Add groups to ssh hosts allowed principals

backend/src/ee/services/ssh-host/ssh-host-dal.ts

@@ -27,8 +27,17 @@ export const sshHostDALFactory = (db: TDbClient) => {
           `${TableName.SshHostLoginUserMapping}.sshHostLoginUserId`
         )
         .leftJoin(TableName.Users, `${TableName.Users}.id`, `${TableName.SshHostLoginUserMapping}.userId`)
+        .leftJoin(
+          TableName.UserGroupMembership,
+          `${TableName.UserGroupMembership}.groupId`,
+          `${TableName.SshHostLoginUserMapping}.groupId`
+        )
         .whereIn(`${TableName.SshHost}.projectId`, projectIds)
-        .andWhere(`${TableName.SshHostLoginUserMapping}.userId`, userId)
+        .andWhere((bd) => {
+          void bd
+            .where(`${TableName.SshHostLoginUserMapping}.userId`, userId)
+            .orWhere(`${TableName.UserGroupMembership}.userId`, userId);
+        })
         .select(
           db.ref("id").withSchema(TableName.SshHost).as("sshHostId"),
           db.ref("projectId").withSchema(TableName.SshHost),
@@ -85,6 +94,7 @@ export const sshHostDALFactory = (db: TDbClient) => {
           `${TableName.SshHostLoginUserMapping}.sshHostLoginUserId`
         )
         .leftJoin(TableName.Users, `${TableName.SshHostLoginUserMapping}.userId`, `${TableName.Users}.id`)
+        .leftJoin(TableName.Groups, `${TableName.SshHostLoginUserMapping}.groupId`, `${TableName.Groups}.id`)
         .where(`${TableName.SshHost}.projectId`, projectId)
         .select(
           db.ref("id").withSchema(TableName.SshHost).as("sshHostId"),
@@ -96,6 +106,7 @@ export const sshHostDALFactory = (db: TDbClient) => {
           db.ref("loginUser").withSchema(TableName.SshHostLoginUser),
           db.ref("username").withSchema(TableName.Users),
           db.ref("userId").withSchema(TableName.SshHostLoginUserMapping),
+          db.ref("slug").withSchema(TableName.Groups).as("groupSlug"),
           db.ref("userSshCaId").withSchema(TableName.SshHost),
           db.ref("hostSshCaId").withSchema(TableName.SshHost)
         )
@@ -113,7 +124,8 @@ export const sshHostDALFactory = (db: TDbClient) => {
         const loginMappings = Object.entries(loginMappingGrouped).map(([loginUser, entries]) => ({
           loginUser,
           allowedPrincipals: {
-            usernames: unique(entries.map((e) => e.username)).filter(Boolean)
+            usernames: unique(entries.map((e) => e.username)).filter(Boolean),
+            groups: unique(entries.map((e) => e.groupSlug)).filter(Boolean)
           }
         }));
 
@@ -144,6 +156,7 @@ export const sshHostDALFactory = (db: TDbClient) => {
           `${TableName.SshHostLoginUserMapping}.sshHostLoginUserId`
         )
         .leftJoin(TableName.Users, `${TableName.SshHostLoginUserMapping}.userId`, `${TableName.Users}.id`)
+        .leftJoin(TableName.Groups, `${TableName.SshHostLoginUserMapping}.groupId`, `${TableName.Groups}.id`)
         .where(`${TableName.SshHost}.id`, sshHostId)
         .select(
           db.ref("id").withSchema(TableName.SshHost).as("sshHostId"),
@@ -156,7 +169,8 @@ export const sshHostDALFactory = (db: TDbClient) => {
           db.ref("username").withSchema(TableName.Users),
           db.ref("userId").withSchema(TableName.SshHostLoginUserMapping),
           db.ref("userSshCaId").withSchema(TableName.SshHost),
-          db.ref("hostSshCaId").withSchema(TableName.SshHost)
+          db.ref("hostSshCaId").withSchema(TableName.SshHost),
+          db.ref("slug").withSchema(TableName.Groups).as("groupSlug")
         );
 
       if (rows.length === 0) return null;
@@ -171,7 +185,8 @@ export const sshHostDALFactory = (db: TDbClient) => {
       const loginMappings = Object.entries(loginMappingGrouped).map(([loginUser, entries]) => ({
         loginUser,
         allowedPrincipals: {
-          usernames: unique(entries.map((e) => e.username)).filter(Boolean)
+          usernames: unique(entries.map((e) => e.username)).filter(Boolean),
+          groups: unique(entries.map((e) => e.groupSlug)).filter(Boolean)
         }
       }));
 

backend/src/ee/services/ssh-host/ssh-host-schema.ts

@@ -15,7 +15,24 @@ export const sanitizedSshHost = SshHostsSchema.pick({
 
 export const loginMappingSchema = z.object({
   loginUser: z.string().trim(),
-  allowedPrincipals: z.object({
-    usernames: z.array(z.string().trim()).transform((usernames) => Array.from(new Set(usernames)))
-  })
+  allowedPrincipals: z
+    .object({
+      usernames: z
+        .array(z.string().trim())
+        .transform((usernames) => Array.from(new Set(usernames)))
+        .optional(),
+      groups: z
+        .array(z.string().trim())
+        .transform((groups) => Array.from(new Set(groups)))
+        .optional()
+    })
+    .refine(
+      (data) => {
+        return (data.usernames && data.usernames.length > 0) || (data.groups && data.groups.length > 0);
+      },
+      {
+        message: "At least one username or group must be provided",
+        path: ["allowedPrincipals"]
+      }
+    )
 });

backend/src/ee/services/ssh-host/ssh-host-service.ts

@@ -1,6 +1,7 @@
 import { ForbiddenError, subject } from "@casl/ability";
 
 import { ActionProjectType, ProjectType } from "@app/db/schemas";
+import { TGroupDALFactory } from "@app/ee/services/group/group-dal";
 import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service";
 import { ProjectPermissionSshHostActions, ProjectPermissionSub } from "@app/ee/services/permission/project-permission";
 import { TSshCertificateAuthorityDALFactory } from "@app/ee/services/ssh/ssh-certificate-authority-dal";
@@ -19,6 +20,7 @@ import { TProjectDALFactory } from "@app/services/project/project-dal";
 import { TProjectSshConfigDALFactory } from "@app/services/project/project-ssh-config-dal";
 import { TUserDALFactory } from "@app/services/user/user-dal";
 
+import { TUserGroupMembershipDALFactory } from "../group/user-group-membership-dal";
 import {
   convertActorToPrincipals,
   createSshCert,
@@ -38,12 +40,14 @@ import {
 
 type TSshHostServiceFactoryDep = {
   userDAL: Pick<TUserDALFactory, "findById" | "find">;
+  groupDAL: Pick<TGroupDALFactory, "findGroupsByProjectId">;
   projectDAL: Pick<TProjectDALFactory, "find">;
   projectSshConfigDAL: Pick<TProjectSshConfigDALFactory, "findOne">;
   sshCertificateAuthorityDAL: Pick<TSshCertificateAuthorityDALFactory, "findOne">;
   sshCertificateAuthoritySecretDAL: Pick<TSshCertificateAuthoritySecretDALFactory, "findOne">;
   sshCertificateDAL: Pick<TSshCertificateDALFactory, "create" | "transaction">;
   sshCertificateBodyDAL: Pick<TSshCertificateBodyDALFactory, "create">;
+  userGroupMembershipDAL: Pick<TUserGroupMembershipDALFactory, "findGroupMembershipsByUserIdInOrg">;
   sshHostDAL: Pick<
     TSshHostDALFactory,
     | "transaction"
@@ -57,7 +61,10 @@ type TSshHostServiceFactoryDep = {
   >;
   sshHostLoginUserDAL: TSshHostLoginUserDALFactory;
   sshHostLoginUserMappingDAL: TSshHostLoginUserMappingDALFactory;
-  permissionService: Pick<TPermissionServiceFactory, "getProjectPermission" | "getUserProjectPermission">;
+  permissionService: Pick<
+    TPermissionServiceFactory,
+    "getProjectPermission" | "getUserProjectPermission" | "checkGroupProjectPermission"
+  >;
   kmsService: Pick<TKmsServiceFactory, "createCipherPairWithDataKey">;
 };
 
@@ -65,6 +72,8 @@ export type TSshHostServiceFactory = ReturnType<typeof sshHostServiceFactory>;
 
 export const sshHostServiceFactory = ({
   userDAL,
+  userGroupMembershipDAL,
+  groupDAL,
   projectDAL,
   projectSshConfigDAL,
   sshCertificateAuthorityDAL,
@@ -212,7 +221,7 @@ export const sshHostServiceFactory = ({
           tx
         );
 
-        if (allowedPrincipals.usernames.length > 0) {
+        if (allowedPrincipals.usernames && allowedPrincipals.usernames.length > 0) {
           const users = await userDAL.find(
             {
               $in: {
@@ -251,6 +260,42 @@ export const sshHostServiceFactory = ({
             tx
           );
         }
+
+        if (allowedPrincipals.groups && allowedPrincipals.groups.length > 0) {
+          const groups = await groupDAL.findGroupsByProjectId(projectId);
+
+          const foundGroupSlugs = new Set(groups.map((g) => g.slug));
+
+          for (const slug of allowedPrincipals.groups) {
+            if (!foundGroupSlugs.has(slug)) {
+              throw new BadRequestError({
+                message: `Invalid group slug: ${slug}`
+              });
+            }
+          }
+
+          for await (const group of groups) {
+            // check that each group has access to the SSH project and have read access to hosts
+            const hasPermission = await permissionService.checkGroupProjectPermission({
+              groupId: group.id,
+              projectId,
+              checkPermissions: [ProjectPermissionSshHostActions.Read, ProjectPermissionSub.SshHosts]
+            });
+            if (!hasPermission) {
+              throw new BadRequestError({
+                message: `Group ${group.slug} does not have access to the SSH project`
+              });
+            }
+          }
+
+          await sshHostLoginUserMappingDAL.insertMany(
+            groups.map((group) => ({
+              sshHostLoginUserId: sshHostLoginUser.id,
+              groupId: group.id
+            })),
+            tx
+          );
+        }
       }
 
       const newSshHostWithLoginMappings = await sshHostDAL.findSshHostByIdWithLoginMappings(host.id, tx);
@@ -319,7 +364,7 @@ export const sshHostServiceFactory = ({
               tx
             );
 
-            if (allowedPrincipals.usernames.length > 0) {
+            if (allowedPrincipals.usernames && allowedPrincipals.usernames.length > 0) {
               const users = await userDAL.find(
                 {
                   $in: {
@@ -357,6 +402,42 @@ export const sshHostServiceFactory = ({
                 tx
               );
             }
+
+            if (allowedPrincipals.groups && allowedPrincipals.groups.length > 0) {
+              const groups = await groupDAL.findGroupsByProjectId(host.projectId);
+
+              const foundGroupSlugs = new Set(groups.map((g) => g.slug));
+
+              for (const slug of allowedPrincipals.groups) {
+                if (!foundGroupSlugs.has(slug)) {
+                  throw new BadRequestError({
+                    message: `Invalid group slug: ${slug}`
+                  });
+                }
+              }
+
+              for await (const group of groups) {
+                // check that each group has access to the SSH project and have read access to hosts
+                const hasPermission = await permissionService.checkGroupProjectPermission({
+                  groupId: group.id,
+                  projectId: host.projectId,
+                  checkPermissions: [ProjectPermissionSshHostActions.Read, ProjectPermissionSub.SshHosts]
+                });
+                if (!hasPermission) {
+                  throw new BadRequestError({
+                    message: `Group ${group.slug} does not have access to the SSH project`
+                  });
+                }
+              }
+
+              await sshHostLoginUserMappingDAL.insertMany(
+                groups.map((group) => ({
+                  sshHostLoginUserId: sshHostLoginUser.id,
+                  groupId: group.id
+                })),
+                tx
+              );
+            }
           }
         }
       }
@@ -460,10 +541,14 @@ export const sshHostServiceFactory = ({
       userDAL
     });
 
+    const userGroups = await userGroupMembershipDAL.findGroupMembershipsByUserIdInOrg(actorId, actorOrgId);
+    const userGroupSlugs = userGroups.map((g) => g.groupSlug);
+
     const mapping = host.loginMappings.find(
       (m) =>
         m.loginUser === loginUser &&
-        m.allowedPrincipals.usernames.some((allowed) => internalPrincipals.includes(allowed))
+        (m.allowedPrincipals.usernames.some((allowed) => internalPrincipals.includes(allowed)) ||
+          m.allowedPrincipals.groups.some((allowed) => userGroupSlugs.includes(allowed)))
     );
 
     if (!mapping) {

backend/src/ee/services/ssh-host/ssh-host-types.ts

@@ -10,7 +10,8 @@ export type TCreateSshHostDTO = {
   loginMappings: {
     loginUser: string;
     allowedPrincipals: {
-      usernames: string[];
+      usernames?: string[];
+      groups?: string[];
     };
   }[];
   userSshCaId?: string;
@@ -26,7 +27,8 @@ export type TUpdateSshHostDTO = {
   loginMappings?: {
     loginUser: string;
     allowedPrincipals: {
-      usernames: string[];
+      usernames?: string[];
+      groups?: string[];
     };
   }[];
 } & Omit<TProjectPermission, "projectId">;