@valentinkolb/cloud 0.1.0

package/src/services/ipa/index.ts

@@ -0,0 +1,17 @@
+import { providers } from "../providers";
+import { search } from "./search";
+
+export const ipa = {
+  auth: providers.ipa.auth,
+  users: {
+    ...providers.ipa.users,
+    addIpa: providers.ipa.users.create,
+    delete: providers.ipa.users.remove,
+  },
+  groups: {
+    ...providers.ipa.groups,
+    delete: providers.ipa.groups.remove,
+  },
+  search,
+  sync: providers.ipa.sync,
+};

package/src/services/ipa/profile.ts

@@ -0,0 +1,90 @@
+/**
+ * Centralized profile calculation for IPA-backed users.
+ *
+ * The calculation uses the local mirrored IPA group tree only and treats
+ * `auth.groups.id` as the canonical group identity.
+ */
+
+import { sql } from "bun";
+import { calculateIpaProfileFromGroupNames } from "../account-model";
+import { getFreeIpaConfig } from "../freeipa-config";
+
+type DbRow = Record<string, unknown>;
+
+/**
+ * Get all IPA group names a user belongs to (direct + inherited via parent groups).
+ */
+export const getAllUserGroups = async (userId: string): Promise<string[]> => {
+  const rows: DbRow[] = await sql`
+    WITH RECURSIVE all_groups AS (
+      SELECT ug.group_id
+      FROM auth.user_groups_v2 ug
+      JOIN auth.groups g ON g.id = ug.group_id
+      WHERE ug.user_id = ${userId} AND g.provider = 'ipa'
+      UNION
+      SELECT gg.parent_group_id
+      FROM auth.group_groups_v2 gg
+      JOIN auth.groups g ON g.id = gg.parent_group_id
+      JOIN all_groups ag ON gg.child_group_id = ag.group_id
+      WHERE g.provider = 'ipa'
+    )
+    SELECT DISTINCT g.name
+    FROM all_groups ag
+    JOIN auth.groups g ON g.id = ag.group_id
+    ORDER BY g.name
+  `;
+
+  return rows.map((row) => row.name as string);
+};
+
+/**
+ * Calculate canonical IPA profile from effective group names. Reads
+ * `freeipa.groups.base_ipa_realm` from settings (cache-aside).
+ */
+export const calculateIpaProfile = async (memberOfGroups: string[]): Promise<"user" | "guest"> => {
+  const config = await getFreeIpaConfig();
+  return calculateIpaProfileFromGroupNames(memberOfGroups, config.groupsBaseIpaRealm);
+};
+
+/**
+ * Calculate canonical IPA profile for a user from the local DB mirror.
+ */
+export const calculateIpaProfileFromLocalDb = async (userId: string): Promise<"user" | "guest"> => {
+  const groups = await getAllUserGroups(userId);
+  return calculateIpaProfile(groups);
+};
+
+/**
+ * Update one IPA-backed user's canonical profile projection.
+ */
+export const updateUserIpaProfile = async (userId: string): Promise<void> => {
+  const profile = await calculateIpaProfileFromLocalDb(userId);
+  await sql`
+    UPDATE auth.users
+    SET provider = 'ipa',
+        profile = ${profile}
+    WHERE id = ${userId} AND provider = 'ipa'
+  `;
+};
+
+/**
+ * Update all IPA-backed users affected by a group hierarchy change.
+ */
+export const updateProfileForAffectedUsers = async (groupId: string): Promise<void> => {
+  const affectedUsers: DbRow[] = await sql`
+    WITH RECURSIVE affected_groups AS (
+      SELECT ${groupId}::uuid AS group_id
+      UNION
+      SELECT gg.child_group_id
+      FROM auth.group_groups_v2 gg
+      JOIN affected_groups ag ON gg.parent_group_id = ag.group_id
+    )
+    SELECT DISTINCT ug.user_id
+    FROM auth.user_groups_v2 ug
+    JOIN affected_groups ag ON ug.group_id = ag.group_id
+  `;
+
+  for (const row of affectedUsers) {
+    await updateUserIpaProfile(row.user_id as string);
+  }
+};

package/src/services/ipa/search.ts

@@ -0,0 +1,154 @@
+import { sql } from "bun";
+import type { BaseUser, BaseGroup, UserProvider, UserProfile } from "../../contracts/shared";
+import { buildRoles } from "../account-model";
+import { freeipa } from "../../server/services";
+import { toPgTextArray, toPgUuidArray } from "../postgres";
+import { getFreeIpaConfig } from "../freeipa-config";
+
+// ==========================
+// Search Options
+// ==========================
+
+export type SearchOptions = {
+  /** Search users */
+  users?: boolean;
+  /** Search groups */
+  groups?: boolean;
+  /** User UUIDs to exclude from results */
+  excludeUserIds?: string[];
+  /** Group IDs to exclude from results */
+  excludeGroups?: string[];
+  /** Only return groups the user is a member of */
+  onlyUserGroups?: string[];
+  /** Only return POSIX groups (have gid_number) */
+  onlyPosixGroups?: boolean;
+  /** Only return users that are members of these groups */
+  usersInGroups?: string[];
+};
+
+// ==========================
+// Search (autocomplete for member/manager add dialogs)
+// Returns BaseUser/BaseGroup (no relations needed for autocomplete)
+// ==========================
+
+/**
+ * Executes a filtered lookup query and returns normalized matches.
+ */
+export const search = async (query: string, options: SearchOptions): Promise<{ users: BaseUser[]; groups: BaseGroup[] }> => {
+  const q = `%${freeipa.util.escapeLike(query.toLowerCase())}%`;
+  let users: BaseUser[] = [];
+  let groups: BaseGroup[] = [];
+
+  // ========== Search Users ==========
+  if (options.users) {
+    const excludeIds = options.excludeUserIds ?? [];
+    const inGroups = options.usersInGroups ?? [];
+    const groupsAdmin = (await getFreeIpaConfig()).groupsAdmin;
+
+    // Build optional WHERE fragments
+    const excludeFilter = excludeIds.length > 0 ? sql`AND u.id <> ALL(${toPgUuidArray(excludeIds)}::uuid[])` : sql``;
+    const groupFilter =
+      inGroups.length > 0
+        ? sql`AND EXISTS (
+            SELECT 1
+            FROM auth.user_groups_v2 ug
+            JOIN auth.groups g ON g.id = ug.group_id
+            WHERE ug.user_id = u.id
+              AND g.provider = 'ipa'
+              AND ug.group_id = ANY(${toPgUuidArray(inGroups)}::uuid[])
+          )`
+        : sql``;
+
+    const rows = await sql`
+      SELECT u.id, u.uid, u.provider, u.profile, u.given_name, u.sn, u.display_name, u.mail,
+        EXISTS(
+          SELECT 1
+          FROM auth.user_groups_v2 ug_admin
+          JOIN auth.groups g_admin ON g_admin.id = ug_admin.group_id
+          WHERE ug_admin.user_id = u.id
+            AND g_admin.provider = 'ipa'
+            AND g_admin.name = ANY(${toPgTextArray(groupsAdmin)}::text[])
+        ) AS effective_admin
+      FROM auth.users u
+      WHERE u.provider = 'ipa'
+        AND (
+          LOWER(u.uid) LIKE ${q} ESCAPE '\\' OR LOWER(u.display_name) LIKE ${q} ESCAPE '\\' OR
+          LOWER(u.given_name) LIKE ${q} ESCAPE '\\' OR LOWER(u.sn) LIKE ${q} ESCAPE '\\' OR LOWER(u.mail) LIKE ${q} ESCAPE '\\'
+        )
+        ${excludeFilter}
+        ${groupFilter}
+      ORDER BY u.uid
+      LIMIT 10
+    `;
+
+    type UserRow = {
+      id: string;
+      uid: string;
+      provider: UserProvider;
+      profile: UserProfile;
+      effective_admin: boolean | null;
+      given_name: string | null;
+      sn: string | null;
+      display_name: string | null;
+      mail: string | null;
+    };
+    users = (rows as UserRow[]).map((row) => ({
+      id: row.id,
+      uid: row.uid,
+      roles: buildRoles({
+        provider: row.provider,
+        profile: row.profile,
+        memberofGroup: [],
+        manages: [],
+        admin: Boolean(row.effective_admin),
+      }),
+      provider: row.provider,
+      profile: row.profile,
+      givenname: row.given_name ?? "",
+      sn: row.sn ?? "",
+      displayName: row.display_name ?? "",
+      mail: row.mail ?? null,
+    }));
+  }
+
+  // ========== Search Groups ==========
+  if (options.groups) {
+    const excludeIds = options.excludeGroups ?? [];
+    const onlyUserGroups = options.onlyUserGroups ?? [];
+    const onlyPosix = options.onlyPosixGroups ?? false;
+
+    // Build optional WHERE fragments
+    const excludeFilter = excludeIds.length > 0 ? sql`AND id <> ALL(${toPgUuidArray(excludeIds)}::uuid[])` : sql``;
+    const userGroupsFilter = onlyUserGroups.length > 0 ? sql`AND id = ANY(${toPgUuidArray(onlyUserGroups)}::uuid[])` : sql``;
+    const posixFilter = onlyPosix ? sql`AND gid_number IS NOT NULL` : sql``;
+
+    const rows = await sql`
+      SELECT id, provider, name, description, gid_number
+      FROM auth.groups
+      WHERE provider = 'ipa'
+        AND (LOWER(name) LIKE ${q} ESCAPE '\\' OR LOWER(description) LIKE ${q} ESCAPE '\\')
+        ${excludeFilter}
+        ${userGroupsFilter}
+        ${posixFilter}
+      ORDER BY name
+      LIMIT 10
+    `;
+
+    type GroupRow = {
+      id: string;
+      provider: UserProvider;
+      name: string;
+      description: string | null;
+      gid_number: number | null;
+    };
+    groups = (rows as GroupRow[]).map((row) => ({
+      id: row.id,
+      provider: row.provider,
+      name: row.name,
+      description: row.description ?? null,
+      gidnumber: row.gid_number ?? null,
+    }));
+  }
+
+  return { users, groups };
+};