zitadel/internal/setup/step1.go

package setup

import (
	"context"

	"github.com/caos/logging"
	"github.com/caos/zitadel/internal/api/authz"
	caos_errs "github.com/caos/zitadel/internal/errors"
	"github.com/caos/zitadel/internal/eventstore/models"
	iam_model "github.com/caos/zitadel/internal/iam/model"
	org_model "github.com/caos/zitadel/internal/org/model"
	policy_model "github.com/caos/zitadel/internal/policy/model"
	proj_model "github.com/caos/zitadel/internal/project/model"
	usr_model "github.com/caos/zitadel/internal/user/model"
)

type Step1 struct {
	GlobalOrg          string
	IAMProject         string
	DefaultLoginPolicy LoginPolicy
	Orgs               []Org
	Owners             []string

	setup              *Setup
	createdUsers       map[string]*usr_model.User
	createdOrgs        map[string]*org_model.Org
	createdProjects    map[string]*proj_model.Project
	pwComplexityPolicy *policy_model.PasswordComplexityPolicy
}

func (s *Step1) isNil() bool {
	return s == nil
}

func (step *Step1) step() iam_model.Step {
	return iam_model.Step1
}

func (step *Step1) init(setup *Setup) {
	step.setup = setup
	step.createdUsers = make(map[string]*usr_model.User)
	step.createdOrgs = make(map[string]*org_model.Org)
	step.createdProjects = make(map[string]*proj_model.Project)
}

func (step *Step1) execute(ctx context.Context) (err error) {
	err = step.loginPolicy(ctx, step.DefaultLoginPolicy)
	if err != nil {
		logging.Log("SETUP-Hdu8S").WithError(err).Error("unable to create login policy")
		return err
	}

	pwComplexityPolicy, err := step.setup.PolicyEvents.GetPasswordComplexityPolicy(ctx, policy_model.DefaultPolicy)
	if err != nil {
		logging.Log("SETUP-9osWF").WithError(err).Error("unable to read complexity policy")
		return err
	}
	step.pwComplexityPolicy = pwComplexityPolicy

	err = step.orgs(ctx, step.Orgs)
	if err != nil {
		logging.Log("SETUP-p4oWq").WithError(err).Error("unable to set up orgs")
		return err
	}

	ctx = setSetUpContextData(ctx, step.setup.iamID)
	err = step.iamOwners(ctx, step.Owners)
	if err != nil {
		logging.Log("SETUP-WHr01").WithError(err).Error("unable to set up iam owners")
		return err
	}

	err = step.setGlobalOrg(ctx, step.GlobalOrg)
	if err != nil {
		logging.Log("SETUP-0874m").WithError(err).Error("unable to set global org")
		return err
	}

	err = step.setIamProject(ctx, step.IAMProject)
	if err != nil {
		logging.Log("SETUP-kaWjq").WithError(err).Error("unable to set zitadel project")
		return err
	}

	_, err = step.setup.IamEvents.SetupDone(ctx, step.setup.iamID, step.step())
	if err != nil {
		logging.Log("SETUP-de342").WithField("step", step.step()).WithError(err).Error("unable to finish setup")
		return err
	}
	return nil
}

func (step *Step1) loginPolicy(ctx context.Context, policy LoginPolicy) error {
	logging.Log("SETUP-4djul").Info("setting up login policy")
	loginPolicy := &iam_model.LoginPolicy{
		ObjectRoot: models.ObjectRoot{
			AggregateID: step.setup.iamID,
		},
		AllowRegister:         policy.AllowRegister,
		AllowUsernamePassword: policy.AllowUsernamePassword,
		AllowExternalIdp:      policy.AllowExternalIdp,
	}
	_, err := step.setup.IamEvents.AddLoginPolicy(ctx, loginPolicy)
	return err
}

func (step *Step1) orgs(ctx context.Context, orgs []Org) error {
	logging.Log("SETUP-dsTh3").Info("setting up orgs")
	for _, iamOrg := range orgs {
		org, err := step.org(ctx, iamOrg)
		if err != nil {
			logging.LogWithFields("SETUP-IlLif", "Org", iamOrg.Name).WithError(err).Error("unable to create org")
			return err
		}
		step.createdOrgs[iamOrg.Name] = org

		var policy *org_model.OrgIAMPolicy
		if iamOrg.OrgIamPolicy {
			policy, err = step.iamorgpolicy(ctx, org)
			if err != nil {
				logging.LogWithFields("SETUP-IlLif", "Org IAM Policy", iamOrg.Name).WithError(err).Error("unable to create iam org policy")
				return err
			}
		} else {
			policy, err = step.setup.OrgEvents.GetOrgIAMPolicy(ctx, policy_model.DefaultPolicy)
			if err != nil {
				logging.LogWithFields("SETUP-IS8wS", "Org IAM Policy", iamOrg.Name).WithError(err).Error("unable to get default iam org policy")
				return err
			}
		}

		ctx = setSetUpContextData(ctx, org.AggregateID)
		err = step.users(ctx, iamOrg.Users, policy)
		if err != nil {
			logging.LogWithFields("SETUP-8zfwz", "Org", iamOrg.Name).WithError(err).Error("unable to set up org users")
			return err
		}

		err = step.orgOwners(ctx, org, iamOrg.Owners)
		if err != nil {
			logging.LogWithFields("SETUP-0874m", "Org", iamOrg.Name).WithError(err).Error("unable to set up org owners")
			return err
		}

		err = step.projects(ctx, iamOrg.Projects, step.createdUsers[iamOrg.Owners[0]].AggregateID)
		if err != nil {
			logging.LogWithFields("SETUP-wUzqY", "Org", iamOrg.Name).WithError(err).Error("unable to set up org projects")
			return err
		}
	}
	logging.Log("SETUP-dgjT4").Info("orgs set up")
	return nil
}

func (step *Step1) org(ctx context.Context, org Org) (*org_model.Org, error) {
	ctx = setSetUpContextData(ctx, "")
	createOrg := &org_model.Org{
		Name:    org.Name,
		Domains: []*org_model.OrgDomain{{Domain: org.Domain}},
	}
	return step.setup.OrgEvents.CreateOrg(ctx, createOrg, nil)
}

func (step *Step1) iamorgpolicy(ctx context.Context, org *org_model.Org) (*org_model.OrgIAMPolicy, error) {
	ctx = setSetUpContextData(ctx, org.AggregateID)
	policy := &org_model.OrgIAMPolicy{
		ObjectRoot:            models.ObjectRoot{AggregateID: org.AggregateID},
		UserLoginMustBeDomain: false,
	}
	return step.setup.OrgEvents.AddOrgIAMPolicy(ctx, policy)
}

func (step *Step1) iamOwners(ctx context.Context, owners []string) error {
	logging.Log("SETUP-dtxfj").Info("setting iam owners")
	for _, iamOwner := range owners {
		user, ok := step.createdUsers[iamOwner]
		if !ok {
			logging.LogWithFields("SETUP-8siew", "Owner", iamOwner).Error("unable to add user to iam members")
			return caos_errs.ThrowPreconditionFailedf(nil, "SETUP-su6L3", "unable to add user to iam members")
		}
		_, err := step.setup.IamEvents.AddIAMMember(ctx, &iam_model.IAMMember{ObjectRoot: models.ObjectRoot{AggregateID: step.setup.iamID}, UserID: user.AggregateID, Roles: []string{"IAM_OWNER"}})
		if err != nil {
			logging.Log("SETUP-LM7rI").WithError(err).Error("unable to add iam administrator to iam members as owner")
			return err
		}
	}
	logging.Log("SETUP-fg5aq").Info("iam owners set")
	return nil
}

func (step *Step1) setGlobalOrg(ctx context.Context, globalOrgName string) error {
	logging.Log("SETUP-dsj75").Info("setting global org")
	globalOrg, ok := step.createdOrgs[globalOrgName]
	if !ok {
		logging.LogWithFields("SETUP-FBhs9", "GlobalOrg", globalOrgName).Error("global org not created")
		return caos_errs.ThrowPreconditionFailedf(nil, "SETUP-4GwU7", "global org not created: %v", globalOrgName)
	}

	if _, err := step.setup.IamEvents.SetGlobalOrg(ctx, step.setup.iamID, globalOrg.AggregateID); err != nil {
		logging.Log("SETUP-uGMA3").WithError(err).Error("unable to set global org on iam")
		return err
	}
	logging.Log("SETUP-d32h1").Info("global org set")
	return nil
}

func (step *Step1) setIamProject(ctx context.Context, iamProjectName string) error {
	logging.Log("SETUP-HE3qa").Info("setting iam project")
	iamProject, ok := step.createdProjects[iamProjectName]
	if !ok {
		logging.LogWithFields("SETUP-SJFWP", "IAM Project", iamProjectName).Error("iam project created")
		return caos_errs.ThrowPreconditionFailedf(nil, "SETUP-sGmQt", "iam project not created: %v", iamProjectName)
	}

	if _, err := step.setup.IamEvents.SetIAMProject(ctx, step.setup.iamID, iamProject.AggregateID); err != nil {
		logging.Log("SETUP-i1pNh").WithError(err).Error("unable to set iam project on iam")
		return err
	}
	logging.Log("SETUP-d7WEU").Info("iam project set")
	return nil
}

func (step *Step1) users(ctx context.Context, users []User, orgPolicy *org_model.OrgIAMPolicy) error {
	for _, user := range users {
		created, err := step.user(ctx, user, orgPolicy)
		if err != nil {
			logging.LogWithFields("SETUP-9soer", "Email", user.Email).WithError(err).Error("unable to create iam user")
			return err
		}
		step.createdUsers[user.Email] = created
	}
	return nil
}

func (step *Step1) user(ctx context.Context, user User, orgPolicy *org_model.OrgIAMPolicy) (*usr_model.User, error) {
	createUser := &usr_model.User{
		UserName: user.UserName,
		Human: &usr_model.Human{
			Profile: &usr_model.Profile{
				FirstName: user.FirstName,
				LastName:  user.LastName,
			},
			Email: &usr_model.Email{
				EmailAddress:    user.Email,
				IsEmailVerified: true,
			},
			Password: &usr_model.Password{
				SecretString: user.Password,
			},
		},
	}
	return step.setup.UserEvents.CreateUser(ctx, createUser, step.pwComplexityPolicy, orgPolicy)
}

func (step *Step1) orgOwners(ctx context.Context, org *org_model.Org, owners []string) error {
	for _, orgOwner := range owners {
		user, ok := step.createdUsers[orgOwner]
		if !ok {
			logging.LogWithFields("SETUP-s9ilr", "Owner", orgOwner).Error("unable to add user to org members")
			return caos_errs.ThrowPreconditionFailedf(nil, "SETUP-s0prs", "unable to add user to org members: %v", orgOwner)
		}
		err := step.orgOwner(ctx, org, user)
		if err != nil {
			logging.Log("SETUP-s90oe").WithError(err).Error("unable to add global org admin to members of global org")
			return err
		}
	}
	return nil
}

func (step *Step1) orgOwner(ctx context.Context, org *org_model.Org, user *usr_model.User) error {
	addMember := &org_model.OrgMember{
		ObjectRoot: models.ObjectRoot{AggregateID: org.AggregateID},
		UserID:     user.AggregateID,
		Roles:      []string{OrgOwnerRole},
	}
	_, err := step.setup.OrgEvents.AddOrgMember(ctx, addMember)
	return err
}

func (step *Step1) projects(ctx context.Context, projects []Project, ownerID string) error {
	ctxData := authz.GetCtxData(ctx)
	ctxData.UserID = ownerID
	projectCtx := authz.SetCtxData(ctx, ctxData)

	for _, project := range projects {
		createdProject, err := step.project(projectCtx, project)
		if err != nil {
			return err
		}
		step.createdProjects[createdProject.Name] = createdProject
		for _, oidc := range project.OIDCApps {
			app, err := step.oidcApp(ctx, createdProject, oidc)
			if err != nil {
				return err
			}
			logging.LogWithFields("SETUP-asd32f", "name", app.Name, "clientID", app.OIDCConfig.ClientID).Info("created OIDC application")
		}
	}
	return nil
}

func (step *Step1) project(ctx context.Context, project Project) (*proj_model.Project, error) {
	addProject := &proj_model.Project{
		Name: project.Name,
	}
	return step.setup.ProjectEvents.CreateProject(ctx, addProject, false)
}

func (step *Step1) oidcApp(ctx context.Context, project *proj_model.Project, oidc OIDCApp) (*proj_model.Application, error) {
	addOIDCApp := &proj_model.Application{
		ObjectRoot: models.ObjectRoot{AggregateID: project.AggregateID},
		Name:       oidc.Name,
		OIDCConfig: &proj_model.OIDCConfig{
			RedirectUris:           oidc.RedirectUris,
			ResponseTypes:          getOIDCResponseTypes(oidc.ResponseTypes),
			GrantTypes:             getOIDCGrantTypes(oidc.GrantTypes),
			ApplicationType:        getOIDCApplicationType(oidc.ApplicationType),
			AuthMethodType:         getOIDCAuthMethod(oidc.AuthMethodType),
			PostLogoutRedirectUris: oidc.PostLogoutRedirectUris,
			DevMode:                oidc.DevMode,
		},
	}
	return step.setup.ProjectEvents.AddApplication(ctx, addOIDCApp)
}