fix(keycloak): project members sync to Keycloak

The implementation of ProjectRole is slightly different from AdminRole in which the members are stored around Project struture. I didn't took account of this difference in #1880 and #1879 leading to member addition to never materialize.

Signed-off-by: William Phetsinorath <william.phetsinorath-open@interieur.gouv.fr>

Author: shikanime

apps/server/src/resources/project-member/business.ts

@@ -44,17 +44,20 @@ export async function addMember(projectId: Project['id'], user: XOR<{ userId: st
   }
 
   await upsertMember({ projectId, userId: userInDb.id, roleIds: [] })
+  await hook.projectMember.upsert(projectId, userInDb.id)
   return listMembers(projectId)
 }
 
 export async function patchMembers(projectId: Project['id'], members: typeof projectMemberContract.patchMembers.body._type) {
   for (const member of members) {
     await upsertMember({ projectId, userId: member.userId, roleIds: member.roles })
+    await hook.projectMember.upsert(projectId, member.userId)
   }
   return listMembers(projectId)
 }
 
 export async function removeMember(projectId: Project['id'], userId: User['id']) {
+  await hook.projectMember.delete(projectId, userId)
   await deleteMember({ projectId, userId })
   return listMembers(projectId)
 }

apps/server/src/utils/hook-wrapper.ts

@@ -1,5 +1,5 @@
-import type { Cluster, Kubeconfig, Project, ProjectRole, Zone } from '@prisma/client'
-import type { ClusterObject, HookResult, KubeCluster, KubeUser, Project as ProjectPayload, RepoCreds, Repository, Store, ZoneObject } from '@cpn-console/hooks'
+import type { Cluster, Kubeconfig, Project, ProjectRole, Zone, ProjectMembers } from '@prisma/client'
+import type { ClusterObject, HookResult, KubeCluster, KubeUser, ProjectMemberPayload, Project as ProjectPayload, RepoCreds, Repository, Store, ZoneObject } from '@cpn-console/hooks'
 import { hooks } from '@cpn-console/hooks'
 import type { AsyncReturnType } from '@cpn-console/shared'
 import { ProjectAuthorized, getPermsByUserRoles, resourceListToDict } from '@cpn-console/shared'
@@ -139,6 +139,65 @@ const user = {
   },
 } as const
 
+const projectMember = {
+  upsert: async (projectId: Project['id'], userId: ProjectMembers['userId']) => {
+    const project = await getHookProjectInfos(projectId)
+    const store = dbToObj(await getAdminPlugin())
+
+    const member = project.members.find(m => m.userId === userId)
+    if (!member) throw new Error('Member not found')
+
+    const memberRoles = project.roles
+      .filter(role => member.roleIds.includes(role.id))
+      .map(role => ({ ...role, oidcGroup: role.oidcGroup ?? undefined }))
+
+    const payload = {
+      userId: member.userId,
+      roleIds: member.roleIds,
+      firstName: member.user.firstName,
+      lastName: member.user.lastName,
+      email: member.user.email,
+      type: member.user.type as 'human' | 'bot' | 'ghost',
+      createdAt: member.user.createdAt.toISOString(),
+      updatedAt: member.user.updatedAt.toISOString(),
+      lastLogin: member.user.lastLogin?.toISOString(),
+      projectId: project.id,
+      roles: memberRoles,
+      project: { id: project.id, slug: project.slug },
+    } as unknown as ProjectMemberPayload
+
+    return hooks.upsertProjectMember.execute(payload, store)
+  },
+  delete: async (projectId: Project['id'], userId: ProjectMembers['userId']) => {
+    const project = await getHookProjectInfos(projectId)
+    const store = dbToObj(await getAdminPlugin())
+
+    const member = project.members.find(m => m.userId === userId)
+    if (!member) throw new Error('Member not found')
+
+    const memberRoles = project.roles
+      .filter(role => member.roleIds.includes(role.id))
+      .map(role => ({ ...role, oidcGroup: role.oidcGroup ?? undefined }))
+
+    const payload = {
+      userId: member.userId,
+      roleIds: member.roleIds,
+      firstName: member.user.firstName,
+      lastName: member.user.lastName,
+      email: member.user.email,
+      type: member.user.type as 'human' | 'bot' | 'ghost',
+      createdAt: member.user.createdAt.toISOString(),
+      updatedAt: member.user.updatedAt.toISOString(),
+      lastLogin: member.user.lastLogin?.toISOString(),
+      projectId: project.id,
+      roles: memberRoles,
+      project: { id: project.id, slug: project.slug },
+    } as unknown as ProjectMemberPayload
+
+    return hooks.deleteProjectMember.execute(payload, store)
+  },
+} as const
+
 const projectRole = {
   upsert: async (roleId: ProjectRole['id']) => {
     const role = await getRole(roleId)
@@ -218,6 +277,8 @@ export const hook = {
   // @ts-ignore TODO voir comment opti la signature de la fonction
   projectRole: genericProxy(projectRole, { delete: ['upsert', 'delete'], upsert: ['delete'] }),
   // @ts-ignore TODO voir comment opti la signature de la fonction
+  projectMember: genericProxy(projectMember, { delete: ['upsert'], upsert: ['delete'] }),
+  // @ts-ignore TODO voir comment opti la signature de la fonction
   cluster: genericProxy(cluster, { delete: ['upsert', 'delete'], upsert: ['delete'] }),
   // @ts-ignore TODO voir comment opti la signature de la fonction
   zone: genericProxy(zone, { delete: ['upsert'], upsert: ['delete'] }),

packages/hooks/src/hooks/hook-project-member.ts

@@ -0,0 +1,19 @@
+import type { ProjectMember, ProjectRole } from '@cpn-console/shared'
+import type { Hook } from './hook.js'
+import { createHook } from './hook.js'
+
+export type ProjectMemberPayload = ProjectMember & {
+  roles: ProjectRole[]
+  project: { id: string, slug: string }
+  environments: {
+    id: string
+    name: string
+    permissions: {
+      ro: boolean
+      rw: boolean
+    }
+  }[]
+}
+
+export const upsertProjectMember: Hook<ProjectMemberPayload> = createHook()
+export const deleteProjectMember: Hook<ProjectMemberPayload> = createHook()

packages/hooks/src/hooks/index.ts

@@ -2,6 +2,7 @@ export * from './hook-cluster.js'
 export * from './hook-misc.js'
 export * from './hook-project.js'
 export * from './hook-project-role.js'
+export * from './hook-project-member.js'
 export * from './hook-user.js'
 export * from './hook-zone.js'
 export * from './hook-admin-role.js'

packages/shared/src/schemas/user.ts

@@ -31,5 +31,10 @@ export const MemberSchema = z.object({
     ,
   )
 
+export const ProjectMemberSchema = MemberSchema.and(z.object({
+  projectId: z.string().uuid(),
+}))
+
 export type User = Zod.infer<typeof UserSchema>
 export type Member = Zod.infer<typeof MemberSchema>
+export type ProjectMember = Zod.infer<typeof ProjectMemberSchema>

plugins/keycloak/src/functions.ts

@@ -1,4 +1,4 @@
-import type { AdminRole, Project, StepCall, UserEmail, ZoneObject } from '@cpn-console/hooks'
+import type { AdminRole, Project, StepCall, UserEmail, ZoneObject, ProjectMemberPayload } from '@cpn-console/hooks'
 import type { ProjectRole } from '@cpn-console/shared'
 import { generateRandomPassword, parseError, PluginResultBuilder } from '@cpn-console/hooks'
 import type GroupRepresentation from '@keycloak/keycloak-admin-client/lib/defs/groupRepresentation.js'
@@ -310,11 +310,7 @@ export const upsertProjectRole: StepCall<ProjectRole> = async ({ args: role }) =
   }
   try {
     const kcClient = await getkcClient()
-    const [projectName, pluginName, roleName] = role.oidcGroup.split('/').slice(1)
-    if (!projectName || !pluginName || !roleName) throw new Error('Invalid OIDC group format')
-    const projectGroup = await getOrCreateProjectGroup(kcClient, projectName)
-    const pluginGroup = await getOrCreateChildGroup(kcClient, projectGroup.id, pluginName)
-    await getOrCreateChildGroup(kcClient, pluginGroup.id, roleName)
+    await getOrCreateGroupByPath(kcClient, role.oidcGroup)
     return {
       status: {
         result: 'OK',
@@ -380,6 +376,63 @@ export const deleteProjectRole: StepCall<ProjectRole> = async ({ args: role }) =
   }
 }
 
+export const upsertProjectMember: StepCall<ProjectMemberPayload> = async ({ args: member }) => {
+  const pluginResult = new PluginResultBuilder('Synced')
+  try {
+    const kcClient = await getkcClient()
+
+    const projectGroup = await getOrCreateProjectGroup(kcClient, member.project.slug)
+    const consoleGroup = await getOrCreateChildGroup(kcClient, projectGroup.id, consoleGroupName)
+    const allRoleGroups = await getAllSubgroups(kcClient, consoleGroup.id, 0)
+    const userGroups = await kcClient.users.listGroups({ id: member.userId })
+
+    const userRolesOidcGroups = member.roles
+      .map(r => r.oidcGroup)
+      .filter((g): g is string => !!g)
+
+    // Sync Roles
+    for (const roleGroup of allRoleGroups) {
+      if (!roleGroup.id || !roleGroup.path) continue
+      const isMember = userGroups.some(ug => ug.id === roleGroup.id)
+      const shouldBeMember = userRolesOidcGroups.includes(roleGroup.path)
+
+      if (shouldBeMember && !isMember) {
+        await kcClient.users.addToGroup({ id: member.userId, groupId: roleGroup.id })
+      } else if (!shouldBeMember && isMember) {
+        await kcClient.users.delFromGroup({ id: member.userId, groupId: roleGroup.id })
+      }
+    }
+
+    return pluginResult.getResultObject()
+  } catch (error) {
+    return pluginResult.returnUnexpectedError(error)
+  }
+}
+
+export const deleteProjectMember: StepCall<ProjectMemberPayload> = async ({ args: member }) => {
+  const pluginResult = new PluginResultBuilder('Deleted')
+  try {
+    const kcClient = await getkcClient()
+    if (!member.userId) return pluginResult.getResultObject()
+
+    const projectGroup = await getGroupByName(kcClient, member.project.slug)
+    if (!projectGroup?.id) return pluginResult.getResultObject()
+
+    const userGroups = await kcClient.users.listGroups({ id: member.userId })
+    const projectGroups = userGroups.filter(g => g.path?.startsWith(projectGroup.path!))
+
+    for (const group of projectGroups) {
+      if (group.id) {
+        await kcClient.users.delFromGroup({ id: member.userId, groupId: group.id })
+      }
+    }
+
+    return pluginResult.getResultObject()
+  } catch (error) {
+    return pluginResult.returnUnexpectedError(error)
+  }
+}
+
 function getClientZoneId(zone: ZoneObject): string {
   return `argocd-${zone.slug}-zone`
 }

plugins/keycloak/src/index.ts

@@ -9,6 +9,8 @@ import {
   upsertZone,
   upsertAdminRole,
   deleteAdminRole,
+  upsertProjectMember,
+  deleteProjectMember,
 } from './functions.js'
 import infos from './infos.js'
 import monitor from './monitor.js'
@@ -29,6 +31,12 @@ export const plugin: Plugin = {
     upsertProjectRole: {
       steps: { main: upsertProjectRole },
     },
+    upsertProjectMember: {
+      steps: { main: upsertProjectMember },
+    },
+    deleteProjectMember: {
+      steps: { post: deleteProjectMember },
+    },
     upsertZone: {
       steps: { main: upsertZone },
     },