From 1f00d504903ad1fd6e71a58f72ee709a19bc4376 Mon Sep 17 00:00:00 2001 From: Pierre-Olivier Mercier Date: Fri, 11 Nov 2022 11:20:13 +0100 Subject: [PATCH 001/729] OIDC: Retrieve face pictures from claim --- auth.go | 14 +++++++++----- auth_krb5.go | 2 +- auth_oidc.go | 7 +++++-- 3 files changed, 15 insertions(+), 8 deletions(-) diff --git a/auth.go b/auth.go index a05ea0d..8e6adb5 100644 --- a/auth.go +++ b/auth.go @@ -77,7 +77,7 @@ func logout(c *gin.Context) { c.JSON(http.StatusOK, true) } -func completeAuth(c *gin.Context, username string, email string, firstname string, lastname string, promo uint, groups string, session *Session) (usr *User, err error) { +func completeAuth(c *gin.Context, username string, email string, firstname string, lastname string, promo uint, groups string, face_url string, session *Session) (usr *User, err error) { if !userExists(username) { if promo == 0 { promo = currentPromo @@ -114,10 +114,14 @@ func completeAuth(c *gin.Context, username string, email string, firstname strin if session == nil { session, err = usr.NewSession() - } else { - _, err = session.SetUser(usr) + if err != nil { + return + } } - + if face_url != "" { + session.SetKey("picture", face_url) + } + _, err = session.SetUser(usr) if err != nil { return } @@ -153,7 +157,7 @@ func dummyAuth(c *gin.Context) { return } - if usr, err := completeAuth(c, lf["username"], lf["email"], lf["firstname"], lf["lastname"], currentPromo, "", nil); err != nil { + if usr, err := completeAuth(c, lf["username"], lf["email"], lf["firstname"], lf["lastname"], currentPromo, "", "", nil); err != nil { c.AbortWithStatusJSON(http.StatusUnauthorized, gin.H{"errmsg": err.Error()}) return } else { diff --git a/auth_krb5.go b/auth_krb5.go index dda6374..55bdc68 100644 --- a/auth_krb5.go +++ b/auth_krb5.go @@ -83,7 +83,7 @@ func checkAuthKrb5(c *gin.Context) { return } - if usr, err := completeAuth(c, lf.Login, lf.Login+"@epita.fr", "", "", currentPromo, "", nil); err != nil { + if usr, err := completeAuth(c, lf.Login, lf.Login+"@epita.fr", "", "", currentPromo, "", "", nil); err != nil { c.AbortWithStatusJSON(http.StatusUnauthorized, gin.H{"errmsg": err.Error()}) return } else { diff --git a/auth_oidc.go b/auth_oidc.go index 6e56990..553baae 100644 --- a/auth_oidc.go +++ b/auth_oidc.go @@ -48,7 +48,7 @@ func initializeOIDC(router *gin.Engine) { Endpoint: provider.Endpoint(), // "openid" is a required scope for OpenID Connect flows. - Scopes: []string{oidc.ScopeOpenID, "profile", "email", "epita"}, + Scopes: []string{oidc.ScopeOpenID, "profile", "email", "epita", "picture"}, } oidcConfig := oidc.Config{ @@ -112,6 +112,9 @@ func OIDC_CRI_complete(c *gin.Context) { Groups []map[string]interface{} `json:"groups"` Campuses []string `json:"campuses"` GraduationYears []uint `json:"graduation_years"` + Picture string `json:"picture"` + PictureSquare string `json:"picture_square"` + PictureThumb string `json:"picture_thumb"` } if err := idToken.Claims(&claims); err != nil { log.Println("Unable to extract claims to Claims:", err.Error()) @@ -135,7 +138,7 @@ func OIDC_CRI_complete(c *gin.Context) { } } - if _, err := completeAuth(c, claims.Username, claims.Email, claims.Firstname, claims.Lastname, promo, groups, session); err != nil { + if _, err := completeAuth(c, claims.Username, claims.Email, claims.Firstname, claims.Lastname, promo, groups, claims.PictureSquare, session); err != nil { c.AbortWithStatusJSON(http.StatusInternalServerError, gin.H{"errmsg": err.Error()}) return } From b4b531409f36bfe8994b45a6d358b62e626bc6f3 Mon Sep 17 00:00:00 2001 From: Pierre-Olivier Mercier Date: Fri, 11 Nov 2022 13:27:09 +0100 Subject: [PATCH 002/729] Implement optional signature --- repositories.go | 29 +++++++++++++++++-------- ui/src/lib/repositories.js | 4 ++-- ui/src/routes/works/[wid]/rendus.svelte | 16 +++++++++----- 3 files changed, 33 insertions(+), 16 deletions(-) diff --git a/repositories.go b/repositories.go index d292e7a..82757d3 100644 --- a/repositories.go +++ b/repositories.go @@ -39,6 +39,11 @@ func initializeDroneOauth() { } } +type RepositoryAdminPull struct { + Tag *string `json:"tag"` + OptionalSignature bool `json:"sig_optional"` +} + func declareAPIAuthRepositoriesRoutes(router *gin.RouterGroup) { router.GET("/repositories", func(c *gin.Context) { var u *User @@ -203,12 +208,12 @@ func declareAPIAuthRepositoriesRoutes(router *gin.RouterGroup) { return } - var tag *string + var rap RepositoryAdminPull if loggeduser.IsAdmin { - c.ShouldBindJSON(&tag) + c.ShouldBindJSON(&rap) } - TriggerTagUpdate(c, work, repo, u, tag) + TriggerTagUpdate(c, work, repo, u, rap.Tag, rap.OptionalSignature) }) repositoriesRoutes.GET("/state", func(c *gin.Context) { @@ -327,7 +332,7 @@ func declareCallbacksRoutes(router *gin.RouterGroup) { tmp := strings.SplitN(hook.Ref, "/", 3) if len(tmp) != 3 { - TriggerTagUpdate(c, work, repo, user, nil) + TriggerTagUpdate(c, work, repo, user, nil, false) return } @@ -355,7 +360,7 @@ func declareCallbacksRoutes(router *gin.RouterGroup) { } } - TriggerTagUpdate(c, work, repo, user, &tmp[2]) + TriggerTagUpdate(c, work, repo, user, &tmp[2], false) }) } @@ -387,7 +392,7 @@ func repositoryHandler(c *gin.Context) { } } -func TriggerTagUpdate(c *gin.Context, work *Work, repo *Repository, u *User, tag *string) { +func TriggerTagUpdate(c *gin.Context, work *Work, repo *Repository, u *User, tag *string, sig_optional bool) { loggeduser := c.MustGet("LoggedUser").(*User) now := time.Now() @@ -411,14 +416,20 @@ func TriggerTagUpdate(c *gin.Context, work *Work, repo *Repository, u *User, tag } } - client := drone.NewClient(droneEndpoint, droneConfig) - result, err := client.BuildCreate("srs", "atsebay.t-worker", "", "master", map[string]string{ + env := map[string]string{ "REPO_URL": repo.URI, "REPO_TAG": repo_tag, "LOGIN": login, "GROUPS": groups, "DEST": fmt.Sprintf("%d", work.Id), - }) + } + + if sig_optional { + env["TAG_SIG_OPTIONAL"] = "1" + } + + client := drone.NewClient(droneEndpoint, droneConfig) + result, err := client.BuildCreate("srs", "atsebay.t-worker", "", "master", env) if err != nil { log.Println("Unable to communicate with Drone:", err.Error()) c.AbortWithStatusJSON(http.StatusInternalServerError, gin.H{"errmsg": "Unable to communication with the extraction service."}) diff --git a/ui/src/lib/repositories.js b/ui/src/lib/repositories.js index 2d75d6c..114a183 100644 --- a/ui/src/lib/repositories.js +++ b/ui/src/lib/repositories.js @@ -55,11 +55,11 @@ export class WorkRepository { } } - async retrieveWork(tag) { + async retrieveWork(admin_struct) { const res = await fetch(this.id_work?`api/works/${this.id_work}/repositories/${this.id}/trigger`:`api/repositories/${this.id}/trigger`, { method: 'POST', headers: {'Accept': 'application/json'}, - body: !tag || tag.length == 0?null:JSON.stringify(tag) + body: !admin_struct?{}:JSON.stringify(admin_struct) }); if (res.status == 200) { const data = await res.json(); diff --git a/ui/src/routes/works/[wid]/rendus.svelte b/ui/src/routes/works/[wid]/rendus.svelte index e11d69e..d23a1c0 100644 --- a/ui/src/routes/works/[wid]/rendus.svelte +++ b/ui/src/routes/works/[wid]/rendus.svelte @@ -38,7 +38,7 @@ let nb_users = 0; let show_logs = null; - let run_pull_for = {repo: null, user: null, tag: null}; + let run_pull_for = {repo: null, user: null, struct: {tag: null, sig_optional: false}}; let search_repo_for = {repo: null, user: null}; @@ -90,7 +90,7 @@ @@ -128,7 +128,7 @@