idpsync

type AGPLIDPSync struct {
	Logger  slog.Logger
	Manager *runtimeconfig.Manager

	SyncSettings
}

type DefaultOrgLegacySettings struct {
	GroupField          string
	GroupMapping        map[string]string
	GroupFilter         *regexp.Regexp
	CreateMissingGroups bool
}

type DeploymentSyncSettings struct {
	// OrganizationField selects the claim field to be used as the created user's
	// organizations. If the field is the empty string, then no organization updates
	// will ever come from the OIDC provider.
	OrganizationField string
	// OrganizationMapping controls how organizations returned by the OIDC provider get mapped
	OrganizationMapping map[string][]uuid.UUID
	// OrganizationAssignDefault will ensure all users that authenticate will be
	// placed into the default organization. This is mostly a hack to support
	// legacy deployments.
	OrganizationAssignDefault bool

	// GroupField at the deployment level is used for deployment level group claim
	// settings.
	GroupField string
	// GroupAllowList (if set) will restrict authentication to only users who
	// have at least one group in this list.
	// A map representation is used for easier lookup.
	GroupAllowList map[string]struct{}
	// Legacy deployment settings that only apply to the default org.
	Legacy DefaultOrgLegacySettings

	// SiteRoleField selects the claim field to be used as the created user's
	// roles. If the field is the empty string, then no site role updates
	// will ever come from the OIDC provider.
	SiteRoleField string
	// SiteRoleMapping controls how groups returned by the OIDC provider get mapped
	// to site roles within Coder.
	// map[oidcRoleName][]coderRoleName
	SiteRoleMapping map[string][]string
	// SiteDefaultRoles is the default set of site roles to assign to a user if role sync
	// is enabled.
	SiteDefaultRoles []string
}

type ExpectedGroup struct {
	OrganizationID uuid.UUID
	GroupID        *uuid.UUID
	GroupName      *string
}

type GroupParams struct {
	// SyncEntitled if false will skip syncing the user's groups
	SyncEntitled bool
	MergedClaims jwt.MapClaims
}

type GroupSyncSettings codersdk.GroupSyncSettings

type HTTPError struct {
	Code                 int
	Msg                  string
	Detail               string
	RenderStaticPage     bool
	RenderDetailMarkdown bool
}

type IDPSync interface {
	OrganizationSyncEntitled() bool
	OrganizationSyncSettings(ctx context.Context, db database.Store) (*OrganizationSyncSettings, error)
	UpdateOrganizationSyncSettings(ctx context.Context, db database.Store, settings OrganizationSyncSettings) error
	// OrganizationSyncEnabled returns true if all OIDC users are assigned
	// to organizations via org sync settings.
	// This is used to know when to disable manual org membership assignment.
	OrganizationSyncEnabled(ctx context.Context, db database.Store) bool
	// ParseOrganizationClaims takes claims from an OIDC provider, and returns the
	// organization sync params for assigning users into organizations.
	ParseOrganizationClaims(ctx context.Context, mergedClaims jwt.MapClaims) (OrganizationParams, *HTTPError)
	// SyncOrganizations assigns and removed users from organizations based on the
	// provided params.
	SyncOrganizations(ctx context.Context, tx database.Store, user database.User, params OrganizationParams) error

	GroupSyncEntitled() bool
	// ParseGroupClaims takes claims from an OIDC provider, and returns the params
	// for group syncing. Most of the logic happens in SyncGroups.
	ParseGroupClaims(ctx context.Context, mergedClaims jwt.MapClaims) (GroupParams, *HTTPError)
	// SyncGroups assigns and removes users from groups based on the provided params.
	SyncGroups(ctx context.Context, db database.Store, user database.User, params GroupParams) error
	// GroupSyncSettings is exposed for the API to implement CRUD operations
	// on the settings used by IDPSync. This entry is thread safe and can be
	// accessed concurrently. The settings are stored in the database.
	GroupSyncSettings(ctx context.Context, orgID uuid.UUID, db database.Store) (*GroupSyncSettings, error)
	UpdateGroupSyncSettings(ctx context.Context, orgID uuid.UUID, db database.Store, settings GroupSyncSettings) error

	// RoleSyncEntitled returns true if the deployment is entitled to role syncing.
	RoleSyncEntitled() bool
	// OrganizationRoleSyncEnabled returns true if the organization has role sync
	// enabled.
	OrganizationRoleSyncEnabled(ctx context.Context, db database.Store, org uuid.UUID) (bool, error)
	// SiteRoleSyncEnabled returns true if the deployment has role sync enabled
	// at the site level.
	SiteRoleSyncEnabled() bool
	// RoleSyncSettings is similar to GroupSyncSettings. See GroupSyncSettings for
	// rational.
	RoleSyncSettings(ctx context.Context, orgID uuid.UUID, db database.Store) (*RoleSyncSettings, error)
	UpdateRoleSyncSettings(ctx context.Context, orgID uuid.UUID, db database.Store, settings RoleSyncSettings) error
	// ParseRoleClaims takes claims from an OIDC provider, and returns the params
	// for role syncing. Most of the logic happens in SyncRoles.
	ParseRoleClaims(ctx context.Context, mergedClaims jwt.MapClaims) (RoleParams, *HTTPError)
	// SyncRoles assigns and removes users from roles based on the provided params.
	// Site & org roles are handled in this method.
	SyncRoles(ctx context.Context, db database.Store, user database.User, params RoleParams) error
}

type OrganizationParams struct {
	// SyncEntitled if false will skip syncing the user's organizations.
	SyncEntitled bool
	// MergedClaims are passed to the organization level for syncing
	MergedClaims jwt.MapClaims
}

type OrganizationSyncSettings struct {
	// Field selects the claim field to be used as the created user's
	// organizations. If the field is the empty string, then no organization updates
	// will ever come from the OIDC provider.
	Field string `json:"field"`
	// Mapping controls how organizations returned by the OIDC provider get mapped
	Mapping map[string][]uuid.UUID `json:"mapping"`
	// AssignDefault will ensure all users that authenticate will be
	// placed into the default organization. This is mostly a hack to support
	// legacy deployments.
	AssignDefault bool `json:"assign_default"`
}

type RoleParams struct {
	// SyncEntitled if false will skip syncing the user's roles at
	// all levels.
	SyncEntitled  bool
	SyncSiteWide  bool
	SiteWideRoles []string
	// MergedClaims are passed to the organization level for syncing
	MergedClaims jwt.MapClaims
}

type RoleSyncSettings codersdk.RoleSyncSettings

type SyncSettings struct {
	DeploymentSyncSettings

	Group        runtimeconfig.RuntimeEntry[*GroupSyncSettings]
	Role         runtimeconfig.RuntimeEntry[*RoleSyncSettings]
	Organization runtimeconfig.RuntimeEntry[*OrganizationSyncSettings]
}