| | | 1 | | using System.Security.Claims; |
| | | 2 | | using System.Text.Json; |
| | | 3 | | using Elsa.Common; |
| | | 4 | | using Elsa.Authorization; |
| | | 5 | | using Elsa.ExternalAuthentication.Contracts; |
| | | 6 | | using Elsa.ExternalAuthentication.Models; |
| | | 7 | | using Elsa.ExternalAuthentication.Notifications; |
| | | 8 | | using Elsa.ExternalAuthentication.Options; |
| | | 9 | | using Elsa.ExternalAuthentication.Permissions; |
| | | 10 | | using Elsa.ExternalAuthentication.Providers; |
| | | 11 | | using Elsa.Mediator.Contracts; |
| | | 12 | | using Microsoft.Extensions.DependencyInjection; |
| | | 13 | | using Microsoft.Extensions.Logging; |
| | | 14 | | using Microsoft.Extensions.Options; |
| | | 15 | | |
| | | 16 | | namespace Elsa.ExternalAuthentication.Services; |
| | | 17 | | |
| | | 18 | | /// <summary> |
| | | 19 | | /// Applies management-only invariants before mutating database-owned connections. |
| | | 20 | | /// Connection stores remain responsible for durable compare-and-swap and unique-key enforcement. |
| | | 21 | | /// </summary> |
| | 109 | 22 | | public sealed partial class IdentityProviderConnectionManagementService( |
| | 109 | 23 | | IIdentityProviderConnectionStore store, |
| | 109 | 24 | | IIdentityProviderConnectionRegistry registry, |
| | 109 | 25 | | IIdentityProviderConnectionValidityAssessor validityAssessor, |
| | 109 | 26 | | IConnectionRegistryVersionStore registryVersions, |
| | 109 | 27 | | IExternalAuthenticationAdapterRegistry adapters, |
| | 109 | 28 | | IAdapterSettingsMigrationService settingsMigrations, |
| | 109 | 29 | | IUnlinkedIdentityPolicyRegistry policies, |
| | 109 | 30 | | IExternalUserMatcherRegistry matchers, |
| | 109 | 31 | | IPermissionGrantSourceRegistry grantSources, |
| | 109 | 32 | | IEnumerable<ISecretBindingResolver> secretBindingResolvers, |
| | 109 | 33 | | IEnumerable<IManagedSecretBindingWriter> managedSecretBindingWriters, |
| | 109 | 34 | | IPermissionDelegationAuthorizer delegationAuthorizer, |
| | 109 | 35 | | IPermissionEvaluator permissionEvaluator, |
| | 109 | 36 | | ConnectionRevisionCalculator revisionCalculator, |
| | 109 | 37 | | ISystemClock clock, |
| | 109 | 38 | | IOptions<ExternalAuthenticationOptions> options, |
| | 109 | 39 | | Elsa.Identity.Contracts.IRoleAuthorizationService roleAuthorizationService, |
| | 109 | 40 | | IExternalAuthenticationSessionStore sessions, |
| | 109 | 41 | | IServiceProvider services, |
| | 109 | 42 | | ILogger<IdentityProviderConnectionManagementService> logger) |
| | | 43 | | { |
| | 216 | 44 | | private readonly IReadOnlyDictionary<string, ISecretBindingResolver> _secretBindingResolvers = secretBindingResolver |
| | 216 | 45 | | private readonly IReadOnlyDictionary<string, IManagedSecretBindingWriter> _managedSecretBindingWriters = managedSecr |
| | | 46 | | |
| | | 47 | | public async ValueTask<ManagementConnectionLookupResult> FindAsync(string id, string targetTenantId, CancellationTok |
| | | 48 | | { |
| | 44 | 49 | | var effective = await registry.FindByIdAsync(targetTenantId, id, cancellationToken); |
| | 44 | 50 | | if (effective is not null && effective.Scope == ConnectionScope.Host) |
| | 43 | 51 | | return new ManagementConnectionLookupResult.Found(await validityAssessor.AssessAsync(effective, cancellation |
| | | 52 | | |
| | 1 | 53 | | var connection = await store.FindByIdAsync(id, cancellationToken); |
| | 1 | 54 | | if (connection is null || connection.TenantId != ConnectionScope.HostTenantId) |
| | 1 | 55 | | return new ManagementConnectionLookupResult.NotFound(); |
| | | 56 | | |
| | 0 | 57 | | return new ManagementConnectionLookupResult.Found(await validityAssessor.AssessAsync(ToEffective(connection), ca |
| | 44 | 58 | | } |
| | | 59 | | |
| | | 60 | | /// <summary>Returns the deployment-derived read-only upstream callback URI for management display.</summary> |
| | 42 | 61 | | public Uri? GetProviderCallbackUri(IdentityProviderConnection connection) => options.Value.Redirects.ExternalCallbac |
| | 42 | 62 | | ? ExternalAuthenticationCallbackUris.GetAuthorizationCallbackUri(baseUri, connection, BrokerTransactionPurpose.E |
| | 42 | 63 | | : null; |
| | | 64 | | |
| | | 65 | | /// <summary>Returns the deployment-derived read-only callback URI used by provider preview sign-ins.</summary> |
| | 42 | 66 | | public Uri? GetProviderPreviewCallbackUri(IdentityProviderConnection connection) => options.Value.Redirects.External |
| | 42 | 67 | | ? ExternalAuthenticationCallbackUris.GetAuthorizationCallbackUri(baseUri, connection, BrokerTransactionPurpose.P |
| | 42 | 68 | | : null; |
| | | 69 | | |
| | | 70 | | public async ValueTask<IReadOnlyCollection<EffectiveIdentityProviderConnection>> ListAsync(string targetTenantId, Co |
| | | 71 | | { |
| | 2 | 72 | | var effective = await registry.GetAsync(targetTenantId, cancellationToken); |
| | 2 | 73 | | var matches = effective.Connections |
| | 6 | 74 | | .Where(x => x.Scope == ConnectionScope.Host) |
| | 6 | 75 | | .Where(x => Matches(x, filter)) |
| | 6 | 76 | | .OrderBy(x => x.Scope.Kind) |
| | 6 | 77 | | .ThenBy(x => x.Connection.DisplayOrder) |
| | 6 | 78 | | .ThenBy(x => x.Connection.Key, StringComparer.Ordinal) |
| | 6 | 79 | | .ThenBy(x => x.Connection.Id, StringComparer.Ordinal) |
| | 2 | 80 | | .ToArray(); |
| | 8 | 81 | | return await Task.WhenAll(matches.Select(x => validityAssessor.AssessAsync(x, cancellationToken).AsTask())); |
| | 2 | 82 | | } |
| | | 83 | | |
| | | 84 | | public async ValueTask<ManagementConnectionMutationResult> CreateAsync(IdentityProviderConnection connection, Claims |
| | | 85 | | { |
| | 27 | 86 | | NormalizeForCreate(connection, targetTenantId); |
| | 27 | 87 | | if (!CanMutate(connection.TenantId, targetTenantId)) |
| | 0 | 88 | | return new ManagementConnectionMutationResult.Forbidden(); |
| | 27 | 89 | | var validation = await ValidateAsync(connection, actor, targetTenantId, requireCompleteConfiguration: false, con |
| | 27 | 90 | | if (!validation.IsValid) |
| | 7 | 91 | | return new ManagementConnectionMutationResult.ValidationFailed(validation); |
| | 20 | 92 | | if (await CollidesWithConfigurationOrHostAsync(connection, null, targetTenantId, cancellationToken)) |
| | 2 | 93 | | return new ManagementConnectionMutationResult.Conflict("connection_key_conflict"); |
| | | 94 | | |
| | 18 | 95 | | connection.MaterialRevision = revisionCalculator.CalculateMaterialRevision(connection); |
| | 18 | 96 | | var result = await store.CreateAsync(connection, cancellationToken); |
| | 18 | 97 | | return await ProcessMutationAsync(result, actor, "created", null, cancellationToken); |
| | 27 | 98 | | } |
| | | 99 | | |
| | | 100 | | public async ValueTask<ManagementConnectionMutationResult> UpdateAsync(string id, IdentityProviderConnection candida |
| | | 101 | | { |
| | 19 | 102 | | var existing = await store.FindByIdAsync(id, cancellationToken); |
| | 19 | 103 | | if (existing is null || existing.TenantId != ConnectionScope.HostTenantId) |
| | 0 | 104 | | return new ManagementConnectionMutationResult.NotFound(); |
| | 19 | 105 | | if (!CanMutate(existing.TenantId, targetTenantId)) |
| | 0 | 106 | | return new ManagementConnectionMutationResult.Forbidden(); |
| | | 107 | | |
| | 19 | 108 | | candidate.Id = existing.Id; |
| | 19 | 109 | | candidate.CreatedAt = existing.CreatedAt; |
| | 19 | 110 | | candidate.Revision = existing.Revision; |
| | 19 | 111 | | candidate.ArchivedAt = existing.ArchivedAt; |
| | 19 | 112 | | NormalizeForUpdate(candidate, existing); |
| | 19 | 113 | | if (!CanMutate(candidate.TenantId, targetTenantId)) |
| | 0 | 114 | | return new ManagementConnectionMutationResult.Forbidden(); |
| | 19 | 115 | | if (!string.Equals(existing.Key, candidate.Key, StringComparison.Ordinal)) |
| | 1 | 116 | | return new ManagementConnectionMutationResult.Conflict("connection_key_immutable"); |
| | 18 | 117 | | var requireUnsafeConfirmation = adapters.TryGet(candidate.AdapterType, out var candidateAdapter) && |
| | 18 | 118 | | UnsafeSettingsChanged(existing.AdapterSettings, candidate.AdapterSettings, candidateAdapter.Describe()); |
| | 18 | 119 | | var validation = await ValidateAsync(candidate, actor, targetTenantId, requireCompleteConfiguration: candidate.I |
| | 17 | 120 | | if (!validation.IsValid) |
| | 4 | 121 | | return new ManagementConnectionMutationResult.ValidationFailed(validation); |
| | | 122 | | |
| | 13 | 123 | | if (await IsBlockedByFinalLoginPathGuardAsync(existing, candidate, targetTenantId, actor, confirmFinalLoginPathO |
| | 1 | 124 | | return new ManagementConnectionMutationResult.Conflict("final_login_path_guard"); |
| | | 125 | | |
| | 12 | 126 | | candidate.MaterialRevision = revisionCalculator.CalculateMaterialRevision(candidate); |
| | 12 | 127 | | var result = await store.UpdateAsync(candidate, expectedRevision, cancellationToken); |
| | 12 | 128 | | return await ProcessMutationAsync(result, actor, "updated", GetLifecycle(existing), cancellationToken, existing) |
| | 18 | 129 | | } |
| | | 130 | | |
| | | 131 | | public async ValueTask<ManagementConnectionMutationResult> ChangeLifecycleAsync(string id, ConnectionLifecycle actio |
| | | 132 | | { |
| | 5 | 133 | | var existing = await store.FindByIdAsync(id, cancellationToken); |
| | 5 | 134 | | if (existing is null || existing.TenantId != ConnectionScope.HostTenantId) |
| | 0 | 135 | | return new ManagementConnectionMutationResult.NotFound(); |
| | 5 | 136 | | if (!CanMutate(existing.TenantId, targetTenantId)) |
| | 0 | 137 | | return new ManagementConnectionMutationResult.Forbidden(); |
| | | 138 | | |
| | 5 | 139 | | var previousLifecycle = GetLifecycle(existing); |
| | 5 | 140 | | var candidate = IdentityProviderConnectionCloner.Clone(existing); |
| | | 141 | | switch (action) |
| | | 142 | | { |
| | | 143 | | case ConnectionLifecycle.Enabled: |
| | | 144 | | { |
| | 2 | 145 | | var validation = await ValidateAsync(candidate, actor, targetTenantId, requireCompleteConfiguration: tru |
| | 2 | 146 | | if (!validation.IsValid) |
| | 1 | 147 | | return new ManagementConnectionMutationResult.ValidationFailed(validation); |
| | 1 | 148 | | if (candidate.ArchivedAt.HasValue) |
| | 0 | 149 | | return new ManagementConnectionMutationResult.Conflict("connection_archived"); |
| | 1 | 150 | | if (candidate.IsPreferred) |
| | | 151 | | { |
| | 0 | 152 | | var current = await registry.GetAsync(targetTenantId, cancellationToken); |
| | 0 | 153 | | if (current.Connections.Any(x => |
| | 0 | 154 | | x is { Ownership: ConnectionSourceOwnership.Configuration, IsShadowed: false, Connection: { |
| | 0 | 155 | | x.Validity != ConnectionValidity.Invalid && |
| | 0 | 156 | | (!candidate.OverridesConfigurationConnection || !string.Equals(x.Connection.Key, candidate.K |
| | 0 | 157 | | return new ManagementConnectionMutationResult.Conflict("configuration_preferred_connection"); |
| | 0 | 158 | | if (current.Connections.Any(x => x is { Ownership: ConnectionSourceOwnership.Database, Connection: { |
| | 0 | 159 | | return new ManagementConnectionMutationResult.Conflict("default_connection_conflict"); |
| | | 160 | | } |
| | 1 | 161 | | candidate.IsEnabled = true; |
| | 1 | 162 | | break; |
| | | 163 | | } |
| | | 164 | | case ConnectionLifecycle.Disabled: |
| | 1 | 165 | | if (candidate.ArchivedAt.HasValue) |
| | 0 | 166 | | return new ManagementConnectionMutationResult.Conflict("connection_archived"); |
| | 1 | 167 | | candidate.IsEnabled = false; |
| | 1 | 168 | | break; |
| | | 169 | | case ConnectionLifecycle.Archived: |
| | 1 | 170 | | candidate.IsEnabled = false; |
| | 1 | 171 | | candidate.ArchivedAt = clock.UtcNow; |
| | 1 | 172 | | break; |
| | | 173 | | case ConnectionLifecycle.Draft: |
| | 1 | 174 | | if (!candidate.ArchivedAt.HasValue) |
| | 0 | 175 | | return new ManagementConnectionMutationResult.Conflict("connection_not_archived"); |
| | 1 | 176 | | candidate.ArchivedAt = null; |
| | 1 | 177 | | candidate.IsEnabled = false; |
| | 1 | 178 | | break; |
| | | 179 | | default: |
| | 0 | 180 | | return new ManagementConnectionMutationResult.Conflict("invalid_lifecycle_action"); |
| | | 181 | | } |
| | | 182 | | |
| | 4 | 183 | | candidate.UpdatedAt = clock.UtcNow; |
| | 4 | 184 | | candidate.MaterialRevision = revisionCalculator.CalculateMaterialRevision(candidate); |
| | 4 | 185 | | if (await IsBlockedByFinalLoginPathGuardAsync(existing, candidate, targetTenantId, actor, confirmFinalLoginPathO |
| | 0 | 186 | | return new ManagementConnectionMutationResult.Conflict("final_login_path_guard"); |
| | 4 | 187 | | var result = await store.UpdateAsync(candidate, expectedRevision, cancellationToken); |
| | 4 | 188 | | var processed = await ProcessMutationAsync(result, actor, action.ToString().ToLowerInvariant(), previousLifecycl |
| | 4 | 189 | | if (processed is ManagementConnectionMutationResult.Success && action == ConnectionLifecycle.Disabled && revokeA |
| | | 190 | | { |
| | 1 | 191 | | var connectionKey = ConnectionRevisionCalculator.NormalizeKey(candidate.Key); |
| | 1 | 192 | | var revokedCount = await sessions.RevokeActiveForConnectionAsync(connectionKey, "connection_disabled", clock |
| | 1 | 193 | | await PublishBulkSessionRevocationAsync(candidate, actor, revokedCount); |
| | | 194 | | } |
| | 4 | 195 | | return processed; |
| | 5 | 196 | | } |
| | | 197 | | |
| | | 198 | | public async ValueTask<ConnectionValidationResult> ValidateAsync(IdentityProviderConnection connection, ClaimsPrinci |
| | | 199 | | { |
| | 51 | 200 | | var errors = new List<ConnectionValidationError>(); |
| | 51 | 201 | | var warnings = new List<string>(); |
| | 51 | 202 | | var configuredOptions = options.Value; |
| | 51 | 203 | | ValidateEnvelope(connection, configuredOptions, errors); |
| | | 204 | | |
| | 51 | 205 | | if (!adapters.TryGet(connection.AdapterType, out var adapter) || !IsAllowed(configuredOptions.AllowedAdapterType |
| | 0 | 206 | | errors.Add(new("adapterType", "unavailable", "The selected adapter is not installed or is not allowed by thi |
| | | 207 | | |
| | 51 | 208 | | await ValidatePolicyAsync(connection, actor, targetTenantId, configuredOptions, errors, cancellationToken); |
| | 50 | 209 | | ValidateGrantSources(connection, configuredOptions, errors); |
| | 50 | 210 | | if (connection.PermissionGrantSources.Count != 0) |
| | | 211 | | { |
| | 0 | 212 | | var delegation = await delegationAuthorizer.AuthorizeAsync(actor, connection.PermissionGrantSources.ToArray( |
| | 0 | 213 | | if (!delegation.IsAuthorized) |
| | 0 | 214 | | errors.Add(new("permissionGrantSources", "delegation_denied", "The caller may not delegate one or more c |
| | | 215 | | } |
| | | 216 | | |
| | 50 | 217 | | if (adapter is null) |
| | 0 | 218 | | return new(false, errors, warnings); |
| | | 219 | | |
| | 50 | 220 | | await ApplySettingsMigrationAsync(connection, errors, cancellationToken); |
| | 50 | 221 | | if (errors.Count != 0) |
| | 10 | 222 | | return new(false, errors, warnings); |
| | | 223 | | |
| | 40 | 224 | | var descriptor = adapter.Describe(); |
| | 40 | 225 | | ValidateSecretBindingFields(connection, descriptor, requireCompleteConfiguration, errors); |
| | 40 | 226 | | ValidateSecretBindingsAreNotAdapterSettings(connection.AdapterSettings, descriptor, errors); |
| | 40 | 227 | | if (requireUnsafeConfirmation && UsesUnsafeSettings(connection.AdapterSettings, descriptor) && (!confirmUnsafeSe |
| | 0 | 228 | | errors.Add(new("adapterSettings", "unsafe_confirmation_required", "Unsafe provider trust settings require pe |
| | | 229 | | |
| | 40 | 230 | | if (requireCompleteConfiguration) |
| | | 231 | | { |
| | 7 | 232 | | var secretStates = await GetSecretStatesAsync(connection, cancellationToken); |
| | 16 | 233 | | foreach (var (name, state) in secretStates) |
| | | 234 | | { |
| | 1 | 235 | | if (!state.IsConfigured) |
| | 0 | 236 | | errors.Add(new($"secretBindings.{name}", "required", "A required secret binding is not configured.") |
| | 1 | 237 | | else if (!state.IsResolvable) |
| | 0 | 238 | | errors.Add(new($"secretBindings.{name}", "unresolvable", "The secret binding cannot be resolved.")); |
| | | 239 | | } |
| | | 240 | | } |
| | | 241 | | |
| | 40 | 242 | | if (errors.Count != 0 || allowIncompleteDraft) |
| | 34 | 243 | | return new(errors.Count == 0, errors, warnings); |
| | | 244 | | |
| | 6 | 245 | | var effective = ToEffective(connection); |
| | 6 | 246 | | var adapterValidation = await adapter.ValidateAsync(new(effective, new Dictionary<string, ResolvedSecretBinding> |
| | 6 | 247 | | errors.AddRange(adapterValidation.Errors); |
| | 6 | 248 | | warnings.AddRange(adapterValidation.Warnings); |
| | 6 | 249 | | return new(errors.Count == 0 && adapterValidation.IsValid, errors, warnings); |
| | 50 | 250 | | } |
| | | 251 | | |
| | 42 | 252 | | public ValueTask<IReadOnlyDictionary<string, SecretBindingState>> GetSecretBindingStatesAsync(IdentityProviderConnec |
| | | 253 | | |
| | 5 | 254 | | public SecretBindingPresentation PresentSecretBinding(SecretBinding binding, SecretBindingState? state) => new( |
| | 5 | 255 | | binding.Ownership == SecretBindingOwnership.Managed ? "managed" : "external", |
| | 5 | 256 | | state?.IsConfigured ?? false, |
| | 5 | 257 | | state?.IsResolvable ?? false); |
| | | 258 | | |
| | 1 | 259 | | public bool CanCreateConfigurationOverride() => options.Value.AllowConfigurationConnectionOverrides; |
| | | 260 | | |
| | | 261 | | public bool CanPromoteToConfigurationOverride(EffectiveIdentityProviderConnection connection) => |
| | 42 | 262 | | connection is { Ownership: ConnectionSourceOwnership.Database, IsShadowed: true, Connection.ArchivedAt: null } & |
| | 42 | 263 | | options.Value.AllowConfigurationConnectionOverrides; |
| | | 264 | | |
| | | 265 | | private async ValueTask<bool> IsBlockedByFinalLoginPathGuardAsync(IdentityProviderConnection existing, IdentityProvi |
| | | 266 | | { |
| | 17 | 267 | | var guard = services.GetService<FinalLoginPathGuard>(); |
| | 17 | 268 | | if (guard is null) |
| | 0 | 269 | | return false; |
| | | 270 | | |
| | 17 | 271 | | var guardExisting = existing; |
| | 17 | 272 | | if (!existing.OverridesConfigurationConnection && candidate.OverridesConfigurationConnection) |
| | | 273 | | { |
| | 2 | 274 | | var normalizedKey = ConnectionRevisionCalculator.NormalizeKey(candidate.Key); |
| | 2 | 275 | | var effective = await registry.GetAsync(targetTenantId, cancellationToken); |
| | 2 | 276 | | var displacedConfigurationConnection = effective.Connections.FirstOrDefault(x => |
| | 4 | 277 | | x is { Ownership: ConnectionSourceOwnership.Configuration, IsShadowed: false } && |
| | 4 | 278 | | string.Equals(ConnectionRevisionCalculator.NormalizeKey(x.Connection.Key), normalizedKey, StringComparis |
| | 2 | 279 | | if (displacedConfigurationConnection is not null) |
| | 2 | 280 | | guardExisting = displacedConfigurationConnection.Connection; |
| | 2 | 281 | | } |
| | | 282 | | |
| | 17 | 283 | | return await guard.AuthorizeAsync(guardExisting, candidate, targetTenantId, actor, confirmedOverride, cancellati |
| | 17 | 284 | | } |
| | | 285 | | |
| | | 286 | | private async ValueTask<ManagementConnectionMutationResult> ProcessMutationAsync(ConnectionMutationResult result, Cl |
| | | 287 | | { |
| | | 288 | | switch (result) |
| | | 289 | | { |
| | | 290 | | case ConnectionMutationResult.Created(var createdConnection): |
| | 18 | 291 | | await RunPostCommitActionsAsync(createdConnection, actor, operation, previousLifecycle, previousConnecti |
| | 18 | 292 | | return new ManagementConnectionMutationResult.Success(createdConnection); |
| | | 293 | | case ConnectionMutationResult.Updated(var updatedConnection): |
| | 14 | 294 | | await RunPostCommitActionsAsync(updatedConnection, actor, operation, previousLifecycle, previousConnecti |
| | 14 | 295 | | return new ManagementConnectionMutationResult.Success(updatedConnection); |
| | | 296 | | case ConnectionMutationResult.NotFound: |
| | 0 | 297 | | return new ManagementConnectionMutationResult.NotFound(); |
| | | 298 | | case ConnectionMutationResult.DuplicateKey: |
| | 0 | 299 | | return new ManagementConnectionMutationResult.Conflict("connection_key_conflict"); |
| | | 300 | | case ConnectionMutationResult.RevisionConflict(var currentRevision): |
| | 2 | 301 | | return new ManagementConnectionMutationResult.PreconditionFailed(currentRevision); |
| | | 302 | | default: |
| | 0 | 303 | | throw new InvalidOperationException("The connection store returned an unknown mutation result."); |
| | | 304 | | } |
| | 34 | 305 | | } |
| | | 306 | | |
| | | 307 | | private async ValueTask RunPostCommitActionsAsync(IdentityProviderConnection connection, ClaimsPrincipal actor, stri |
| | | 308 | | { |
| | | 309 | | try |
| | | 310 | | { |
| | 32 | 311 | | await registryVersions.AdvanceAsync(CancellationToken.None); |
| | 32 | 312 | | } |
| | 0 | 313 | | catch (Exception exception) |
| | | 314 | | { |
| | 0 | 315 | | logger.LogCritical(exception, "Connection {ConnectionId} was committed, but advancing the external-authentic |
| | 0 | 316 | | } |
| | | 317 | | |
| | | 318 | | try |
| | | 319 | | { |
| | 32 | 320 | | await PublishAsync(connection, actor, operation, previousLifecycle, previousConnection, CancellationToken.No |
| | 31 | 321 | | } |
| | 1 | 322 | | catch (Exception exception) |
| | | 323 | | { |
| | 1 | 324 | | logger.LogError(exception, "Connection {ConnectionId} was committed, but publishing external-authentication |
| | 1 | 325 | | } |
| | 32 | 326 | | } |
| | | 327 | | |
| | | 328 | | private async ValueTask PublishBulkSessionRevocationAsync(IdentityProviderConnection connection, ClaimsPrincipal act |
| | | 329 | | { |
| | 1 | 330 | | if (revokedCount == 0) |
| | 0 | 331 | | return; |
| | | 332 | | |
| | 1 | 333 | | var notificationSender = services.GetService<INotificationSender>(); |
| | 1 | 334 | | if (notificationSender is null) |
| | 0 | 335 | | return; |
| | | 336 | | |
| | | 337 | | try |
| | | 338 | | { |
| | 1 | 339 | | var context = new SecurityEventContext( |
| | 1 | 340 | | actor.FindFirstValue(ClaimTypes.NameIdentifier) ?? actor.FindFirstValue("sub"), |
| | 1 | 341 | | connection.TenantId, |
| | 1 | 342 | | connection.Id, |
| | 1 | 343 | | null, |
| | 1 | 344 | | clock.UtcNow, |
| | 1 | 345 | | SecurityEventOutcome.Succeeded, |
| | 1 | 346 | | Guid.NewGuid().ToString("N"), |
| | 1 | 347 | | "Active external authentication sessions were revoked when the connection was disabled."); |
| | 1 | 348 | | await notificationSender.SendAsync(new ExternalAuthenticationConnectionSessionsRevoked(context, revokedCount |
| | 1 | 349 | | } |
| | 0 | 350 | | catch (Exception exception) |
| | | 351 | | { |
| | 0 | 352 | | logger.LogError(exception, "Connection {ConnectionId} sessions were revoked, but publishing the aggregate se |
| | 0 | 353 | | } |
| | 1 | 354 | | } |
| | | 355 | | |
| | | 356 | | private async ValueTask PublishAsync(IdentityProviderConnection connection, ClaimsPrincipal actor, string operation, |
| | | 357 | | { |
| | 32 | 358 | | var notificationSender = services.GetService<INotificationSender>(); |
| | 32 | 359 | | if (notificationSender is null) |
| | 0 | 360 | | return; |
| | | 361 | | |
| | 32 | 362 | | var context = new SecurityEventContext( |
| | 32 | 363 | | actor.FindFirstValue(ClaimTypes.NameIdentifier) ?? actor.FindFirstValue("sub"), |
| | 32 | 364 | | connection.TenantId, |
| | 32 | 365 | | connection.Id, |
| | 32 | 366 | | null, |
| | 32 | 367 | | clock.UtcNow, |
| | 32 | 368 | | SecurityEventOutcome.Succeeded, |
| | 32 | 369 | | Guid.NewGuid().ToString("N"), |
| | 32 | 370 | | "Identity provider connection management operation completed."); |
| | 32 | 371 | | await notificationSender.SendAsync(new IdentityProviderConnectionChanged(context, operation, connection.Revision |
| | 31 | 372 | | if (previousLifecycle is { } previous && previous != GetLifecycle(connection)) |
| | 4 | 373 | | await notificationSender.SendAsync(new IdentityProviderConnectionLifecycleChanged(context, previous.ToString |
| | 31 | 374 | | if (previousConnection is not null) |
| | | 375 | | { |
| | 13 | 376 | | var fields = previousConnection.SecretBindings.Keys |
| | 13 | 377 | | .Concat(connection.SecretBindings.Keys) |
| | 13 | 378 | | .Distinct(StringComparer.Ordinal) |
| | 17 | 379 | | .Where(field => !previousConnection.SecretBindings.TryGetValue(field, out var before) || !connection.Sec |
| | 32 | 380 | | foreach (var field in fields) |
| | | 381 | | { |
| | 3 | 382 | | previousConnection.SecretBindings.TryGetValue(field, out var previousBinding); |
| | 3 | 383 | | connection.SecretBindings.TryGetValue(field, out var binding); |
| | 3 | 384 | | var isConfigured = binding is not null && _secretBindingResolvers.TryGetValue(binding.ResolverType, out |
| | 3 | 385 | | await notificationSender.SendAsync(new IdentityProviderConnectionSecretBindingChanged(context, field, bi |
| | 3 | 386 | | } |
| | | 387 | | } |
| | 31 | 388 | | } |
| | | 389 | | |
| | | 390 | | private async ValueTask<bool> CollidesWithConfigurationOrHostAsync(IdentityProviderConnection candidate, string? sel |
| | | 391 | | { |
| | 20 | 392 | | var lookupTenant = candidate.TenantId == ConnectionScope.HostTenantId ? ConnectionScope.HostTenantId : candidate |
| | 20 | 393 | | var effective = await registry.GetAsync(lookupTenant, cancellationToken); |
| | 20 | 394 | | var key = ConnectionRevisionCalculator.NormalizeKey(candidate.Key); |
| | 22 | 395 | | if (effective.Connections.Any(x => x.Ownership == ConnectionSourceOwnership.Configuration && x.Scope.TenantId == |
| | 1 | 396 | | return !candidate.OverridesConfigurationConnection; |
| | | 397 | | |
| | 19 | 398 | | if (candidate.TenantId != ConnectionScope.HostTenantId) |
| | 0 | 399 | | return effective.Connections.Any(x => |
| | 0 | 400 | | !string.Equals(x.Connection.Id, selfId, StringComparison.Ordinal) && |
| | 0 | 401 | | x.Scope.Kind == ConnectionScopeKind.Host && |
| | 0 | 402 | | string.Equals(ConnectionRevisionCalculator.NormalizeKey(x.Connection.Key), key, StringComparison.Ordinal)); |
| | | 403 | | |
| | 19 | 404 | | var rows = await store.FindAsync(new(), cancellationToken); |
| | 19 | 405 | | if (rows.Items.Any(x => |
| | 22 | 406 | | !string.Equals(x.Id, selfId, StringComparison.Ordinal) && |
| | 22 | 407 | | x.TenantId != ConnectionScope.HostTenantId && |
| | 22 | 408 | | string.Equals(ConnectionRevisionCalculator.NormalizeKey(x.Key), key, StringComparison.Ordinal))) |
| | 1 | 409 | | return true; |
| | | 410 | | |
| | 18 | 411 | | return options.Value.ConfigurationConnections.Any(x => |
| | 18 | 412 | | x.TenantId != ConnectionScope.HostTenantId && |
| | 18 | 413 | | string.Equals(ConnectionRevisionCalculator.NormalizeKey(x.Key), key, StringComparison.Ordinal)); |
| | 20 | 414 | | } |
| | | 415 | | |
| | | 416 | | private async ValueTask<IReadOnlyDictionary<string, SecretBindingState>> GetSecretStatesAsync(IdentityProviderConnec |
| | | 417 | | { |
| | 49 | 418 | | var states = new Dictionary<string, SecretBindingState>(StringComparer.Ordinal); |
| | 110 | 419 | | foreach (var (name, binding) in connection.SecretBindings) |
| | | 420 | | { |
| | 6 | 421 | | if (!_secretBindingResolvers.TryGetValue(binding.ResolverType, out var resolver)) |
| | 0 | 422 | | states[name] = new(false, false); |
| | | 423 | | else |
| | 6 | 424 | | states[name] = await resolver.GetStateAsync(binding, cancellationToken); |
| | | 425 | | } |
| | | 426 | | |
| | 49 | 427 | | return states; |
| | 49 | 428 | | } |
| | | 429 | | |
| | | 430 | | private async ValueTask ApplySettingsMigrationAsync(IdentityProviderConnection connection, ICollection<ConnectionVal |
| | | 431 | | { |
| | | 432 | | try |
| | | 433 | | { |
| | 50 | 434 | | var migration = await settingsMigrations.MigrateAsync(connection.AdapterType, connection.AdapterSettingsVers |
| | 48 | 435 | | connection.AdapterSettingsVersion = migration.SettingsVersion; |
| | 48 | 436 | | connection.AdapterSettings = migration.Settings; |
| | 48 | 437 | | } |
| | 2 | 438 | | catch (InvalidOperationException) |
| | | 439 | | { |
| | 2 | 440 | | errors.Add(new("adapterSettingsVersion", "migration_unavailable", "The adapter settings version is not compa |
| | 2 | 441 | | } |
| | 50 | 442 | | } |
| | | 443 | | |
| | | 444 | | private void NormalizeForCreate(IdentityProviderConnection connection, string targetTenantId) |
| | | 445 | | { |
| | 27 | 446 | | connection.Id = string.IsNullOrWhiteSpace(connection.Id) ? Guid.NewGuid().ToString("N") : connection.Id; |
| | 27 | 447 | | connection.Key = connection.Key?.Trim() ?? string.Empty; |
| | 27 | 448 | | connection.TenantId = ConnectionScope.HostTenantId; |
| | 27 | 449 | | connection.IsEnabled = false; |
| | 27 | 450 | | connection.ArchivedAt = null; |
| | 27 | 451 | | connection.Revision = 1; |
| | 27 | 452 | | connection.CreatedAt = clock.UtcNow; |
| | 27 | 453 | | connection.UpdatedAt = clock.UtcNow; |
| | 27 | 454 | | connection.MaterialRevision = revisionCalculator.CalculateMaterialRevision(connection); |
| | 27 | 455 | | } |
| | | 456 | | |
| | | 457 | | private void NormalizeForUpdate(IdentityProviderConnection candidate, IdentityProviderConnection existing) |
| | | 458 | | { |
| | 19 | 459 | | candidate.Key = candidate.Key?.Trim() ?? string.Empty; |
| | 19 | 460 | | candidate.TenantId = ConnectionScope.HostTenantId; |
| | 19 | 461 | | candidate.IsEnabled = existing.IsEnabled; |
| | 19 | 462 | | candidate.UpdatedAt = clock.UtcNow; |
| | 19 | 463 | | candidate.SecretBindings ??= new Dictionary<string, SecretBinding>(StringComparer.Ordinal); |
| | 19 | 464 | | candidate.PermissionGrantSources ??= []; |
| | 19 | 465 | | candidate.ClaimProjection ??= ClaimProjection.Empty; |
| | 19 | 466 | | } |
| | | 467 | | |
| | | 468 | | private static void ValidateEnvelope(IdentityProviderConnection connection, ExternalAuthenticationOptions configured |
| | | 469 | | { |
| | 51 | 470 | | if (!configuredOptions.EnableDatabaseConnections) |
| | 0 | 471 | | errors.Add(new("source", "disabled", "Database-owned connections are disabled by deployment configuration.") |
| | 51 | 472 | | if (connection.OverridesConfigurationConnection && !configuredOptions.AllowConfigurationConnectionOverrides) |
| | 1 | 473 | | errors.Add(new("overridesConfigurationConnection", "not_allowed", "This deployment does not allow database c |
| | 51 | 474 | | if (string.IsNullOrWhiteSpace(connection.Key) || connection.Key.Length > 128 || connection.Key.Any(char.IsWhiteS |
| | 0 | 475 | | errors.Add(new("key", "invalid", "Connection keys must be non-empty lowercase URL-safe tokens up to 128 char |
| | 51 | 476 | | else if (!ConnectionKeyPattern().IsMatch(connection.Key)) |
| | 1 | 477 | | errors.Add(new("key", "invalid", "Connection keys must use lowercase letters, digits, and interior hyphens o |
| | 51 | 478 | | if (string.IsNullOrWhiteSpace(connection.DisplayName) || connection.DisplayName.Trim().Length > 256) |
| | 0 | 479 | | errors.Add(new("displayName", "invalid", "Display name is required and may not exceed 256 characters.")); |
| | 51 | 480 | | if (connection.AdapterSettingsVersion <= 0) |
| | 0 | 481 | | errors.Add(new("adapterSettingsVersion", "invalid", "Adapter settings version must be positive.")); |
| | 51 | 482 | | if (!Enum.IsDefined(connection.UpstreamLogoutMode)) |
| | 0 | 483 | | errors.Add(new("upstreamLogoutMode", "invalid", "Upstream logout mode is invalid.")); |
| | 51 | 484 | | if (!IsValidScope(connection.TenantId)) |
| | 0 | 485 | | errors.Add(new("scope", "host_scope_required", "Identity provider connections are managed host-wide in this |
| | 51 | 486 | | if (connection.ClaimProjection.MaximumClaimCount < 0 || connection.ClaimProjection.MaximumValueLength < 0 || con |
| | 51 | 487 | | connection.ClaimProjection.MaximumClaimCount > configuredOptions.Claims.MaximumClaimCount || connection.Clai |
| | 0 | 488 | | errors.Add(new("claimProjection", "invalid", "Claim projection limits exceed deployment bounds.")); |
| | 51 | 489 | | if (!connection.ClaimProjection.RedactedClaimTypes.IsSubsetOf(connection.ClaimProjection.AllowedClaimTypes)) |
| | 0 | 490 | | errors.Add(new("claimProjection.redactedClaimTypes", "invalid", "Redacted claim types must also be allowed c |
| | 51 | 491 | | } |
| | | 492 | | |
| | | 493 | | private async ValueTask ValidatePolicyAsync(IdentityProviderConnection connection, ClaimsPrincipal actor, string tar |
| | | 494 | | { |
| | | 495 | | // The roles the candidate would actually assign. A policy that does not create users assigns none, |
| | | 496 | | // and so does no policy at all -- which is what makes switching away from, or clearing, a stored |
| | | 497 | | // create-user fallback a change rather than a no-op. |
| | 51 | 498 | | var defaultRoleIds = connection.UnlinkedPolicy is { } candidate && UsesCreateUserFallback(candidate) |
| | 51 | 499 | | ? Policies.CreateUserUnlinkedIdentityPolicy.ReadRoleIds(candidate.Settings) |
| | 51 | 500 | | : []; |
| | | 501 | | |
| | | 502 | | // Two independent checks, reported separately because they answer different questions. The |
| | | 503 | | // permission asks whether this actor may decide what auto-created users receive; the subset rule |
| | | 504 | | // asks whether these particular roles stay within what the actor already holds. Only the second |
| | | 505 | | // existed, which left the sibling resource guarded on the write path while the roles inside it |
| | | 506 | | // were not -- see #7977. |
| | | 507 | | // |
| | | 508 | | // Gated on the effective set *changing*, not on it being non-empty, and evaluated before the |
| | | 509 | | // null-policy early return. Validation runs on every update, on enabling a connection, and on |
| | | 510 | | // read-only validate, so keying off presence would stop an administrator without this permission |
| | | 511 | | // from editing an unrelated field once anyone had set roles. Evaluating it only for non-null |
| | | 512 | | // policies would be worse: omitting unlinkedPolicy from an update clears a stored fallback and |
| | | 513 | | // drops its role assignments, the same decision as switching it to 'reject'. |
| | | 514 | | // |
| | | 515 | | // The cheap in-memory permission check goes first: the unchanged-roles comparison rebuilds the |
| | | 516 | | // effective registry, and its answer is irrelevant for an actor who holds the permission. |
| | 51 | 517 | | if (!permissionEvaluator.HasPermission(actor, ExternalAuthenticationResourcePermissions.PolicyDefaultRoles, Core |
| | 51 | 518 | | && !await DefaultRolesAreUnchangedAsync(connection, targetTenantId, defaultRoleIds, cancellationToken)) |
| | 4 | 519 | | errors.Add(new("unlinkedPolicy.defaultRoleIds", "forbidden", "Changing the default roles for an unlinked ide |
| | | 520 | | |
| | 51 | 521 | | if (connection.UnlinkedPolicy is not { } policy) |
| | 36 | 522 | | return; |
| | 15 | 523 | | if (!configuredOptions.UnlinkedIdentityPolicy.AllowDatabaseConnectionOverride) |
| | 0 | 524 | | errors.Add(new("unlinkedPolicy", "not_allowed", "This deployment does not allow database connection policy o |
| | 15 | 525 | | else if (policy.SettingsVersion <= 0 || !policies.TryGet(policy.Type, out _) || !IsAllowed(configuredOptions.All |
| | 0 | 526 | | errors.Add(new("unlinkedPolicy", "unavailable", "The selected unlinked identity policy is not installed or a |
| | | 527 | | else |
| | | 528 | | { |
| | | 529 | | // The subset rule only has something to say about roles actually being assigned. |
| | 15 | 530 | | if (UsesCreateUserFallback(policy) && !await roleAuthorizationService.CanAssignRolesAsync(actor, defaultRole |
| | 1 | 531 | | errors.Add(new("unlinkedPolicy.defaultRoleIds", "forbidden", "The selected default roles are unavailable |
| | | 532 | | |
| | 14 | 533 | | if (string.Equals(policy.Type, Policies.MatchExternalUserUnlinkedIdentityPolicy.PolicyType, StringComparison |
| | 14 | 534 | | (!TryGetMatcherSelection(policy.Settings, out var matcherType, out var matcherSettingsVersion) || |
| | 14 | 535 | | !IsAllowed(configuredOptions.AllowedExternalUserMatcherTypes, matcherType) || |
| | 14 | 536 | | !matchers.TryGet(matcherType, out _) || |
| | 27 | 537 | | matchers.ListDescriptors().All(x => !string.Equals(x.Type, matcherType, StringComparison.Ordinal) || x. |
| | 1 | 538 | | errors.Add(new("unlinkedPolicy.matcher", "unavailable", "The selected external user matcher is not insta |
| | 14 | 539 | | } |
| | 50 | 540 | | } |
| | | 541 | | |
| | | 542 | | /// <summary>Whether <paramref name="candidateRoleIds"/> matches what the connection already assigns.</summary> |
| | | 543 | | /// <remarks> |
| | | 544 | | /// The baseline comes from the registry rather than the database store, because a configuration-owned |
| | | 545 | | /// connection has no database record: looking only there made its configured roles read as newly assigned |
| | | 546 | | /// on every validation, so a caller with view access could not validate one at all. The registry answers |
| | | 547 | | /// for both ownerships, which is the question being asked -- what does this connection assign today. |
| | | 548 | | /// </remarks> |
| | | 549 | | private async ValueTask<bool> DefaultRolesAreUnchangedAsync(IdentityProviderConnection connection, string targetTena |
| | | 550 | | { |
| | 11 | 551 | | var existing = string.IsNullOrWhiteSpace(connection.Id) |
| | 11 | 552 | | ? null |
| | 11 | 553 | | : (await registry.FindByIdAsync(targetTenantId, connection.Id, cancellationToken))?.Connection |
| | 11 | 554 | | ?? await store.FindByIdAsync(connection.Id, cancellationToken); |
| | 11 | 555 | | var storedRoleIds = existing?.UnlinkedPolicy is { } storedPolicy && UsesCreateUserFallback(storedPolicy) |
| | 11 | 556 | | ? Policies.CreateUserUnlinkedIdentityPolicy.ReadRoleIds(storedPolicy.Settings) |
| | 11 | 557 | | : []; |
| | | 558 | | |
| | | 559 | | // Order is not meaningful in a role set, so a reordering is not a change. |
| | 19 | 560 | | return storedRoleIds.OrderBy(x => x, StringComparer.Ordinal).SequenceEqual(candidateRoleIds.OrderBy(x => x, Stri |
| | 11 | 561 | | } |
| | | 562 | | |
| | | 563 | | private static bool UsesCreateUserFallback(PolicySelection policy) => |
| | 35 | 564 | | string.Equals(policy.Type, Policies.CreateUserUnlinkedIdentityPolicy.PolicyType, StringComparison.Ordinal) || |
| | 35 | 565 | | string.Equals(policy.Type, Policies.MatchExternalUserUnlinkedIdentityPolicy.PolicyType, StringComparison.Ordinal |
| | 35 | 566 | | string.Equals(ReadString(policy.Settings, "noMatchAction"), "create-user", StringComparison.OrdinalIgnoreCase); |
| | | 567 | | |
| | | 568 | | private static bool TryGetMatcherSelection(JsonElement settings, out string matcherType, out int settingsVersion) |
| | | 569 | | { |
| | 14 | 570 | | matcherType = string.Empty; |
| | 14 | 571 | | settingsVersion = 0; |
| | 14 | 572 | | if (settings.ValueKind != JsonValueKind.Object || !settings.TryGetProperty("matcher", out var matcher) || matche |
| | 0 | 573 | | return false; |
| | | 574 | | |
| | 14 | 575 | | matcherType = type.GetString() ?? string.Empty; |
| | 14 | 576 | | return !string.IsNullOrWhiteSpace(matcherType) && matcher.TryGetProperty("settingsVersion", out var version) && |
| | | 577 | | } |
| | | 578 | | |
| | | 579 | | private static string? ReadString(JsonElement settings, string propertyName) => |
| | 35 | 580 | | settings.ValueKind == JsonValueKind.Object && |
| | 35 | 581 | | settings.TryGetProperty(propertyName, out var value) && |
| | 35 | 582 | | value.ValueKind == JsonValueKind.String |
| | 35 | 583 | | ? value.GetString() |
| | 35 | 584 | | : null; |
| | | 585 | | |
| | | 586 | | private void ValidateGrantSources(IdentityProviderConnection connection, ExternalAuthenticationOptions configuredOpt |
| | | 587 | | { |
| | 50 | 588 | | var orders = new HashSet<int>(); |
| | 100 | 589 | | foreach (var source in connection.PermissionGrantSources) |
| | | 590 | | { |
| | 0 | 591 | | if (source.SettingsVersion <= 0 || !grantSources.TryGet(source.Type, out _) || !IsAllowed(configuredOptions. |
| | 0 | 592 | | errors.Add(new("permissionGrantSources", "unavailable", "A selected permission grant source is not insta |
| | 0 | 593 | | if (!orders.Add(source.Order)) |
| | 0 | 594 | | errors.Add(new("permissionGrantSources", "duplicate_order", "Permission grant source orders must be uniq |
| | | 595 | | } |
| | 50 | 596 | | } |
| | | 597 | | |
| | | 598 | | private static void ValidateSecretBindingFields(IdentityProviderConnection connection, ExternalAuthenticationAdapter |
| | | 599 | | { |
| | 160 | 600 | | var secretFields = descriptor.Fields.Where(x => x.IsSecretBinding).ToDictionary(x => x.Name, StringComparer.Ordi |
| | 92 | 601 | | foreach (var name in connection.SecretBindings.Keys) |
| | 6 | 602 | | if (!secretFields.ContainsKey(name)) |
| | 0 | 603 | | errors.Add(new($"secretBindings.{name}", "undeclared", "The adapter does not declare this secret binding |
| | 40 | 604 | | if (!requireCompleteConfiguration) |
| | 33 | 605 | | return; |
| | 23 | 606 | | foreach (var field in secretFields.Values.Where(x => x.IsRequired)) |
| | 1 | 607 | | if (!connection.SecretBindings.ContainsKey(field.Name)) |
| | 1 | 608 | | errors.Add(new($"secretBindings.{field.Name}", "required", "A required secret binding is missing.")); |
| | 7 | 609 | | } |
| | | 610 | | |
| | | 611 | | private static void ValidateSecretBindingsAreNotAdapterSettings(JsonElement settings, ExternalAuthenticationAdapterD |
| | | 612 | | { |
| | 40 | 613 | | if (settings.ValueKind != JsonValueKind.Object) |
| | 0 | 614 | | return; |
| | | 615 | | |
| | 240 | 616 | | foreach (var field in descriptor.Fields.Where(x => x.IsSecretBinding)) |
| | 40 | 617 | | if (settings.TryGetProperty(field.Name, out _)) |
| | 1 | 618 | | errors.Add(new($"adapterSettings.{field.Name}", "secret_binding_required", "Secret fields must be config |
| | 40 | 619 | | } |
| | | 620 | | |
| | | 621 | | private static bool UsesUnsafeSettings(JsonElement settings, ExternalAuthenticationAdapterDescriptor descriptor) |
| | | 622 | | { |
| | 21 | 623 | | if (settings.ValueKind != JsonValueKind.Object) |
| | 0 | 624 | | return false; |
| | 63 | 625 | | return descriptor.Fields.Where(x => x.IsUnsafe).Any(field => |
| | 42 | 626 | | settings.TryGetProperty(field.Name, out var value) && IsUnsafeFieldValue(field, value)); |
| | | 627 | | } |
| | | 628 | | |
| | | 629 | | private static bool UnsafeSettingsChanged(JsonElement beforeSettings, JsonElement afterSettings, ExternalAuthenticat |
| | | 630 | | { |
| | 18 | 631 | | if (afterSettings.ValueKind != JsonValueKind.Object) |
| | 0 | 632 | | return false; |
| | | 633 | | |
| | 108 | 634 | | foreach (var field in descriptor.Fields.Where(x => x.IsUnsafe)) |
| | | 635 | | { |
| | 18 | 636 | | if (!afterSettings.TryGetProperty(field.Name, out var afterValue) || !IsUnsafeFieldValue(field, afterValue)) |
| | | 637 | | continue; |
| | 2 | 638 | | if (beforeSettings.ValueKind != JsonValueKind.Object || !beforeSettings.TryGetProperty(field.Name, out var b |
| | 0 | 639 | | return true; |
| | | 640 | | } |
| | | 641 | | |
| | 18 | 642 | | return false; |
| | 0 | 643 | | } |
| | | 644 | | |
| | | 645 | | private static bool IsUnsafeFieldValue(SettingFieldDescriptor field, JsonElement value) => |
| | 3 | 646 | | value.ValueKind is not JsonValueKind.Null and not JsonValueKind.Undefined and not JsonValueKind.False && |
| | 3 | 647 | | (!string.Equals(field.Name, "providerPkce", StringComparison.Ordinal) || value.ValueKind != JsonValueKind.String |
| | | 648 | | |
| | | 649 | | private static bool JsonValueEquals(JsonElement left, JsonElement right) => |
| | 2 | 650 | | left.ValueKind == right.ValueKind && string.Equals(left.GetRawText(), right.GetRawText(), StringComparison.Ordin |
| | | 651 | | |
| | 6 | 652 | | private static EffectiveIdentityProviderConnection ToEffective(IdentityProviderConnection connection) => new(connect |
| | 6 | 653 | | private static ConnectionScope ToScope(string tenantId) => tenantId == ConnectionScope.HostTenantId ? ConnectionScop |
| | 70 | 654 | | private static bool CanMutate(string connectionTenantId, string targetTenantId) => connectionTenantId == ConnectionS |
| | 51 | 655 | | private static bool IsValidScope(string tenantId) => tenantId == ConnectionScope.HostTenantId; |
| | 0 | 656 | | private static string NormalizeScopeTenantId(string requestedTenantId, string fallback) => requestedTenantId is null |
| | 80 | 657 | | private static bool IsAllowed(ICollection<string> allowedTypes, string type) => allowedTypes.Count == 0 || allowedTy |
| | 34 | 658 | | private static ConnectionLifecycle GetLifecycle(IdentityProviderConnection connection) => connection.ArchivedAt.HasV |
| | | 659 | | private static bool Matches(EffectiveIdentityProviderConnection connection, ConnectionFilter filter) => |
| | 6 | 660 | | (filter.Ownership is null || filter.Ownership == connection.Ownership) && |
| | 6 | 661 | | (filter.Scope is null || filter.Scope == connection.Scope) && |
| | 6 | 662 | | (string.IsNullOrWhiteSpace(filter.Search) || connection.Connection.Key.Contains(filter.Search, StringComparison. |
| | 6 | 663 | | (string.IsNullOrWhiteSpace(filter.AdapterType) || string.Equals(filter.AdapterType, connection.Connection.Adapte |
| | 6 | 664 | | (!filter.IsEnabled.HasValue || filter.IsEnabled.Value == connection.Connection.IsEnabled) && |
| | 6 | 665 | | (!filter.IsArchived.HasValue || filter.IsArchived.Value == connection.Connection.ArchivedAt.HasValue); |
| | | 666 | | |
| | | 667 | | [System.Text.RegularExpressions.GeneratedRegex("^[a-z0-9](?:[a-z0-9-]{0,126}[a-z0-9])?$")] |
| | | 668 | | private static partial System.Text.RegularExpressions.Regex ConnectionKeyPattern(); |
| | | 669 | | } |
| | | 670 | | |
| | | 671 | | public abstract record ManagementConnectionLookupResult |
| | | 672 | | { |
| | | 673 | | private ManagementConnectionLookupResult() { } |
| | | 674 | | public sealed record Found(EffectiveIdentityProviderConnection Connection) : ManagementConnectionLookupResult; |
| | | 675 | | public sealed record NotFound : ManagementConnectionLookupResult; |
| | | 676 | | } |
| | | 677 | | |
| | | 678 | | public abstract record ManagementConnectionMutationResult |
| | | 679 | | { |
| | | 680 | | private ManagementConnectionMutationResult() { } |
| | | 681 | | public sealed record Success(IdentityProviderConnection Connection) : ManagementConnectionMutationResult; |
| | | 682 | | public sealed record NotFound : ManagementConnectionMutationResult; |
| | | 683 | | public sealed record Conflict(string Code) : ManagementConnectionMutationResult; |
| | | 684 | | public sealed record PreconditionFailed(long CurrentRevision) : ManagementConnectionMutationResult; |
| | | 685 | | public sealed record Forbidden : ManagementConnectionMutationResult; |
| | | 686 | | public sealed record ValidationFailed(ConnectionValidationResult Validation) : ManagementConnectionMutationResult; |
| | | 687 | | } |