Implement external identities

Gemfile

@@ -83,5 +83,7 @@ gem 'rotp'
 gem 'grpc', '~> 1.64', '< 1.65'
 gem 'tucana', '0.0.4'
 
+gem 'code0-identities', '~> 0.0.1'
+
 gem 'pry', '~> 0.14.2'
 gem 'pry-byebug', '~> 3.10'

Gemfile.lock

@@ -85,11 +85,14 @@ GEM
       msgpack (~> 1.2)
     builder (3.3.0)
     byebug (11.1.3)
+    code0-identities (0.0.1)
+      httparty (~> 0.22)
     code0-license (0.2.0)
     coderay (1.1.3)
     concurrent-ruby (1.3.4)
     connection_pool (2.4.1)
     crass (1.0.6)
+    csv (3.3.0)
     database_cleaner-active_record (2.2.0)
       activerecord (>= 5.a)
       database_cleaner-core (~> 2.0.0)
@@ -137,6 +140,10 @@ GEM
     grpc (1.64.3-x86_64-linux)
       google-protobuf (~> 3.25)
       googleapis-common-protos-types (~> 1.0)
+    httparty (0.22.0)
+      csv
+      mini_mime (>= 1.0.0)
+      multi_xml (>= 0.5.2)
     i18n (1.14.5)
       concurrent-ruby (~> 1.0)
     io-console (0.7.2)
@@ -164,6 +171,8 @@ GEM
     minitest (5.25.1)
     msgpack (1.7.2)
     multi_json (1.15.0)
+    multi_xml (0.7.1)
+      bigdecimal (~> 3.1)
     mutex_m (0.2.0)
     net-imap (0.4.12)
       date
@@ -348,6 +357,7 @@ PLATFORMS
 DEPENDENCIES
   bcrypt (~> 3.1.7)
   bootsnap
+  code0-identities (~> 0.0.1)
   code0-license (~> 0.2.0)
   database_cleaner-active_record (~> 2.1)
   debug

app/controllers/graphql_controller.rb

@@ -88,7 +88,7 @@ def anonymous_mutation?
     return false unless selections.length == 1
 
     mutation_name = selections.first.name
-    %w[usersLogin usersRegister].include?(mutation_name)
+    %w[usersLogin usersRegister usersIdentityRegister usersIdentityLogin].include?(mutation_name)
   end
 
   Authorization = Struct.new(:type, :authorization) do

app/graphql/mutations/users/identity/link.rb

@@ -0,0 +1,22 @@
+# frozen_string_literal: true
+
+module Mutations
+  module Users
+    module Identity
+      class Link < BaseMutation
+        description 'Links an external identity to and existing user'
+
+        field :user_identity, Types::UserIdentityType, null: true, description: 'The created user session'
+
+        argument :args, Types::Input::IdentityInput, required: true, description: 'The validation object'
+        argument :provider_id, String, required: true,
+                                       description: 'The ID of the external provider (e.g. google, discord, gitlab...) '
+
+        def resolve(provider_id:, args:)
+          ::Users::Identity::LinkService.new(current_user, provider_id,
+                                             args).execute.to_mutation_response(success_key: :user_identity)
+        end
+      end
+    end
+  end
+end

app/graphql/mutations/users/identity/login.rb

@@ -0,0 +1,26 @@
+# frozen_string_literal: true
+
+module Mutations
+  module Users
+    module Identity
+      class Login < BaseMutation
+        include Sagittarius::Graphql::AuthorizationBypass
+
+        description 'Login to an existing user via an external identity'
+
+        field :user_session, Types::UserSessionType, null: true, description: 'The created user session'
+
+        argument :args, Types::Input::IdentityInput, required: true, description: 'The validation object'
+        argument :provider_id, String, required: true,
+                                       description: 'The ID of the external provider (e.g. google, discord, gitlab...) '
+
+        def resolve(provider_id:, args:)
+          response = ::Users::Identity::LoginService.new(provider_id,
+                                                         args).execute.to_mutation_response(success_key: :user_session)
+          bypass_authorization! response, object_path: %i[user_session user]
+          bypass_authorization! response, object_path: :user_session
+        end
+      end
+    end
+  end
+end

app/graphql/mutations/users/identity/register.rb

@@ -0,0 +1,28 @@
+# frozen_string_literal: true
+
+module Mutations
+  module Users
+    module Identity
+      class Register < BaseMutation
+        include Sagittarius::Graphql::AuthorizationBypass
+
+        description 'Register a new user via a external identity'
+
+        field :user_session, Types::UserSessionType, null: true, description: 'The created users session'
+
+        argument :args, Types::Input::IdentityInput, required: true, description: 'The validation object'
+        argument :provider_id, String, required: true,
+                                       description: 'The ID of the external provider (e.g. google, discord, gitlab...) '
+
+        def resolve(provider_id:, args:)
+          response = ::Users::Identity::RegisterService.new(
+            provider_id,
+            args
+          ).execute.to_mutation_response(success_key: :user_session)
+          bypass_authorization! response, object_path: %i[user_session user]
+          bypass_authorization! response, object_path: :user_session
+        end
+      end
+    end
+  end
+end

app/graphql/mutations/users/identity/unlink.rb

@@ -0,0 +1,30 @@
+# frozen_string_literal: true
+
+module Mutations
+  module Users
+    module Identity
+      class Unlink < BaseMutation
+        description 'Links an external identity to and existing user'
+
+        field :user_identity, Types::UserIdentityType, null: true, description: 'The removed identity'
+
+        argument :identity_id, Types::GlobalIdType[UserIdentity], required: true,
+                                                                  description: 'The ID of the identity to remove'
+
+        def resolve(identity_id:)
+          user_identity = SagittariusSchema.object_from_id(identity_id)
+
+          if user_identity.nil?
+            return { user_identity: nil,
+                     errors: [create_message_error('Invalid identity')] }
+          end
+
+          ::Users::Identity::UnlinkService.new(
+            current_user,
+            user_identity
+          ).execute.to_mutation_response(success_key: :user_identity)
+        end
+      end
+    end
+  end
+end

app/graphql/types/input/identity_input.rb

@@ -0,0 +1,12 @@
+# frozen_string_literal: true
+
+module Types
+  module Input
+    class IdentityInput < ::Types::BaseInputObject
+      description 'Represents the input for external user identity validation'
+
+      argument :code, String, required: false,
+                              description: 'This validation code will be used for the oAuth validation process'
+    end
+  end
+end

app/graphql/types/mutation_type.rb

@@ -25,6 +25,10 @@ class MutationType < Types::BaseObject
     mount_mutation Mutations::Runtimes::Delete
     mount_mutation Mutations::Runtimes::RotateToken
     mount_mutation Mutations::Runtimes::Update
+    mount_mutation Mutations::Users::Identity::Link
+    mount_mutation Mutations::Users::Identity::Login
+    mount_mutation Mutations::Users::Identity::Register
+    mount_mutation Mutations::Users::Identity::Unlink
     mount_mutation Mutations::Users::Mfa::BackupCodes::Rotate
     mount_mutation Mutations::Users::Mfa::Totp::GenerateSecret
     mount_mutation Mutations::Users::Mfa::Totp::ValidateSecret

app/graphql/types/user_identity_type.rb

@@ -0,0 +1,16 @@
+# frozen_string_literal: true
+
+module Types
+  class UserIdentityType < Types::BaseObject
+    description 'Represents an external user identity'
+
+    authorize :read_user_identity
+
+    field :identifier, String, null: false, description: 'The description for the runtime if present'
+    field :provider_id, String, null: false, description: 'The name for the runtime'
+    field :user, Types::UserType, null: false, description: 'The correlating user of the identity'
+
+    id_field UserIdentity
+    timestamps
+  end
+end

app/models/application_setting.rb

@@ -10,6 +10,7 @@ class ApplicationSetting < ApplicationRecord
   SETTINGS = {
     user_registration_enabled: 1,
     organization_creation_restricted: 2,
+    identity_providers: 3,
   }.with_indifferent_access
 
   BOOLEAN_OPTIONS = %i[user_registration_enabled organization_creation_restricted].freeze

app/models/audit_event.rb

@@ -28,6 +28,8 @@ class AuditEvent < ApplicationRecord
     mfa_enabled: 24,
     backup_codes_rotated: 25,
     user_updated: 26,
+    user_identity_linked: 27,
+    user_identity_unlinked: 28,
   }.with_indifferent_access
 
   # rubocop:disable Lint/StructNewOverride

app/models/user.rb

@@ -26,6 +26,8 @@ class User < ApplicationRecord
   has_many :namespace_memberships, class_name: 'NamespaceMember', inverse_of: :user
   has_many :namespaces, through: :namespace_memberships, inverse_of: :users
 
+  has_many :user_identities, inverse_of: :user
+
   def mfa_enabled?
     totp_secret != nil
   end

app/models/user_identity.rb

@@ -0,0 +1,10 @@
+# frozen_string_literal: true
+
+class UserIdentity < ApplicationRecord
+  belongs_to :user, inverse_of: :user_identities
+
+  validates :provider_id, presence: true
+  validates :identifier, presence: true
+
+  validates :identifier, uniqueness: { scope: :provider_id }
+end

app/policies/user_identity_policy.rb

@@ -0,0 +1,5 @@
+# frozen_string_literal: true
+
+class UserIdentityPolicy < BasePolicy
+  delegate { @subject.user }
+end

app/policies/user_policy.rb

@@ -8,9 +8,11 @@ class UserPolicy < BasePolicy
 
   rule { user_is_admin }.policy do
     enable :update_user
+    enable :read_user_identity
   end
 
   rule { user_is_self }.policy do
+    enable :read_user_identity
     enable :manage_mfa
     enable :update_user
   end

app/services/users/identity/base_service.rb

@@ -0,0 +1,17 @@
+# frozen_string_literal: true
+
+module Users
+  module Identity
+    class BaseService
+      def identity_provider
+        identity_provider = Code0::Identities::IdentityProvider.new
+        enabled_providers = ApplicationSetting.current[:identity_providers]
+        enabled_providers.each do |provider|
+          provider.deep_symbolize_keys!
+          identity_provider.add_named_provider(provider[:id], provider[:type], -> { provider[:config] })
+        end
+        identity_provider
+      end
+    end
+  end
+end

app/services/users/identity/link_service.rb

@@ -0,0 +1,55 @@
+# frozen_string_literal: true
+
+module Users
+  module Identity
+    class LinkService < BaseService
+      include Sagittarius::Database::Transactional
+
+      attr_reader :current_user, :provider_id, :args
+
+      def initialize(current_user, provider_id, args)
+        super()
+        @current_user = current_user
+        @provider_id = provider_id
+        @args = args
+      end
+
+      def execute
+        begin
+          identity = identity_provider.load_identity(provider_id, args)
+        rescue Code0::Identities::Error => e
+          return ServiceResponse.error(payload: e, message: 'An error occurred while loading external identity')
+        end
+        if identity.nil?
+          return ServiceResponse.error(payload: :invalid_external_identity, message: 'External identity is nil')
+        end
+
+        transactional do |t|
+          user_identity = UserIdentity.create(user: current_user, identifier: identity.identifier,
+                                              provider_id: provider_id)
+
+          unless user_identity.valid?
+            t.rollback_and_return! ServiceResponse.error(payload: user_identity.errors,
+                                                         message: 'An error occurred while creating user identity')
+          end
+
+          current_user.user_identities << user_identity
+
+          unless current_user.save
+            t.rollback_and_return! ServiceResponse.error(payload: current_user.errors, message: 'Failed to save user')
+          end
+
+          AuditService.audit(
+            :user_identity_linked,
+            author_id: current_user.id,
+            entity: current_user,
+            details: { provider_id: user_identity.provider_id, identifier: identity.identifier },
+            target: current_user
+          )
+
+          ServiceResponse.success(payload: user_identity)
+        end
+      end
+    end
+  end
+end

app/services/users/identity/login_service.rb

@@ -0,0 +1,55 @@
+# frozen_string_literal: true
+
+module Users
+  module Identity
+    class LoginService < BaseService
+      include Sagittarius::Database::Transactional
+
+      attr_reader :provider_id, :args
+
+      def initialize(provider_id, args)
+        super()
+        @provider_id = provider_id
+        @args = args
+      end
+
+      def execute
+        begin
+          identity = identity_provider.load_identity(provider_id, args)
+        rescue Code0::Identities::Error => e
+          return ServiceResponse.error(payload: e, message: 'An error occurred while loading external identity')
+        end
+        if identity.nil?
+          return ServiceResponse.error(payload: :invalid_external_identity, message: 'External identity is nil')
+        end
+
+        user_identity = UserIdentity.find_by(provider_id: identity.provider.to_s, identifier: identity.identifier)
+
+        if user_identity.nil?
+          return ServiceResponse.error(payload: :external_identity_does_not_exist,
+                                       message: 'No user with that external identity exists, please register first')
+        end
+
+        user = user_identity.user
+
+        transactional do |t|
+          user_session = UserSession.create(user: user)
+          unless user_session.persisted?
+            t.rollback_and_return! ServiceResponse.error(message: 'UserSession is invalid',
+                                                         payload: user_session.errors)
+          end
+
+          AuditService.audit(
+            :user_logged_in,
+            author_id: user.id,
+            entity: user,
+            details: { provider_id: user_identity.provider_id, identifier: identity.identifier },
+            target: user
+          )
+
+          ServiceResponse.success(payload: user_session)
+        end
+      end
+    end
+  end
+end