From 828742c46cb2030552a10a21342a77cf78fd61fe Mon Sep 17 00:00:00 2001 From: Bharath Gajjala <120367134+bgajjala8@users.noreply.github.com> Date: Mon, 24 Aug 2026 10:54:27 -0700 Subject: [PATCH] feat(db): Add Provider Type to OIDC Auth Method test(db): add sqltest coverage for oidc auth method provider_type --- .../112/01_auth_oidc_provider_type.up.sql | 98 +++++++++++++++++++ .../postgres/79/01_auth_oidc_prompt.up.sql | 1 + .../sqltest/tests/auth/oidc/provider_type.sql | 91 +++++++++++++++++ 3 files changed, 190 insertions(+) create mode 100644 internal/db/schema/migrations/oss/postgres/112/01_auth_oidc_provider_type.up.sql create mode 100644 internal/db/sqltest/tests/auth/oidc/provider_type.sql diff --git a/internal/db/schema/migrations/oss/postgres/112/01_auth_oidc_provider_type.up.sql b/internal/db/schema/migrations/oss/postgres/112/01_auth_oidc_provider_type.up.sql new file mode 100644 index 000000000..f42e80b24 --- /dev/null +++ b/internal/db/schema/migrations/oss/postgres/112/01_auth_oidc_provider_type.up.sql @@ -0,0 +1,98 @@ +-- Copyright IBM Corp. 2020, 2026 +-- SPDX-License-Identifier: BUSL-1.1 + +-- Adds auth_oidc_method_provider_type_enm enum table and a nullable provider_type column +-- on auth_oidc_method to support Azure Entra ID group overage resolution. Recreates the +-- oidc_auth_method_with_value_obj view to include the new provider_type column. + +begin; + +-- auth_oidc_method_provider_type_enm entries define the supported oidc auth method provider types. +create table auth_oidc_method_provider_type_enm ( + name text primary key + constraint only_predefined_auth_oidc_provider_types_allowed + check ( + name in ( + 'azure' + ) + ) +); + +comment on table auth_oidc_method_provider_type_enm is + 'auth_oidc_method_provider_type_enm entries enumerate the valid oidc auth method provider types'; + +-- define the immutable fields for auth_oidc_method_provider_type_enm +create trigger immutable_columns before update on auth_oidc_method_provider_type_enm + for each row execute procedure immutable_columns('name'); + +insert into auth_oidc_method_provider_type_enm (name) +values + ('azure'); + +-- add an optional provider_type column to auth_oidc_method. null means the +-- provider type is unspecified and no provider-specific behavior is applied. +alter table auth_oidc_method + add column provider_type text + constraint auth_oidc_method_provider_type_enm_fkey + references auth_oidc_method_provider_type_enm(name) + on delete restrict + on update cascade; + +-- we will drop the oidc_auth_method_with_value_obj view, so we can recreate it +-- and add the provider_type to the returned set. +drop view oidc_auth_method_with_value_obj; + +-- Replaces view from 79/01_auth_oidc_prompt.up.sql +-- oidc_auth_method_with_value_obj is useful for reading an oidc auth method +-- with its associated value objects (algs, auds, certs, claims scopes, +-- account claim maps and prompts) as columns with | delimited values. The +-- use of the postgres string_agg(...) to aggregate the value objects into a +-- column works because we are only pulling in one column from the associated +-- tables and that value is part of the primary key and unique. This view +-- will make things like recursive listing of oidc auth methods fairly +-- straightforward to implement for the oidc repo. The view also includes an +-- is_primary_auth_method bool +create view oidc_auth_method_with_value_obj as +select + case when s.primary_auth_method_id is not null then + true + else false end + as is_primary_auth_method, + am.public_id, + am.scope_id, + am.name, + am.description, + am.create_time, + am.update_time, + am.version, + am.state, + am.api_url, + am.disable_discovered_config_validation, + am.issuer, + am.client_id, + am.client_secret, + am.client_secret_hmac, + am.key_id, + am.max_age, + am.provider_type, + -- the string_agg(..) column will be null if there are no associated value objects + string_agg(distinct alg.signing_alg_name, '|') as algs, + string_agg(distinct aud.aud_claim, '|') as auds, + string_agg(distinct cert.certificate, '|') as certs, + string_agg(distinct cs.scope, '|') as claims_scopes, + string_agg(distinct p.prompt, '|') as prompts, + string_agg(distinct concat_ws('=', acm.from_claim, acm.to_claim), '|') as account_claim_maps +from + auth_oidc_method am + left outer join iam_scope s on am.public_id = s.primary_auth_method_id + left outer join auth_oidc_signing_alg alg on am.public_id = alg.oidc_method_id + left outer join auth_oidc_aud_claim aud on am.public_id = aud.oidc_method_id + left outer join auth_oidc_certificate cert on am.public_id = cert.oidc_method_id + left outer join auth_oidc_scope cs on am.public_id = cs.oidc_method_id + left outer join auth_oidc_account_claim_map acm on am.public_id = acm.oidc_method_id + left outer join auth_oidc_prompt p on am.public_id = p.oidc_method_id +group by am.public_id, is_primary_auth_method; -- there can be only one public_id + is_primary_auth_method, so group by isn't a problem. +comment on view oidc_auth_method_with_value_obj is + 'oidc auth method with its associated value objects (algs, auds, certs, scopes, prompts) as columns with | delimited values'; + +commit; diff --git a/internal/db/schema/migrations/oss/postgres/79/01_auth_oidc_prompt.up.sql b/internal/db/schema/migrations/oss/postgres/79/01_auth_oidc_prompt.up.sql index bf07fa723..f9873d0ef 100644 --- a/internal/db/schema/migrations/oss/postgres/79/01_auth_oidc_prompt.up.sql +++ b/internal/db/schema/migrations/oss/postgres/79/01_auth_oidc_prompt.up.sql @@ -67,6 +67,7 @@ drop view oidc_auth_method_with_value_obj; -- will make things like recursive listing of oidc auth methods fairly -- straightforward to implement for the oidc repo. The view also includes an -- is_primary_auth_method bool +-- Replaced in 112/01_auth_oidc_provider_type.up.sql create view oidc_auth_method_with_value_obj as select case when s.primary_auth_method_id is not null then diff --git a/internal/db/sqltest/tests/auth/oidc/provider_type.sql b/internal/db/sqltest/tests/auth/oidc/provider_type.sql new file mode 100644 index 000000000..900f0a2c5 --- /dev/null +++ b/internal/db/sqltest/tests/auth/oidc/provider_type.sql @@ -0,0 +1,91 @@ +-- Copyright IBM Corp. 2020, 2026 +-- SPDX-License-Identifier: BUSL-1.1 + +begin; + select plan(11); + select wtt_load('widgets', 'iam', 'kms', 'auth'); + + -- Set a valid provider_type on the widget oidc auth method + prepare valid_provider_type as + update auth_oidc_method + set provider_type = 'azure' + where public_id = 'aom___widget'; + select lives_ok('valid_provider_type', 'azure is a valid provider_type'); + + select is(provider_type, 'azure', 'provider_type should be azure') + from auth_oidc_method + where public_id = 'aom___widget'; + + -- Set a provider_type that is not in the enum table + prepare invalid_provider_type as + update auth_oidc_method + set provider_type = 'unsupported' + where public_id = 'aom___widget'; + select throws_ok( + 'invalid_provider_type', + '23503', + 'insert or update on table "auth_oidc_method" violates foreign key constraint "auth_oidc_method_provider_type_enm_fkey"', + 'setting a provider_type not in the enum table' + ); + + select is(provider_type, 'azure', 'provider_type is unchanged after a rejected update') + from auth_oidc_method + where public_id = 'aom___widget'; + + -- Set provider_type to null + prepare null_provider_type as + update auth_oidc_method + set provider_type = null + where public_id = 'aom___widget'; + select lives_ok('null_provider_type', 'null is an allowed provider_type'); + + select is(provider_type, null, 'provider_type should be null') + from auth_oidc_method + where public_id = 'aom___widget'; + + -- Insert an unsupported value into the provider_type enum table + prepare invalid_enum_value as + insert into auth_oidc_method_provider_type_enm + (name) + values + ('unsupported'); + select throws_ok( + 'invalid_enum_value', + '23514', + 'new row for relation "auth_oidc_method_provider_type_enm" violates check constraint "only_predefined_auth_oidc_provider_types_allowed"', + 'inserting an unsupported value into the provider_type enum table' + ); + + -- Update an immutable provider_type enum row + prepare immutable_enum_value as + update auth_oidc_method_provider_type_enm + set name = 'unsupported' + where name = 'azure'; + select throws_ok( + 'immutable_enum_value', + '23601', + 'immutable column: auth_oidc_method_provider_type_enm.name', + 'updating an immutable provider_type enum row' + ); + + -- validate oidc_auth_method_with_value_obj view returns provider_type + update auth_oidc_method + set provider_type = 'azure' + where public_id = 'aom___widget'; + select is(provider_type, 'azure', 'the view returns the provider_type') + from oidc_auth_method_with_value_obj + where public_id = 'aom___widget'; + + -- Reset provider_type back to null after it was set + prepare reset_provider_type as + update auth_oidc_method + set provider_type = null + where public_id = 'aom___widget'; + select lives_ok('reset_provider_type', 'provider_type can be reset to null'); + + select is(provider_type, null, 'provider_type should be null after reset') + from auth_oidc_method + where public_id = 'aom___widget'; + + select * from finish(); +rollback;