Niklas Ye
a27ff49171
terdut can now sign people in through any OIDC provider (written against Authentik), and let groups at the provider decide who may sign in, which teams they belong to and whether they administer the install. Password login keeps working alongside it; TERDUT_PASSWORD_LOGIN=false turns it off, and is refused at startup unless SSO is configured. With no TERDUT_OIDC_* setting nothing changes, so every existing install behaves as before. Identity is (issuer, subject), never email or username: those are mutable at the provider and a recycled address must not inherit an account. An existing user is linked by email only when the provider marks it verified, or TERDUT_OIDC_TRUST_EMAIL is set, which Authentik needs. Group grants are marked source='oidc' on team_members and users, and the sync changes only those rows. Hand-made memberships and administrators are left alone, and the sync bypasses the last-owner and last-admin guards because the provider is the source of truth for what it grants. Editing managed access by hand is refused with 409, since the next sign-in would undo it. The web UI badges it as SSO and disables the controls. Groups are read only at sign-in, so an SSO session carries a hard ceiling (sessions.max_expires_at, 12h by default) that sliding never extends. There is no refresh token, which means API keys of somebody removed at the provider stay valid until an administrator disables the user. That is accepted and documented, not fixed. A client with no browser, the TUI over SSH, signs in with a device code run by terdut itself (POST /api/oidc/device and /device/token), so the terminal never talks to the provider and ends up with the ordinary terdut_session cookie. Only a browser session can approve a code; an API key cannot. /device?code= sends a signed-out visitor through sign-in and back, which is what oidc_logins.next is for. oauth2 is pinned to v0.36.0: v0.37 needs Go 1.26 and the Dockerfile builds on 1.25. Migrations 011 and 012 add tables and defaulted columns only.
63 lines
2.0 KiB
Go
63 lines
2.0 KiB
Go
package models
|
|
|
|
import "time"
|
|
|
|
// Team is the unit of tenancy: it owns its incidents, alerts, schedule and
|
|
// integrations, and a user sees exactly the teams they belong to.
|
|
type Team struct {
|
|
ID int64 `json:"id"`
|
|
Name string `json:"name"`
|
|
CreatedAt time.Time `json:"created_at"`
|
|
|
|
// Role is the caller's own role in this team, populated when a team is
|
|
// listed for a particular person. Empty when nobody in particular is
|
|
// asking, as in the admin listing.
|
|
Role string `json:"role,omitempty"`
|
|
|
|
// Source says who granted Role, on the endpoint that lists one user's teams:
|
|
// "manual", or "oidc" when the identity provider's groups did.
|
|
Source string `json:"source,omitempty"`
|
|
}
|
|
|
|
// Team roles. An owner configures the team — its schedule, its integrations and
|
|
// who is in it. A member works its incidents.
|
|
const (
|
|
RoleOwner = "owner"
|
|
RoleMember = "member"
|
|
)
|
|
|
|
// TeamMember is one person's membership of one team.
|
|
type TeamMember struct {
|
|
TeamID int64 `json:"team_id"`
|
|
UserID int64 `json:"user_id"`
|
|
Username string `json:"username"`
|
|
Role string `json:"role"`
|
|
JoinedAt time.Time `json:"joined_at"`
|
|
|
|
// Source is who granted the membership: "manual", or "oidc" when the
|
|
// identity provider's groups did and only they can change it.
|
|
Source string `json:"source"`
|
|
}
|
|
|
|
// Integration is how alerts get in, and the only thing that says which team an
|
|
// arriving alert belongs to.
|
|
type Integration struct {
|
|
ID int64 `json:"id"`
|
|
TeamID int64 `json:"team_id"`
|
|
Kind string `json:"kind"`
|
|
Name string `json:"name"`
|
|
CreatedAt time.Time `json:"created_at"`
|
|
LastUsedAt *time.Time `json:"last_used_at,omitempty"`
|
|
|
|
// Key is the raw integration key, shown once when the integration is
|
|
// created and never stored. URL is the address to point the sender at,
|
|
// likewise only complete at creation time.
|
|
Key string `json:"key,omitempty"`
|
|
URL string `json:"url,omitempty"`
|
|
}
|
|
|
|
// Integration kinds.
|
|
const (
|
|
IntegrationAlertmanager = "alertmanager"
|
|
)
|