NM-341-v6

auth/host_session.go

@@ -264,6 +264,7 @@ func joinHostToNetworks(ctx context.Context, key models.EnrollmentKey, host *sch
 		}
 
 		violations, _ := logic.CheckPostureViolationsForHost(
+			ctx,
 			host,
 			keyTags,
 			schema.NetworkID(network.Name),

controllers/device.go

@@ -118,7 +118,7 @@ func getDeviceNetworks(w http.ResponseWriter, r *http.Request) {
 		}
 		// Ownership mismatch must not block the network list; host-scoped state is omitted without a verified host.
 	}
-	networks, err := logic.GetDeviceNetworks(db.WithContext(r.Context()), user, host)
+	networks, err := logic.GetDeviceNetworks(r.Context(), user, host)
 	if err != nil {
 		logic.ReturnErrorResponse(w, r, logic.FormatError(err, "internal"))
 		return

controllers/enrollmentkeys.go

@@ -593,7 +593,7 @@ func handleHostRegister(w http.ResponseWriter, r *http.Request) {
 
 	var joinNetworks []string
 	for _, netI := range enrollmentKey.Networks {
-		violations, _ := logic.CheckPostureViolationsForHost(&newHost, keyTags, schema.NetworkID(netI), true)
+		violations, _ := logic.CheckPostureViolationsForHost(r.Context(), &newHost, keyTags, schema.NetworkID(netI), true)
 		if len(violations) == 0 {
 			joinNetworks = append(joinNetworks, netI)
 		}

controllers/ext_client.go

@@ -646,7 +646,7 @@ func createExtClient(w http.ResponseWriter, r *http.Request) {
 	if extclient.DeviceID != "" {
 		// check for violations connecting from desktop app
 		staticNode := models.ConvertToStaticNode(extclient)
-		violations, _ := logic.CheckPostureViolations(logic.GetPostureCheckDeviceInfoByNode(&staticNode), schema.NetworkID(extclient.Network))
+		violations, _ := logic.CheckPostureViolations(r.Context(), logic.GetPostureCheckDeviceInfoByNode(&staticNode), schema.NetworkID(extclient.Network))
 		if len(violations) > 0 {
 			logic.ReturnErrorResponse(w, r, logic.FormatError(errors.New("posture check violations"), logic.Forbidden))
 			return
@@ -927,7 +927,7 @@ func updateExtClient(w http.ResponseWriter, r *http.Request) {
 	if newclient.DeviceID != "" && newclient.Enabled {
 		// check for violations connecting from desktop app
 		staticNode := models.ConvertToStaticNode(newclient)
-		violations, _ := logic.CheckPostureViolations(logic.GetPostureCheckDeviceInfoByNode(&staticNode), schema.NetworkID(newclient.Network))
+		violations, _ := logic.CheckPostureViolations(r.Context(), logic.GetPostureCheckDeviceInfoByNode(&staticNode), schema.NetworkID(newclient.Network))
 		if len(violations) > 0 {
 			logic.ReturnErrorResponse(w, r, logic.FormatError(errors.New("posture check violations"), logic.Forbidden))
 			return

controllers/hosts.go

@@ -647,7 +647,7 @@ func hostUpdateFallback(w http.ResponseWriter, r *http.Request) {
 			)
 			for _, _node := range _nodes {
 				node := logic.ConvertSchemaNodeToModelsNode(&_node)
-				node.PostureChecksViolations, node.PostureCheckViolationSeverityLevel = logic.CheckPostureViolations(logic.GetPostureCheckDeviceInfoByNode(node), schema.NetworkID(node.Network))
+				node.PostureChecksViolations, node.PostureCheckViolationSeverityLevel = logic.CheckPostureViolations(ctx, logic.GetPostureCheckDeviceInfoByNode(node), schema.NetworkID(node.Network))
 				_node.PostureCheckSeverity = node.PostureCheckViolationSeverityLevel
 				_node.PostureCheckLastEvaluationCycleID = uuid.NewString()
 				_node.PostureCheckLastEvaluatedAt = time.Now().UTC()
@@ -977,7 +977,7 @@ func addHostToNetwork(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	violations, _ := logic.CheckPostureViolationsForHost(host, nil, schema.NetworkID(networkID), true)
+	violations, _ := logic.CheckPostureViolationsForHost(r.Context(), host, nil, schema.NetworkID(networkID), true)
 	if len(violations) > 0 {
 		logic.ReturnErrorResponseWithJson(w, r, violations, logic.FormatError(errors.New("posture check violations"), logic.BadReq))
 		return
@@ -1871,7 +1871,7 @@ func approvePendingHost(w http.ResponseWriter, r *http.Request) {
 		keyTags[models.TagID(tagI)] = struct{}{}
 	}
 
-	violations, _ := logic.CheckPostureViolationsForHost(host, keyTags, schema.NetworkID(network.Name), true)
+	violations, _ := logic.CheckPostureViolationsForHost(r.Context(), host, keyTags, schema.NetworkID(network.Name), true)
 	if len(violations) > 0 {
 		err = fmt.Errorf("failed to approve pending host (%s): posture check violations", id)
 		logger.Log(0, err.Error())
@@ -1939,7 +1939,7 @@ func addDefaultHostToNetworks(ctx context.Context, host *schema.Host) {
 			continue
 		}
 
-		violations, _ := logic.CheckPostureViolationsForHost(host, make(map[models.TagID]struct{}), schema.NetworkID(network.Name), true)
+		violations, _ := logic.CheckPostureViolationsForHost(ctx, host, make(map[models.TagID]struct{}), schema.NetworkID(network.Name), true)
 		if len(violations) > 0 {
 			logger.Log(2, "skipping network", network.Name, "for default host", host.Name, ": posture check violations")
 			continue

controllers/org.go

@@ -45,10 +45,20 @@ func resolveSoleOrg(ctx context.Context, orgID string) (*schema.Organization, er
 	if err != nil {
 		return nil, err
 	}
-	if orgID != "sole" && orgID != o.ID && orgID != o.Slug {
-		return nil, errOrgNotFound
+
+	if orgID == "sole" {
+		return o, nil
+	}
+
+	if orgID == o.ID {
+		return o, nil
 	}
-	return o, nil
+
+	if orgID == o.Slug {
+		return o, nil
+	}
+
+	return nil, errOrgNotFound
 }
 
 // @Summary     Get organization SSO settings

controllers/user.go

@@ -324,7 +324,7 @@ func authenticateUser(response http.ResponseWriter, request *http.Request) {
 		return
 	}
 
-	if logic.IsOauthUser(user) == nil {
+	if logic.IsOauthUser(request.Context(), user) == nil {
 		logic.ReturnErrorResponse(response, request, logic.FormatError(errors.New("user is registered via SSO"), "badrequest"))
 		return
 	}
@@ -1682,48 +1682,61 @@ func updateUser(w http.ResponseWriter, r *http.Request) {
 			break
 		}
 	}
-	if !ismaster && selfUpdate {
-		if user.PlatformRoleID != userchange.PlatformRoleID {
-			slog.Error("user cannot change his own role", "caller", caller.Username, "attempted to update user role", username)
-			logic.ReturnErrorResponse(w, r, logic.FormatError(errors.New("user not allowed to self assign role"), "forbidden"))
-			return
 
-		}
+	if scope.Level(r.Context()) == scope.TenantScope {
+		if !ismaster && selfUpdate {
+			if user.PlatformRoleID != userchange.PlatformRoleID {
+				slog.Error("user cannot change his own role", "caller", caller.Username, "attempted to update user role", username)
+				logic.ReturnErrorResponse(w, r, logic.FormatError(errors.New("user not allowed to self assign role"), "forbidden"))
+				return
 
-		if logic.IsMFAEnforced(r.Context()) && user.IsMFAEnabled && !userchange.IsMFAEnabled {
-			err = errors.New("mfa is enforced, user cannot unset their own mfa")
-			slog.Error("failed to update user", "caller", caller.Username, "attempted to update user", username, "error", err)
-			logic.ReturnErrorResponse(w, r, logic.FormatError(err, "forbidden"))
-			return
-		}
+			}
 
-		if servercfg.IsPro && caller.PlatformRoleID != schema.SuperAdminRole {
-			// users cannot update their own groups; superadmin is exempt
-			if len(user.UserGroups.Data()) != len(userchange.UserGroups.Data()) || !reflect.DeepEqual(user.UserGroups.Data(), userchange.UserGroups.Data()) {
-				err = errors.New("user cannot update self update their groups")
+			if logic.IsMFAEnforced(r.Context()) && user.IsMFAEnabled && !userchange.IsMFAEnabled {
+				err = errors.New("mfa is enforced, user cannot unset their own mfa")
 				slog.Error("failed to update user", "caller", caller.Username, "attempted to update user", username, "error", err)
 				logic.ReturnErrorResponse(w, r, logic.FormatError(err, "forbidden"))
 				return
 			}
+
+			if servercfg.IsPro && caller.PlatformRoleID != schema.SuperAdminRole {
+				// users cannot update their own groups; superadmin is exempt
+				if len(user.UserGroups.Data()) != len(userchange.UserGroups.Data()) || !reflect.DeepEqual(user.UserGroups.Data(), userchange.UserGroups.Data()) {
+					err = errors.New("user cannot self update their groups")
+					slog.Error("failed to update user", "caller", caller.Username, "attempted to update user", username, "error", err)
+					logic.ReturnErrorResponse(w, r, logic.FormatError(err, "forbidden"))
+					return
+				}
+			}
 		}
-	}
-	if ismaster {
-		if user.PlatformRoleID != schema.SuperAdminRole && userchange.PlatformRoleID == schema.SuperAdminRole {
-			slog.Error("operation not allowed", "caller", logic.MasterUser, "attempted to update user role to superadmin", username)
-			logic.ReturnErrorResponse(w, r, logic.FormatError(errors.New("attempted to update user role to superadmin"), "forbidden"))
+
+		if ismaster {
+			if user.PlatformRoleID != schema.SuperAdminRole && userchange.PlatformRoleID == schema.SuperAdminRole {
+				slog.Error("operation not allowed", "caller", logic.MasterUser, "attempted to update user role to superadmin", username)
+				logic.ReturnErrorResponse(w, r, logic.FormatError(errors.New("attempted to update user role to superadmin"), "forbidden"))
+				return
+			}
+		}
+
+		if user.AuthType == schema.Inherited && userchange.Password != "" {
+			err = fmt.Errorf("cannot update password for user with inherited auth")
+			logic.ReturnErrorResponse(w, r, logic.FormatError(err, logic.BadReq))
 			return
 		}
 	}
 
-	if logic.IsOauthUser(user) == nil && userchange.Password != "" {
-		err := fmt.Errorf("cannot update user's password for an oauth user %s", username)
+	if logic.IsOauthUser(r.Context(), user) == nil && userchange.Password != "" {
+		err := fmt.Errorf("cannot update password for an oauth user %s", username)
 		logic.ReturnErrorResponse(w, r, logic.FormatError(err, "forbidden"))
 		return
 	}
+
+	var deleteAccessTokens bool
 	if scope.Level(r.Context()) == scope.TenantScope &&
 		(userchange.PlatformRoleID != user.PlatformRoleID || !logic.CompareMaps(user.UserGroups.Data(), userchange.UserGroups.Data())) {
-		(&schema.UserAccessToken{UserName: user.Username}).DeleteAllUserTokens(r.Context())
+		deleteAccessTokens = true
 	}
+
 	oldUser := *user
 	if ismaster {
 		caller = &schema.User{
@@ -1770,6 +1783,11 @@ func updateUser(w http.ResponseWriter, r *http.Request) {
 		logic.ReturnErrorResponse(w, r, logic.FormatError(err, "badrequest"))
 		return
 	}
+
+	if deleteAccessTokens {
+		_ = (&schema.UserAccessToken{UserName: user.Username}).DeleteAllUserTokens(r.Context())
+	}
+
 	logic.LogEvent(r.Context(), &e)
 	ctx := scope.WithContext(db.WithContext(context.Background()), scope.Level(r.Context()), scope.ID(r.Context()))
 	go mq.PublishPeerUpdate(ctx, false)
@@ -1916,7 +1934,7 @@ func deleteUser(w http.ResponseWriter, r *http.Request) {
 		break
 	}
 
-	if user.AuthType == schema.OAuth || user.ExternalIdentityProviderID != "" {
+	if logic.IsIDPUser(r.Context(), user) {
 		err = fmt.Errorf("cannot delete idp user %s", username)
 		logger.Log(0, username, "failed to delete user: ", err.Error())
 		logic.ReturnErrorResponse(w, r, logic.FormatError(err, "badrequest"))

logic/auth.go

@@ -60,8 +60,8 @@ func ResolveInheritedAuth(ctx context.Context, user *schema.User) error {
 }
 
 // IsOauthUser - returns
-func IsOauthUser(user *schema.User) error {
-	var currentValue, err = FetchOAuthSecret()
+func IsOauthUser(ctx context.Context, user *schema.User) error {
+	var currentValue, err = FetchOAuthSecret(ctx)
 	if err != nil {
 		return err
 	}
@@ -346,6 +346,16 @@ func ValidateUser(user *schema.User) error {
 	return validationErr
 }
 
+func IsIDPUser(ctx context.Context, user *schema.User) bool {
+	if scope.Level(ctx) == scope.TenantScope {
+		if user.AuthType == schema.OAuth && IsSyncEnabled(ctx) {
+			return true
+		}
+	}
+
+	return false
+}
+
 // DeleteUser - deletes a given user
 func DeleteUser(ctx context.Context, user *schema.User) error {
 	err := user.DeleteMembership(ctx)
@@ -383,11 +393,11 @@ func SetOAuthSecret(secret string) error {
 }
 
 // FetchOAuthSecret fetches secrets for oauth
-func FetchOAuthSecret() (string, error) {
+func FetchOAuthSecret(ctx context.Context) (string, error) {
 	oauthSecret := &schema.Internal{
 		Key: schema.InternalKey_OAuthSecret,
 	}
-	err := oauthSecret.Get(db.WithContext(context.TODO()))
+	err := oauthSecret.Get(ctx)
 	if err != nil {
 		return "", err
 	}

logic/device.go

@@ -232,7 +232,7 @@ func applyDeviceNetworkHostState(ctx context.Context, host *schema.Host, network
 		return
 	}
 
-	violations, _ := CheckPostureViolationsForHost(host, nil, schema.NetworkID(network.Name), true)
+	violations, _ := CheckPostureViolationsForHost(ctx, host, nil, schema.NetworkID(network.Name), true)
 	if len(violations) > 0 {
 		dn.Status = models.DeviceNetworkStatusBlocked
 		return
@@ -289,7 +289,7 @@ func JoinDeviceNetwork(ctx context.Context, user *schema.User, host *schema.Host
 		return models.DeviceJoinResult{Status: models.DeviceJoinStatusJoined}, nil
 	}
 
-	violations, _ := CheckPostureViolationsForHost(host, nil, schema.NetworkID(networkID), true)
+	violations, _ := CheckPostureViolationsForHost(ctx, host, nil, schema.NetworkID(networkID), true)
 	if len(violations) > 0 {
 		return empty, errors.New("access blocked: this device doesn't meet security requirements")
 	}

logic/hosts.go

@@ -40,17 +40,16 @@ var HostLimitExceeded = func(ctx context.Context) bool {
 	return false
 }
 
-// todo(nm-341): add ctx to func
-var CheckPostureViolations = func(d models.PostureCheckDeviceInfo, network schema.NetworkID) (v []models.Violation, level schema.Severity) {
+var CheckPostureViolations = func(ctx context.Context, d models.PostureCheckDeviceInfo, network schema.NetworkID) (v []models.Violation, level schema.Severity) {
 	return []models.Violation{}, schema.SeverityUnknown
 }
 
 // todo(nm-341): add ctx to func
-var CheckPostureViolationsForHost = func(host *schema.Host, tags map[models.TagID]struct{}, network schema.NetworkID, skipAutoUpdate bool) ([]models.Violation, schema.Severity) {
+var CheckPostureViolationsForHost = func(ctx context.Context, host *schema.Host, tags map[models.TagID]struct{}, network schema.NetworkID, skipAutoUpdate bool) ([]models.Violation, schema.Severity) {
 	if host == nil {
 		return []models.Violation{}, schema.SeverityUnknown
 	}
-	return CheckPostureViolations(models.PostureCheckDeviceInfo{
+	return CheckPostureViolations(ctx, models.PostureCheckDeviceInfo{
 		ClientLocation: host.CountryCode,
 		ClientVersion:  host.Version,
 		OS:             host.OS,

logic/usage.go

@@ -9,7 +9,6 @@ import (
 )
 
 func GetCurrentServerUsage(ctx context.Context) (limits models.Usage) {
-	// todo(nm-341): get usage of all tenants or specific tenant?
 	limits.SetDefaults()
 	hosts, hErr := GetAllHostsWithStatus(ctx, schema.OnlineSt)
 	if hErr == nil {

migrate/migrate.go

@@ -426,7 +426,7 @@ func syncUsers() {
 		for _, user := range users {
 			user := user
 			user.AuthType = schema.BasicAuth
-			if logic.IsOauthUser(&user) == nil {
+			if logic.IsOauthUser(db.WithContext(context.TODO()), &user) == nil {
 				user.AuthType = schema.OAuth
 			}
 

orchestrator/extensions/user.go

@@ -8,15 +8,15 @@ import (
 )
 
 type UserExtensions interface {
-	ConfigureAuthType(user *schema.User) error
+	ConfigureAuthType(ctx context.Context, user *schema.User) error
 	ConfigureGlobalAdminGroup(membership *schema.TenantMembership)
 	ConfigureGroups(ctx context.Context, membership *schema.TenantMembership, groups datatypes.JSONType[map[schema.UserGroupID]struct{}])
 	SendEmailValidation(ctx context.Context, user *schema.User) error
 }
 
 type CEUserExtensions struct{}
 
-func (c *CEUserExtensions) ConfigureAuthType(user *schema.User) error {
+func (c *CEUserExtensions) ConfigureAuthType(_ context.Context, user *schema.User) error {
 	user.AuthType = schema.BasicAuth
 	return nil
 }

orchestrator/node.go

@@ -153,10 +153,10 @@ func (n *NodeOrchestrator) CreateNode(ctx context.Context, host *schema.Host, ne
 		}
 	}
 
-	go func() {
+	go func(ctx context.Context) {
 		modelsNode := logic.ConvertSchemaNodeToModelsNode(node)
 
-		modelsNode.PostureChecksViolations, modelsNode.PostureCheckViolationSeverityLevel = logic.CheckPostureViolations(logic.GetPostureCheckDeviceInfoByNode(modelsNode), schema.NetworkID(node.Network.Name))
+		modelsNode.PostureChecksViolations, modelsNode.PostureCheckViolationSeverityLevel = logic.CheckPostureViolations(ctx, logic.GetPostureCheckDeviceInfoByNode(modelsNode), schema.NetworkID(node.Network.Name))
 		node.PostureCheckSeverity = modelsNode.PostureCheckViolationSeverityLevel
 		node.PostureCheckLastEvaluationCycleID = uuid.NewString()
 		node.PostureCheckLastEvaluatedAt = time.Now().UTC()
@@ -175,7 +175,7 @@ func (n *NodeOrchestrator) CreateNode(ctx context.Context, host *schema.Host, ne
 				EvaluatedAt:       node.PostureCheckLastEvaluatedAt,
 			})
 		}
-		err = node.UpsertViolations(db.WithContext(context.TODO()), _violations)
+		err = node.UpsertViolations(ctx, _violations)
 		if err != nil {
 			logger.Log(1, fmt.Sprintf("failed to upsert node (%s) posture check violations: %v", modelsNode.ID, err))
 		}
@@ -204,7 +204,7 @@ func (n *NodeOrchestrator) CreateNode(ctx context.Context, host *schema.Host, ne
 			time.Sleep(time.Second * 30)
 			logic.TriggerCollectMetrics(host.ID.String(), node.ID, "join")
 		}
-	}()
+	}(scope.WithContext(db.WithContext(context.Background()), scope.Level(ctx), scope.ID(ctx)))
 
 	return node, nil
 }

orchestrator/user.go

@@ -79,7 +79,7 @@ func (u *UserOrchestrator) CreateUser(ctx context.Context, user *schema.User, op
 
 		user.Password = string(passwordHash)
 
-		err = u.userExt.ConfigureAuthType(user)
+		err = u.userExt.ConfigureAuthType(ctx, user)
 		if err != nil {
 			return err
 		}

pro/auth/azure-ad.go

@@ -98,7 +98,7 @@ func (p *AzureADProvider) HandleCallback(w http.ResponseWriter, r *http.Request)
 	if err != nil {
 		if errors.Is(err, gorm.ErrRecordNotFound) {
 			if inviteExists {
-				user, err := proLogic.PrepareOauthUserFromInvite(in)
+				user, err := proLogic.PrepareOauthUserFromInvite(r.Context(), in)
 				if err != nil {
 					logic.ReturnErrorResponse(w, r, logic.FormatError(err, "internal"))
 					return
@@ -179,7 +179,7 @@ func (p *AzureADProvider) HandleCallback(w http.ResponseWriter, r *http.Request)
 		return
 	}
 
-	newPass, fetchErr := logic.FetchOAuthSecret()
+	newPass, fetchErr := logic.FetchOAuthSecret(r.Context())
 	if fetchErr != nil {
 		return
 	}