SyncOrganizations if enabled will ensure the user is a member of the provided organizations. It will add and remove their membership to match the expected set.
(ctx context.Context, tx database.Store, user database.User, params OrganizationParams)
| 74 | // SyncOrganizations if enabled will ensure the user is a member of the provided |
| 75 | // organizations. It will add and remove their membership to match the expected set. |
| 76 | func (s AGPLIDPSync) SyncOrganizations(ctx context.Context, tx database.Store, user database.User, params OrganizationParams) error { |
| 77 | // Nothing happens if sync is not enabled |
| 78 | if !params.SyncEntitled { |
| 79 | return nil |
| 80 | } |
| 81 | |
| 82 | // nolint:gocritic // all syncing is done as a system user |
| 83 | ctx = dbauthz.AsSystemRestricted(ctx) |
| 84 | |
| 85 | orgSettings, err := s.OrganizationSyncSettings(ctx, tx) |
| 86 | if err != nil { |
| 87 | return xerrors.Errorf("failed to get org sync settings: %w", err) |
| 88 | } |
| 89 | |
| 90 | if orgSettings.Field == "" { |
| 91 | return nil // No sync configured, nothing to do |
| 92 | } |
| 93 | |
| 94 | expectedOrgIDs, err := orgSettings.ParseClaims(ctx, tx, params.MergedClaims) |
| 95 | if err != nil { |
| 96 | return xerrors.Errorf("organization claims: %w", err) |
| 97 | } |
| 98 | |
| 99 | // Fetch all organizations, even deleted ones. This is to remove a user |
| 100 | // from any deleted organizations they may be in. |
| 101 | existingOrgs, err := tx.GetOrganizationsByUserID(ctx, database.GetOrganizationsByUserIDParams{ |
| 102 | UserID: user.ID, |
| 103 | Deleted: sql.NullBool{}, |
| 104 | }) |
| 105 | if err != nil { |
| 106 | return xerrors.Errorf("failed to get user organizations: %w", err) |
| 107 | } |
| 108 | |
| 109 | existingOrgIDs := slice.List(existingOrgs, func(org database.Organization) uuid.UUID { |
| 110 | return org.ID |
| 111 | }) |
| 112 | |
| 113 | // finalExpected is the final set of org ids the user is expected to be in. |
| 114 | // Deleted orgs are omitted from this set. |
| 115 | finalExpected := expectedOrgIDs |
| 116 | if len(expectedOrgIDs) > 0 { |
| 117 | // If you pass in an empty slice to the db arg, you get all orgs. So the slice |
| 118 | // has to be non-empty to get the expected set. Logically it also does not make |
| 119 | // sense to fetch an empty set from the db. |
| 120 | expectedOrganizations, err := tx.GetOrganizations(ctx, database.GetOrganizationsParams{ |
| 121 | IDs: expectedOrgIDs, |
| 122 | // Do not include deleted organizations. Omitting deleted orgs will remove the |
| 123 | // user from any deleted organizations they are a member of. |
| 124 | Deleted: false, |
| 125 | }) |
| 126 | if err != nil { |
| 127 | return xerrors.Errorf("failed to get expected organizations: %w", err) |
| 128 | } |
| 129 | finalExpected = slice.List(expectedOrganizations, func(org database.Organization) uuid.UUID { |
| 130 | return org.ID |
| 131 | }) |
| 132 | } |
| 133 |
nothing calls this directly
no test coverage detected