feat(db): Add Provider Type to OIDC Auth Method

test(db): add sqltest coverage for oidc auth method provider_type

internal/db/schema/migrations/oss/postgres/112/01_auth_oidc_provider_type.up.sql

@@ -0,0 +1,98 @@
+-- Copyright IBM Corp. 2020, 2026
+-- SPDX-License-Identifier: BUSL-1.1
+
+-- Adds auth_oidc_method_provider_type_enm enum table and a nullable provider_type column
+-- on auth_oidc_method to support Azure Entra ID group overage resolution. Recreates the
+-- oidc_auth_method_with_value_obj view to include the new provider_type column.
+
+begin;
+
+-- auth_oidc_method_provider_type_enm entries define the supported oidc auth method provider types.
+create table auth_oidc_method_provider_type_enm (
+  name text primary key
+    constraint only_predefined_auth_oidc_provider_types_allowed
+      check (
+        name in (
+          'azure'
+        )
+      )
+);
+
+comment on table auth_oidc_method_provider_type_enm is
+  'auth_oidc_method_provider_type_enm entries enumerate the valid oidc auth method provider types';
+
+-- define the immutable fields for auth_oidc_method_provider_type_enm
+create trigger immutable_columns before update on auth_oidc_method_provider_type_enm
+  for each row execute procedure immutable_columns('name');
+
+insert into auth_oidc_method_provider_type_enm (name) 
+values
+  ('azure');
+
+-- add an optional provider_type column to auth_oidc_method. null means the
+-- provider type is unspecified and no provider-specific behavior is applied.
+alter table auth_oidc_method
+  add column provider_type text
+    constraint auth_oidc_method_provider_type_enm_fkey
+      references auth_oidc_method_provider_type_enm(name)
+      on delete restrict
+      on update cascade;
+
+-- we will drop the oidc_auth_method_with_value_obj view, so we can recreate it
+-- and add the provider_type to the returned set.
+drop view oidc_auth_method_with_value_obj;
+
+-- Replaces view from 79/01_auth_oidc_prompt.up.sql
+-- oidc_auth_method_with_value_obj is useful for reading an oidc auth method
+-- with its associated value objects (algs, auds, certs, claims scopes,
+-- account claim maps and prompts) as columns with | delimited values.  The
+-- use of the postgres string_agg(...) to aggregate the value objects into a
+-- column works because we are only pulling in one column from the associated
+-- tables and that value is part of the primary key and unique.  This view
+-- will make things like recursive listing of oidc auth methods fairly
+-- straightforward to implement for the oidc repo. The view also includes an
+-- is_primary_auth_method bool
+create view oidc_auth_method_with_value_obj as
+select
+  case when s.primary_auth_method_id is not null then
+    true
+  else false end
+  as is_primary_auth_method,
+  am.public_id,
+  am.scope_id,
+  am.name,
+  am.description,
+  am.create_time,
+  am.update_time,
+  am.version,
+  am.state,
+  am.api_url,
+  am.disable_discovered_config_validation,
+  am.issuer,
+  am.client_id,
+  am.client_secret,
+  am.client_secret_hmac,
+  am.key_id,
+  am.max_age,
+  am.provider_type,
+  -- the string_agg(..) column will be null if there are no associated value objects
+  string_agg(distinct alg.signing_alg_name, '|') as algs,
+  string_agg(distinct aud.aud_claim, '|') as auds,
+  string_agg(distinct cert.certificate, '|') as certs,
+  string_agg(distinct cs.scope, '|') as claims_scopes,
+  string_agg(distinct p.prompt, '|') as prompts,
+  string_agg(distinct concat_ws('=', acm.from_claim, acm.to_claim), '|') as account_claim_maps
+from
+  auth_oidc_method am
+  left outer join iam_scope                   s     on am.public_id = s.primary_auth_method_id
+  left outer join auth_oidc_signing_alg       alg   on am.public_id = alg.oidc_method_id
+  left outer join auth_oidc_aud_claim         aud   on am.public_id = aud.oidc_method_id
+  left outer join auth_oidc_certificate       cert  on am.public_id = cert.oidc_method_id
+  left outer join auth_oidc_scope             cs    on am.public_id = cs.oidc_method_id
+  left outer join auth_oidc_account_claim_map acm   on am.public_id = acm.oidc_method_id
+  left outer join auth_oidc_prompt            p     on am.public_id = p.oidc_method_id
+group by am.public_id, is_primary_auth_method; -- there can be only one public_id + is_primary_auth_method, so group by isn't a problem.
+comment on view oidc_auth_method_with_value_obj is
+  'oidc auth method with its associated value objects (algs, auds, certs, scopes, prompts) as columns with | delimited values';
+
+commit;

internal/db/schema/migrations/oss/postgres/79/01_auth_oidc_prompt.up.sql

@@ -67,6 +67,7 @@ drop view oidc_auth_method_with_value_obj;
 -- will make things like recursive listing of oidc auth methods fairly 
 -- straightforward to implement for the oidc repo. The view also includes an 
 -- is_primary_auth_method bool 
+-- Replaced in 112/01_auth_oidc_provider_type.up.sql
 create view oidc_auth_method_with_value_obj as 
 select
   case when s.primary_auth_method_id is not null then

internal/db/sqltest/tests/auth/oidc/provider_type.sql

@@ -0,0 +1,91 @@
+-- Copyright IBM Corp. 2020, 2026
+-- SPDX-License-Identifier: BUSL-1.1
+
+begin;
+  select plan(11);
+  select wtt_load('widgets', 'iam', 'kms', 'auth');
+
+  -- Set a valid provider_type on the widget oidc auth method
+  prepare valid_provider_type as
+    update auth_oidc_method
+    set provider_type = 'azure'
+    where public_id = 'aom___widget';
+  select lives_ok('valid_provider_type', 'azure is a valid provider_type');
+
+  select is(provider_type, 'azure', 'provider_type should be azure')
+    from auth_oidc_method
+    where public_id = 'aom___widget';
+
+  -- Set a provider_type that is not in the enum table
+  prepare invalid_provider_type as
+    update auth_oidc_method
+    set provider_type = 'unsupported'
+    where public_id = 'aom___widget';
+  select throws_ok(
+    'invalid_provider_type',
+    '23503',
+    'insert or update on table "auth_oidc_method" violates foreign key constraint "auth_oidc_method_provider_type_enm_fkey"',
+    'setting a provider_type not in the enum table'
+  );
+
+  select is(provider_type, 'azure', 'provider_type is unchanged after a rejected update')
+    from auth_oidc_method
+    where public_id = 'aom___widget';
+
+  -- Set provider_type to null
+  prepare null_provider_type as
+    update auth_oidc_method
+    set provider_type = null
+    where public_id = 'aom___widget';
+  select lives_ok('null_provider_type', 'null is an allowed provider_type');
+
+  select is(provider_type, null, 'provider_type should be null')
+    from auth_oidc_method
+    where public_id = 'aom___widget';
+
+  -- Insert an unsupported value into the provider_type enum table
+  prepare invalid_enum_value as
+    insert into auth_oidc_method_provider_type_enm
+    (name)
+    values
+      ('unsupported');
+  select throws_ok(
+    'invalid_enum_value',
+    '23514',
+    'new row for relation "auth_oidc_method_provider_type_enm" violates check constraint "only_predefined_auth_oidc_provider_types_allowed"',
+    'inserting an unsupported value into the provider_type enum table'
+  );
+
+  -- Update an immutable provider_type enum row
+  prepare immutable_enum_value as
+    update auth_oidc_method_provider_type_enm
+    set name = 'unsupported'
+    where name = 'azure';
+  select throws_ok(
+    'immutable_enum_value',
+    '23601',
+    'immutable column: auth_oidc_method_provider_type_enm.name',
+    'updating an immutable provider_type enum row'
+  );
+
+  -- validate oidc_auth_method_with_value_obj view returns provider_type
+  update auth_oidc_method
+    set provider_type = 'azure'
+    where public_id = 'aom___widget';
+  select is(provider_type, 'azure', 'the view returns the provider_type')
+    from oidc_auth_method_with_value_obj
+    where public_id = 'aom___widget';
+
+  -- Reset provider_type back to null after it was set
+  prepare reset_provider_type as
+    update auth_oidc_method
+    set provider_type = null
+    where public_id = 'aom___widget';
+  select lives_ok('reset_provider_type', 'provider_type can be reset to null');
+
+  select is(provider_type, null, 'provider_type should be null after reset')
+    from auth_oidc_method
+    where public_id = 'aom___widget';
+
+  select * from finish();
+rollback;