Skip to content

Commit d17078d

Browse files
breardon2011breardon2011
committed
add org scoping, test to demo
1 parent 7856604 commit d17078d

35 files changed

+1757
-1250
lines changed

‎taco/cmd/statesman/main.go‎

Lines changed: 28 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,7 @@ import (
2222
"github.com/kelseyhightower/envconfig"
2323
"github.com/labstack/echo/v4"
2424
echomiddleware "github.com/labstack/echo/v4/middleware"
25+
"gorm.io/gorm"
2526
)
2627

2728
// change this random number to bump version of statesman: 421
@@ -111,8 +112,24 @@ func main() {
111112

112113
// create repository
113114
// repository coordinates blob storage with query index internally
114-
repo := repositories.NewUnitRepository(blobStore, queryStore)
115-
log.Println("Repository initialized (coordinates blob + query)")
115+
// Get the underlying *gorm.DB from the query store
116+
type dbGetter interface {
117+
GetDB() *gorm.DB
118+
}
119+
dbStore, ok := queryStore.(dbGetter)
120+
if !ok {
121+
log.Fatalf("Query store does not provide GetDB method")
122+
}
123+
124+
// Ensure default organization exists
125+
defaultOrgUUID, err := repositories.EnsureDefaultOrganization(context.Background(), dbStore.GetDB())
126+
if err != nil {
127+
log.Fatalf("Failed to ensure default organization: %v", err)
128+
}
129+
log.Printf("Default organization ensured: %s", defaultOrgUUID)
130+
131+
repo := repositories.NewUnitRepository(dbStore.GetDB(), blobStore)
132+
log.Println("Repository initialized (database-first with blob storage backend)")
116133

117134
// Create RBAC Manager
118135
rbacManager, err := rbac.NewRBACManagerFromQueryStore(queryStore)
@@ -128,8 +145,12 @@ func main() {
128145
if !*authDisable {
129146
log.Println("Authorization is ENABLED. Wrapping repository with RBAC.")
130147

148+
// Create bootstrap context with default org for RBAC check
149+
// During startup, we need org context to check RBAC status
150+
bootstrapCtx := domain.ContextWithOrg(context.Background(), defaultOrgUUID)
151+
131152
// Verify RBAC manager was created successfully (fail closed for security)
132-
canInit, err := rbacManager.IsEnabled(context.Background())
153+
canInit, err := rbacManager.IsEnabled(bootstrapCtx)
133154
if err != nil {
134155
log.Fatalf("Failed to verify RBAC manager: %v", err)
135156
}
@@ -144,8 +165,8 @@ func main() {
144165
}
145166

146167
// Initialize analytics with system ID management (always create system ID)
147-
// Analytics uses the full repository for storage operations
148-
analytics.InitGlobalWithSystemID("production", fullRepo)
168+
// Analytics uses the blob store for storage operations
169+
analytics.InitGlobalWithSystemID("production", blobStore)
149170
// Initialize system ID synchronously during startup
150171
ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
151172
defer cancel()
@@ -184,7 +205,8 @@ func main() {
184205

185206
// Register routes with interface-based dependencies
186207
api.RegisterRoutes(e, api.Dependencies{
187-
Repository: fullRepo, // Coordinated unit operations
208+
Repository: fullRepo, // RBAC-wrapped repository (used by all routes)
209+
BlobStore: blobStore, // Direct blob access (for legacy components)
188210
QueryStore: queryStore, // Direct query access
189211
RBACManager: rbacManager, // RBAC management
190212
Signer: signer, // JWT signing

‎taco/cmd/taco/commands/login.go‎

Lines changed: 17 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -231,9 +231,24 @@ func exchangeCodeForTokens(tokenURL, clientID, redirectURI, code, verifier strin
231231
resp, err := http.DefaultClient.Do(req)
232232
if err != nil { return nil, err }
233233
defer resp.Body.Close()
234-
if resp.StatusCode != 200 { return nil, fmt.Errorf("token http %d", resp.StatusCode) }
234+
235+
// Read response body for error details
236+
body, _ := io.ReadAll(resp.Body)
237+
238+
if resp.StatusCode != 200 {
239+
// Try to parse Auth0/OIDC error response
240+
var errResp struct {
241+
Error string `json:"error"`
242+
ErrorDescription string `json:"error_description"`
243+
}
244+
if json.Unmarshal(body, &errResp) == nil && errResp.Error != "" {
245+
return nil, fmt.Errorf("token exchange failed (HTTP %d): %s - %s", resp.StatusCode, errResp.Error, errResp.ErrorDescription)
246+
}
247+
return nil, fmt.Errorf("token http %d: %s", resp.StatusCode, string(body))
248+
}
249+
235250
var out struct{ IDToken string `json:"id_token"` }
236-
if err := json.NewDecoder(resp.Body).Decode(&out); err != nil { return nil, err }
251+
if err := json.Unmarshal(body, &out); err != nil { return nil, err }
237252
return &out, nil
238253
}
239254

‎taco/internal/api/internal.go‎

Lines changed: 50 additions & 40 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,7 @@ import (
1111
"github.com/diggerhq/digger/opentaco/internal/repositories"
1212
unithandlers "github.com/diggerhq/digger/opentaco/internal/unit"
1313
"github.com/labstack/echo/v4"
14+
"gorm.io/gorm"
1415
)
1516

1617

@@ -32,9 +33,23 @@ func RegisterInternalRoutes(e *echo.Echo, deps Dependencies) {
3233
userRepo = repositories.NewUserRepositoryFromQueryStore(deps.QueryStore)
3334
}
3435

35-
// Create internal group with webhook auth (with orgRepo for existence check)
36+
// Create internal group with webhook auth
3637
internal := e.Group("/internal/api")
37-
internal.Use(middleware.WebhookAuth(orgRepo))
38+
internal.Use(middleware.WebhookAuth())
39+
40+
// Add org resolution middleware - resolves org name to UUID and adds to domain context
41+
if deps.QueryStore != nil {
42+
if dbGetter, ok := deps.QueryStore.(interface{ GetDB() *gorm.DB }); ok {
43+
db := dbGetter.GetDB()
44+
// Create identifier resolver (infrastructure layer)
45+
identifierResolver := repositories.NewIdentifierResolver(db)
46+
// Pass interface to middleware (clean architecture!)
47+
internal.Use(middleware.ResolveOrgContextMiddleware(identifierResolver))
48+
log.Println("Org context resolution middleware enabled for internal routes")
49+
} else {
50+
log.Println("WARNING: QueryStore does not implement GetDB() *gorm.DB - org resolution disabled")
51+
}
52+
}
3853

3954
// Organization and User management endpoints
4055
if orgRepo != nil && userRepo != nil {
@@ -70,50 +85,45 @@ func RegisterInternalRoutes(e *echo.Echo, deps Dependencies) {
7085
log.Println("RBAC management endpoints registered at /internal/api/rbac")
7186
}
7287

73-
orgService := domain.NewOrgService()
74-
orgScopedRepo := repositories.NewOrgScopedRepository(deps.Repository, orgService)
88+
// For internal routes, use RBAC-wrapped repository
89+
// Architecture:
90+
// - Webhook secret authenticates the SYSTEM (backend orchestrator)
91+
// - X-User-ID header identifies the END USER making the request
92+
// - RBAC enforces what that USER can do (via repository layer)
93+
// - Org scoping handled by middleware (ResolveOrgContextMiddleware) + database foreign keys
94+
95+
// Create identifier resolver for unit name→UUID resolution
96+
var identifierResolver domain.IdentifierResolver
97+
if deps.QueryStore != nil {
98+
if dbGetter, ok := deps.QueryStore.(interface{ GetDB() *gorm.DB }); ok {
99+
db := dbGetter.GetDB()
100+
identifierResolver = repositories.NewIdentifierResolver(db)
101+
}
102+
}
75103

76-
// Create handler with org-scoped repository
77-
// The repository will automatically:
78-
// - Filter List() to org namespace
79-
// - Validate all operations belong to user's org
104+
// Create handler with org-scoped + RBAC-wrapped repository
80105
unitHandler := unithandlers.NewHandler(
81-
domain.UnitManagement(orgScopedRepo),
106+
domain.UnitManagement(deps.Repository), // Use RBAC-wrapped repository directly
107+
deps.BlobStore,
82108
deps.RBACManager,
83109
deps.Signer,
84110
deps.QueryStore,
111+
identifierResolver,
85112
)
86113

87-
88-
89-
90-
if deps.RBACManager != nil {
91-
// With RBAC - apply RBAC permission checks
92-
// Org scoping is automatic via orgScopedRepository
93-
internal.POST("/units", wrapWithWebhookRBAC(deps.RBACManager, rbac.ActionUnitWrite, "*")(unitHandler.CreateUnit))
94-
internal.GET("/units", unitHandler.ListUnits) // Automatically filters by org
95-
internal.GET("/units/:id", wrapWithWebhookRBAC(deps.RBACManager, rbac.ActionUnitRead, "{id}")(unitHandler.GetUnit))
96-
internal.DELETE("/units/:id", wrapWithWebhookRBAC(deps.RBACManager, rbac.ActionUnitDelete, "{id}")(unitHandler.DeleteUnit))
97-
internal.GET("/units/:id/download", wrapWithWebhookRBAC(deps.RBACManager, rbac.ActionUnitRead, "{id}")(unitHandler.DownloadUnit))
98-
internal.POST("/units/:id/upload", wrapWithWebhookRBAC(deps.RBACManager, rbac.ActionUnitWrite, "{id}")(unitHandler.UploadUnit))
99-
internal.POST("/units/:id/lock", wrapWithWebhookRBAC(deps.RBACManager, rbac.ActionUnitLock, "{id}")(unitHandler.LockUnit))
100-
internal.DELETE("/units/:id/unlock", wrapWithWebhookRBAC(deps.RBACManager, rbac.ActionUnitLock, "{id}")(unitHandler.UnlockUnit))
101-
internal.GET("/units/:id/status", wrapWithWebhookRBAC(deps.RBACManager, rbac.ActionUnitRead, "{id}")(unitHandler.GetUnitStatus))
102-
internal.GET("/units/:id/versions", wrapWithWebhookRBAC(deps.RBACManager, rbac.ActionUnitRead, "{id}")(unitHandler.ListVersions))
103-
internal.POST("/units/:id/restore", wrapWithWebhookRBAC(deps.RBACManager, rbac.ActionUnitWrite, "{id}")(unitHandler.RestoreVersion))
104-
} else {
105-
internal.POST("/units", unitHandler.CreateUnit)
106-
internal.GET("/units", unitHandler.ListUnits)
107-
internal.GET("/units/:id", unitHandler.GetUnit)
108-
internal.DELETE("/units/:id", unitHandler.DeleteUnit)
109-
internal.GET("/units/:id/download", unitHandler.DownloadUnit)
110-
internal.POST("/units/:id/upload", unitHandler.UploadUnit)
111-
internal.POST("/units/:id/lock", unitHandler.LockUnit)
112-
internal.DELETE("/units/:id/unlock", unitHandler.UnlockUnit)
113-
internal.GET("/units/:id/status", unitHandler.GetUnitStatus)
114-
internal.GET("/units/:id/versions", unitHandler.ListVersions)
115-
internal.POST("/units/:id/restore", unitHandler.RestoreVersion)
116-
}
114+
// Internal routes with RBAC enforcement
115+
// Note: Users must have permissions assigned via /internal/api/rbac endpoints
116+
internal.POST("/units", unitHandler.CreateUnit)
117+
internal.GET("/units", unitHandler.ListUnits)
118+
internal.GET("/units/:id", unitHandler.GetUnit)
119+
internal.DELETE("/units/:id", unitHandler.DeleteUnit)
120+
internal.GET("/units/:id/download", unitHandler.DownloadUnit)
121+
internal.POST("/units/:id/upload", unitHandler.UploadUnit)
122+
internal.POST("/units/:id/lock", unitHandler.LockUnit)
123+
internal.DELETE("/units/:id/unlock", unitHandler.UnlockUnit)
124+
internal.GET("/units/:id/status", unitHandler.GetUnitStatus)
125+
internal.GET("/units/:id/versions", unitHandler.ListVersions)
126+
internal.POST("/units/:id/restore", unitHandler.RestoreVersion)
117127

118128
// Health check for internal routes
119129
internal.GET("/health", func(c echo.Context) error {
@@ -153,7 +163,6 @@ func RegisterInternalRoutes(e *echo.Echo, deps Dependencies) {
153163

154164
log.Printf("Internal routes registered at /internal/api/* with webhook authentication")
155165
}
156-
157166
// wrapWithWebhookRBAC wraps a handler with RBAC permission checking
158167
func wrapWithWebhookRBAC(manager *rbac.RBACManager, action rbac.Action, resource string) func(echo.HandlerFunc) echo.HandlerFunc {
159168
return func(next echo.HandlerFunc) echo.HandlerFunc {
@@ -208,3 +217,4 @@ func wrapWithWebhookRBAC(manager *rbac.RBACManager, action rbac.Action, resource
208217
}
209218
}
210219
}
220+

‎taco/internal/api/org_handler.go‎

Lines changed: 36 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -29,16 +29,17 @@ func NewOrgHandler(orgRepo domain.OrganizationRepository, userRepo domain.UserRe
2929

3030
// CreateOrgRequest is the request body for creating an organization
3131
type CreateOrgRequest struct {
32-
OrgID string `json:"org_id" validate:"required"`
33-
Name string `json:"name" validate:"required"`
32+
Name string `json:"name" validate:"required"` // Unique identifier (e.g., "acme")
33+
DisplayName string `json:"display_name" validate:"required"` // Friendly name (e.g., "Acme Corp")
3434
}
3535

3636
// CreateOrgResponse is the response for creating an organization
3737
type CreateOrgResponse struct {
38-
OrgID string `json:"org_id"`
39-
Name string `json:"name"`
40-
CreatedBy string `json:"created_by"`
41-
CreatedAt string `json:"created_at"`
38+
ID string `json:"id"` // UUID
39+
Name string `json:"name"` // Unique identifier
40+
DisplayName string `json:"display_name"` // Friendly name
41+
CreatedBy string `json:"created_by"`
42+
CreatedAt string `json:"created_at"`
4243
}
4344

4445
// CreateOrganization handles POST /internal/orgs
@@ -82,15 +83,15 @@ func (h *OrgHandler) CreateOrganization(c echo.Context) error {
8283
})
8384
}
8485

85-
if req.OrgID == "" || req.Name == "" {
86+
if req.Name == "" || req.DisplayName == "" {
8687
return c.JSON(http.StatusBadRequest, map[string]string{
87-
"error": "org_id and name are required",
88+
"error": "name and display_name are required",
8889
})
8990
}
9091

9192
slog.Info("Creating organization",
92-
"orgID", req.OrgID,
9393
"name", req.Name,
94+
"displayName", req.DisplayName,
9495
"createdBy", userIDStr,
9596
)
9697

@@ -101,7 +102,7 @@ func (h *OrgHandler) CreateOrganization(c echo.Context) error {
101102

102103
// Create organization in transaction
103104
err := h.orgRepo.WithTransaction(ctx, func(ctx context.Context, txRepo domain.OrganizationRepository) error {
104-
createdOrg, err := txRepo.Create(ctx, req.OrgID, req.Name, userIDStr)
105+
createdOrg, err := txRepo.Create(ctx, req.Name, req.DisplayName, userIDStr)
105106
if err != nil {
106107
return err
107108
}
@@ -123,7 +124,7 @@ func (h *OrgHandler) CreateOrganization(c echo.Context) error {
123124
}
124125

125126
slog.Error("Failed to create organization",
126-
"orgID", req.OrgID,
127+
"name", req.Name,
127128
"error", err,
128129
)
129130
return c.JSON(http.StatusInternalServerError, map[string]string{
@@ -135,33 +136,37 @@ func (h *OrgHandler) CreateOrganization(c echo.Context) error {
135136
// Initialize RBAC after org creation (outside transaction for SQLite compatibility)
136137
if h.rbacManager != nil {
137138
slog.Info("Initializing RBAC for new organization",
138-
"orgID", req.OrgID,
139+
"orgName", req.Name,
140+
"orgID", org.ID,
139141
"adminUser", userIDStr,
140142
)
141143

142-
if err := h.rbacManager.InitializeRBAC(ctx, userIDStr, emailStr); err != nil {
144+
if err := h.rbacManager.InitializeRBAC(ctx, org.ID, userIDStr, emailStr); err != nil {
143145
// Org was created but RBAC failed - log warning but don't fail the request
144146
// User can retry RBAC initialization or assign roles manually
145147
slog.Warn("Organization created but RBAC initialization failed",
146-
"orgID", req.OrgID,
148+
"orgName", req.Name,
149+
"orgID", org.ID,
147150
"error", err,
148151
"recommendation", "RBAC can be initialized later via /rbac/init endpoint",
149152
)
150153
// Continue with success response - org was created
151154
} else {
152155
slog.Info("RBAC initialized successfully",
153-
"orgID", req.OrgID,
156+
"orgName", req.Name,
157+
"orgID", org.ID,
154158
"adminUser", userIDStr,
155159
)
156160
}
157161
}
158162

159163
// Success - org created (and RBAC initialized if available)
160164
return c.JSON(http.StatusCreated, CreateOrgResponse{
161-
OrgID: org.OrgID,
162-
Name: org.Name,
163-
CreatedBy: org.CreatedBy,
164-
CreatedAt: org.CreatedAt.Format("2006-01-02T15:04:05Z07:00"),
165+
ID: org.ID,
166+
Name: org.Name,
167+
DisplayName: org.DisplayName,
168+
CreatedBy: org.CreatedBy,
169+
CreatedAt: org.CreatedAt.Format("2006-01-02T15:04:05Z07:00"),
165170
})
166171
}
167172

@@ -193,11 +198,12 @@ func (h *OrgHandler) GetOrganization(c echo.Context) error {
193198
}
194199

195200
return c.JSON(http.StatusOK, map[string]interface{}{
196-
"org_id": org.OrgID,
197-
"name": org.Name,
198-
"created_by": org.CreatedBy,
199-
"created_at": org.CreatedAt.Format("2006-01-02T15:04:05Z07:00"),
200-
"updated_at": org.UpdatedAt.Format("2006-01-02T15:04:05Z07:00"),
201+
"id": org.ID,
202+
"name": org.Name,
203+
"display_name": org.DisplayName,
204+
"created_by": org.CreatedBy,
205+
"created_at": org.CreatedAt.Format("2006-01-02T15:04:05Z07:00"),
206+
"updated_at": org.UpdatedAt.Format("2006-01-02T15:04:05Z07:00"),
201207
})
202208
}
203209

@@ -216,11 +222,12 @@ func (h *OrgHandler) ListOrganizations(c echo.Context) error {
216222
response := make([]map[string]interface{}, len(orgs))
217223
for i, org := range orgs {
218224
response[i] = map[string]interface{}{
219-
"org_id": org.OrgID,
220-
"name": org.Name,
221-
"created_by": org.CreatedBy,
222-
"created_at": org.CreatedAt.Format("2006-01-02T15:04:05Z07:00"),
223-
"updated_at": org.UpdatedAt.Format("2006-01-02T15:04:05Z07:00"),
225+
"id": org.ID,
226+
"name": org.Name,
227+
"display_name": org.DisplayName,
228+
"created_by": org.CreatedBy,
229+
"created_at": org.CreatedAt.Format("2006-01-02T15:04:05Z07:00"),
230+
"updated_at": org.UpdatedAt.Format("2006-01-02T15:04:05Z07:00"),
224231
}
225232
}
226233

0 commit comments

Comments
 (0)