mirror of
https://github.com/empayre/fleet.git
synced 2024-11-06 08:55:24 +00:00
1ebfbb14eb
#8593 This PR adds a new role `gitops` to Fleet. MDM capabilities for the role coming on a separate PR. We need this merged ASAP so that we can unblock the UI work for this. - [X] Changes file added for user-visible changes in `changes/` or `orbit/changes/`. See [Changes files](https://fleetdm.com/docs/contributing/committing-changes#changes-files) for more information. - [x] Documented any API changes (docs/Using-Fleet/REST-API.md or docs/Contributing/API-for-contributors.md) - [X] Documented any permissions changes - ~[ ] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements)~ - ~[ ] Added support on fleet's osquery simulator `cmd/osquery-perf` for new osquery data ingestion features.~ - [X] Added/updated tests - [x] Manual QA for all new/changed functionality - ~For Orbit and Fleet Desktop changes:~ - ~[ ] Manual QA must be performed in the three main OSs, macOS, Windows and Linux.~ - ~[ ] Auto-update manual QA, from released version of component to new version (see [tools/tuf/test](../tools/tuf/test/README.md)).~
79 lines
2.0 KiB
Go
79 lines
2.0 KiB
Go
package service
|
|
|
|
import (
|
|
"context"
|
|
|
|
"github.com/fleetdm/fleet/v4/server/authz"
|
|
"github.com/fleetdm/fleet/v4/server/contexts/ctxerr"
|
|
"github.com/fleetdm/fleet/v4/server/contexts/license"
|
|
"github.com/fleetdm/fleet/v4/server/fleet"
|
|
"github.com/fleetdm/fleet/v4/server/ptr"
|
|
)
|
|
|
|
func (svc *Service) CreateInitialUser(ctx context.Context, p fleet.UserPayload) (*fleet.User, error) {
|
|
// skipauth: Only the initial user creation should be allowed to skip
|
|
// authorization (because there is not yet a user context to check against).
|
|
svc.authz.SkipAuthorization(ctx)
|
|
|
|
setupRequired, err := svc.SetupRequired(ctx)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
if !setupRequired {
|
|
return nil, ctxerr.New(ctx, "a user already exists")
|
|
}
|
|
|
|
// Initial user should be global admin with no explicit teams
|
|
p.GlobalRole = ptr.String(fleet.RoleAdmin)
|
|
p.Teams = nil
|
|
|
|
return svc.NewUser(ctx, p)
|
|
}
|
|
|
|
func (svc *Service) NewUser(ctx context.Context, p fleet.UserPayload) (*fleet.User, error) {
|
|
license, _ := license.FromContext(ctx)
|
|
if license == nil {
|
|
return nil, ctxerr.New(ctx, "license not found")
|
|
}
|
|
if err := fleet.ValidateUserRoles(true, p, *license); err != nil {
|
|
return nil, ctxerr.Wrap(ctx, err, "validate role")
|
|
}
|
|
|
|
user, err := p.User(svc.config.Auth.SaltKeySize, svc.config.Auth.BcryptCost)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
user, err = svc.ds.NewUser(ctx, user)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
adminUser := authz.UserFromContext(ctx)
|
|
if adminUser == nil {
|
|
// In case of invites the user created herself.
|
|
adminUser = user
|
|
}
|
|
if err := svc.ds.NewActivity(
|
|
ctx,
|
|
adminUser,
|
|
fleet.ActivityTypeCreatedUser{
|
|
UserID: user.ID,
|
|
UserName: user.Name,
|
|
UserEmail: user.Email,
|
|
},
|
|
); err != nil {
|
|
return nil, err
|
|
}
|
|
if err := fleet.LogRoleChangeActivities(ctx, svc.ds, adminUser, nil, nil, user); err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
return user, nil
|
|
}
|
|
|
|
func (svc *Service) UserUnauthorized(ctx context.Context, id uint) (*fleet.User, error) {
|
|
// Explicitly no authorization check. Should only be used by middleware.
|
|
return svc.ds.UserByID(ctx, id)
|
|
}
|