rohit/probo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Accept/Expire invitations on SAML & SCIM operations

Browse Source 
Signed-off-by: Émile Ré <emile@getprobo.com>
This commit is contained in:
Émile Ré
2026-01-08 20:01:41 +01:00
committed by Bryan Frimin
parent cfcbda4519
commit b961069e1d
5 changed files with 168 additions and 102 deletions
Download Patch File Download Diff File Expand all files Collapse all files

41
pkg/iam/account_service.go
View File

@@ -210,8 +210,7 @@ func (s *AccountService) AcceptInvitation(
func(tx pg.Conn) error {
identity := coredata.Identity{}
err := identity.LoadByID(ctx, tx, identityID)
if err != nil {
if err := identity.LoadByID(ctx, tx, identityID); err != nil {
if err == coredata.ErrResourceNotFound {
return NewIdentityNotFoundError(identityID)
}
@@ -219,8 +218,7 @@ func (s *AccountService) AcceptInvitation(
return fmt.Errorf("cannot load identity: %w", err)
}
err = invitation.LoadByID(ctx, tx, coredata.NewNoScope(), invitationID)
if err != nil {
if err := invitation.LoadByID(ctx, tx, coredata.NewNoScope(), invitationID); err != nil {
if err == coredata.ErrResourceNotFound {
return NewInvitationNotFoundError(invitationID)
}
@@ -244,8 +242,13 @@ func (s *AccountService) AcceptInvitation(
scope := coredata.NewScope(invitation.OrganizationID.TenantID())
existingMembership := &coredata.Membership{}
err = existingMembership.LoadByIdentityAndOrg(ctx, tx, scope, identityID, invitation.OrganizationID)
if err != nil && err != coredata.ErrResourceNotFound {
if err := existingMembership.LoadByIdentityAndOrg(
ctx,
tx,
scope,
identityID,
invitation.OrganizationID,
); err != nil && err != coredata.ErrResourceNotFound {
return fmt.Errorf("cannot load existing membership: %w", err)
}
@@ -254,8 +257,7 @@ func (s *AccountService) AcceptInvitation(
existingMembership.Role = invitation.Role
existingMembership.UpdatedAt = now
err = existingMembership.Update(ctx, tx, scope)
if err != nil {
if err := existingMembership.Update(ctx, tx, scope); err != nil {
return fmt.Errorf("cannot reactivate membership: %w", err)
}
@@ -272,8 +274,7 @@ func (s *AccountService) AcceptInvitation(
UpdatedAt: now,
}
err = membership.Insert(ctx, tx, scope)
if err != nil {
if err := membership.Insert(ctx, tx, scope); err != nil {
return fmt.Errorf("cannot create membership: %w", err)
}
@@ -285,15 +286,13 @@ func (s *AccountService) AcceptInvitation(
UpdatedAt: now,
}
err = profile.Insert(ctx, tx)
if err != nil {
if err := profile.Insert(ctx, tx); err != nil {
return fmt.Errorf("cannot insert profile: %w", err)
}
}
invitation.AcceptedAt = &now
err = invitation.Update(ctx, tx, scope)
if err != nil {
if err := invitation.Update(ctx, tx, scope); err != nil {
if err == coredata.ErrResourceNotFound {
return NewInvitationNotFoundError(invitationID)
}
@@ -301,6 +300,20 @@ func (s *AccountService) AcceptInvitation(
return fmt.Errorf("cannot update invitation: %w", err)
}
// Accept other pending invitations for email in organization
invitations := &coredata.Invitations{}
onlyPending := coredata.NewInvitationFilter([]coredata.InvitationStatus{coredata.InvitationStatusPending})
if err := invitations.AcceptByEmailAndOrganization(
ctx,
tx,
coredata.NewScopeFromObjectID(invitation.OrganizationID),
invitation.Email,
invitation.OrganizationID,
onlyPending,
); err != nil {
return fmt.Errorf("cannot accept pending invitations by email: %w", err)
}
return nil
},
)

14
pkg/iam/saml/service.go
View File

@@ -325,6 +325,20 @@ func (s *Service) HandleAssertion(
if err != nil {
return fmt.Errorf("cannot insert membership profile: %w", err)
}
// Accept all pending invitations for email in organization
invitations := &coredata.Invitations{}
onlyPending := coredata.NewInvitationFilter([]coredata.InvitationStatus{coredata.InvitationStatusPending})
if err := invitations.AcceptByEmailAndOrganization(
ctx,
tx,
coredata.NewScopeFromObjectID(config.OrganizationID),
email,
config.OrganizationID,
onlyPending,
); err != nil {
return fmt.Errorf("cannot accept pending invitations by email: %w", err)
}
}
if membership.Source != coredata.MembershipSourceSCIM {

61
pkg/iam/scim/service.go
View File

@@ -172,6 +172,22 @@ func (s *Service) CreateUser(
if err != nil {
return fmt.Errorf("cannot insert membership profile: %w", err)
}
// Accept all pending invitations for email in organization
invitations := &coredata.Invitations{}
onlyPending := coredata.NewInvitationFilter([]coredata.InvitationStatus{coredata.InvitationStatusPending})
err := invitations.AcceptByEmailAndOrganization(
ctx,
tx,
coredata.NewScopeFromObjectID(config.OrganizationID),
emailAddr,
config.OrganizationID,
onlyPending,
)
if err != nil {
return fmt.Errorf("cannot accept pending invitations by email")
}
} else if err != nil {
return fmt.Errorf("cannot load membership: %w", err)
} else {
@@ -335,8 +351,7 @@ func (s *Service) updateUser(
ctx,
func(tx pg.Conn) error {
membership = &coredata.Membership{}
err := membership.LoadByID(ctx, tx, scope, membershipID)
if err != nil {
if err := membership.LoadByID(ctx, tx, scope, membershipID); err != nil {
if err == coredata.ErrResourceNotFound {
return scimerrors.ScimErrorResourceNotFound(membershipID.String())
}
@@ -350,13 +365,46 @@ func (s *Service) updateUser(
needsUpdate := false
if active != nil {
identity := &coredata.Identity{}
if err := identity.LoadByID(ctx, tx, membership.IdentityID); err != nil {
return fmt.Errorf("cannot load identity: %w", err)
}
if *active && membership.State == coredata.MembershipStateInactive {
membership.State = coredata.MembershipStateActive
membership.Role = coredata.MembershipRoleEmployee
needsUpdate = true
// Accept all pending invitations for email in organization
invitations := &coredata.Invitations{}
onlyPending := coredata.NewInvitationFilter([]coredata.InvitationStatus{coredata.InvitationStatusPending})
if err := invitations.AcceptByEmailAndOrganization(
ctx,
tx,
coredata.NewScopeFromObjectID(config.OrganizationID),
identity.EmailAddress,
config.OrganizationID,
onlyPending,
); err != nil {
return fmt.Errorf("cannot accept pending invitations by email: %w", err)
}
} else if !*active && membership.State == coredata.MembershipStateActive {
membership.State = coredata.MembershipStateInactive
needsUpdate = true
// Expire all pending invitations for email in organization
invitations := &coredata.Invitations{}
onlyPending := coredata.NewInvitationFilter([]coredata.InvitationStatus{coredata.InvitationStatusPending})
if err := invitations.ExpireByEmailAndOrganization(
ctx,
tx,
coredata.NewScopeFromObjectID(config.OrganizationID),
identity.EmailAddress,
config.OrganizationID,
onlyPending,
); err != nil {
return fmt.Errorf("cannot expire pending invitations: %w", err)
}
}
}
@@ -367,21 +415,18 @@ func (s *Service) updateUser(
if needsUpdate {
membership.UpdatedAt = now
err = membership.Update(ctx, tx, scope)
if err != nil {
if err := membership.Update(ctx, tx, scope); err != nil {
return fmt.Errorf("cannot update membership: %w", err)
}
}
profile := &coredata.MembershipProfile{}
err = profile.LoadByMembershipID(ctx, tx, scope, membershipID)
if err == nil {
if err := profile.LoadByMembershipID(ctx, tx, scope, membershipID); err == nil {
if fullName != "" {
profile.FullName = fullName
profile.UpdatedAt = now
err = profile.Update(ctx, tx, scope)
if err != nil {
if err := profile.Update(ctx, tx, scope); err != nil {
return fmt.Errorf("cannot update membership profile: %w", err)
}
}