsServiceUser)) {
|
2023-04-22 12:57:51 +02:00
|
|
|
return status.Errorf(status.PermissionDenied, "no permission to delete PAT for this user")
|
|
|
|
}
|
|
|
|
|
|
|
|
pat := targetUser.PATs[tokenID]
|
2023-03-20 16:14:55 +01:00
|
|
|
if pat == nil {
|
|
|
|
return status.Errorf(status.NotFound, "PAT not found")
|
|
|
|
}
|
|
|
|
|
|
|
|
err = am.Store.DeleteTokenID2UserIDIndex(pat.ID)
|
|
|
|
if err != nil {
|
2023-03-30 13:58:44 +02:00
|
|
|
return status.Errorf(status.Internal, "Failed to delete token id index: %s", err)
|
2023-03-20 16:14:55 +01:00
|
|
|
}
|
|
|
|
err = am.Store.DeleteHashedPAT2TokenIDIndex(pat.HashedToken)
|
|
|
|
if err != nil {
|
2023-03-30 13:58:44 +02:00
|
|
|
return status.Errorf(status.Internal, "Failed to delete hashed token index: %s", err)
|
2023-03-20 16:14:55 +01:00
|
|
|
}
|
2023-03-31 17:41:22 +02:00
|
|
|
|
2023-04-22 12:57:51 +02:00
|
|
|
meta := map[string]any{"name": pat.Name, "is_service_user": targetUser.IsServiceUser, "user_name": targetUser.ServiceUserName}
|
2023-11-08 11:35:37 +01:00
|
|
|
am.StoreEvent(initiatorUserID, targetUserID, accountID, activity.PersonalAccessTokenDeleted, meta)
|
2023-03-31 17:41:22 +02:00
|
|
|
|
2023-04-22 12:57:51 +02:00
|
|
|
delete(targetUser.PATs, tokenID)
|
2023-03-16 15:57:44 +01:00
|
|
|
|
2023-03-30 13:58:44 +02:00
|
|
|
err = am.Store.SaveAccount(account)
|
|
|
|
if err != nil {
|
|
|
|
return status.Errorf(status.Internal, "Failed to save account: %s", err)
|
|
|
|
}
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
|
|
|
// GetPAT returns a specific PAT from a user
|
2023-05-11 18:09:36 +02:00
|
|
|
func (am *DefaultAccountManager) GetPAT(accountID string, initiatorUserID string, targetUserID string, tokenID string) (*PersonalAccessToken, error) {
|
2023-03-30 13:58:44 +02:00
|
|
|
unlock := am.Store.AcquireAccountLock(accountID)
|
|
|
|
defer unlock()
|
|
|
|
|
|
|
|
account, err := am.Store.GetAccount(accountID)
|
|
|
|
if err != nil {
|
|
|
|
return nil, status.Errorf(status.NotFound, "account not found: %s", err)
|
|
|
|
}
|
|
|
|
|
2023-09-04 17:03:44 +02:00
|
|
|
targetUser, ok := account.Users[targetUserID]
|
|
|
|
if !ok {
|
2023-03-30 13:58:44 +02:00
|
|
|
return nil, status.Errorf(status.NotFound, "user not found")
|
|
|
|
}
|
|
|
|
|
2023-09-04 17:03:44 +02:00
|
|
|
executingUser, ok := account.Users[initiatorUserID]
|
|
|
|
if !ok {
|
2023-04-22 12:57:51 +02:00
|
|
|
return nil, status.Errorf(status.NotFound, "user not found")
|
|
|
|
}
|
|
|
|
|
2023-12-01 17:24:57 +01:00
|
|
|
if !(initiatorUserID == targetUserID || (executingUser.HasAdminPower() && targetUser.IsServiceUser)) {
|
2023-04-22 12:57:51 +02:00
|
|
|
return nil, status.Errorf(status.PermissionDenied, "no permission to get PAT for this userser")
|
|
|
|
}
|
|
|
|
|
|
|
|
pat := targetUser.PATs[tokenID]
|
2023-03-30 13:58:44 +02:00
|
|
|
if pat == nil {
|
|
|
|
return nil, status.Errorf(status.NotFound, "PAT not found")
|
|
|
|
}
|
|
|
|
|
|
|
|
return pat, nil
|
|
|
|
}
|
|
|
|
|
|
|
|
// GetAllPATs returns all PATs for a user
|
2023-05-11 18:09:36 +02:00
|
|
|
func (am *DefaultAccountManager) GetAllPATs(accountID string, initiatorUserID string, targetUserID string) ([]*PersonalAccessToken, error) {
|
2023-03-30 13:58:44 +02:00
|
|
|
unlock := am.Store.AcquireAccountLock(accountID)
|
|
|
|
defer unlock()
|
|
|
|
|
|
|
|
account, err := am.Store.GetAccount(accountID)
|
|
|
|
if err != nil {
|
|
|
|
return nil, status.Errorf(status.NotFound, "account not found: %s", err)
|
|
|
|
}
|
|
|
|
|
2023-09-04 17:03:44 +02:00
|
|
|
targetUser, ok := account.Users[targetUserID]
|
|
|
|
if !ok {
|
2023-03-30 13:58:44 +02:00
|
|
|
return nil, status.Errorf(status.NotFound, "user not found")
|
|
|
|
}
|
|
|
|
|
2023-09-04 17:03:44 +02:00
|
|
|
executingUser, ok := account.Users[initiatorUserID]
|
|
|
|
if !ok {
|
2023-04-22 12:57:51 +02:00
|
|
|
return nil, status.Errorf(status.NotFound, "user not found")
|
|
|
|
}
|
|
|
|
|
2023-12-01 17:24:57 +01:00
|
|
|
if !(initiatorUserID == targetUserID || (executingUser.HasAdminPower() && targetUser.IsServiceUser)) {
|
2023-04-22 12:57:51 +02:00
|
|
|
return nil, status.Errorf(status.PermissionDenied, "no permission to get PAT for this user")
|
|
|
|
}
|
|
|
|
|
2023-03-30 13:58:44 +02:00
|
|
|
var pats []*PersonalAccessToken
|
2023-04-22 12:57:51 +02:00
|
|
|
for _, pat := range targetUser.PATs {
|
2023-03-30 13:58:44 +02:00
|
|
|
pats = append(pats, pat)
|
|
|
|
}
|
|
|
|
|
|
|
|
return pats, nil
|
2023-03-16 15:57:44 +01:00
|
|
|
}
|
|
|
|
|
2023-05-11 18:09:36 +02:00
|
|
|
// SaveUser saves updates to the given user. If the user doesn't exit it will throw status.NotFound error.
|
|
|
|
func (am *DefaultAccountManager) SaveUser(accountID, initiatorUserID string, update *User) (*UserInfo, error) {
|
2023-11-13 14:04:18 +01:00
|
|
|
return am.SaveOrAddUser(accountID, initiatorUserID, update, false) // false means do not create user and throw status.NotFound
|
|
|
|
}
|
|
|
|
|
|
|
|
// SaveOrAddUser updates the given user. If addIfNotExists is set to true it will add user when no exist
|
|
|
|
// Only User.AutoGroups, User.Role, and User.Blocked fields are allowed to be updated for now.
|
|
|
|
func (am *DefaultAccountManager) SaveOrAddUser(accountID, initiatorUserID string, update *User, addIfNotExists bool) (*UserInfo, error) {
|
2022-11-07 17:52:23 +01:00
|
|
|
unlock := am.Store.AcquireAccountLock(accountID)
|
|
|
|
defer unlock()
|
2022-09-22 09:06:32 +02:00
|
|
|
|
|
|
|
if update == nil {
|
2022-11-11 20:36:45 +01:00
|
|
|
return nil, status.Errorf(status.InvalidArgument, "provided user update is nil")
|
2022-09-22 09:06:32 +02:00
|
|
|
}
|
|
|
|
|
|
|
|
account, err := am.Store.GetAccount(accountID)
|
|
|
|
if err != nil {
|
2022-11-11 20:36:45 +01:00
|
|
|
return nil, err
|
2022-09-22 09:06:32 +02:00
|
|
|
}
|
|
|
|
|
2023-05-11 18:09:36 +02:00
|
|
|
initiatorUser, err := account.FindUser(initiatorUserID)
|
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
|
2023-12-01 17:24:57 +01:00
|
|
|
if !initiatorUser.HasAdminPower() || initiatorUser.IsBlocked() {
|
|
|
|
return nil, status.Errorf(status.PermissionDenied, "only users with admin power are authorized to perform user update operations")
|
2022-09-22 09:06:32 +02:00
|
|
|
}
|
|
|
|
|
|
|
|
oldUser := account.Users[update.Id]
|
|
|
|
if oldUser == nil {
|
2023-11-13 14:04:18 +01:00
|
|
|
if !addIfNotExists {
|
|
|
|
return nil, status.Errorf(status.NotFound, "user to update doesn't exist")
|
|
|
|
}
|
2023-11-14 12:25:21 +01:00
|
|
|
// when addIfNotExists is set to true the newUser will use all fields from the update input
|
2023-11-13 14:04:18 +01:00
|
|
|
oldUser = update
|
2023-05-11 18:09:36 +02:00
|
|
|
}
|
|
|
|
|
2023-12-01 17:24:57 +01:00
|
|
|
if initiatorUser.HasAdminPower() && initiatorUserID == update.Id && oldUser.Blocked != update.Blocked {
|
2023-05-11 18:09:36 +02:00
|
|
|
return nil, status.Errorf(status.PermissionDenied, "admins can't block or unblock themselves")
|
|
|
|
}
|
|
|
|
|
2023-12-01 17:24:57 +01:00
|
|
|
if initiatorUser.HasAdminPower() && initiatorUserID == update.Id && update.Role != initiatorUser.Role {
|
2023-05-11 18:09:36 +02:00
|
|
|
return nil, status.Errorf(status.PermissionDenied, "admins can't change their role")
|
2022-09-22 09:06:32 +02:00
|
|
|
}
|
|
|
|
|
2023-12-01 17:24:57 +01:00
|
|
|
if initiatorUser.Role == UserRoleAdmin && oldUser.Role == UserRoleOwner && update.Role != oldUser.Role {
|
|
|
|
return nil, status.Errorf(status.PermissionDenied, "only owners can remove owner role from their user")
|
|
|
|
}
|
|
|
|
|
|
|
|
if initiatorUser.Role == UserRoleAdmin && oldUser.Role == UserRoleOwner && update.IsBlocked() && !oldUser.IsBlocked() {
|
|
|
|
return nil, status.Errorf(status.PermissionDenied, "unable to block owner user")
|
|
|
|
}
|
|
|
|
|
|
|
|
if initiatorUser.Role == UserRoleAdmin && update.Role == UserRoleOwner && update.Role != oldUser.Role {
|
|
|
|
return nil, status.Errorf(status.PermissionDenied, "only owners can add owner role to other users")
|
|
|
|
}
|
|
|
|
|
|
|
|
if oldUser.IsServiceUser && update.Role == UserRoleOwner {
|
|
|
|
return nil, status.Errorf(status.PermissionDenied, "can't update a service user with owner role")
|
|
|
|
}
|
|
|
|
|
|
|
|
transferedOwnerRole := false
|
|
|
|
if initiatorUser.Role == UserRoleOwner && initiatorUserID != update.Id && update.Role == UserRoleOwner {
|
|
|
|
newInitiatorUser := initiatorUser.Copy()
|
|
|
|
newInitiatorUser.Role = UserRoleAdmin
|
|
|
|
account.Users[initiatorUserID] = newInitiatorUser
|
|
|
|
transferedOwnerRole = true
|
|
|
|
}
|
|
|
|
|
2023-11-14 12:25:21 +01:00
|
|
|
// only auto groups, revoked status, and integration reference can be updated for now
|
2022-09-22 09:06:32 +02:00
|
|
|
newUser := oldUser.Copy()
|
2022-09-23 14:18:42 +02:00
|
|
|
newUser.Role = update.Role
|
2023-05-11 18:09:36 +02:00
|
|
|
newUser.Blocked = update.Blocked
|
2023-11-14 12:25:21 +01:00
|
|
|
// these two fields can't be set via API, only via direct call to the method
|
|
|
|
newUser.Issued = update.Issued
|
|
|
|
newUser.IntegrationReference = update.IntegrationReference
|
2023-05-11 18:09:36 +02:00
|
|
|
|
|
|
|
for _, newGroupID := range update.AutoGroups {
|
|
|
|
if _, ok := account.Groups[newGroupID]; !ok {
|
|
|
|
return nil, status.Errorf(status.InvalidArgument, "provided group ID %s in the user %s update doesn't exist",
|
|
|
|
newGroupID, update.Id)
|
|
|
|
}
|
|
|
|
}
|
|
|
|
newUser.AutoGroups = update.AutoGroups
|
2022-09-22 09:06:32 +02:00
|
|
|
|
|
|
|
account.Users[newUser.Id] = newUser
|
|
|
|
|
2023-05-11 18:09:36 +02:00
|
|
|
if !oldUser.IsBlocked() && update.IsBlocked() {
|
|
|
|
// expire peers that belong to the user who's getting blocked
|
|
|
|
blockedPeers, err := account.FindUserPeers(update.Id)
|
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
|
2023-09-19 18:08:40 +02:00
|
|
|
if err := am.expireAndUpdatePeers(account, blockedPeers); err != nil {
|
|
|
|
log.Errorf("failed update expired peers: %s", err)
|
|
|
|
return nil, err
|
2023-05-11 18:09:36 +02:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2023-08-07 17:44:51 +02:00
|
|
|
if update.AutoGroups != nil && account.Settings.GroupsPropagationEnabled {
|
|
|
|
removedGroups := difference(oldUser.AutoGroups, update.AutoGroups)
|
2023-11-01 17:11:16 +01:00
|
|
|
// need force update all auto groups in any case they will not be duplicated
|
2023-08-07 17:44:51 +02:00
|
|
|
account.UserGroupsAddToPeers(oldUser.Id, update.AutoGroups...)
|
|
|
|
account.UserGroupsRemoveFromPeers(oldUser.Id, removedGroups...)
|
|
|
|
|
2023-08-18 15:36:05 +02:00
|
|
|
account.Network.IncSerial()
|
|
|
|
if err = am.Store.SaveAccount(account); err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
|
2023-10-04 15:08:50 +02:00
|
|
|
am.updateAccountPeers(account)
|
2023-08-18 15:36:05 +02:00
|
|
|
} else {
|
|
|
|
if err = am.Store.SaveAccount(account); err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
2022-09-22 09:06:32 +02:00
|
|
|
}
|
|
|
|
|
2023-01-02 15:11:32 +01:00
|
|
|
defer func() {
|
2023-05-17 09:54:20 +02:00
|
|
|
if oldUser.IsBlocked() != update.IsBlocked() {
|
|
|
|
if update.IsBlocked() {
|
2023-11-08 11:35:37 +01:00
|
|
|
am.StoreEvent(initiatorUserID, oldUser.Id, accountID, activity.UserBlocked, nil)
|
2023-05-17 09:54:20 +02:00
|
|
|
} else {
|
2023-11-08 11:35:37 +01:00
|
|
|
am.StoreEvent(initiatorUserID, oldUser.Id, accountID, activity.UserUnblocked, nil)
|
2023-05-17 09:54:20 +02:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2023-12-01 17:24:57 +01:00
|
|
|
switch {
|
|
|
|
case transferedOwnerRole:
|
|
|
|
am.StoreEvent(initiatorUserID, oldUser.Id, accountID, activity.TransferredOwnerRole, nil)
|
|
|
|
case oldUser.Role != newUser.Role:
|
2023-11-08 11:35:37 +01:00
|
|
|
am.StoreEvent(initiatorUserID, oldUser.Id, accountID, activity.UserRoleUpdated, map[string]any{"role": newUser.Role})
|
2023-12-01 17:24:57 +01:00
|
|
|
default:
|
2023-01-02 15:11:32 +01:00
|
|
|
}
|
|
|
|
|
2023-05-11 18:09:36 +02:00
|
|
|
if update.AutoGroups != nil {
|
|
|
|
removedGroups := difference(oldUser.AutoGroups, update.AutoGroups)
|
|
|
|
addedGroups := difference(newUser.AutoGroups, oldUser.AutoGroups)
|
|
|
|
for _, g := range removedGroups {
|
|
|
|
group := account.GetGroup(g)
|
|
|
|
if group != nil {
|
2023-11-08 11:35:37 +01:00
|
|
|
am.StoreEvent(initiatorUserID, oldUser.Id, accountID, activity.GroupRemovedFromUser,
|
2023-05-11 18:09:36 +02:00
|
|
|
map[string]any{"group": group.Name, "group_id": group.ID, "is_service_user": newUser.IsServiceUser, "user_name": newUser.ServiceUserName})
|
|
|
|
} else {
|
|
|
|
log.Errorf("group %s not found while saving user activity event of account %s", g, account.Id)
|
|
|
|
}
|
|
|
|
}
|
2023-01-02 15:11:32 +01:00
|
|
|
|
2023-05-11 18:09:36 +02:00
|
|
|
for _, g := range addedGroups {
|
|
|
|
group := account.GetGroup(g)
|
|
|
|
if group != nil {
|
2023-11-08 11:35:37 +01:00
|
|
|
am.StoreEvent(initiatorUserID, oldUser.Id, accountID, activity.GroupAddedToUser,
|
2023-05-11 18:09:36 +02:00
|
|
|
map[string]any{"group": group.Name, "group_id": group.ID, "is_service_user": newUser.IsServiceUser, "user_name": newUser.ServiceUserName})
|
|
|
|
}
|
2023-01-02 15:11:32 +01:00
|
|
|
}
|
|
|
|
}
|
|
|
|
}()
|
|
|
|
|
2023-04-22 12:57:51 +02:00
|
|
|
if !isNil(am.idpManager) && !newUser.IsServiceUser {
|
2022-10-13 18:26:31 +02:00
|
|
|
userData, err := am.lookupUserInCache(newUser.Id, account)
|
2022-09-22 09:06:32 +02:00
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
2022-10-13 18:26:31 +02:00
|
|
|
if userData == nil {
|
2023-11-13 14:04:18 +01:00
|
|
|
// lets check external cache
|
|
|
|
key := newUser.IntegrationReference.CacheKey(account.Id, newUser.Id)
|
|
|
|
log.Debugf("looking up user %s of account %s in external cache", key, account.Id)
|
|
|
|
info, err := am.externalCacheManager.Get(am.ctx, key)
|
|
|
|
if err != nil {
|
|
|
|
log.Infof("Get ExternalCache for key: %s, error: %s", key, err)
|
|
|
|
return nil, status.Errorf(status.NotFound, "user %s not found in the IdP", newUser.Id)
|
|
|
|
}
|
|
|
|
|
|
|
|
return newUser.ToUserInfo(info)
|
2022-10-13 18:26:31 +02:00
|
|
|
}
|
2023-05-11 18:09:36 +02:00
|
|
|
return newUser.ToUserInfo(userData)
|
2022-09-22 09:06:32 +02:00
|
|
|
}
|
2023-05-11 18:09:36 +02:00
|
|
|
return newUser.ToUserInfo(nil)
|
2022-09-22 09:06:32 +02:00
|
|
|
}
|
|
|
|
|
2021-12-27 13:17:15 +01:00
|
|
|
// GetOrCreateAccountByUser returns an existing account for a given user id or creates a new one if doesn't exist
|
2022-11-07 17:52:23 +01:00
|
|
|
func (am *DefaultAccountManager) GetOrCreateAccountByUser(userID, domain string) (*Account, error) {
|
|
|
|
unlock := am.Store.AcquireGlobalLock()
|
|
|
|
defer unlock()
|
2021-12-27 13:17:15 +01:00
|
|
|
|
2022-03-01 15:22:18 +01:00
|
|
|
lowerDomain := strings.ToLower(domain)
|
|
|
|
|
2022-11-07 17:52:23 +01:00
|
|
|
account, err := am.Store.GetAccountByUser(userID)
|
2021-12-27 13:17:15 +01:00
|
|
|
if err != nil {
|
2022-11-11 20:36:45 +01:00
|
|
|
if s, ok := status.FromError(err); ok && s.Type() == status.NotFound {
|
2022-11-07 17:52:23 +01:00
|
|
|
account, err = am.newAccount(userID, lowerDomain)
|
2022-06-20 18:20:43 +02:00
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
2021-12-27 13:17:15 +01:00
|
|
|
err = am.Store.SaveAccount(account)
|
|
|
|
if err != nil {
|
2022-11-11 20:36:45 +01:00
|
|
|
return nil, err
|
2021-12-27 13:17:15 +01:00
|
|
|
}
|
|
|
|
} else {
|
|
|
|
// other error
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2022-11-07 17:52:23 +01:00
|
|
|
userObj := account.Users[userID]
|
2022-06-20 18:20:43 +02:00
|
|
|
|
2023-12-01 17:24:57 +01:00
|
|
|
if account.Domain != lowerDomain && userObj.Role == UserRoleOwner {
|
2022-03-01 15:22:18 +01:00
|
|
|
account.Domain = lowerDomain
|
2022-02-11 17:18:18 +01:00
|
|
|
err = am.Store.SaveAccount(account)
|
|
|
|
if err != nil {
|
2022-11-11 20:36:45 +01:00
|
|
|
return nil, status.Errorf(status.Internal, "failed updating account with domain")
|
2022-02-11 17:18:18 +01:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2021-12-27 13:17:15 +01:00
|
|
|
return account, nil
|
|
|
|
}
|
|
|
|
|
2022-11-05 10:24:50 +01:00
|
|
|
// GetUsersFromAccount performs a batched request for users from IDP by account ID apply filter on what data to return
|
|
|
|
// based on provided user role.
|
|
|
|
func (am *DefaultAccountManager) GetUsersFromAccount(accountID, userID string) ([]*UserInfo, error) {
|
2022-11-07 17:52:23 +01:00
|
|
|
account, err := am.Store.GetAccount(accountID)
|
2022-09-22 09:06:32 +02:00
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
|
2022-11-05 10:24:50 +01:00
|
|
|
user, err := account.FindUser(userID)
|
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
|
2022-09-22 09:06:32 +02:00
|
|
|
queriedUsers := make([]*idp.UserData, 0)
|
|
|
|
if !isNil(am.idpManager) {
|
2022-10-13 18:26:31 +02:00
|
|
|
users := make(map[string]struct{}, len(account.Users))
|
2023-11-13 14:04:18 +01:00
|
|
|
usersFromIntegration := make([]*idp.UserData, 0)
|
2022-10-13 18:26:31 +02:00
|
|
|
for _, user := range account.Users {
|
2023-11-20 12:05:32 +01:00
|
|
|
if user.Issued == UserIssuedIntegration {
|
2023-11-13 14:04:18 +01:00
|
|
|
key := user.IntegrationReference.CacheKey(accountID, user.Id)
|
|
|
|
info, err := am.externalCacheManager.Get(am.ctx, key)
|
|
|
|
if err != nil {
|
|
|
|
log.Infof("Get ExternalCache for key: %s, error: %s", key, err)
|
|
|
|
users[user.Id] = struct{}{}
|
|
|
|
continue
|
|
|
|
}
|
|
|
|
usersFromIntegration = append(usersFromIntegration, info)
|
|
|
|
continue
|
|
|
|
}
|
2023-04-22 12:57:51 +02:00
|
|
|
if !user.IsServiceUser {
|
|
|
|
users[user.Id] = struct{}{}
|
|
|
|
}
|
2022-10-13 18:26:31 +02:00
|
|
|
}
|
|
|
|
queriedUsers, err = am.lookupCache(users, accountID)
|
2022-09-22 09:06:32 +02:00
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
2023-11-13 14:04:18 +01:00
|
|
|
log.Debugf("Got %d users from ExternalCache for account %s", len(usersFromIntegration), accountID)
|
|
|
|
log.Debugf("Got %d users from InternalCache for account %s", len(queriedUsers), accountID)
|
|
|
|
queriedUsers = append(queriedUsers, usersFromIntegration...)
|
2022-09-22 09:06:32 +02:00
|
|
|
}
|
|
|
|
|
|
|
|
userInfos := make([]*UserInfo, 0)
|
|
|
|
|
|
|
|
// in case of self-hosted, or IDP doesn't return anything, we will return the locally stored userInfo
|
|
|
|
if len(queriedUsers) == 0 {
|
2022-11-05 10:24:50 +01:00
|
|
|
for _, accountUser := range account.Users {
|
2023-12-01 17:24:57 +01:00
|
|
|
if !user.HasAdminPower() && user.Id != accountUser.Id {
|
2022-11-05 10:24:50 +01:00
|
|
|
// if user is not an admin then show only current user and do not show other users
|
|
|
|
continue
|
|
|
|
}
|
2023-05-11 18:09:36 +02:00
|
|
|
info, err := accountUser.ToUserInfo(nil)
|
2022-09-22 09:06:32 +02:00
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
userInfos = append(userInfos, info)
|
|
|
|
}
|
|
|
|
return userInfos, nil
|
|
|
|
}
|
|
|
|
|
2023-04-22 12:57:51 +02:00
|
|
|
for _, localUser := range account.Users {
|
2023-12-01 17:24:57 +01:00
|
|
|
if !user.HasAdminPower() && user.Id != localUser.Id {
|
2022-11-05 10:24:50 +01:00
|
|
|
// if user is not an admin then show only current user and do not show other users
|
|
|
|
continue
|
|
|
|
}
|
2022-09-22 09:06:32 +02:00
|
|
|
|
2023-04-22 12:57:51 +02:00
|
|
|
var info *UserInfo
|
|
|
|
if queriedUser, contains := findUserInIDPUserdata(localUser.Id, queriedUsers); contains {
|
2023-05-11 18:09:36 +02:00
|
|
|
info, err = localUser.ToUserInfo(queriedUser)
|
2022-09-22 09:06:32 +02:00
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
2023-04-22 12:57:51 +02:00
|
|
|
} else {
|
|
|
|
name := ""
|
|
|
|
if localUser.IsServiceUser {
|
|
|
|
name = localUser.ServiceUserName
|
|
|
|
}
|
|
|
|
info = &UserInfo{
|
|
|
|
ID: localUser.Id,
|
|
|
|
Email: "",
|
|
|
|
Name: name,
|
|
|
|
Role: string(localUser.Role),
|
|
|
|
AutoGroups: localUser.AutoGroups,
|
|
|
|
Status: string(UserStatusActive),
|
|
|
|
IsServiceUser: localUser.IsServiceUser,
|
2023-11-15 16:22:00 +01:00
|
|
|
NonDeletable: localUser.NonDeletable,
|
2023-04-22 12:57:51 +02:00
|
|
|
}
|
2022-09-22 09:06:32 +02:00
|
|
|
}
|
2023-04-22 12:57:51 +02:00
|
|
|
userInfos = append(userInfos, info)
|
2022-09-22 09:06:32 +02:00
|
|
|
}
|
|
|
|
|
|
|
|
return userInfos, nil
|
|
|
|
}
|
2023-04-22 12:57:51 +02:00
|
|
|
|
2023-09-19 18:08:40 +02:00
|
|
|
// expireAndUpdatePeers expires all peers of the given user and updates them in the account
|
2023-11-28 13:45:26 +01:00
|
|
|
func (am *DefaultAccountManager) expireAndUpdatePeers(account *Account, peers []*nbpeer.Peer) error {
|
2023-09-19 18:08:40 +02:00
|
|
|
var peerIDs []string
|
|
|
|
for _, peer := range peers {
|
2023-09-29 17:37:04 +02:00
|
|
|
if peer.Status.LoginExpired {
|
|
|
|
continue
|
|
|
|
}
|
2023-09-19 18:08:40 +02:00
|
|
|
peerIDs = append(peerIDs, peer.ID)
|
|
|
|
peer.MarkLoginExpired(true)
|
|
|
|
account.UpdatePeer(peer)
|
|
|
|
if err := am.Store.SavePeerStatus(account.Id, peer.ID, *peer.Status); err != nil {
|
|
|
|
return err
|
|
|
|
}
|
2023-11-08 11:35:37 +01:00
|
|
|
am.StoreEvent(
|
2023-09-19 18:08:40 +02:00
|
|
|
peer.UserID, peer.ID, account.Id,
|
|
|
|
activity.PeerLoginExpired, peer.EventMeta(am.GetDNSDomain()),
|
|
|
|
)
|
|
|
|
}
|
|
|
|
|
|
|
|
if len(peerIDs) != 0 {
|
|
|
|
// this will trigger peer disconnect from the management service
|
|
|
|
am.peersUpdateManager.CloseChannels(peerIDs)
|
2023-10-04 15:08:50 +02:00
|
|
|
am.updateAccountPeers(account)
|
2023-09-19 18:08:40 +02:00
|
|
|
}
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
|
|
|
func (am *DefaultAccountManager) deleteUserFromIDP(targetUserID, accountID string) error {
|
|
|
|
if am.userDeleteFromIDPEnabled {
|
|
|
|
log.Debugf("user %s deleted from IdP", targetUserID)
|
|
|
|
err := am.idpManager.DeleteUser(targetUserID)
|
|
|
|
if err != nil {
|
|
|
|
return fmt.Errorf("failed to delete user %s from IdP: %s", targetUserID, err)
|
|
|
|
}
|
|
|
|
} else {
|
|
|
|
err := am.idpManager.UpdateUserAppMetadata(targetUserID, idp.AppMetadata{})
|
|
|
|
if err != nil {
|
|
|
|
return fmt.Errorf("failed to remove user %s app metadata in IdP: %s", targetUserID, err)
|
|
|
|
}
|
2024-01-01 19:17:44 +01:00
|
|
|
}
|
|
|
|
err := am.removeUserFromCache(accountID, targetUserID)
|
|
|
|
if err != nil {
|
|
|
|
log.Errorf("remove user from account (%q) cache failed with error: %v", accountID, err)
|
2023-09-19 18:08:40 +02:00
|
|
|
}
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
2023-09-23 10:47:49 +02:00
|
|
|
func (am *DefaultAccountManager) getEmailAndNameOfTargetUser(accountId, initiatorId, targetId string) (string, string, error) {
|
2023-09-19 18:08:40 +02:00
|
|
|
userInfos, err := am.GetUsersFromAccount(accountId, initiatorId)
|
|
|
|
if err != nil {
|
2023-09-23 10:47:49 +02:00
|
|
|
return "", "", err
|
2023-09-19 18:08:40 +02:00
|
|
|
}
|
|
|
|
for _, ui := range userInfos {
|
|
|
|
if ui.ID == targetId {
|
2023-09-23 10:47:49 +02:00
|
|
|
return ui.Email, ui.Name, nil
|
2023-09-19 18:08:40 +02:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2023-09-23 10:47:49 +02:00
|
|
|
return "", "", fmt.Errorf("user info not found for user: %s", targetId)
|
2023-09-19 18:08:40 +02:00
|
|
|
}
|
|
|
|
|
2023-04-22 12:57:51 +02:00
|
|
|
func findUserInIDPUserdata(userID string, userData []*idp.UserData) (*idp.UserData, bool) {
|
|
|
|
for _, user := range userData {
|
|
|
|
if user.ID == userID {
|
|
|
|
return user, true
|
|
|
|
}
|
|
|
|
}
|
|
|
|
return nil, false
|
|
|
|
}
|