bcmmbaga
7d0331f41e
Fix prevent users from creating PATs for other users
...
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com>
2024-11-21 21:03:16 +03:00
bcmmbaga
7af55fbd71
Add account locks
...
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com>
2024-11-21 19:50:59 +03:00
bcmmbaga
66d8bbf8e2
Fix database transaction locking issue
...
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com>
2024-11-20 22:45:14 +03:00
bcmmbaga
6a456c52bf
Refactor user and PAT handling
...
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com>
2024-11-19 23:42:27 +03:00
bcmmbaga
a61e9da3e9
run peer ops in transaction
...
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com>
2024-11-18 15:06:25 +03:00
bcmmbaga
c557c98390
Refactor peer to use store methods
...
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com>
2024-11-14 19:33:57 +03:00
bcmmbaga
ed259a6a03
Merge branch 'main' into groups-get-account-refactoring
...
# Conflicts:
# management/server/account.go
# management/server/status/error.go
2024-11-12 17:14:45 +03:00
Pascal Fischer
20a5afc359
[management] Add more logs to the peer update processes ( #2881 )
2024-11-12 14:19:22 +01:00
Bethuel Mmbaga
6cb697eed6
[management] Refactor setup key to use store methods ( #2861 )
...
* Refactor setup key handling to use store methods
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com>
* add lock to get account groups
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com>
* add check for regular user
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com>
* get only required groups for auto-group validation
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com>
* add account lock and return auto groups map on validation
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com>
* fix missing group removed from setup key activity
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com>
* Remove context from DB queries
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com>
* Add user permission check and add setup events into events to store slice
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com>
* Retrieve all groups once during setup key auto-group validation
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com>
* Fix lint
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com>
* Fix sonar
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com>
---------
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com>
2024-11-11 19:46:10 +03:00
bcmmbaga
106fc75936
refactor account peers update
...
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com>
2024-11-08 18:38:32 +03:00
bcmmbaga
1a5f3c653c
add check for regular user
...
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com>
2024-11-08 00:37:47 +03:00
Bethuel Mmbaga
7bda385e1b
[management] Optimize network map updates ( #2718 )
...
* Skip peer update on unchanged network map (#2236 )
* Enhance network updates by skipping unchanged messages
Optimizes the network update process
by skipping updates where no changes in the peer update message received.
* Add unit tests
* add locks
* Improve concurrency and update peer message handling
* Refactor account manager network update tests
* fix test
* Fix inverted network map update condition
* Add default group and policy to test data
* Run peer updates in a separate goroutine
* Refactor
* Refactor lock
* Fix peers update by including NetworkMap and posture Checks
* go mod tidy
* fix merge
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com>
* fix merge
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com>
* [management] Skip account peers update if no changes affect peers (#2310 )
* Remove incrementing network serial and updating peers after group deletion
* Update account peer if posture check is linked to policy
* Remove account peers update on saving setup key
* Refactor group link checking into re-usable functions
* Add HasPeers function to group
* Refactor group management
* Optimize group change effects on account peers
* Update account peers if ns group has peers
* Refactor group changes
* Optimize account peers update in DNS settings
* Optimize update of account peers on jwt groups sync
* Refactor peer account updates for efficiency
* Optimize peer update on user deletion and changes
* Remove condition check for network serial update
* Optimize account peers updates on route changes
* Remove UpdatePeerSSHKey method
* Remove unused isPolicyRuleGroupsEmpty
* Add tests for peer update behavior on posture check changes
* Add tests for peer update behavior on policy changes
* Add tests for peer update behavior on group changes
* Add tests for peer update behavior on dns settings changes
* Refactor
* Add tests for peer update behavior on name server changes
* Add tests for peer update behavior on user changes
* Add tests for peer update behavior on route changes
* fix tests
* Add tests for peer update behavior on setup key changes
* Add tests for peer update behavior on peers changes
* fix merge
* Fix tests
* go mod tidy
* Add NameServer and Route comparators
* Update network map diff logic with custom comparators
* Add tests
* Refactor duplicate diff handling logic
* fix linter
* fix tests
* Refactor policy group handling and update logic.
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com>
* Update route check by checking if group has peers
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com>
* Refactor posture check policy linking logic
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com>
* Simplify peer update condition in DNS management
Refactor the condition for updating account peers to remove redundant checks
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com>
* fix tests
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com>
* fix merge
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com>
* add policy tests
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com>
* add posture checks tests
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com>
* fix user and setup key tests
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com>
* fix account and route tests
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com>
* fix typo
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com>
* fix nameserver tests
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com>
* fix routes tests
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com>
* fix group tests
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com>
* upgrade diff package
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com>
* fix nameserver tests
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com>
* use generic differ for netip.Addr and netip.Prefix
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com>
* go mod tidy
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com>
* add peer tests
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com>
* fix merge
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com>
* fix management suite tests
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com>
* fix postgres tests
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com>
* enable diff nil structs comparison
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com>
* skip the update only last sent the serial is larger
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com>
* refactor peer and user
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com>
* skip spell check for groupD
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com>
* Refactor group, ns group, policy and posture checks
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com>
* skip spell check for GroupD
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com>
* update account policy check before verifying policy status
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com>
* Update management/server/route_test.go
Co-authored-by: Maycon Santos <mlsmaycon@gmail.com>
* Update management/server/route_test.go
Co-authored-by: Maycon Santos <mlsmaycon@gmail.com>
* Update management/server/route_test.go
Co-authored-by: Maycon Santos <mlsmaycon@gmail.com>
* Update management/server/route_test.go
Co-authored-by: Maycon Santos <mlsmaycon@gmail.com>
* Update management/server/route_test.go
Co-authored-by: Maycon Santos <mlsmaycon@gmail.com>
* add tests missing tests for dns setting groups
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com>
* add tests for posture checks changes
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com>
* add ns group and policy tests
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com>
* add route and group tests
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com>
* increase Linux test timeout to 10 minutes
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com>
* Run diff for client posture checks only
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com>
* add panic recovery and detailed logging in peer update comparison
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com>
* Fix tests
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com>
---------
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com>
Co-authored-by: Maycon Santos <mlsmaycon@gmail.com>
---------
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com>
Co-authored-by: Maycon Santos <mlsmaycon@gmail.com>
2024-10-23 13:05:02 +03:00
Misha Bragin
208a2b7169
Add billing user role ( #2714 )
2024-10-10 14:14:56 +02:00
Bethuel Mmbaga
7f09b39769
[management] Refactor User JWT group sync ( #2690 )
...
* Refactor GetAccountIDByUserOrAccountID
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com>
* sync user jwt group changes
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com>
* propagate jwt group changes to peers
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com>
* fix no jwt groups synced
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com>
* fix tests and lint
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com>
* Move the account peer update outside the transaction
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com>
* move updateUserPeersInGroups to account manager
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com>
* move event store outside of transaction
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com>
* get user with update lock
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com>
* Run jwt sync in transaction
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com>
---------
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com>
2024-10-04 17:17:01 +03:00
Bethuel Mmbaga
acb73bd64a
[management] Remove redundant get account calls in GetAccountFromToken ( #2615 )
...
* refactor access control middleware and user access by JWT groups
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com>
* refactor jwt groups extractor
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com>
* refactor handlers to get account when necessary
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com>
* refactor getAccountFromToken
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com>
* refactor getAccountWithAuthorizationClaims
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com>
* fix merge
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com>
* revert handles change
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com>
* remove GetUserByID from account manager
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com>
* fix tests
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com>
* refactor getAccountWithAuthorizationClaims to return account id
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com>
* refactor handlers to use GetAccountIDFromToken
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com>
* fix tests
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com>
* remove locks
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com>
* refactor
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com>
* add GetGroupByName from store
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com>
* add GetGroupByID from store and refactor
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com>
* Refactor retrieval of policy and posture checks
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com>
* Refactor user permissions and retrieves PAT
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com>
* Refactor route, setupkey, nameserver and dns to get record(s) from store
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com>
* Refactor store
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com>
* fix lint
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com>
* fix tests
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com>
* fix add missing policy source posture checks
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com>
* add store lock
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com>
* fix tests
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com>
* add get account
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com>
---------
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com>
2024-09-27 17:10:50 +03:00
pascal-fischer
6c50b0c84b
[management] Add transaction to addPeer ( #2469 )
...
This PR removes the GetAccount and SaveAccount operations from the AddPeer and instead makes use of gorm.Transaction to add the new peer.
2024-09-16 15:47:03 +02:00
Bethuel Mmbaga
539480a713
[management] Prevent removal of All group from peers during user groups propagation ( #2410 )
...
* Prevent removal of "All" group from peers
* Prevent adding "All" group to users and setup keys
* Refactor setup key group validation
2024-08-12 13:48:05 +03:00
Bethuel Mmbaga
0911163146
Add batch delete for groups and users ( #2370 )
...
* Refactor user deletion logic and introduce batch delete
* Prevent self-deletion for users
* Add delete multiple groups
* Refactor group deletion with validation
* Fix tests
* Add bulk delete functions for Users and Groups in account manager interface and mocks
* Add tests for DeleteGroups method in group management
* Add tests for DeleteUsers method in users management
2024-08-08 18:01:38 +03:00
Bethuel Mmbaga
c832cef44c
Update SaveUsers and SaveGroups to SaveAccount ( #2362 )
...
Changed SaveUsers and SaveGroups method calls to SaveAccount for consistency in data persistence operations.
2024-07-31 19:48:12 +03:00
Maycon Santos
165988429c
Add write lock for peer when saving its connection status ( #2359 )
2024-07-31 14:53:32 +02:00
Bethuel Mmbaga
1537b0f5e7
Add batch save/update for groups and users ( #2245 )
...
* Add functionality to update multiple users
* Remove SaveUsers from DefaultAccountManager
* Add SaveGroups method to AccountManager interface
* Refactoring
* Add SaveUsers and SaveGroups methods to store interface
* Refactor method SaveAccount to SaveUsers and SaveGroups
The method SaveAccount in user.go and group.go files was split into two separate methods. Now, user-specific data is handled by SaveUsers and group-specific data is handled by SaveGroups method. This provides a cleaner and more efficient way to save user and group data.
* Add account ID to user and group in SqlStore
* Refactor SaveUsers and SaveGroups in store
* Remove unnecessary ID assignment in SaveUsers and SaveGroups
2024-07-15 17:04:06 +03:00
pascal-fischer
e8c2fafccd
Avoid empty domain overwrite ( #2252 )
2024-07-10 14:08:35 +02:00
pascal-fischer
765aba2c1c
Add context to throughout the project and update logging ( #2209 )
...
propagate context from all the API calls and log request ID, account ID and peer ID
---------
Co-authored-by: Zoltan Papp <zoltan.pmail@gmail.com>
2024-07-03 11:33:02 +02:00
Maycon Santos
29a2d93873
Log global lock acquisition per user ( #2039 )
2024-05-23 17:09:58 +02:00
pascal-fischer
2e0047daea
Improve Sync performance ( #1901 )
2024-05-07 14:30:03 +02:00
Maycon Santos
a80c8b0176
Redeem invite only when incoming user was invited ( #1861 )
...
checks for users with pending invite status in the cache that already logged in and refresh the cache
2024-04-22 11:10:27 +02:00
Zoltan Papp
2d76b058fc
Feature/peer validator ( #1553 )
...
Follow up management-integrations changes
move groups to separated packages to avoid circle dependencies
save location information in Login action
2024-03-27 18:48:48 +01:00
pascal-fischer
ea2d060f93
Add limited dashboard view ( #1738 )
2024-03-27 16:11:45 +01:00
Maycon Santos
aa935bdae3
Register creation time for peer, user and account ( #1654 )
...
This change register creation time for new peers, users and accounts
2024-03-02 13:49:40 +01:00
Maycon Santos
a7547b9990
Get cache from external cache when refresh fails ( #1537 )
...
In some cases, when the refresh cache fails, we should try to get the cache from the external cache obj.
This may happen if the IDP is not responsive between storing metadata and refreshing the cache
2024-02-07 16:14:30 +01:00
pascal-fischer
399493a954
Allow service users with user role read-only access to all resources ( #1484 )
...
We allow service users with user role read-only access
to all resources so users can create service user and propagate
PATs without having to give full admin permissions.
2024-01-25 09:50:27 +01:00
Maycon Santos
8b4ec96516
Update user's last login when authenticating a peer ( #1437 )
...
* Update user's last login when authenticating a peer
Prior to this update the user's last login only updated on dashboard authentication
* use account and user methods
2024-01-06 12:57:05 +01:00
Maycon Santos
b28b8fce50
Remove the user from the cache without refreshing it ( #1422 )
...
Some IdPs might have eventual consistency for their API calls, and refreshing the cache with its data may return the deleted user as part of the account
Introduce a new account manager method, removeUserFromCache, to remove the user from the local cache without refresh
2024-01-01 19:17:44 +01:00
pascal-fischer
d5bf79bc51
Merge branch 'main' into feature/peer-approval
2023-12-01 18:12:59 +01:00
Maycon Santos
d7efea74b6
add owner role support ( #1340 )
...
This PR adds support to Owner roles.
The owner role has a similar access level as the admin, but it has the power to delete the account.
Besides that, the role has the following constraints:
- The role can only be transferred. So, only a user with the owner role can transfer the owner role to a new user
- It can't be assigned to users being invited
- It can't be assigned to service users
2023-12-01 17:24:57 +01:00
pascal-fischer
141065f14e
Merge branch 'main' into feature/peer-approval
2023-11-29 16:27:01 +01:00
Pascal Fischer
a729c83b06
extract peer into seperate package
2023-11-28 13:45:26 +01:00
Maycon Santos
dc05102b8f
Fix panic on empty username for invites ( #1334 )
...
Validate email and user are not empty
2023-11-28 13:09:33 +01:00
Bethuel Mmbaga
d78b7e5d93
Skip user deletion if the user does not exist in IdP ( #1320 )
2023-11-20 16:56:21 +03:00
Yury Gargay
67906f6da5
Improve Account cache reload condition ( #1319 )
...
To take in consideration that cache may know more users
2023-11-20 12:05:32 +01:00
Bethuel Mmbaga
e7d063126d
Add non-deletable service user ( #1311 )
...
* Add non-deletable flag for service users
* fix non deletable service user created as deletable
* Exclude non deletable service users in service users api response
* Fix broken tests
* Add test for non deletable service user
* Add handling for non-deletable service users in tests
* Remove non-deletable service users when fetching all users
* Ensure non-deletable users are filtered out when fetching all user data
2023-11-15 18:22:00 +03:00
Yury Gargay
70c7543e36
Allow to update IntegrationReference for user ( #1308 )
...
This should not happen via an API but be possible when calling the method directly.
2023-11-14 12:25:21 +01:00
Yury Gargay
d1d01a0611
Extend AccountManager with external cache and group/user management methods ( #1289 )
2023-11-13 14:04:18 +01:00
Bethuel Mmbaga
89e8540531
Export account manager events store ( #1295 )
...
* Expose account manager StoreEvent to integrations
* Add account manager StoreEvent mock
2023-11-08 13:35:37 +03:00
Bethuel Mmbaga
9f7e13fc87
Enable deletion of integration resources ( #1294 )
...
* Enforce admin service user role for integration group deletion
Added a check to prevent non-admin service users from deleting integration groups.
* Restrict deletion of integration user to admin service user only
* Refactor user and group deletion tests
2023-11-07 17:02:51 +03:00
Fabio Fantoni
c99ae6f009
fix some typo spotted with codespell ( #1278 )
...
Fixed spelling typos on logs, comments and command help text
2023-11-01 17:11:16 +01:00
Bethuel Mmbaga
c38d65ef4c
Extends management user and group structure ( #1268 )
...
* extends user and group structure by introducing fields for issued and integration references
* Add integration checks to group management to prevent groups added by integration.
* Add integration checks to user management to prevent deleting user added by integration.
* Fix broken user update tests
* Initialize all user fields for testing
* Change a serializer option to embedded for IntegrationReference in user and group models
* Add issued field to user api response
* Add IntegrationReference to Group in update groups handler
* Set the default issued field for users in file store
2023-11-01 13:04:17 +03:00
Yury Gargay
90c2093018
Fix SaveUserLastLogin in SQLite store ( #1241 )
2023-10-23 16:08:21 +02:00
Maycon Santos
7d8a69cc0c
Use account creator as inviter as a fallback ( #1225 )
...
When inviting a user using a service user PAT, we need to fall back to a known ID to get the user's email, which is used in the invite message.
2023-10-17 15:54:50 +02:00
Yury Gargay
32880c56a4
Implement SQLite Store using gorm and relational approach ( #1065 )
...
Restructure data handling for improved performance and flexibility.
Introduce 'G'-prefixed fields to represent Gorm relations, simplifying resource management.
Eliminate complexity in lookup tables for enhanced query and write speed.
Enable independent operations on data structures, requiring adjustments in the Store interface and Account Manager.
2023-10-12 15:42:36 +02:00
