outline · EternalDeiwos · Sep 14, 2021 · Sep 14, 2021 · Sep 14, 2021
diff --git a/server/commands/accountProvisioner.js b/server/commands/accountProvisioner.js
@@ -7,10 +7,13 @@ import {
   AuthenticationProviderDisabledError,
 } from "../errors";
 import mailer from "../mailer";
-import { Collection, Team, User } from "../models";
+import { Collection, Team, User, Group, GroupUser } from "../models";
+import groupCreator from "./groupCreator";
 import teamCreator from "./teamCreator";
 import userCreator from "./userCreator";
 
+const Op = Sequelize.Op;
+
 type Props = {|
   ip: string,
   user: {|
@@ -24,6 +27,7 @@ type Props = {|
     subdomain: string,
     avatarUrl?: string,
   |},
+  groups: string[],
   authenticationProvider: {|
     name: string,
     providerId: string,
@@ -39,6 +43,11 @@ type Props = {|
 export type AccountProvisionerResult = {|
   user: User,
   team: Team,
+  groups: {|
+    group: Group,
+    membership: GroupUser,
+    isNewGroup: boolean,
+  |},
   isNewTeam: boolean,
   isNewUser: boolean,
 |};
@@ -47,12 +56,13 @@ export default async function accountProvisioner({
   ip,
   user: userParams,
   team: teamParams,
+  groups: groupNames = [],
   authenticationProvider: authenticationProviderParams,
   authentication: authenticationParams,
 }: Props): Promise<AccountProvisionerResult> {
-  let result;
+  let teamResult;
   try {
-    result = await teamCreator({
+    teamResult = await teamCreator({
       name: teamParams.name,
       domain: teamParams.domain,
       subdomain: teamParams.subdomain,
@@ -63,15 +73,16 @@ export default async function accountProvisioner({
     throw new AuthenticationError(err.message);
   }
 
-  invariant(result, "Team creator result must exist");
-  const { authenticationProvider, team, isNewTeam } = result;
+  invariant(teamResult, "Team creator result must exist");
+  const { authenticationProvider, team, isNewTeam } = teamResult;
 
   if (!authenticationProvider.enabled) {
     throw new AuthenticationProviderDisabledError();
   }
 
+  let userResult;
   try {
-    const result = await userCreator({
+    userResult = await userCreator({
       name: userParams.name,
       email: userParams.email,
       isAdmin: isNewTeam,
@@ -84,7 +95,7 @@ export default async function accountProvisioner({
       },
     });
 
-    const { isNewUser, user } = result;
+    const { isNewUser, user } = userResult;
 
     if (isNewUser) {
       await mailer.sendTemplate("welcome", {
@@ -108,13 +119,6 @@ export default async function accountProvisioner({
         await team.provisionFirstCollection(user.id);
       }
     }
-
-    return {
-      user,
-      team,
-      isNewUser,
-      isNewTeam,
-    };
   } catch (err) {
     if (err instanceof Sequelize.UniqueConstraintError) {
       const exists = await User.findOne({
@@ -136,4 +140,48 @@ export default async function accountProvisioner({
 
     throw err;
   }
+
+  invariant(userResult, "User creator result must exist");
+  const { user } = userResult;
+
+  let groups;
+  try {
+    groups = await Promise.all(
+      groupNames.map(async (name) =>
+        groupCreator({
+          name,
+          ip,
+          user,
+        })
+      )
+    );
+  } catch (err) {
+    // TODO
+    console.error(err);
+  }
+
+  // Remove group memberships that are not part of the current user info.
+  // This reconciles the user with whatever groups are passed in with the latest auth.
+  // At least one group must be specfied to enable this behaviour.
+  if (groupNames.length) {
+    try {
+      await GroupUser.destroy({
+        where: {
+          userId: userResult.user.id,
+          groupId: {
+            [Op.notIn]: groups.map((group) => group.membership.groupId),
+          },
+        },
+      });
+    } catch (err) {
+      // TODO
+      console.error(err);
+    }
+  }
+
+  return {
+    ...teamResult,
+    ...userResult,
+    groups,
+  };
 }
diff --git a/server/commands/groupCreator.js b/server/commands/groupCreator.js
@@ -0,0 +1,111 @@
+// @flow
+import Sequelize from "sequelize";
+import { Event, Group, GroupUser, User } from "../models";
+import { sequelize } from "../sequelize";
+
+const Op = Sequelize.Op;
+
+type GroupCreatorResult = {|
+  group: Group,
+  membership: GroupUser,
+  isNewGroup: boolean,
+|};
+
+export default async function groupCreator({
+  name,
+  ip,
+  user,
+}: {|
+  name: string,
+  ip: string,
+  user: User,
+|}): Promise<GroupCreatorResult> {
+  let isNewGroup = false;
+  let group = await Group.findOne({
+    where: {
+      name: { [Op.iLike]: name },
+    },
+  });
+
+  // The group does not already exist so we should create it
+  if (!group) {
+    let transaction = await sequelize.transaction();
+
+    try {
+      group = await Group.create(
+        {
+          name,
+          teamId: user.teamId,
+          createdById: user.id,
+        },
+        {
+          transaction,
+        }
+      );
+
+      await Event.create(
+        {
+          name: "groups.create",
+          actorId: user.id,
+          teamId: user.teamId,
+          modelId: group.id,
+          data: { name },
+          ip,
+        },
+        {
+          transaction,
+        }
+      );
+
+      await transaction.commit();
+
+      // reload to get default scope
+      group = await Group.findByPk(group.id);
+      isNewGroup = true;
+    } catch (err) {
+      await transaction.rollback();
+      throw err;
+    }
+  }
+
+  // Check for an existing group membership
+  let membership = await GroupUser.findOne({
+    where: {
+      groupId: group.id,
+      userId: user.id,
+    },
+  });
+
+  // User is not a member of the group, so we should add them
+  if (!membership) {
+    await group.addUser(user, {
+      through: { createdById: user.id },
+    });
+
+    membership = await GroupUser.findOne({
+      where: {
+        groupId: group.id,
+        userId: user.id,
+      },
+    });
+
+    await Event.create({
+      name: "groups.add_user",
+      userId: user.id,
+      teamId: user.teamId,
+      modelId: group.id,
+      actorId: user.id,
+      data: { name: user.name },
+      ip,
+    });
+
+    // reload to get default scope
+    group = await Group.findByPk(group.id);
+  }
+
+  return {
+    isNewGroup,
+    group,
+    membership,
+  };
+}
diff --git a/server/routes/auth/providers/oidc.js b/server/routes/auth/providers/oidc.js
@@ -21,6 +21,7 @@ const OIDC_CLIENT_SECRET = process.env.OIDC_CLIENT_SECRET;
 const OIDC_AUTH_URI = process.env.OIDC_AUTH_URI;
 const OIDC_TOKEN_URI = process.env.OIDC_TOKEN_URI;
 const OIDC_USERINFO_URI = process.env.OIDC_USERINFO_URI;
+const OIDC_GROUPS_CLAIM = process.env.OIDC_GROUPS_CLAIM || "groups";
 const OIDC_SCOPES = process.env.OIDC_SCOPES || "";
 const allowedDomains = getAllowedDomains();
 
@@ -90,6 +91,12 @@ if (OIDC_CLIENT_ID) {
           }
 
           const subdomain = domain.split(".")[0];
+          let groups = profile[OIDC_GROUPS_CLAIM] || [];
+
+          // Ensure groups is an array
+          if (typeof groups === "string") {
+            groups = groups.split(",");
+          }
 
           const result = await accountProvisioner({
             ip: req.ip,
@@ -104,6 +111,7 @@ if (OIDC_CLIENT_ID) {
               email: profile.email,
               avatarUrl: profile.picture,
             },
+            groups,
             authenticationProvider: {
               name: providerName,
               providerId: domain,