Merge branch 'issue/8' into release/v2.0.2

magda-io · Aug 4, 2023 · 126a81a · 126a81a
2 parents debf08e + df8d064
commit 126a81a
Show file tree

Hide file tree

Showing 3 changed files with 18 additions and 12 deletions.
diff --git a/deploy/magda-auth-oidc/templates/deployment.yaml b/deploy/magda-auth-oidc/templates/deployment.yaml
@@ -49,10 +49,10 @@ spec:
             "--maxClockSkew", {{ .Values.maxClockSkew | quote }},
             {{- end }}
             {{- if .Values.userDefaultOrgUnitId }}
-            "--orgUnitId", {{ .Values.userDefaultOrgUnitId | quote }},
+            "--userDefaultOrgUnitId", {{ .Values.userDefaultOrgUnitId | quote }},
             {{- end }}
             {{- if .Values.userDefaultRoleId }}
-            "--roleId", {{ .Values.userDefaultRoleId | quote }},
+            "--userDefaultRoleId", {{ .Values.userDefaultRoleId | quote }},
             {{- end }}
             "--disableLogoutEndpoint", {{ .Values.disableLogoutEndpoint | default false | quote }},
             "--issuer", {{ .Values.issuer | required (printf "`issuer` is required for magda auth plugin `%s`." .Chart.Name) | quote }}

diff --git a/src/createAuthPluginRouter.ts b/src/createAuthPluginRouter.ts
@@ -122,10 +122,10 @@ export interface AuthPluginRouterOptions {
     sessionCookieOptions: CookieOptions;
     // target magda org unit id
     // when provided, the user will be assigned to this org unit
-    orgUnitId?: string;
+    userDefaultOrgUnitId?: string;
     // target magda role id
     // when provided, the user will be granted this role
-    roleId?: string;
+    userDefaultRoleId?: string;
 }
 
 /**
@@ -254,6 +254,10 @@ function createNameFromProfile(profile: UserinfoResponse) {
     return profile.email;
 }
 
+const isValidRoleId = (id?: string) =>
+    typeof id === "string" &&
+    (uuidValidate(id) || id.match(/^\d{8}-\d{4}-\d{4}-\d{4}-\d{12}$/));
+
 export default async function createAuthPluginRouter(
     options: AuthPluginRouterOptions
 ): Promise<Router> {
@@ -283,6 +287,8 @@ export default async function createAuthPluginRouter(
     }
 
     console.log("scope settings: ", scope);
+    console.log(`Default user role ID: ${options?.userDefaultRoleId}`);
+    console.log(`Default user orgUnit ID: ${options?.userDefaultOrgUnitId}`);
 
     const [issuer, client] = await createOpenIdIssuerWithClient(options);
     const disableLogoutEndpoint = !issuer["end_session_endpoint"]
@@ -327,16 +333,16 @@ export default async function createAuthPluginRouter(
                     authorizationApi,
                     userData,
                     authPluginConfig.key,
-                    uuidValidate(options?.orgUnitId)
+                    uuidValidate(options?.userDefaultOrgUnitId)
                         ? async (authApi, userData, profile) => ({
                               ...userData,
-                              orgUnitId: options.orgUnitId
+                              orgUnitId: options.userDefaultOrgUnitId
                           })
                         : undefined,
-                    uuidValidate(options?.roleId)
+                    isValidRoleId(options?.userDefaultRoleId)
                         ? async (authApi, user, profile) => {
                               await authApi.addUserRoles(user.id, [
-                                  options.roleId
+                                  options.userDefaultRoleId
                               ]);
                           }
                         : undefined

diff --git a/src/index.ts b/src/index.ts
@@ -38,12 +38,12 @@ const argv = yargs
         type: "string",
         coerce: coerceJson
     })
-    .option("orgUnitId", {
+    .option("userDefaultOrgUnitId", {
         describe:
             "The target magda org unit id. When provided, all new users will be assigned to this org unit",
         type: "string"
     })
-    .option("roleId", {
+    .option("userDefaultRoleId", {
         describe:
             "The target magda role id. When provided, all new users will be grant this role",
         type: "string"
@@ -215,8 +215,8 @@ const authApiClient = new AuthApiClient(
             allowedExternalRedirectDomains,
             disableLogoutEndpoint: argv?.disableLogoutEndpoint,
             sessionCookieOptions: argv.cookieJson as any,
-            orgUnitId: argv?.orgUnitId,
-            roleId: argv?.roleId
+            userDefaultOrgUnitId: argv?.userDefaultOrgUnitId,
+            userDefaultRoleId: argv?.userDefaultRoleId
         });
         app.use(routes);