Plug assume organization session

Signed-off-by: Émile Ré <nemile.re@gmail.com>
2025-12-21 11:46:29 +01:00
parent 62721f7627
commit 86bdb14289
9 changed files with 564 additions and 178 deletions
--- a/pkg/coredata/membership.go
+++ b/pkg/coredata/membership.go
@@ -62,18 +62,32 @@ func (m Membership) CursorKey(orderBy MembershipOrderField) page.CursorKey {

 func (m *Membership) LoadByIdentityInOrganization(ctx context.Context, conn pg.Conn, identityID gid.GID, organizationID gid.GID) error {
 	q := `
+WITH mbr AS (
+    SELECT
+        id,
+        identity_id,
+        organization_id,
+        role,
+        created_at,
+        updated_at
+    FROM
+        iam_memberships
+    WHERE
+        identity_id = @identity_id
+        AND organization_id = @organization_id
+)
 SELECT
-		id,
-		identity_id,
-		organization_id,
-		role,
-		created_at,
-		updated_at
+    mbr.id,
+    mbr.identity_id,
+    mbr.organization_id,
+    mbr.role,
+    i.fullname AS full_name,
+    i.email_address,
+    mbr.created_at,
+    mbr.updated_at
 FROM
-	iam_memberships
-WHERE
-	identity_id = @identity_id
-	AND organization_id = @organization_id
+    mbr
+JOIN identities i ON mbr.identity_id = i.id
 `

 	args := pgx.StrictNamedArgs{
@@ -157,18 +171,18 @@ func (m *Membership) LoadByID(
 ) error {
 	query := `
 WITH mbr AS (
-	SELECT
-		id,
-		identity_id,
-		organization_id,
-		role,
-		created_at,
-		updated_at
-	FROM
-		iam_memberships
-	WHERE
-		id = @membership_id
-		AND %s
+    SELECT
+        id,
+        identity_id,
+        organization_id,
+        role,
+        created_at,
+        updated_at
+    FROM
+        iam_memberships
+    WHERE
+        id = @membership_id
+        AND %s
 )
 SELECT
    mbr.id,
@@ -237,19 +251,19 @@ func (m *Membership) LoadRoleByIdentityAndEntityID(

 	query := fmt.Sprintf(`
 SELECT
-	m.id,
-	m.identity_id,
-	m.organization_id,
-	m.role,
-	m.created_at,
-	m.updated_at
+    m.id,
+    m.identity_id,
+    m.organization_id,
+    m.role,
+    m.created_at,
+    m.updated_at
 FROM
-	iam_memberships m
-	INNER JOIN %s e ON e.id = @entity_id
+    iam_memberships m
+    INNER JOIN %s e ON e.id = @entity_id
 WHERE
-	%s
-	AND m.identity_id = @identity_id
-	AND m.organization_id = e.organization_id
+    %s
+    AND m.identity_id = @identity_id
+    AND m.organization_id = e.organization_id
 LIMIT 1;
 `, tableName, scopeFragment)

@@ -296,19 +310,19 @@ func (m *Membership) LoadByIdentityAndOrg(
 ) error {
 	q := `
 WITH mbr AS (
-	SELECT
-		am.id,
-		am.identity_id,
-		am.organization_id,
-		am.role,
-		am.created_at,
-		am.updated_at
-	FROM
-		iam_memberships am
-	WHERE
-		am.identity_id = @identity_id
-		AND am.organization_id = @organization_id
-		AND %s
+    SELECT
+        am.id,
+        am.identity_id,
+        am.organization_id,
+        am.role,
+        am.created_at,
+        am.updated_at
+    FROM
+        iam_memberships am
+    WHERE
+        am.identity_id = @identity_id
+        AND am.organization_id = @organization_id
+        AND %s
 )
 SELECT
    mbr.id,
@@ -389,7 +403,7 @@ func (m *Membership) Delete(ctx context.Context, conn pg.Conn, scope Scoper, mem
 DELETE FROM
    iam_memberships
 WHERE
-	%s
+    %s
    AND id = @membership_id
 `

@@ -421,20 +435,20 @@ func (m *Memberships) LoadByIdentityID(
 ) error {
 	query := `
 WITH mbr AS (
-	SELECT
-		id,
-		identity_id,
-		organization_id,
-		role,
-		created_at,
-		updated_at
-	FROM
-		iam_memberships
-	WHERE
-		identity_id = @identity_id
-		AND %s
-	ORDER BY
-		created_at DESC
+    SELECT
+        id,
+        identity_id,
+        organization_id,
+        role,
+        created_at,
+        updated_at
+    FROM
+        iam_memberships
+    WHERE
+        identity_id = @identity_id
+        AND %s
+    ORDER BY
+        created_at DESC
 )
 SELECT
    mbr.id,
@@ -483,18 +497,18 @@ func (m *Memberships) LoadByOrganizationID(
 ) error {
 	query := `
 WITH mbr AS (
-	SELECT
-		id,
-		identity_id,
-		organization_id,
-		role,
-		created_at,
-		updated_at
-	FROM
-		iam_memberships
-	WHERE
-		organization_id = @organization_id
-		AND %s
+    SELECT
+        id,
+        identity_id,
+        organization_id,
+        role,
+        created_at,
+        updated_at
+    FROM
+        iam_memberships
+    WHERE
+        organization_id = @organization_id
+        AND %s
 )
 SELECT
    id,
@@ -506,19 +520,19 @@ SELECT
    created_at,
    updated_at
 FROM (
-	SELECT
-		mbr.id,
-		mbr.identity_id,
-		mbr.organization_id,
-		mbr.role,
-		i.fullname as full_name,
-		i.email_address,
-		mbr.created_at,
-		mbr.updated_at
-	FROM
-		mbr
-	JOIN
-		identities i ON mbr.identity_id = i.id
+    SELECT
+        mbr.id,
+        mbr.identity_id,
+        mbr.organization_id,
+        mbr.role,
+        i.fullname as full_name,
+        i.email_address,
+        mbr.created_at,
+        mbr.updated_at
+    FROM
+        mbr
+    JOIN
+        identities i ON mbr.identity_id = i.id
 ) AS membership_with_identity
 WHERE %s
 `
--- a/pkg/coredata/saml_configuration.go
+++ b/pkg/coredata/saml_configuration.go
@@ -18,6 +18,7 @@ import (
 	"context"
 	"crypto/x509"
 	"encoding/pem"
+	"errors"
 	"fmt"
 	"maps"
 	"time"
@@ -125,6 +126,10 @@ LIMIT 1;

 	config, err := pgx.CollectExactlyOneRow(rows, pgx.RowToStructByName[SAMLConfiguration])
 	if err != nil {
+		if errors.Is(err, pgx.ErrNoRows) {
+			return ErrResourceNotFound
+		}
+
 		return fmt.Errorf("cannot collect saml_configuration: %w", err)
 	}

--- a/pkg/coredata/session.go
+++ b/pkg/coredata/session.go
@@ -195,9 +195,9 @@ UPDATE iam_sessions
 SET
    expired_at = @expired_at,
    updated_at = @updated_at,
-	user_agent = @user_agent,
-	ip_address = @ip_address,
-	expire_reason = @expire_reason,
+    user_agent = @user_agent,
+    ip_address = @ip_address,
+    expire_reason = @expire_reason,
    data = @data
 WHERE
    id = @session_id
@@ -246,7 +246,7 @@ FROM
    iam_sessions
 WHERE
    identity_id = @identity_id
-	AND %s
+    AND %s
 `

 	q = fmt.Sprintf(q, cursor.SQLFragment())
@@ -272,12 +272,12 @@ WHERE
 func (s *Sessions) CountByIdentityID(ctx context.Context, conn pg.Conn, identityID gid.GID) (int, error) {
 	q := `
 SELECT
-	COUNT(*)
+    COUNT(*)
 FROM
-	iam_sessions
+    iam_sessions
 WHERE
-	identity_id = @identity_id
-	`
+    identity_id = @identity_id
+`

 	args := pgx.StrictNamedArgs{"identity_id": identityID}

@@ -297,11 +297,11 @@ UPDATE iam_sessions
 SET
    expired_at = NOW(),
    updated_at = NOW(),
-	expire_reason = 'revoked'
+    expire_reason = 'revoked'
 WHERE
    id != @session_id
-	AND identity_id = @identity_id
-	AND expire_reason IS NULL
+    AND identity_id = @identity_id
+    AND expire_reason IS NULL
 `

 	args := pgx.StrictNamedArgs{
@@ -320,25 +320,27 @@ WHERE
 func (s *Session) LoadByRootSessionIDAndMembershipID(ctx context.Context, conn pg.Conn, rootSessionID gid.GID, membershipID gid.GID) error {
 	q := `
 SELECT
-	id,
-	identity_id,
-	tenant_id,
-	membership_id,
-	data,
-	parent_session_id,
-	auth_method,
-	authenticated_at,
-	expire_reason,
-	user_agent,
-	ip_address,
-	expired_at,
-	created_at,
-	updated_at
+    id,
+    identity_id,
+    tenant_id,
+    membership_id,
+    data,
+    parent_session_id,
+    auth_method,
+    authenticated_at,
+    expire_reason,
+    user_agent,
+    ip_address,
+    expired_at,
+    created_at,
+    updated_at
 FROM
-	iam_sessions
+    iam_sessions
 WHERE
-	parent_session_id = @root_session_id
-	AND membership_id = @membership_id
+    parent_session_id = @root_session_id
+    AND membership_id = @membership_id
+ORDER BY created_at DESC
+LIMIT 1
 `

 	args := pgx.StrictNamedArgs{