refactor: SDK users, pm, and checks modules with submodule splits
Split users.rs (1157L) into mod.rs + provisioning.rs (mailbox, projects user, welcome email). Split pm.rs (1664L) into mod.rs + planka.rs (PlankaClient) + gitea_issues.rs (GiteaClient). Split checks.rs (1214L) into mod.rs + probes.rs (11 check functions + S3).
This commit is contained in:
656
sunbeam-sdk/src/users/mod.rs
Normal file
656
sunbeam-sdk/src/users/mod.rs
Normal file
@@ -0,0 +1,656 @@
|
||||
//! User management -- Kratos identity operations via port-forwarded admin API.
|
||||
|
||||
mod provisioning;
|
||||
pub use provisioning::{cmd_user_onboard, cmd_user_offboard};
|
||||
|
||||
use serde_json::Value;
|
||||
use std::io::Write;
|
||||
|
||||
use crate::error::{Result, ResultExt, SunbeamError};
|
||||
use crate::output::{ok, step, table, warn};
|
||||
|
||||
const SMTP_LOCAL_PORT: u16 = 10025;
|
||||
|
||||
// ---------------------------------------------------------------------------
|
||||
// Port-forward helper
|
||||
// ---------------------------------------------------------------------------
|
||||
|
||||
/// RAII guard that terminates the port-forward on drop.
|
||||
struct PortForward {
|
||||
child: tokio::process::Child,
|
||||
pub base_url: String,
|
||||
}
|
||||
|
||||
impl PortForward {
|
||||
async fn new(ns: &str, svc: &str, local_port: u16, remote_port: u16) -> Result<Self> {
|
||||
let ctx = crate::kube::context();
|
||||
let child = tokio::process::Command::new("kubectl")
|
||||
.arg(format!("--context={ctx}"))
|
||||
.args([
|
||||
"-n",
|
||||
ns,
|
||||
"port-forward",
|
||||
&format!("svc/{svc}"),
|
||||
&format!("{local_port}:{remote_port}"),
|
||||
])
|
||||
.stdout(std::process::Stdio::piped())
|
||||
.stderr(std::process::Stdio::piped())
|
||||
.spawn()
|
||||
.with_ctx(|| format!("Failed to spawn port-forward to {ns}/svc/{svc}"))?;
|
||||
|
||||
// Give the port-forward time to bind
|
||||
tokio::time::sleep(std::time::Duration::from_millis(1500)).await;
|
||||
|
||||
Ok(Self {
|
||||
child,
|
||||
base_url: format!("http://localhost:{local_port}"),
|
||||
})
|
||||
}
|
||||
|
||||
/// Convenience: Kratos admin (ory/kratos-admin 80 -> 4434).
|
||||
async fn kratos() -> Result<Self> {
|
||||
Self::new("ory", "kratos-admin", 4434, 80).await
|
||||
}
|
||||
}
|
||||
|
||||
impl Drop for PortForward {
|
||||
fn drop(&mut self) {
|
||||
let _ = self.child.start_kill();
|
||||
}
|
||||
}
|
||||
|
||||
// ---------------------------------------------------------------------------
|
||||
// HTTP helpers
|
||||
// ---------------------------------------------------------------------------
|
||||
|
||||
/// Make an HTTP request to an admin API endpoint.
|
||||
async fn api(
|
||||
base_url: &str,
|
||||
path: &str,
|
||||
method: &str,
|
||||
body: Option<&Value>,
|
||||
prefix: &str,
|
||||
ok_statuses: &[u16],
|
||||
) -> Result<Option<Value>> {
|
||||
let url = format!("{base_url}{prefix}{path}");
|
||||
let client = reqwest::Client::new();
|
||||
|
||||
let mut req = match method {
|
||||
"GET" => client.get(&url),
|
||||
"POST" => client.post(&url),
|
||||
"PUT" => client.put(&url),
|
||||
"PATCH" => client.patch(&url),
|
||||
"DELETE" => client.delete(&url),
|
||||
_ => bail!("Unsupported HTTP method: {method}"),
|
||||
};
|
||||
|
||||
req = req
|
||||
.header("Content-Type", "application/json")
|
||||
.header("Accept", "application/json");
|
||||
|
||||
if let Some(b) = body {
|
||||
req = req.json(b);
|
||||
}
|
||||
|
||||
let resp = req
|
||||
.send()
|
||||
.await
|
||||
.with_ctx(|| format!("HTTP {method} {url} failed"))?;
|
||||
let status = resp.status().as_u16();
|
||||
|
||||
if !resp.status().is_success() {
|
||||
if ok_statuses.contains(&status) {
|
||||
return Ok(None);
|
||||
}
|
||||
let err_text = resp.text().await.unwrap_or_default();
|
||||
bail!("API error {status}: {err_text}");
|
||||
}
|
||||
|
||||
let text = resp.text().await.unwrap_or_default();
|
||||
if text.is_empty() {
|
||||
return Ok(None);
|
||||
}
|
||||
let val: Value = serde_json::from_str(&text)
|
||||
.with_ctx(|| format!("Failed to parse API response as JSON: {text}"))?;
|
||||
Ok(Some(val))
|
||||
}
|
||||
|
||||
/// Shorthand: Kratos admin API call (prefix = "/admin").
|
||||
async fn kratos_api(
|
||||
base_url: &str,
|
||||
path: &str,
|
||||
method: &str,
|
||||
body: Option<&Value>,
|
||||
ok_statuses: &[u16],
|
||||
) -> Result<Option<Value>> {
|
||||
api(base_url, path, method, body, "/admin", ok_statuses).await
|
||||
}
|
||||
|
||||
// ---------------------------------------------------------------------------
|
||||
// Identity helpers
|
||||
// ---------------------------------------------------------------------------
|
||||
|
||||
/// Find identity by UUID or email search. Returns the identity JSON.
|
||||
async fn find_identity(base_url: &str, target: &str, required: bool) -> Result<Option<Value>> {
|
||||
// Looks like a UUID?
|
||||
if target.len() == 36 && target.chars().filter(|&c| c == '-').count() == 4 {
|
||||
let result = kratos_api(base_url, &format!("/identities/{target}"), "GET", None, &[]).await?;
|
||||
return Ok(result);
|
||||
}
|
||||
|
||||
// Search by email
|
||||
let result = kratos_api(
|
||||
base_url,
|
||||
&format!("/identities?credentials_identifier={target}&page_size=1"),
|
||||
"GET",
|
||||
None,
|
||||
&[],
|
||||
)
|
||||
.await?;
|
||||
|
||||
if let Some(Value::Array(arr)) = &result {
|
||||
if let Some(first) = arr.first() {
|
||||
return Ok(Some(first.clone()));
|
||||
}
|
||||
}
|
||||
|
||||
if required {
|
||||
return Err(SunbeamError::identity(format!("Identity not found: {target}")));
|
||||
}
|
||||
Ok(None)
|
||||
}
|
||||
|
||||
/// Build the PUT body for updating an identity, preserving all required fields.
|
||||
fn identity_put_body(identity: &Value, state: Option<&str>, extra: Option<Value>) -> Value {
|
||||
let mut body = serde_json::json!({
|
||||
"schema_id": identity["schema_id"],
|
||||
"traits": identity["traits"],
|
||||
"state": state.unwrap_or_else(|| identity.get("state").and_then(|v| v.as_str()).unwrap_or("active")),
|
||||
"metadata_public": identity.get("metadata_public").cloned().unwrap_or(Value::Null),
|
||||
"metadata_admin": identity.get("metadata_admin").cloned().unwrap_or(Value::Null),
|
||||
});
|
||||
|
||||
if let Some(extra_obj) = extra {
|
||||
if let (Some(base_map), Some(extra_map)) = (body.as_object_mut(), extra_obj.as_object()) {
|
||||
for (k, v) in extra_map {
|
||||
base_map.insert(k.clone(), v.clone());
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
body
|
||||
}
|
||||
|
||||
/// Generate a 24h recovery code. Returns (link, code).
|
||||
async fn generate_recovery(base_url: &str, identity_id: &str) -> Result<(String, String)> {
|
||||
let body = serde_json::json!({
|
||||
"identity_id": identity_id,
|
||||
"expires_in": "24h",
|
||||
});
|
||||
|
||||
let result = kratos_api(base_url, "/recovery/code", "POST", Some(&body), &[]).await?;
|
||||
|
||||
let recovery = result.unwrap_or_default();
|
||||
let link = recovery
|
||||
.get("recovery_link")
|
||||
.and_then(|v| v.as_str())
|
||||
.unwrap_or("")
|
||||
.to_string();
|
||||
let code = recovery
|
||||
.get("recovery_code")
|
||||
.and_then(|v| v.as_str())
|
||||
.unwrap_or("")
|
||||
.to_string();
|
||||
|
||||
Ok((link, code))
|
||||
}
|
||||
|
||||
/// Find the next sequential employee ID by scanning all employee identities.
|
||||
///
|
||||
/// Paginates through all identities using `page` and `page_size` params to
|
||||
/// avoid missing employee IDs when there are more than 200 identities.
|
||||
async fn next_employee_id(base_url: &str) -> Result<String> {
|
||||
let mut max_num: u64 = 0;
|
||||
let mut page = 1;
|
||||
loop {
|
||||
let result = kratos_api(
|
||||
base_url,
|
||||
&format!("/identities?page_size=200&page={page}"),
|
||||
"GET",
|
||||
None,
|
||||
&[],
|
||||
)
|
||||
.await?;
|
||||
|
||||
let identities = match result {
|
||||
Some(Value::Array(arr)) if !arr.is_empty() => arr,
|
||||
_ => break,
|
||||
};
|
||||
|
||||
for ident in &identities {
|
||||
if let Some(eid) = ident
|
||||
.get("traits")
|
||||
.and_then(|t| t.get("employee_id"))
|
||||
.and_then(|v| v.as_str())
|
||||
{
|
||||
if let Ok(n) = eid.parse::<u64>() {
|
||||
max_num = max_num.max(n);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
if identities.len() < 200 {
|
||||
break; // last page
|
||||
}
|
||||
page += 1;
|
||||
}
|
||||
|
||||
Ok((max_num + 1).to_string())
|
||||
}
|
||||
|
||||
// ---------------------------------------------------------------------------
|
||||
// Display helpers
|
||||
// ---------------------------------------------------------------------------
|
||||
|
||||
/// Extract a display name from identity traits (supports both default and employee schemas).
|
||||
fn display_name(traits: &Value) -> String {
|
||||
let given = traits
|
||||
.get("given_name")
|
||||
.and_then(|v| v.as_str())
|
||||
.unwrap_or("");
|
||||
let family = traits
|
||||
.get("family_name")
|
||||
.and_then(|v| v.as_str())
|
||||
.unwrap_or("");
|
||||
|
||||
if !given.is_empty() || !family.is_empty() {
|
||||
return format!("{given} {family}").trim().to_string();
|
||||
}
|
||||
|
||||
match traits.get("name") {
|
||||
Some(Value::Object(name_map)) => {
|
||||
let first = name_map
|
||||
.get("first")
|
||||
.and_then(|v| v.as_str())
|
||||
.unwrap_or("");
|
||||
let last = name_map
|
||||
.get("last")
|
||||
.and_then(|v| v.as_str())
|
||||
.unwrap_or("");
|
||||
format!("{first} {last}").trim().to_string()
|
||||
}
|
||||
Some(name) => name.as_str().unwrap_or("").to_string(),
|
||||
None => String::new(),
|
||||
}
|
||||
}
|
||||
|
||||
/// Extract the short ID prefix (first 8 chars + "...").
|
||||
fn short_id(id: &str) -> String {
|
||||
if id.len() >= 8 {
|
||||
format!("{}...", &id[..8])
|
||||
} else {
|
||||
id.to_string()
|
||||
}
|
||||
}
|
||||
|
||||
/// Get identity ID as a string from a JSON value.
|
||||
fn identity_id(identity: &Value) -> Result<String> {
|
||||
identity
|
||||
.get("id")
|
||||
.and_then(|v| v.as_str())
|
||||
.map(|s| s.to_string())
|
||||
.ok_or_else(|| SunbeamError::identity("Identity missing 'id' field"))
|
||||
}
|
||||
|
||||
// ---------------------------------------------------------------------------
|
||||
// Public commands
|
||||
// ---------------------------------------------------------------------------
|
||||
|
||||
pub async fn cmd_user_list(search: &str) -> Result<()> {
|
||||
step("Listing identities...");
|
||||
|
||||
let pf = PortForward::kratos().await?;
|
||||
let mut path = "/identities?page_size=20".to_string();
|
||||
if !search.is_empty() {
|
||||
path.push_str(&format!("&credentials_identifier={search}"));
|
||||
}
|
||||
let result = kratos_api(&pf.base_url, &path, "GET", None, &[]).await?;
|
||||
drop(pf);
|
||||
|
||||
let identities = match result {
|
||||
Some(Value::Array(arr)) => arr,
|
||||
_ => vec![],
|
||||
};
|
||||
|
||||
let rows: Vec<Vec<String>> = identities
|
||||
.iter()
|
||||
.map(|i| {
|
||||
let traits = i.get("traits").cloned().unwrap_or(Value::Object(Default::default()));
|
||||
let email = traits
|
||||
.get("email")
|
||||
.and_then(|v| v.as_str())
|
||||
.unwrap_or("")
|
||||
.to_string();
|
||||
let name = display_name(&traits);
|
||||
let state = i
|
||||
.get("state")
|
||||
.and_then(|v| v.as_str())
|
||||
.unwrap_or("active")
|
||||
.to_string();
|
||||
let id = i
|
||||
.get("id")
|
||||
.and_then(|v| v.as_str())
|
||||
.unwrap_or("");
|
||||
vec![short_id(id), email, name, state]
|
||||
})
|
||||
.collect();
|
||||
|
||||
println!("{}", table(&rows, &["ID", "Email", "Name", "State"]));
|
||||
Ok(())
|
||||
}
|
||||
|
||||
pub async fn cmd_user_get(target: &str) -> Result<()> {
|
||||
step(&format!("Getting identity: {target}"));
|
||||
|
||||
let pf = PortForward::kratos().await?;
|
||||
let identity = find_identity(&pf.base_url, target, true)
|
||||
.await?
|
||||
.ok_or_else(|| SunbeamError::identity("Identity not found"))?;
|
||||
drop(pf);
|
||||
|
||||
println!("{}", serde_json::to_string_pretty(&identity)?);
|
||||
Ok(())
|
||||
}
|
||||
|
||||
pub async fn cmd_user_create(email: &str, name: &str, schema_id: &str) -> Result<()> {
|
||||
step(&format!("Creating identity: {email}"));
|
||||
|
||||
let mut traits = serde_json::json!({ "email": email });
|
||||
if !name.is_empty() {
|
||||
let parts: Vec<&str> = name.splitn(2, ' ').collect();
|
||||
traits["name"] = serde_json::json!({
|
||||
"first": parts[0],
|
||||
"last": if parts.len() > 1 { parts[1] } else { "" },
|
||||
});
|
||||
}
|
||||
|
||||
let body = serde_json::json!({
|
||||
"schema_id": schema_id,
|
||||
"traits": traits,
|
||||
"state": "active",
|
||||
});
|
||||
|
||||
let pf = PortForward::kratos().await?;
|
||||
let identity = kratos_api(&pf.base_url, "/identities", "POST", Some(&body), &[])
|
||||
.await?
|
||||
.ok_or_else(|| SunbeamError::identity("Failed to create identity"))?;
|
||||
|
||||
let iid = identity_id(&identity)?;
|
||||
ok(&format!("Created identity: {iid}"));
|
||||
|
||||
let (link, code) = generate_recovery(&pf.base_url, &iid).await?;
|
||||
drop(pf);
|
||||
|
||||
ok("Recovery link (valid 24h):");
|
||||
println!("{link}");
|
||||
ok("Recovery code (enter on the page above):");
|
||||
println!("{code}");
|
||||
Ok(())
|
||||
}
|
||||
|
||||
pub async fn cmd_user_delete(target: &str) -> Result<()> {
|
||||
step(&format!("Deleting identity: {target}"));
|
||||
|
||||
eprint!("Delete identity '{target}'? This cannot be undone. [y/N] ");
|
||||
std::io::stderr().flush()?;
|
||||
let mut answer = String::new();
|
||||
std::io::stdin().read_line(&mut answer)?;
|
||||
if answer.trim().to_lowercase() != "y" {
|
||||
ok("Cancelled.");
|
||||
return Ok(());
|
||||
}
|
||||
|
||||
let pf = PortForward::kratos().await?;
|
||||
let identity = find_identity(&pf.base_url, target, true)
|
||||
.await?
|
||||
.ok_or_else(|| SunbeamError::identity("Identity not found"))?;
|
||||
let iid = identity_id(&identity)?;
|
||||
kratos_api(
|
||||
&pf.base_url,
|
||||
&format!("/identities/{iid}"),
|
||||
"DELETE",
|
||||
None,
|
||||
&[],
|
||||
)
|
||||
.await?;
|
||||
drop(pf);
|
||||
|
||||
ok("Deleted.");
|
||||
Ok(())
|
||||
}
|
||||
|
||||
pub async fn cmd_user_recover(target: &str) -> Result<()> {
|
||||
step(&format!("Generating recovery link for: {target}"));
|
||||
|
||||
let pf = PortForward::kratos().await?;
|
||||
let identity = find_identity(&pf.base_url, target, true)
|
||||
.await?
|
||||
.ok_or_else(|| SunbeamError::identity("Identity not found"))?;
|
||||
let iid = identity_id(&identity)?;
|
||||
let (link, code) = generate_recovery(&pf.base_url, &iid).await?;
|
||||
drop(pf);
|
||||
|
||||
ok("Recovery link (valid 24h):");
|
||||
println!("{link}");
|
||||
ok("Recovery code (enter on the page above):");
|
||||
println!("{code}");
|
||||
Ok(())
|
||||
}
|
||||
|
||||
pub async fn cmd_user_disable(target: &str) -> Result<()> {
|
||||
step(&format!("Disabling identity: {target}"));
|
||||
|
||||
let pf = PortForward::kratos().await?;
|
||||
let identity = find_identity(&pf.base_url, target, true)
|
||||
.await?
|
||||
.ok_or_else(|| SunbeamError::identity("Identity not found"))?;
|
||||
let iid = identity_id(&identity)?;
|
||||
|
||||
let put_body = identity_put_body(&identity, Some("inactive"), None);
|
||||
kratos_api(
|
||||
&pf.base_url,
|
||||
&format!("/identities/{iid}"),
|
||||
"PUT",
|
||||
Some(&put_body),
|
||||
&[],
|
||||
)
|
||||
.await?;
|
||||
kratos_api(
|
||||
&pf.base_url,
|
||||
&format!("/identities/{iid}/sessions"),
|
||||
"DELETE",
|
||||
None,
|
||||
&[],
|
||||
)
|
||||
.await?;
|
||||
drop(pf);
|
||||
|
||||
ok(&format!(
|
||||
"Identity {}... disabled and all Kratos sessions revoked.",
|
||||
&iid[..8.min(iid.len())]
|
||||
));
|
||||
warn("App sessions (docs/people) expire within SESSION_COOKIE_AGE -- currently 1h.");
|
||||
Ok(())
|
||||
}
|
||||
|
||||
pub async fn cmd_user_enable(target: &str) -> Result<()> {
|
||||
step(&format!("Enabling identity: {target}"));
|
||||
|
||||
let pf = PortForward::kratos().await?;
|
||||
let identity = find_identity(&pf.base_url, target, true)
|
||||
.await?
|
||||
.ok_or_else(|| SunbeamError::identity("Identity not found"))?;
|
||||
let iid = identity_id(&identity)?;
|
||||
|
||||
let put_body = identity_put_body(&identity, Some("active"), None);
|
||||
kratos_api(
|
||||
&pf.base_url,
|
||||
&format!("/identities/{iid}"),
|
||||
"PUT",
|
||||
Some(&put_body),
|
||||
&[],
|
||||
)
|
||||
.await?;
|
||||
drop(pf);
|
||||
|
||||
ok(&format!("Identity {}... re-enabled.", short_id(&iid)));
|
||||
Ok(())
|
||||
}
|
||||
|
||||
pub async fn cmd_user_set_password(target: &str, password: &str) -> Result<()> {
|
||||
step(&format!("Setting password for: {target}"));
|
||||
|
||||
let pf = PortForward::kratos().await?;
|
||||
let identity = find_identity(&pf.base_url, target, true)
|
||||
.await?
|
||||
.ok_or_else(|| SunbeamError::identity("Identity not found"))?;
|
||||
let iid = identity_id(&identity)?;
|
||||
|
||||
let extra = serde_json::json!({
|
||||
"credentials": {
|
||||
"password": {
|
||||
"config": {
|
||||
"password": password,
|
||||
}
|
||||
}
|
||||
}
|
||||
});
|
||||
let put_body = identity_put_body(&identity, None, Some(extra));
|
||||
kratos_api(
|
||||
&pf.base_url,
|
||||
&format!("/identities/{iid}"),
|
||||
"PUT",
|
||||
Some(&put_body),
|
||||
&[],
|
||||
)
|
||||
.await?;
|
||||
drop(pf);
|
||||
|
||||
ok(&format!("Password set for {}...", short_id(&iid)));
|
||||
Ok(())
|
||||
}
|
||||
|
||||
// ---------------------------------------------------------------------------
|
||||
// Tests
|
||||
// ---------------------------------------------------------------------------
|
||||
|
||||
#[cfg(test)]
|
||||
mod tests {
|
||||
use super::*;
|
||||
|
||||
#[test]
|
||||
fn test_display_name_employee_schema() {
|
||||
let traits = serde_json::json!({
|
||||
"email": "test@example.com",
|
||||
"given_name": "Alice",
|
||||
"family_name": "Smith",
|
||||
});
|
||||
assert_eq!(display_name(&traits), "Alice Smith");
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn test_display_name_default_schema() {
|
||||
let traits = serde_json::json!({
|
||||
"email": "test@example.com",
|
||||
"name": { "first": "Bob", "last": "Jones" },
|
||||
});
|
||||
assert_eq!(display_name(&traits), "Bob Jones");
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn test_display_name_empty() {
|
||||
let traits = serde_json::json!({ "email": "test@example.com" });
|
||||
assert_eq!(display_name(&traits), "");
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn test_display_name_given_only() {
|
||||
let traits = serde_json::json!({
|
||||
"given_name": "Alice",
|
||||
});
|
||||
assert_eq!(display_name(&traits), "Alice");
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn test_short_id() {
|
||||
assert_eq!(
|
||||
short_id("12345678-abcd-1234-abcd-123456789012"),
|
||||
"12345678..."
|
||||
);
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn test_short_id_short() {
|
||||
assert_eq!(short_id("abc"), "abc");
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn test_identity_put_body_preserves_fields() {
|
||||
let identity = serde_json::json!({
|
||||
"schema_id": "employee",
|
||||
"traits": { "email": "a@b.com" },
|
||||
"state": "active",
|
||||
"metadata_public": null,
|
||||
"metadata_admin": null,
|
||||
});
|
||||
|
||||
let body = identity_put_body(&identity, Some("inactive"), None);
|
||||
assert_eq!(body["state"], "inactive");
|
||||
assert_eq!(body["schema_id"], "employee");
|
||||
assert_eq!(body["traits"]["email"], "a@b.com");
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn test_identity_put_body_with_extra() {
|
||||
let identity = serde_json::json!({
|
||||
"schema_id": "default",
|
||||
"traits": { "email": "a@b.com" },
|
||||
"state": "active",
|
||||
});
|
||||
|
||||
let extra = serde_json::json!({
|
||||
"credentials": {
|
||||
"password": { "config": { "password": "s3cret" } }
|
||||
}
|
||||
});
|
||||
let body = identity_put_body(&identity, None, Some(extra));
|
||||
assert_eq!(body["state"], "active");
|
||||
assert!(body["credentials"]["password"]["config"]["password"] == "s3cret");
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn test_identity_put_body_default_state() {
|
||||
let identity = serde_json::json!({
|
||||
"schema_id": "default",
|
||||
"traits": {},
|
||||
"state": "inactive",
|
||||
});
|
||||
let body = identity_put_body(&identity, None, None);
|
||||
assert_eq!(body["state"], "inactive");
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn test_identity_id_extraction() {
|
||||
let identity = serde_json::json!({ "id": "12345678-abcd-1234-abcd-123456789012" });
|
||||
assert_eq!(
|
||||
identity_id(&identity).unwrap(),
|
||||
"12345678-abcd-1234-abcd-123456789012"
|
||||
);
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn test_identity_id_missing() {
|
||||
let identity = serde_json::json!({});
|
||||
assert!(identity_id(&identity).is_err());
|
||||
}
|
||||
}
|
||||
516
sunbeam-sdk/src/users/provisioning.rs
Normal file
516
sunbeam-sdk/src/users/provisioning.rs
Normal file
@@ -0,0 +1,516 @@
|
||||
//! User provisioning -- onboarding and offboarding workflows.
|
||||
|
||||
use serde_json::Value;
|
||||
use std::io::Write;
|
||||
|
||||
use crate::error::{Result, ResultExt, SunbeamError};
|
||||
use crate::output::{ok, step, warn};
|
||||
|
||||
use super::{
|
||||
api, find_identity, generate_recovery, identity_id, identity_put_body, kratos_api,
|
||||
next_employee_id, short_id, PortForward, SMTP_LOCAL_PORT,
|
||||
};
|
||||
|
||||
// ---------------------------------------------------------------------------
|
||||
// App-level provisioning (best-effort)
|
||||
// ---------------------------------------------------------------------------
|
||||
|
||||
/// Resolve a deployment to the name of a running pod.
|
||||
async fn pod_for_deployment(ns: &str, deployment: &str) -> Result<String> {
|
||||
let client = crate::kube::get_client().await?;
|
||||
let pods: kube::Api<k8s_openapi::api::core::v1::Pod> =
|
||||
kube::Api::namespaced(client.clone(), ns);
|
||||
|
||||
let label = format!("app.kubernetes.io/name={deployment}");
|
||||
let lp = kube::api::ListParams::default().labels(&label);
|
||||
let pod_list = pods
|
||||
.list(&lp)
|
||||
.await
|
||||
.with_ctx(|| format!("Failed to list pods for deployment {deployment} in {ns}"))?;
|
||||
|
||||
for pod in &pod_list.items {
|
||||
if let Some(status) = &pod.status {
|
||||
let phase = status.phase.as_deref().unwrap_or("");
|
||||
if phase == "Running" {
|
||||
if let Some(name) = &pod.metadata.name {
|
||||
return Ok(name.clone());
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// Fallback: try with app= label
|
||||
let label2 = format!("app={deployment}");
|
||||
let lp2 = kube::api::ListParams::default().labels(&label2);
|
||||
let pod_list2 = match pods.list(&lp2).await {
|
||||
Ok(list) => list,
|
||||
Err(_) => {
|
||||
return Err(SunbeamError::kube(format!(
|
||||
"No running pod found for deployment {deployment} in {ns}"
|
||||
)));
|
||||
}
|
||||
};
|
||||
|
||||
for pod in &pod_list2.items {
|
||||
if let Some(status) = &pod.status {
|
||||
let phase = status.phase.as_deref().unwrap_or("");
|
||||
if phase == "Running" {
|
||||
if let Some(name) = &pod.metadata.name {
|
||||
return Ok(name.clone());
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
Err(SunbeamError::kube(format!(
|
||||
"No running pod found for deployment {deployment} in {ns}"
|
||||
)))
|
||||
}
|
||||
|
||||
/// Create a mailbox in Messages via kubectl exec into the backend.
|
||||
async fn create_mailbox(email: &str, name: &str) {
|
||||
let parts: Vec<&str> = email.splitn(2, '@').collect();
|
||||
if parts.len() != 2 {
|
||||
warn(&format!("Invalid email for mailbox creation: {email}"));
|
||||
return;
|
||||
}
|
||||
let local_part = parts[0];
|
||||
let domain_part = parts[1];
|
||||
let display_name = if name.is_empty() { local_part } else { name };
|
||||
let _ = display_name; // used in Python for future features; kept for parity
|
||||
|
||||
step(&format!("Creating mailbox: {email}"));
|
||||
|
||||
let pod = match pod_for_deployment("lasuite", "messages-backend").await {
|
||||
Ok(p) => p,
|
||||
Err(e) => {
|
||||
warn(&format!("Could not find messages-backend pod: {e}"));
|
||||
return;
|
||||
}
|
||||
};
|
||||
|
||||
let script = format!(
|
||||
"mb, created = Mailbox.objects.get_or_create(\n local_part=\"{}\",\n domain=MailDomain.objects.get(name=\"{}\"),\n)\nprint(\"created\" if created else \"exists\")\n",
|
||||
local_part, domain_part,
|
||||
);
|
||||
|
||||
let cmd: Vec<&str> = vec!["python", "manage.py", "shell", "-c", &script];
|
||||
match crate::kube::kube_exec("lasuite", &pod, &cmd, Some("messages-backend")).await {
|
||||
Ok((0, output)) if output.contains("created") => {
|
||||
ok(&format!("Mailbox {email} created."));
|
||||
}
|
||||
Ok((0, output)) if output.contains("exists") => {
|
||||
ok(&format!("Mailbox {email} already exists."));
|
||||
}
|
||||
Ok((_, output)) => {
|
||||
warn(&format!(
|
||||
"Could not create mailbox (Messages backend may not be running): {output}"
|
||||
));
|
||||
}
|
||||
Err(e) => {
|
||||
warn(&format!("Could not create mailbox: {e}"));
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
/// Delete a mailbox and associated Django user in Messages.
|
||||
async fn delete_mailbox(email: &str) {
|
||||
let parts: Vec<&str> = email.splitn(2, '@').collect();
|
||||
if parts.len() != 2 {
|
||||
warn(&format!("Invalid email for mailbox deletion: {email}"));
|
||||
return;
|
||||
}
|
||||
let local_part = parts[0];
|
||||
let domain_part = parts[1];
|
||||
|
||||
step(&format!("Cleaning up mailbox: {email}"));
|
||||
|
||||
let pod = match pod_for_deployment("lasuite", "messages-backend").await {
|
||||
Ok(p) => p,
|
||||
Err(e) => {
|
||||
warn(&format!("Could not find messages-backend pod: {e}"));
|
||||
return;
|
||||
}
|
||||
};
|
||||
|
||||
let script = format!(
|
||||
"from django.contrib.auth import get_user_model\nUser = get_user_model()\ndeleted = 0\nfor mb in Mailbox.objects.filter(local_part=\"{local_part}\", domain__name=\"{domain_part}\"):\n mb.delete()\n deleted += 1\ntry:\n u = User.objects.get(email=\"{email}\")\n u.delete()\n deleted += 1\nexcept User.DoesNotExist:\n pass\nprint(f\"deleted {{deleted}}\")\n",
|
||||
);
|
||||
|
||||
let cmd: Vec<&str> = vec!["python", "manage.py", "shell", "-c", &script];
|
||||
match crate::kube::kube_exec("lasuite", &pod, &cmd, Some("messages-backend")).await {
|
||||
Ok((0, output)) if output.contains("deleted") => {
|
||||
ok("Mailbox and user cleaned up.");
|
||||
}
|
||||
Ok((_, output)) => {
|
||||
warn(&format!("Could not clean up mailbox: {output}"));
|
||||
}
|
||||
Err(e) => {
|
||||
warn(&format!("Could not clean up mailbox: {e}"));
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
/// Create a Projects (Planka) user and add them as manager of the Default project.
|
||||
async fn setup_projects_user(email: &str, name: &str) {
|
||||
step(&format!("Setting up Projects user: {email}"));
|
||||
|
||||
let pod = match pod_for_deployment("lasuite", "projects").await {
|
||||
Ok(p) => p,
|
||||
Err(e) => {
|
||||
warn(&format!("Could not find projects pod: {e}"));
|
||||
return;
|
||||
}
|
||||
};
|
||||
|
||||
let js = format!(
|
||||
"const knex = require('knex')({{client: 'pg', connection: process.env.DATABASE_URL}});\nasync function go() {{\n let user = await knex('user_account').where({{email: '{email}'}}).first();\n if (!user) {{\n const id = Date.now().toString();\n await knex('user_account').insert({{\n id, email: '{email}', name: '{name}', password: '',\n is_admin: true, is_sso: true, language: 'en-US',\n created_at: new Date(), updated_at: new Date()\n }});\n user = {{id}};\n console.log('user_created');\n }} else {{\n console.log('user_exists');\n }}\n const project = await knex('project').where({{name: 'Default'}}).first();\n if (project) {{\n const exists = await knex('project_manager').where({{project_id: project.id, user_id: user.id}}).first();\n if (!exists) {{\n await knex('project_manager').insert({{\n id: (Date.now()+1).toString(), project_id: project.id,\n user_id: user.id, created_at: new Date()\n }});\n console.log('manager_added');\n }} else {{\n console.log('manager_exists');\n }}\n }} else {{\n console.log('no_default_project');\n }}\n}}\ngo().then(() => process.exit(0)).catch(e => {{ console.error(e.message); process.exit(1); }});\n",
|
||||
);
|
||||
|
||||
let cmd: Vec<&str> = vec!["node", "-e", &js];
|
||||
match crate::kube::kube_exec("lasuite", &pod, &cmd, Some("projects")).await {
|
||||
Ok((0, output))
|
||||
if output.contains("manager_added") || output.contains("manager_exists") =>
|
||||
{
|
||||
ok("Projects user ready.");
|
||||
}
|
||||
Ok((0, output)) if output.contains("no_default_project") => {
|
||||
warn("No Default project found in Projects -- skip.");
|
||||
}
|
||||
Ok((_, output)) => {
|
||||
warn(&format!("Could not set up Projects user: {output}"));
|
||||
}
|
||||
Err(e) => {
|
||||
warn(&format!("Could not set up Projects user: {e}"));
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
/// Remove a user from Projects (Planka) -- delete memberships and soft-delete user.
|
||||
async fn cleanup_projects_user(email: &str) {
|
||||
step(&format!("Cleaning up Projects user: {email}"));
|
||||
|
||||
let pod = match pod_for_deployment("lasuite", "projects").await {
|
||||
Ok(p) => p,
|
||||
Err(e) => {
|
||||
warn(&format!("Could not find projects pod: {e}"));
|
||||
return;
|
||||
}
|
||||
};
|
||||
|
||||
let js = format!(
|
||||
"const knex = require('knex')({{client: 'pg', connection: process.env.DATABASE_URL}});\nasync function go() {{\n const user = await knex('user_account').where({{email: '{email}'}}).first();\n if (!user) {{ console.log('not_found'); return; }}\n await knex('board_membership').where({{user_id: user.id}}).del();\n await knex('project_manager').where({{user_id: user.id}}).del();\n await knex('user_account').where({{id: user.id}}).update({{deleted_at: new Date()}});\n console.log('cleaned');\n}}\ngo().then(() => process.exit(0)).catch(e => {{ console.error(e.message); process.exit(1); }});\n",
|
||||
);
|
||||
|
||||
let cmd: Vec<&str> = vec!["node", "-e", &js];
|
||||
match crate::kube::kube_exec("lasuite", &pod, &cmd, Some("projects")).await {
|
||||
Ok((0, output)) if output.contains("cleaned") => {
|
||||
ok("Projects user cleaned up.");
|
||||
}
|
||||
Ok((_, output)) => {
|
||||
warn(&format!("Could not clean up Projects user: {output}"));
|
||||
}
|
||||
Err(e) => {
|
||||
warn(&format!("Could not clean up Projects user: {e}"));
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// ---------------------------------------------------------------------------
|
||||
// Onboard
|
||||
// ---------------------------------------------------------------------------
|
||||
|
||||
/// Send a welcome email via cluster Postfix (port-forward to svc/postfix in lasuite).
|
||||
async fn send_welcome_email(
|
||||
domain: &str,
|
||||
email: &str,
|
||||
name: &str,
|
||||
recovery_link: &str,
|
||||
recovery_code: &str,
|
||||
job_title: &str,
|
||||
department: &str,
|
||||
) -> Result<()> {
|
||||
let greeting = if name.is_empty() {
|
||||
"Hi".to_string()
|
||||
} else {
|
||||
format!("Hi {name}")
|
||||
};
|
||||
|
||||
let joining_line = if !job_title.is_empty() && !department.is_empty() {
|
||||
format!(
|
||||
" You're joining as {job_title} in the {department} department."
|
||||
)
|
||||
} else {
|
||||
String::new()
|
||||
};
|
||||
|
||||
let body_text = format!(
|
||||
"{greeting},
|
||||
|
||||
Welcome to Sunbeam Studios!{joining_line} Your account has been created.
|
||||
|
||||
To set your password, open this link and enter the recovery code below:
|
||||
|
||||
Link: {recovery_link}
|
||||
Code: {recovery_code}
|
||||
|
||||
This link expires in 24 hours.
|
||||
|
||||
Once signed in you will be prompted to set up 2FA (mandatory).
|
||||
|
||||
After that, head to https://auth.{domain}/settings to set up your
|
||||
profile -- add your name, profile picture, and any other details.
|
||||
|
||||
Your services:
|
||||
Calendar: https://cal.{domain}
|
||||
Drive: https://drive.{domain}
|
||||
Mail: https://mail.{domain}
|
||||
Meet: https://meet.{domain}
|
||||
Projects: https://projects.{domain}
|
||||
Source Code: https://src.{domain}
|
||||
|
||||
Messages (Matrix):
|
||||
Download Element from https://element.io/download
|
||||
Open Element and sign in with a custom homeserver:
|
||||
Homeserver: https://messages.{domain}
|
||||
Use \"Sign in with Sunbeam Studios\" (SSO) to log in.
|
||||
|
||||
-- With Love & Warmth, Sunbeam Studios
|
||||
"
|
||||
);
|
||||
|
||||
use lettre::message::Mailbox;
|
||||
use lettre::{Message, SmtpTransport, Transport};
|
||||
|
||||
let from: Mailbox = format!("Sunbeam Studios <noreply@{domain}>")
|
||||
.parse()
|
||||
.map_err(|e| SunbeamError::Other(format!("Invalid from address: {e}")))?;
|
||||
let to: Mailbox = email
|
||||
.parse()
|
||||
.map_err(|e| SunbeamError::Other(format!("Invalid recipient address: {e}")))?;
|
||||
|
||||
let message = Message::builder()
|
||||
.from(from)
|
||||
.to(to)
|
||||
.subject("Welcome to Sunbeam Studios -- Set Your Password")
|
||||
.body(body_text)
|
||||
.ctx("Failed to build email message")?;
|
||||
|
||||
let _pf = PortForward::new("lasuite", "postfix", SMTP_LOCAL_PORT, 25).await?;
|
||||
|
||||
let mailer = SmtpTransport::builder_dangerous("localhost")
|
||||
.port(SMTP_LOCAL_PORT)
|
||||
.build();
|
||||
|
||||
tokio::task::spawn_blocking(move || {
|
||||
mailer
|
||||
.send(&message)
|
||||
.map_err(|e| SunbeamError::Other(format!("Failed to send welcome email via SMTP: {e}")))
|
||||
})
|
||||
.await
|
||||
.map_err(|e| SunbeamError::Other(format!("Email send task panicked: {e}")))??;
|
||||
|
||||
ok(&format!("Welcome email sent to {email}"));
|
||||
Ok(())
|
||||
}
|
||||
|
||||
#[allow(clippy::too_many_arguments)]
|
||||
pub async fn cmd_user_onboard(
|
||||
email: &str,
|
||||
name: &str,
|
||||
schema_id: &str,
|
||||
send_email: bool,
|
||||
notify: &str,
|
||||
job_title: &str,
|
||||
department: &str,
|
||||
office_location: &str,
|
||||
hire_date: &str,
|
||||
manager: &str,
|
||||
) -> Result<()> {
|
||||
step(&format!("Onboarding: {email}"));
|
||||
|
||||
let pf = PortForward::kratos().await?;
|
||||
|
||||
let (iid, recovery_link, recovery_code, is_new) = {
|
||||
let existing = find_identity(&pf.base_url, email, false).await?;
|
||||
|
||||
if let Some(existing) = existing {
|
||||
let iid = identity_id(&existing)?;
|
||||
warn(&format!("Identity already exists: {}...", short_id(&iid)));
|
||||
step("Generating fresh recovery link...");
|
||||
let (link, code) = generate_recovery(&pf.base_url, &iid).await?;
|
||||
(iid, link, code, false)
|
||||
} else {
|
||||
let mut traits = serde_json::json!({ "email": email });
|
||||
if !name.is_empty() {
|
||||
let parts: Vec<&str> = name.splitn(2, ' ').collect();
|
||||
traits["given_name"] = Value::String(parts[0].to_string());
|
||||
traits["family_name"] =
|
||||
Value::String(if parts.len() > 1 { parts[1] } else { "" }.to_string());
|
||||
}
|
||||
|
||||
let mut employee_id = String::new();
|
||||
if schema_id == "employee" {
|
||||
employee_id = next_employee_id(&pf.base_url).await?;
|
||||
traits["employee_id"] = Value::String(employee_id.clone());
|
||||
if !job_title.is_empty() {
|
||||
traits["job_title"] = Value::String(job_title.to_string());
|
||||
}
|
||||
if !department.is_empty() {
|
||||
traits["department"] = Value::String(department.to_string());
|
||||
}
|
||||
if !office_location.is_empty() {
|
||||
traits["office_location"] = Value::String(office_location.to_string());
|
||||
}
|
||||
if !hire_date.is_empty() {
|
||||
traits["hire_date"] = Value::String(hire_date.to_string());
|
||||
}
|
||||
if !manager.is_empty() {
|
||||
traits["manager"] = Value::String(manager.to_string());
|
||||
}
|
||||
}
|
||||
|
||||
let body = serde_json::json!({
|
||||
"schema_id": schema_id,
|
||||
"traits": traits,
|
||||
"state": "active",
|
||||
"verifiable_addresses": [{
|
||||
"value": email,
|
||||
"verified": true,
|
||||
"via": "email",
|
||||
}],
|
||||
});
|
||||
|
||||
let identity = kratos_api(&pf.base_url, "/identities", "POST", Some(&body), &[])
|
||||
.await?
|
||||
.ok_or_else(|| SunbeamError::identity("Failed to create identity"))?;
|
||||
|
||||
let iid = identity_id(&identity)?;
|
||||
ok(&format!("Created identity: {iid}"));
|
||||
if !employee_id.is_empty() {
|
||||
ok(&format!("Employee #{employee_id}"));
|
||||
}
|
||||
|
||||
// Kratos ignores verifiable_addresses on POST -- PATCH to mark verified
|
||||
let patch_body = serde_json::json!([
|
||||
{"op": "replace", "path": "/verifiable_addresses/0/verified", "value": true},
|
||||
{"op": "replace", "path": "/verifiable_addresses/0/status", "value": "completed"},
|
||||
]);
|
||||
kratos_api(
|
||||
&pf.base_url,
|
||||
&format!("/identities/{iid}"),
|
||||
"PATCH",
|
||||
Some(&patch_body),
|
||||
&[],
|
||||
)
|
||||
.await?;
|
||||
|
||||
let (link, code) = generate_recovery(&pf.base_url, &iid).await?;
|
||||
(iid, link, code, true)
|
||||
}
|
||||
};
|
||||
|
||||
drop(pf);
|
||||
|
||||
// Provision app-level accounts for new users
|
||||
if is_new {
|
||||
create_mailbox(email, name).await;
|
||||
setup_projects_user(email, name).await;
|
||||
}
|
||||
|
||||
if send_email {
|
||||
let domain = crate::kube::get_domain().await?;
|
||||
let recipient = if notify.is_empty() { email } else { notify };
|
||||
send_welcome_email(
|
||||
&domain, recipient, name, &recovery_link, &recovery_code,
|
||||
job_title, department,
|
||||
)
|
||||
.await?;
|
||||
}
|
||||
|
||||
ok(&format!("Identity ID: {iid}"));
|
||||
ok("Recovery link (valid 24h):");
|
||||
println!("{recovery_link}");
|
||||
ok("Recovery code:");
|
||||
println!("{recovery_code}");
|
||||
Ok(())
|
||||
}
|
||||
|
||||
// ---------------------------------------------------------------------------
|
||||
// Offboard
|
||||
// ---------------------------------------------------------------------------
|
||||
|
||||
pub async fn cmd_user_offboard(target: &str) -> Result<()> {
|
||||
step(&format!("Offboarding: {target}"));
|
||||
|
||||
eprint!("Offboard '{target}'? This will disable the account and revoke all sessions. [y/N] ");
|
||||
std::io::stderr().flush()?;
|
||||
let mut answer = String::new();
|
||||
std::io::stdin().read_line(&mut answer)?;
|
||||
if answer.trim().to_lowercase() != "y" {
|
||||
ok("Cancelled.");
|
||||
return Ok(());
|
||||
}
|
||||
|
||||
let pf = PortForward::kratos().await?;
|
||||
let identity = find_identity(&pf.base_url, target, true)
|
||||
.await?
|
||||
.ok_or_else(|| SunbeamError::identity("Identity not found"))?;
|
||||
let iid = identity_id(&identity)?;
|
||||
|
||||
step("Disabling identity...");
|
||||
let put_body = identity_put_body(&identity, Some("inactive"), None);
|
||||
kratos_api(
|
||||
&pf.base_url,
|
||||
&format!("/identities/{iid}"),
|
||||
"PUT",
|
||||
Some(&put_body),
|
||||
&[],
|
||||
)
|
||||
.await?;
|
||||
ok(&format!("Identity {}... disabled.", short_id(&iid)));
|
||||
|
||||
step("Revoking Kratos sessions...");
|
||||
kratos_api(
|
||||
&pf.base_url,
|
||||
&format!("/identities/{iid}/sessions"),
|
||||
"DELETE",
|
||||
None,
|
||||
&[404],
|
||||
)
|
||||
.await?;
|
||||
ok("Kratos sessions revoked.");
|
||||
|
||||
step("Revoking Hydra consent sessions...");
|
||||
{
|
||||
let hydra_pf = PortForward::new("ory", "hydra-admin", 14445, 4445).await?;
|
||||
api(
|
||||
&hydra_pf.base_url,
|
||||
&format!("/oauth2/auth/sessions/consent?subject={iid}&all=true"),
|
||||
"DELETE",
|
||||
None,
|
||||
"/admin",
|
||||
&[404],
|
||||
)
|
||||
.await?;
|
||||
}
|
||||
ok("Hydra consent sessions revoked.");
|
||||
|
||||
drop(pf);
|
||||
|
||||
// Clean up Messages mailbox and Projects user
|
||||
let email = identity
|
||||
.get("traits")
|
||||
.and_then(|t| t.get("email"))
|
||||
.and_then(|v| v.as_str())
|
||||
.unwrap_or("");
|
||||
if !email.is_empty() {
|
||||
delete_mailbox(email).await;
|
||||
cleanup_projects_user(email).await;
|
||||
}
|
||||
|
||||
ok(&format!("Offboarding complete for {}...", short_id(&iid)));
|
||||
warn("Existing access tokens expire within ~1h (Hydra TTL).");
|
||||
warn("App sessions (docs/people) expire within SESSION_COOKIE_AGE (~1h).");
|
||||
Ok(())
|
||||
}
|
||||
Reference in New Issue
Block a user