Reuse existing session when signing in in for assume

Signed-off-by: Émile Ré <emile@getprobo.com>

pkg/server/api/connect/v1/schema.graphql

@@ -626,6 +626,8 @@ type PageInfo {
 }
 
 input SignInInput {
+  # When assuming an org with a password auth method
+  organizationId: ID
   email: EmailAddr!
   password: String!
 }

pkg/server/api/connect/v1/schema/schema.go

@@ -3068,6 +3068,8 @@ type PageInfo {
 }
 
 input SignInInput {
+  # When assuming an org with a password auth method
+  organizationId: ID
   email: EmailAddr!
   password: String!
 }
@@ -15772,13 +15774,20 @@ func (ec *executionContext) unmarshalInputSignInInput(ctx context.Context, obj a
 		asMap[k] = v
 	}
 
-	fieldsInOrder := [...]string{"email", "password"}
+	fieldsInOrder := [...]string{"organizationId", "email", "password"}
 	for _, k := range fieldsInOrder {
 		v, ok := asMap[k]
 		if !ok {
 			continue
 		}
 		switch k {
+		case "organizationId":
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("organizationId"))
+			data, err := ec.unmarshalOID2ᚖgoᚗproboᚗincᚋproboᚋpkgᚋgidᚐGID(ctx, v)
+			if err != nil {
+				return it, err
+			}
+			it.OrganizationID = data
 		case "email":
 			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("email"))
 			data, err := ec.unmarshalNEmailAddr2goᚗproboᚗincᚋproboᚋpkgᚋmailᚐAddr(ctx, v)

pkg/server/api/connect/v1/types/types.go

@@ -485,8 +485,9 @@ type SessionOrder struct {
 }
 
 type SignInInput struct {
-	Email    mail.Addr `json:"email"`
-	Password string    `json:"password"`
+	OrganizationID *gid.GID  `json:"organizationId,omitempty"`
+	Email          mail.Addr `json:"email"`
+	Password       string    `json:"password"`
 }
 
 type SignInPayload struct {

pkg/server/api/connect/v1/v1_resolver.go

@@ -356,9 +356,7 @@ func (r *membershipProfileResolver) Permission(ctx context.Context, obj *types.M
 
 // SignIn is the resolver for the signIn field.
 func (r *mutationResolver) SignIn(ctx context.Context, input types.SignInInput) (*types.SignInPayload, error) {
-	// TODO: handle existing session to only open child session and chnage root session auth method to PASSWORD
-
-	identity, session, err := r.iam.AuthService.OpenSessionWithPassword(ctx, input.Email, input.Password)
+	identity, err := r.iam.AuthService.CheckCredentials(ctx, input.Email, input.Password)
 	if err != nil {
 		var errInvalidPassword *iam.ErrInvalidPassword
 		if errors.As(err, &errInvalidPassword) {
@@ -375,10 +373,59 @@ func (r *mutationResolver) SignIn(ctx context.Context, input types.SignInInput)
 			}
 		}
 
-		r.logger.ErrorCtx(ctx, "cannot sign in", log.Error(err))
+		r.logger.ErrorCtx(ctx, "cannot check credentials", log.Error(err))
 		return nil, gqlutils.Internal(ctx)
 	}
 
+	session := authn.SessionFromContext(ctx)
+
+	switch {
+	case session == nil:
+		var err error
+		session, err = r.iam.AuthService.OpenSessionWithPassword(
+			ctx,
+			identity.ID,
+		)
+		if err != nil {
+			r.logger.ErrorCtx(ctx, "cannot create session", log.Error(err))
+			return nil, gqlutils.Internal(ctx)
+		}
+	case session.IdentityID != identity.ID:
+		if err := r.iam.SessionService.CloseSession(ctx, session.ID); err != nil {
+			r.logger.ErrorCtx(ctx, "cannot close session", log.Error(err))
+			return nil, gqlutils.Internal(ctx)
+		}
+
+		session, err = r.iam.AuthService.OpenSessionWithPassword(
+			ctx,
+			identity.ID,
+		)
+		if err != nil {
+			r.logger.ErrorCtx(ctx, "cannot create session", log.Error(err))
+			return nil, gqlutils.Internal(ctx)
+		}
+	}
+
+	if input.OrganizationID != nil {
+		var err error
+		session, _, err = r.iam.SessionService.OpenPasswordChildSessionForOrganization(ctx, session.ID, *input.OrganizationID)
+		if err != nil {
+			var errSessionExpired *iam.ErrSessionExpired
+			var errMembershipNotFound *iam.ErrMembershipNotFound
+			var errMembershipInactive *iam.ErrMembershipInactive
+
+			if errors.As(err, errSessionExpired) {
+				return nil, gqlutils.Unauthenticated(ctx, err)
+			}
+			if errors.As(err, errMembershipNotFound) || errors.As(err, errMembershipInactive) {
+				return nil, gqlutils.Forbidden(ctx, err)
+			}
+
+			r.logger.ErrorCtx(ctx, "cannot assume organization", log.Error(err))
+			return nil, gqlutils.Internal(ctx)
+		}
+	}
+
 	w := gqlutils.HTTPResponseWriterFromContext(ctx)
 	r.sessionCookie.Set(w, session)