snapshot of https://github.com/cortezaproject/corteza.git (2024.9.x, 2026-09-18; blobs > 131072B omitted)

server/pkg/provision/auth.go

@@ -0,0 +1,337 @@
+package provision
+
+import (
+	"context"
+	"fmt"
+	"os"
+	"regexp"
+	"strings"
+
+	internalAuth "github.com/cortezaproject/corteza/server/pkg/auth"
+	"github.com/cortezaproject/corteza/server/pkg/handle"
+	"github.com/cortezaproject/corteza/server/pkg/id"
+	"github.com/cortezaproject/corteza/server/pkg/logger"
+	"github.com/cortezaproject/corteza/server/pkg/mail"
+	"github.com/cortezaproject/corteza/server/pkg/options"
+	"github.com/cortezaproject/corteza/server/system/service"
+	"go.uber.org/zap"
+
+	"github.com/cortezaproject/corteza/server/pkg/errors"
+	"github.com/cortezaproject/corteza/server/pkg/rand"
+	"github.com/cortezaproject/corteza/server/store"
+	"github.com/cortezaproject/corteza/server/system/types"
+)
+
+var (
+	nextID = func() uint64 {
+		return id.Next()
+	}
+)
+
+// Sets email-related settings (if not set) under "auth.internal..."
+func emailSettings(ctx context.Context, s store.Storer) error {
+	var (
+		val, has      = os.LookupEnv("SMTP_HOST")
+		canSendEmails = has && len(val) > 0
+	)
+
+	// List of name-value pairs we need to iterate and set
+	ss := types.SettingValueSet{
+		types.MakeSettingValue(
+			"auth.internal.signup.email-confirmation-required",
+			canSendEmails,
+		),
+
+		types.MakeSettingValue(
+			"auth.internal.password-reset.enabled",
+			canSendEmails,
+		),
+	}
+
+	return s.Tx(ctx, func(ctx context.Context, s store.Storer) error {
+		return ss.Walk(func(setting *types.SettingValue) error {
+			_, err := store.LookupSettingValueByNameOwnedBy(ctx, s, setting.Name, 0)
+			if errors.IsNotFound(err) {
+				setting.UpdatedAt = *now()
+				return store.CreateSettingValue(ctx, s, setting)
+			}
+
+			return err
+		})
+	})
+}
+
+// addAuthSuperUsers assigns BYPASS roles to users from AUTH_PROVISION_SUPER_USER value
+// When in Production, Corteza should stop and report an error.
+func addAuthSuperUsers(ctx context.Context, log *zap.Logger, s store.Storer, authOpt options.AuthOpt) (err error) {
+	log.Info("provision start")
+	defer log.Info("provision end")
+
+	var (
+		envOpt = options.Environment()
+	)
+
+	if authOpt.ProvisionSuperUser == "" {
+		return nil
+	}
+
+	if envOpt.IsProduction() {
+		log.Warn(fmt.Sprint("when in production environment (ENVIRONMENT=production) you cannot provision " +
+			"super users; set the environment to dev (ENVIRONMENT=dev) to provision super users"))
+		return
+	}
+
+	users := strings.Split(authOpt.ProvisionSuperUser, ";")
+
+	for _, usr := range users {
+		u := prepareUser(usr)
+
+		//check if the email address is valid
+		if !mail.IsValidAddress(u.Email) {
+			log.Warn(fmt.Sprintf("Email address %s is invalid", u.Email))
+			continue
+		}
+
+		// skip existing email
+		_, err = s.LookupUserByEmail(ctx, u.Email)
+		if err != store.ErrNotFound {
+			log.Warn(fmt.Sprintf("Email address already %s exists", u.Email))
+			continue
+		}
+
+		// skip existing handle
+		_, err = s.LookupUserByHandle(ctx, u.Handle)
+		if err != store.ErrNotFound {
+			log.Warn(fmt.Sprintf("Handle %s already exists", u.Handle))
+			continue
+		}
+
+		err = store.Tx(ctx, s, func(ctx context.Context, s store.Storer) (err error) {
+			if err = store.CreateUser(ctx, s, u); err != nil {
+				return err
+			}
+
+			if err = service.SetPasswordCredentials(ctx, s, u.ID, u.Email); err != nil {
+				return err
+			}
+
+			log.Warn(fmt.Sprintf("User {userID: %d, email: %s} created", u.ID, u.Email))
+
+			//assign the user a bypass role
+			for _, r := range internalAuth.BypassRoles() {
+				m := &types.RoleMember{Resource: fmt.Sprintf("corteza::system:user/%d", u.ID), RoleID: r.ID}
+				if err = store.CreateRoleMember(ctx, s, m); err != nil {
+					return err
+				}
+			}
+
+			return
+		})
+
+		if err != nil {
+			return err
+		}
+	}
+
+	return
+}
+
+// prepareUser creates and fills a new user depending on the number of arguments provided
+func prepareUser(user string) *types.User {
+	u := &types.User{
+		ID:        nextID(),
+		CreatedAt: *now(),
+	}
+
+	usr := strings.Split(user, ",")
+	u.Email = usr[0]
+	u.EmailConfirmed = true
+	u.Handle = createUserHandle(u)
+
+	if len(usr) > 1 {
+		u.Handle = usr[1]
+	}
+
+	if len(usr) > 2 {
+		u.Name = usr[2]
+	}
+
+	return u
+}
+
+func createUserHandle(u *types.User) (hdl string) {
+	hdl, _ = handle.Cast(
+		func(lookup string) bool {
+			return true
+		},
+		// use email w/o domain
+		regexp.
+			MustCompile("(@.*)$").
+			ReplaceAllString(u.Email, ""),
+	)
+
+	return hdl
+}
+
+func defaultUserGroup(ctx context.Context, log *zap.Logger, s store.UserGroups, authOpt options.AuthOpt) error {
+	log.Info("provision start")
+	defer log.Info("provision end")
+
+	g := &types.UserGroup{
+		ID:     id.Next(),
+		Handle: authOpt.DefaultUserGroup,
+		Meta: &types.UserGroupMeta{
+			Short:       "Default User Group",
+			Description: "The default user group",
+		},
+		CreatedAt: *now(),
+	}
+
+	_, err := store.LookupUserGroupByHandle(ctx, s, g.Handle)
+	if err == nil {
+		return nil
+	}
+
+	if !errors.IsNotFound(err) {
+		return err
+	}
+
+	if err = store.CreateUserGroup(ctx, s, g); err != nil {
+		return err
+	}
+
+	log.Info(
+		"Added default user group",
+		zap.String("name", g.Meta.Short),
+		zap.String("handle", g.Handle),
+		logger.Uint64("userGroupID", g.ID),
+	)
+
+	g = &types.UserGroup{
+		ID:     id.Next(),
+		Handle: authOpt.DefaultSubUserGroup,
+		Config: &types.UserGroupConfig{
+			Paths: []types.UserGroupPath{{
+				SelfID: g.ID,
+				Name:   "",
+			}},
+		},
+		Meta: &types.UserGroupMeta{
+			Short:       "Default Sub-User Group",
+			Description: "The default sub-user group",
+		},
+		CreatedAt: *now(),
+	}
+	err = store.CreateUserGroup(ctx, s, g)
+	if err != nil {
+		return err
+	}
+
+	log.Info(
+		"Added default sub-user group",
+		zap.String("name", g.Meta.Short),
+		zap.String("handle", g.Handle),
+		logger.Uint64("userGroupID", g.ID),
+	)
+
+	return nil
+}
+
+// defaultAuthClient checks if default client exists (handle = AUTH_DEFAULT_CLIENT) and adds it
+func defaultAuthClient(ctx context.Context, log *zap.Logger, s store.Storer, authOpt options.AuthOpt) error {
+	log.Info("provision start")
+	defer log.Info("provision end")
+
+	if authOpt.DefaultClient == "" {
+		// Default client not set
+		return nil
+	}
+
+	// Already provisioned; bail out before the user group lookups so a
+	// deleted group can not fail provisioning on every subsequent boot
+	if _, err := store.LookupAuthClientByHandle(ctx, s, authOpt.DefaultClient); err == nil {
+		return nil
+	} else if !errors.IsNotFound(err) {
+		return err
+	}
+
+	var (
+		ug  *types.UserGroup
+		err error
+	)
+
+	if authOpt.DefaultSubUserGroup != "" {
+		ug, err = store.LookupUserGroupByHandle(ctx, s, authOpt.DefaultSubUserGroup)
+		if err != nil && !errors.IsNotFound(err) {
+			return err
+		}
+	}
+
+	if ug == nil && authOpt.DefaultUserGroup != "" {
+		ug, err = store.LookupUserGroupByHandle(ctx, s, authOpt.DefaultUserGroup)
+		if err != nil && !errors.IsNotFound(err) {
+			return err
+		}
+	}
+
+	if ug == nil {
+		// Missing/deleted group; create the client without it instead of aborting
+		log.Warn(
+			"default (sub) user group not found or deleted, provisioning default auth client without a security user group",
+			zap.String("subUserGroup", authOpt.DefaultSubUserGroup),
+			zap.String("userGroup", authOpt.DefaultUserGroup),
+		)
+	}
+
+	var ugID uint64
+	if ug != nil {
+		ugID = ug.ID
+	}
+
+	c := &types.AuthClient{
+		ID:     id.Next(),
+		Handle: authOpt.DefaultClient,
+		Meta: &types.AuthClientMeta{
+			Name: "Corteza Web Applications",
+		},
+		ValidGrant: "authorization_code",
+		RedirectURI: func() string {
+			// Disabling protection by redirection URL for now, it caused too much confusion on simple setups
+			//baseURL, _ := url.Parse(authOpt.BaseURL)
+			//return fmt.Sprintf("%s://%s", baseURL.Scheme, baseURL.Hostname())
+			return ""
+		}(),
+
+		Secret:  string(rand.Bytes(64)),
+		Scope:   "profile api",
+		Enabled: true,
+		Trusted: true,
+		Security: &types.AuthClientSecurity{
+			UserGroup: ugID,
+		},
+		Labels:    nil,
+		CreatedAt: *now(),
+	}
+
+	_, err = store.LookupAuthClientByHandle(ctx, s, c.Handle)
+	if err == nil {
+		return nil
+	}
+
+	if !errors.IsNotFound(err) {
+		return err
+	}
+
+	if err = store.CreateAuthClient(ctx, s, c); err != nil {
+		return err
+	}
+
+	log.Info(
+		"Added OAuth2 client",
+		zap.String("name", c.Meta.Name),
+		zap.String("redirectURI", c.RedirectURI),
+		logger.Uint64("clientId", c.ID),
+	)
+
+	return nil
+}