entitlements-github-plugin 0.2.0 → 0.4.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 1f3e4d8ab46a20943aefe27a5696b328fe1b793424d62bbdea0794fc303567be
-  data.tar.gz: 29364fce9fbccf6a72c66d323bcc5d0860f0e1ea840fe1e97189c88cc29f18b8
+  metadata.gz: c768cc8f03a6eae9aaf1350173a59274b53d51cb38b7df20e798ea2e49b049e9
+  data.tar.gz: 1d66f2116e098a02cd81ca0f9a50c98995cda306ff3aceba0e2f37fc705f3b93
 SHA512:
-  metadata.gz: e43bb1a57382d57baa89321c4d45bf20d6620f37f08a4f0699ab662f745e831e60f349221bdbe8936a69b72c6634fee6af42dbd2c31a4e7445deb5d3fb3807fb
-  data.tar.gz: b76d0efc764efc7eb5f6886b7181285c036cf6f70f0cb9dd2a6db06ac32a9c5d1d883d371a6579abc460ba05654aa58071b415e03e5b69640c655dc734e6f83c
+  metadata.gz: 47b00156083eabe37d014eaccbca358c291e7c0ebd4d48f0da8225f347526fdd6cef79969ec152d14db258a8412dc4ab73b1aa35742cf904e135206c85cca51b
+  data.tar.gz: c9f604456245070f5b6ff2dd89b63a16bd36f052f8b489aad4c72b0d85e06782789b5697099053e0f2176a90884c303b5c75e28c9d5c4fb2944267619fde5e25

data/lib/entitlements/backend/github_org/controller.rb

@@ -83,7 +83,7 @@ module Entitlements
           validate_no_dupes!       # calls read() for each group
 
           if changes.any?
-            print_differences(key: group_name, added: [], removed: [], changed: changes, ignored_users: ignored_users)
+            print_differences(key: group_name, added: [], removed: [], changed: changes, ignored_users:)
             @actions.concat(changes)
           else
             logger.debug "UNCHANGED: No GitHub organization changes for #{group_name}"
@@ -398,11 +398,11 @@ module Entitlements
               if removed.key?(member.downcase)
                 # Already removed from a previous role. Therefore this is a move to a different role.
                 removed.delete(member.downcase)
-                moved[member.downcase] = { member: member, role: role }
+                moved[member.downcase] = { member:, role: }
               else
                 # Not removed from a previous role. Suspect this is an addition to the org (if we later spot a removal
                 # from a role, then the code below will update that to be a move instead).
-                added[member.downcase] = { member: member, role: role }
+                added[member.downcase] = { member:, role: }
               end
             end
 
@@ -414,12 +414,12 @@ module Entitlements
               else
                 # Not added to a previous role. Suspect this is a removal from the org (if we later spot an addition
                 # to another role, then the code above will update that to be a move instead).
-                removed[member.downcase] = { member: member, role: role }
+                removed[member.downcase] = { member:, role: }
               end
             end
           end
 
-          { added: added, removed: removed, moved: moved }
+          { added:, removed:, moved: }
         end
 
         # Admins or members who are both `invited` and `pending` do not need to be re-invited. We're waiting for them

data/lib/entitlements/backend/github_org/service.rb

@@ -44,7 +44,7 @@ module Entitlements
         Contract String, String => C::Bool
         def add_user_to_organization(user, role)
           Entitlements.logger.debug "#{identifier} add_user_to_organization(user=#{user}, org=#{org}, role=#{role})"
-          new_membership = octokit.update_organization_membership(org, user: user, role: role)
+          new_membership = octokit.update_organization_membership(org, user:, role:)
 
           # Happy path
           if new_membership[:role] == role
@@ -70,7 +70,7 @@ module Entitlements
         Contract String => C::Bool
         def remove_user_from_organization(user)
           Entitlements.logger.debug "#{identifier} remove_user_from_organization(user=#{user}, org=#{org})"
-          result = octokit.remove_organization_membership(org, user: user)
+          result = octokit.remove_organization_membership(org, user:)
 
           # If we removed the user, remove them from the cache of members, so that any GitHub team
           # operations in this organization will ignore this user.

data/lib/entitlements/backend/github_team/controller.rb

@@ -61,12 +61,12 @@ module Entitlements
             end
 
             if diff[:metadata] && diff[:metadata][:create_team]
-              added << Entitlements::Models::Action.new(team_slug, provider.read(group), group, group_name, ignored_users: ignored_users)
+              added << Entitlements::Models::Action.new(team_slug, provider.read(group), group, group_name, ignored_users:)
             else
-              changed << Entitlements::Models::Action.new(team_slug, provider.read(group), group, group_name, ignored_users: ignored_users)
+              changed << Entitlements::Models::Action.new(team_slug, provider.read(group), group, group_name, ignored_users:)
             end
           end
-          print_differences(key: group_name, added: added, removed: [], changed: changed)
+          print_differences(key: group_name, added:, removed: [], changed:)
 
           @actions = added + changed
         end

data/lib/entitlements/backend/github_team/models/team.rb

@@ -27,7 +27,7 @@ module Entitlements
             @team_id = team_id
             @team_name = team_name.downcase
             @team_dn = ["cn=#{team_name.downcase}", ou].join(",")
-            super(dn: @team_dn, members: Set.new(members.map { |m| m.downcase }), metadata: metadata)
+            super(dn: @team_dn, members: Set.new(members.map { |m| m.downcase }), metadata:)
           end
         end
       end

data/lib/entitlements/backend/github_team/provider.rb

@@ -127,7 +127,7 @@ module Entitlements
           # Create the new team and invalidate the cache
           if github_team.nil?
             team_name = entitlement_group.cn.downcase
-            github.create_team(entitlement_group: entitlement_group)
+            github.create_team(entitlement_group:)
             github.invalidate_predictive_cache(entitlement_group)
             @github_team_cache.delete(team_name)
             github_team = github.read_team(entitlement_group)
@@ -168,7 +168,7 @@ module Entitlements
             team_name: entitlement_group.cn.downcase,
             members: Set.new,
             ou: github.ou,
-            metadata: metadata
+            metadata:
           )
         end
 

data/lib/entitlements/backend/github_team/service.rb

@@ -4,6 +4,7 @@ require_relative "models/team"
 require_relative "../../service/github"
 
 require "base64"
+require "set"
 
 module Entitlements
   class Backend
@@ -77,7 +78,7 @@ module Entitlements
                 team_id: -1,
                 team_name: team_identifier,
                 members: cached_members,
-                ou: ou,
+                ou:,
                 metadata: team_metadata
               )
 
@@ -107,11 +108,11 @@ module Entitlements
                   team_id: teamdata[:team_id],
                   team_name: team_identifier,
                   members: Set.new(teamdata[:members]),
-                  ou: ou,
+                  ou:,
                   metadata: team_metadata
                 )
               rescue TeamNotFound
-                Entitlements.logger.warn "Team #{team_identifier} does not exist in this GitHub.com organization"
+                Entitlements.logger.warn "Team #{team_identifier} does not exist in this GitHub.com organization. If applied, the team will be created."
                 return nil
               end
 
@@ -196,14 +197,56 @@ module Entitlements
             end
           end
 
-          added_members = desired_state.member_strings.map { |u| u.downcase } - current_state.member_strings.map { |u| u.downcase }
-          removed_members = current_state.member_strings.map { |u| u.downcase } - desired_state.member_strings.map { |u| u.downcase }
+          desired_team_members = Set.new(desired_state.member_strings.map { |u| u.downcase })
+          current_team_members = Set.new(current_state.member_strings.map { |u| u.downcase })
+
+          added_members = desired_team_members - current_team_members
+          removed_members = current_team_members - desired_team_members
 
           added_members.select! { |username| add_user_to_team(user: username, team: current_state) }
           removed_members.select! { |username| remove_user_from_team(user: username, team: current_state) }
 
+          added_maintainers = Set.new
+          removed_maintainers = Set.new
+          unless desired_metadata["team_maintainers"] == current_metadata["team_maintainers"]
+            if desired_metadata["team_maintainers"].nil?
+              # We will not delete ALL maintainers from a team and leave it without maintainers.
+              Entitlements.logger.debug "sync_team(#{current_state.team_name}=#{current_state.team_id}): IGNORING GitHub Team Maintainer DELETE"
+            else
+              desired_maintainers_str = desired_metadata["team_maintainers"] # not nil, we tested that above
+              desired_maintainers = Set.new(desired_maintainers_str.split(",").map { |u| u.strip.downcase })
+              unless desired_maintainers.subset?(desired_team_members)
+                maintainer_not_member = desired_maintainers - desired_team_members
+                Entitlements.logger.warn "sync_team(#{current_state.team_name}=#{current_state.team_id}): Maintainers must be a subset of team members. Desired maintainers: #{maintainer_not_member.to_a} are not members. Ignoring."
+                desired_maintainers = desired_maintainers.intersection(desired_team_members)
+              end
+
+              current_maintainers_str = current_metadata["team_maintainers"]
+              current_maintainers = Set.new(
+                current_maintainers_str.nil? ? [] : current_maintainers_str.split(",").map { |u| u.strip.downcase }
+              )
+              # We ignore any current maintainer who is not a member of the team according to the team spec
+              # This avoids messing with teams who have been manually modified to add a maintainer
+              current_maintainers = current_maintainers.intersection(desired_team_members)
+              added_maintainers = desired_maintainers - current_maintainers
+              removed_maintainers = current_maintainers - desired_maintainers
+              if added_maintainers.empty? && removed_maintainers.empty?
+                Entitlements.logger.debug "sync_team(#{current_state.team_name}=#{current_state.team_id}): Textual change but no semantic change in maintainers. It is remains: #{current_maintainers.to_a}."
+              else
+                Entitlements.logger.debug "sync_team(#{current_state.team_name}=#{current_state.team_id}): Maintainer members change found - From #{current_maintainers.to_a} to #{desired_maintainers.to_a}"
+                added_maintainers.select! { |username| add_user_to_team(user: username, team: current_state, role: "maintainer") }
+
+                ## We only touch previous maintainers who are actually still going to be members of the team
+                removed_maintainers = removed_maintainers.intersection(desired_team_members)
+                ## Downgrade membership to default (role: "member")
+                removed_maintainers.select! { |username| add_user_to_team(user: username, team: current_state, role: "member") }
+              end
+            end
+          end
+
+
           Entitlements.logger.debug "sync_team(#{current_state.team_name}=#{current_state.team_id}): Added #{added_members.count}, removed #{removed_members.count}"
-          added_members.any? || removed_members.any? || changed_parent_team
+          added_members.any? || removed_members.any? || added_maintainers.any? || removed_maintainers.any? || changed_parent_team
         end
 
         # Create a team
@@ -337,7 +380,7 @@ module Entitlements
             break
           end
 
-          { members: result, team_id: team_id, parent_team_name: parent_team_name }
+          { members: result, team_id:, parent_team_name: }
         end
 
         # Ensure that the given team ID actually matches up to the team slug on GitHub. This is in place
@@ -366,17 +409,23 @@ module Entitlements
         #
         # user - String with the GitHub username
         # team - Entitlements::Backend::GitHubTeam::Models::Team object for the team.
+        # role - optional (default: "member") String with the role to assign to the user: either "member" or "maintainer"
         #
-        # Returns true if the user was added to the team, false if user was already on team.
+        # Returns true if the user was added to the team or role changed; false if user was already on team with same role
         Contract C::KeywordArgs[
           user: String,
           team: Entitlements::Backend::GitHubTeam::Models::Team,
+          role: C::Optional[String]
         ] => C::Bool
-        def add_user_to_team(user:, team:)
+        def add_user_to_team(user:, team:, role: "member")
           return false unless org_members.include?(user.downcase)
-          Entitlements.logger.debug "#{identifier} add_user_to_team(user=#{user}, org=#{org}, team_id=#{team.team_id})"
+          unless role == "member" || role == "maintainer"
+            # :nocov:
+            raise "add_user_to_team role mismatch: team_id=#{team.team_id} user=#{user} expected role=maintainer/member got=#{role}"
+          end
+          Entitlements.logger.debug "#{identifier} add_user_to_team(user=#{user}, org=#{org}, team_id=#{team.team_id}, role=#{role})"
           validate_team_id_and_slug!(team.team_id, team.team_name)
-          result = octokit.add_team_membership(team.team_id, user)
+          result = octokit.add_team_membership(team.team_id, user, role:)
           result[:state] == "active" || result[:state] == "pending"
         end
 

data/lib/entitlements/service/github.rb

@@ -82,7 +82,7 @@ module Entitlements
           member_count = result.count { |_, role| role == "member" }
           Entitlements.logger.debug "Currently #{org} has #{admin_count} admin(s) and #{member_count} member(s)"
 
-          { cache: cache, value: result }
+          { cache:, value: result }
         end
 
         Entitlements.cache[:github_org_members][org_signature][:value]
@@ -354,9 +354,9 @@ module Entitlements
             data = JSON.parse(response.body)
             if data.key?("errors")
               Entitlements.logger.error "Errors reported: #{data['errors'].inspect}"
-              return { code: 500, data: data }
+              return { code: 500, data: }
             end
-            { code: response.code.to_i, data: data }
+            { code: response.code.to_i, data: }
           rescue JSON::ParserError => e
             Entitlements.logger.error "#{e.class} #{e.message}: #{response.body.inspect}"
             { code: 500, data: { "body" => response.body } }

data/lib/version.rb

@@ -0,0 +1,7 @@
+# frozen_string_literal: true
+
+module Entitlements
+  module Version
+    VERSION = "0.4.0"
+  end
+end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: entitlements-github-plugin
 version: !ruby/object:Gem::Version
-  version: 0.2.0
+  version: 0.4.0
 platform: ruby
 authors:
 - GitHub, Inc. Security Ops
-autorequire:
+autorequire: 
 bindir: bin
 cert_chain: []
-date: 2022-09-14 00:00:00.000000000 Z
+date: 2023-08-29 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: contracts
@@ -234,13 +234,12 @@ dependencies:
     - - '='
       - !ruby/object:Gem::Version
         version: 3.4.2
-description: ''
+description: Entitlements plugin to manage GitHub Orgs and Team memberships and access
 email: security@github.com
 executables: []
 extensions: []
 extra_rdoc_files: []
 files:
-- VERSION
 - lib/entitlements/backend/github_org.rb
 - lib/entitlements/backend/github_org/controller.rb
 - lib/entitlements/backend/github_org/provider.rb
@@ -251,11 +250,12 @@ files:
 - lib/entitlements/backend/github_team/provider.rb
 - lib/entitlements/backend/github_team/service.rb
 - lib/entitlements/service/github.rb
+- lib/version.rb
 homepage: https://github.com/github/entitlements-github-plugin
 licenses:
 - MIT
 metadata: {}
-post_install_message:
+post_install_message: 
 rdoc_options: []
 require_paths:
 - lib
@@ -271,7 +271,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements: []
 rubygems_version: 3.3.7
-signing_key:
+signing_key: 
 specification_version: 4
 summary: GitHub dotcom provider for entitlements-app
 test_files: []

data/VERSION

@@ -1 +0,0 @@
-0.2.0