Merge branch 'main' into add-bull-queue

backend/src/utils/auth.ts

@@ -3,7 +3,7 @@ import passport from "passport";
 import { Types } from "mongoose";
 import { AuthData } from "../interfaces/middleware";
 import {
-  AuthProvider,
+  AuthMethod,
   MembershipOrg,
   Organization,
   ServiceAccount,
@@ -97,20 +97,20 @@ const initializePassport = async () => {
           email
         }).select("+publicKey");
         
-        if (user && user.authProvider !== AuthProvider.GOOGLE) {
-          done(InternalServerError());
-        }
-
         if (!user) {
           user = await new User({
             email,
-            authProvider: AuthProvider.GOOGLE,
-            authId: profile.id,
+            authMethods: [AuthMethod.GOOGLE],
             firstName: profile.name.givenName,
             lastName: profile.name.familyName
           }).save();
         }
 
+        let isLinkingRequired = false;
+        if (!user.authMethods.includes(AuthMethod.GOOGLE)) {
+          isLinkingRequired = true;
+        }
+
         const isUserCompleted = !!user.publicKey;
         const providerAuthToken = createToken({
           payload: {
@@ -118,8 +118,9 @@ const initializePassport = async () => {
             email: user.email,
             firstName: user.firstName,
             lastName: user.lastName,
-            authProvider: user.authProvider,
+            authMethod: AuthMethod.GOOGLE,
             isUserCompleted,
+            isLinkingRequired,
             ...(req.query.state ? {
               callbackPort: req.query.state as string
             } : {})
@@ -150,20 +151,20 @@ const initializePassport = async () => {
       let user = await User.findOne({
         email
       }).select("+publicKey");
-      
-      if (user && user.authProvider !== AuthProvider.GITHUB) {
-        done(InternalServerError());
-      }
-      
+
       if (!user) {
         user = await new User({
           email: email,
-          authProvider: AuthProvider.GITHUB,
-          authId: profile.id,
+          authMethods: [AuthMethod.GITHUB],
           firstName: profile.displayName,
           lastName: ""
         }).save();
       }
+      
+      let isLinkingRequired = false;
+      if (!user.authMethods.includes(AuthMethod.GITHUB)) {
+        isLinkingRequired = true;
+      }
 
       const isUserCompleted = !!user.publicKey;
       const providerAuthToken = createToken({
@@ -172,8 +173,9 @@ const initializePassport = async () => {
           email: user.email,
           firstName: user.firstName,
           lastName: user.lastName,
-          authProvider: user.authProvider,
+          authMethod: AuthMethod.GITHUB,
           isUserCompleted,
+          isLinkingRequired,
           ...(req.query.state ? {
             callbackPort: req.query.state as string
           } : {})
@@ -218,7 +220,7 @@ const initializePassport = async () => {
           audience: await getSiteURL()
         });
         
-        if (ssoConfig.authProvider === AuthProvider.JUMPCLOUD_SAML) {
+        if (ssoConfig.authProvider.toString() === AuthMethod.JUMPCLOUD_SAML.toString()) {
           samlConfig.wantAuthnResponseSigned = false;
         }
         
@@ -243,11 +245,21 @@ const initializePassport = async () => {
       }).select("+publicKey");
       
       if (user) {
-        if (!user.authProvider || user.authProvider === AuthProvider.EMAIL || user.authProvider === AuthProvider.GOOGLE) {
+        // if user does not have SAML enabled then update 
+        const hasSamlEnabled = user.authMethods
+          .some(
+            (authMethod: AuthMethod) => [
+                AuthMethod.OKTA_SAML,
+                AuthMethod.AZURE_SAML,
+                AuthMethod.JUMPCLOUD_SAML
+            ].includes(authMethod)
+          );
+        
+        if (!hasSamlEnabled) {
           await User.findByIdAndUpdate(
             user._id, 
             {
-              authProvider: req.ssoConfig.authProvider
+              authMethods: [req.ssoConfig.authProvider]
             },
             {
               new: true
@@ -279,7 +291,7 @@ const initializePassport = async () => {
       } else {
         user = await new User({
           email,
-          authProvider: req.ssoConfig.authProvider,
+          authMethods: [req.ssoConfig.authProvider],
           firstName,
           lastName
         }).save();
@@ -301,7 +313,7 @@ const initializePassport = async () => {
           firstName,
           lastName,
           organizationName: organization?.name,
-          authProvider: user.authProvider,
+          authMethod: req.ssoConfig.authProvider,
           isUserCompleted,
           ...(req.body.RelayState ? {
             callbackPort: req.body.RelayState as string

backend/src/utils/posthog.ts

@@ -1,15 +1,15 @@
-const CLI_USER_AGENT_NAME = "cli"
-const K8_OPERATOR_AGENT_NAME = "k8-operator"
-export const getChannelFromUserAgent = function (userAgent: string | undefined) {
+import { UserAgentType } from "../ee/models"
+
+export const getUserAgentType = function (userAgent: string | undefined) {
   if (userAgent == undefined) {
-    return "other"
-  } else if (userAgent == CLI_USER_AGENT_NAME) {
-    return "cli"
-  } else if (userAgent == K8_OPERATOR_AGENT_NAME) {
-    return "k8-operator"
+    return UserAgentType.OTHER;
+  } else if (userAgent == UserAgentType.CLI) {
+    return UserAgentType.CLI;
+  } else if (userAgent == UserAgentType.K8_OPERATOR) {
+    return UserAgentType.K8_OPERATOR;
   } else if (userAgent.toLowerCase().includes("mozilla")) {
-    return "web"
+    return UserAgentType.WEB;
   } else {
-    return "other"
+    return UserAgentType.OTHER;
   }
 } 

backend/src/utils/setup/backfillData.ts

@@ -11,6 +11,7 @@ import {
   TrustedIP
 } from "../../ee/models";
 import {
+  AuthMethod,
   BackupPrivateKey,
   Bot,
   BotOrg,
@@ -21,6 +22,7 @@ import {
   Secret,
   SecretBlindIndexData,
   ServiceTokenData,
+  User,
   Workspace
 } from "../../models";
 import { generateKeyPair } from "../../utils/crypto";
@@ -631,3 +633,40 @@ export const backfillTrustedIps = async () => {
     console.log("Backfill: Trusted IPs complete");
   }
 }
+
+export const backfillUserAuthMethods = async () => {
+  await User.updateMany(
+    {
+      authProvider: {
+        $exists: false
+      },
+      authMethods: {
+        $exists: false
+      }
+    },
+    {
+      authMethods: [AuthMethod.EMAIL]
+    }
+  );
+
+  await User.updateMany(
+  {
+    authProvider: {
+      $exists: true
+    },
+    authMethods: {
+      $exists: false
+    }
+  },
+  [
+    {
+      $set: {
+        authMethods: ["$authProvider"]
+      }
+    },
+    {
+      $unset: ["authProvider", "authId"]
+    }
+  ]
+);
+}

backend/src/utils/setup/index.ts

@@ -16,7 +16,8 @@ import {
   backfillSecretVersions,
   backfillServiceToken,
   backfillServiceTokenMultiScope,
-  backfillTrustedIps
+  backfillTrustedIps,
+  backfillUserAuthMethods
 } from "./backfillData";
 import {
   reencryptBotOrgKeys,
@@ -84,6 +85,7 @@ export const setup = async () => {
   await backfillIntegration();
   await backfillServiceTokenMultiScope();
   await backfillTrustedIps();
+  await backfillUserAuthMethods();
 
   // re-encrypt any data previously encrypted under server hex 128-bit ENCRYPTION_KEY
   // to base64 256-bit ROOT_ENCRYPTION_KEY