diff --git a/packages/bbui/src/Icon/IconAvatar.svelte b/packages/bbui/src/Icon/IconAvatar.svelte index add51f5bdc..b046e4dfd5 100644 --- a/packages/bbui/src/Icon/IconAvatar.svelte +++ b/packages/bbui/src/Icon/IconAvatar.svelte @@ -1,22 +1,41 @@ + +
(showTooltip = true)} + on:mouseleave={() => (showTooltip = false)} + on:focus={() => (showTooltip = true)} + on:blur={() => (showTooltip = false)} + on:click={() => (showTooltip = false)} > + {#if tooltip && showTooltip} +
+ +
+ {/if}
diff --git a/packages/bbui/src/Table/Table.svelte b/packages/bbui/src/Table/Table.svelte index 36668571bc..33b9bd9a7e 100644 --- a/packages/bbui/src/Table/Table.svelte +++ b/packages/bbui/src/Table/Table.svelte @@ -470,6 +470,7 @@ --table-border: 1px solid var(--spectrum-alias-border-color-mid); --cell-padding: var(--spectrum-global-dimension-size-250); overflow: auto; + display: contents; } .wrapper--quiet { --table-bg: var(--spectrum-alias-background-color-transparent); diff --git a/packages/builder/src/pages/builder/portal/users/_components/ActiveDirectoryInfo.svelte b/packages/builder/src/pages/builder/portal/users/_components/ActiveDirectoryInfo.svelte new file mode 100644 index 0000000000..e060e2ca3f --- /dev/null +++ b/packages/builder/src/pages/builder/portal/users/_components/ActiveDirectoryInfo.svelte @@ -0,0 +1,23 @@ + + +
+ + {text} +
+ + diff --git a/packages/builder/src/pages/builder/portal/users/_components/SCIMBanner.svelte b/packages/builder/src/pages/builder/portal/users/_components/SCIMBanner.svelte deleted file mode 100644 index 2d02214800..0000000000 --- a/packages/builder/src/pages/builder/portal/users/_components/SCIMBanner.svelte +++ /dev/null @@ -1,15 +0,0 @@ - - -
- - Users are synced from your AD -
- - diff --git a/packages/builder/src/pages/builder/portal/users/groups/[groupId].svelte b/packages/builder/src/pages/builder/portal/users/groups/[groupId].svelte index d03c62d528..d0eb50c8dd 100644 --- a/packages/builder/src/pages/builder/portal/users/groups/[groupId].svelte +++ b/packages/builder/src/pages/builder/portal/users/groups/[groupId].svelte @@ -13,7 +13,7 @@ import ConfirmDialog from "components/common/ConfirmDialog.svelte" import { Breadcrumb, Breadcrumbs } from "components/portal/page" import { roles } from "stores/builder" - import { apps, auth, features, groups } from "stores/portal" + import { apps, auth, groups } from "stores/portal" import { onMount, setContext } from "svelte" import AppNameTableRenderer from "../users/_components/AppNameTableRenderer.svelte" import AppRoleTableRenderer from "../users/_components/AppRoleTableRenderer.svelte" @@ -47,9 +47,9 @@ let loaded = false let editModal, deleteModal - $: scimEnabled = $features.isScimEnabled - $: readonly = !sdk.users.isAdmin($auth.user) || scimEnabled $: group = $groups.find(x => x._id === groupId) + $: isScimGroup = group?.scimInfo?.isSync + $: readonly = !sdk.users.isAdmin($auth.user) || isScimGroup $: groupApps = $apps .filter(app => groups.actions @@ -119,23 +119,27 @@
{group?.name} - {#if !readonly} - - - - - editModal.show()}> - Edit - - deleteModal.show()}> + + + + + editModal.show()}> + Edit + +
+ deleteModal.show()} + disabled={isScimGroup} + > Delete - - {/if} +
+
- + diff --git a/packages/builder/src/pages/builder/portal/users/groups/_components/CreateEditGroupModal.svelte b/packages/builder/src/pages/builder/portal/users/groups/_components/CreateEditGroupModal.svelte index 2f0d295052..9a0c3540af 100644 --- a/packages/builder/src/pages/builder/portal/users/groups/_components/CreateEditGroupModal.svelte +++ b/packages/builder/src/pages/builder/portal/users/groups/_components/CreateEditGroupModal.svelte @@ -11,6 +11,8 @@ export let group export let saveGroup + let readonlyTitle = group?.scimInfo?.isSync + let nameError @@ -26,7 +28,12 @@ title={group?._rev ? "Edit group" : "Create group"} confirmText="Save" > - +
Icon diff --git a/packages/builder/src/pages/builder/portal/users/groups/_components/EditUserPicker.svelte b/packages/builder/src/pages/builder/portal/users/groups/_components/EditUserPicker.svelte index cc524f1acf..8cec28a0ef 100644 --- a/packages/builder/src/pages/builder/portal/users/groups/_components/EditUserPicker.svelte +++ b/packages/builder/src/pages/builder/portal/users/groups/_components/EditUserPicker.svelte @@ -2,8 +2,7 @@ import { Button, Popover, notifications } from "@budibase/bbui" import UserGroupPicker from "components/settings/UserGroupPicker.svelte" import { createPaginationStore } from "helpers/pagination" - import { auth, groups, users } from "stores/portal" - import { sdk } from "@budibase/shared-core" + import { groups, users } from "stores/portal" export let groupId export let onUsersUpdated @@ -14,7 +13,6 @@ let prevSearch = undefined let pageInfo = createPaginationStore() - $: readonly = !sdk.users.isAdmin($auth.user) $: page = $pageInfo.page $: searchUsers(page, searchTerm) $: group = $groups.find(x => x._id === groupId) @@ -43,7 +41,7 @@
- +
- +
+ +
+ + diff --git a/packages/builder/src/pages/builder/portal/users/groups/_components/GroupNameTableRenderer.svelte b/packages/builder/src/pages/builder/portal/users/groups/_components/GroupNameTableRenderer.svelte index 831ac6e20b..30da076e9c 100644 --- a/packages/builder/src/pages/builder/portal/users/groups/_components/GroupNameTableRenderer.svelte +++ b/packages/builder/src/pages/builder/portal/users/groups/_components/GroupNameTableRenderer.svelte @@ -1,5 +1,6 @@
- {#if !scimEnabled} + {#if !readonly} {:else} - + {/if}
diff --git a/packages/builder/src/pages/builder/portal/users/groups/index.svelte b/packages/builder/src/pages/builder/portal/users/groups/index.svelte index ab0a0eb938..5636d555ae 100644 --- a/packages/builder/src/pages/builder/portal/users/groups/index.svelte +++ b/packages/builder/src/pages/builder/portal/users/groups/index.svelte @@ -13,7 +13,7 @@ Search, notifications, } from "@budibase/bbui" - import { groups, auth, licensing, admin, features } from "stores/portal" + import { groups, auth, licensing, admin } from "stores/portal" import { onMount } from "svelte" import CreateEditGroupModal from "./_components/CreateEditGroupModal.svelte" import { cloneDeep } from "lodash/fp" @@ -21,7 +21,6 @@ import UsersTableRenderer from "./_components/UsersTableRenderer.svelte" import GroupNameTableRenderer from "./_components/GroupNameTableRenderer.svelte" import { goto } from "@roxi/routify" - import ScimBanner from "../_components/SCIMBanner.svelte" import { sdk } from "@budibase/shared-core" const DefaultGroup = { @@ -110,14 +109,10 @@
{#if $licensing.groupsEnabled} - {#if !$features.isScimEnabled} - - - {:else} - - {/if} + + {:else} -
+ {#if internalGroups?.length} +
+ +
+ {/if} !g?.scimInfo?.isSync) + function removeInput(idx) { userData = userData.filter((e, i) => i !== idx) } @@ -133,12 +135,12 @@ {/if} - {#if $licensing.groupsEnabled} + {#if $licensing.groupsEnabled && internalGroups?.length} option.name} getOptionValue={option => option._id} /> diff --git a/packages/builder/src/pages/builder/portal/users/users/_components/EmailTableRenderer.svelte b/packages/builder/src/pages/builder/portal/users/users/_components/EmailTableRenderer.svelte new file mode 100644 index 0000000000..99ba5abc2f --- /dev/null +++ b/packages/builder/src/pages/builder/portal/users/users/_components/EmailTableRenderer.svelte @@ -0,0 +1,11 @@ + + +{value} +{#if row.scimInfo?.isSync} + +{/if} diff --git a/packages/builder/src/pages/builder/portal/users/users/_components/ImportUsersModal.svelte b/packages/builder/src/pages/builder/portal/users/users/_components/ImportUsersModal.svelte index bb03f166b3..432fb7abb7 100644 --- a/packages/builder/src/pages/builder/portal/users/users/_components/ImportUsersModal.svelte +++ b/packages/builder/src/pages/builder/portal/users/users/_components/ImportUsersModal.svelte @@ -34,6 +34,8 @@ label: `${option.label} - ${option.subtitle}`, })) + $: internalGroups = $groups?.filter(g => !g?.scimInfo?.isSync) + const validEmails = userEmails => { if ($admin.cloud && userEmails.length > MAX_USERS_UPLOAD_LIMIT) { notifications.error( @@ -106,12 +108,12 @@ {/if} - {#if $licensing.groupsEnabled} + {#if $licensing.groupsEnabled && internalGroups?.length} option.name} getOptionValue={option => option._id} /> diff --git a/packages/builder/src/pages/builder/portal/users/users/_components/RemoveGroupTableRenderer.svelte b/packages/builder/src/pages/builder/portal/users/users/_components/RemoveGroupTableRenderer.svelte index df25ae7d30..5eacdec944 100644 --- a/packages/builder/src/pages/builder/portal/users/users/_components/RemoveGroupTableRenderer.svelte +++ b/packages/builder/src/pages/builder/portal/users/users/_components/RemoveGroupTableRenderer.svelte @@ -5,6 +5,7 @@ import { sdk } from "@budibase/shared-core" export let value + export let row const groupContext = getContext("groups") @@ -12,12 +13,11 @@ e.stopPropagation() groupContext.removeGroup(value) } + + $: disabled = !sdk.users.isAdmin($auth.user) || row?.scimInfo?.isSync + $: tooltip = row?.scimInfo?.isSync && "This group is managed via your AD" -Remove - Remove - diff --git a/packages/builder/src/pages/builder/portal/users/users/index.svelte b/packages/builder/src/pages/builder/portal/users/users/index.svelte index 18ee4f7d43..c2fbce5747 100644 --- a/packages/builder/src/pages/builder/portal/users/users/index.svelte +++ b/packages/builder/src/pages/builder/portal/users/users/index.svelte @@ -19,7 +19,6 @@ auth, licensing, organisation, - features, admin, } from "stores/portal" import { onMount } from "svelte" @@ -28,6 +27,7 @@ import GroupsTableRenderer from "./_components/GroupsTableRenderer.svelte" import AppsTableRenderer from "./_components/AppsTableRenderer.svelte" import RoleTableRenderer from "./_components/RoleTableRenderer.svelte" + import EmailTableRenderer from "./_components/EmailTableRenderer.svelte" import { goto } from "@roxi/routify" import OnboardingTypeModal from "./_components/OnboardingTypeModal.svelte" import PasswordModal from "./_components/PasswordModal.svelte" @@ -37,7 +37,6 @@ import { Constants, Utils, fetchData } from "@budibase/frontend-core" import { API } from "api" import { OnboardingType } from "constants" - import ScimBanner from "../_components/SCIMBanner.svelte" import { sdk } from "@budibase/shared-core" const fetch = fetchData({ @@ -63,6 +62,7 @@ let selectedRows = [] let bulkSaveResponse let customRenderers = [ + { column: "email", component: EmailTableRenderer }, { column: "userGroups", component: GroupsTableRenderer }, { column: "apps", component: AppsTableRenderer }, { column: "role", component: RoleTableRenderer }, @@ -73,7 +73,7 @@ let parsedInvites = [] $: isOwner = $auth.accountPortalAccess && $admin.cloud - $: readonly = !sdk.users.isAdmin($auth.user) || $features.isScimEnabled + $: readonly = !sdk.users.isAdmin($auth.user) $: debouncedUpdateFetch(searchEmail) $: schema = { email: { @@ -247,19 +247,25 @@ } } - const deleteRows = async () => { + const deleteUsers = async () => { try { let ids = selectedRows.map(user => user._id) if (ids.includes(get(auth).user._id)) { notifications.error("You cannot delete yourself") return } + + if (selectedRows.some(u => u.scimInfo?.isSync)) { + notifications.error("You cannot remove users created via your AD") + return + } + await users.bulkDelete(ids) notifications.success(`Successfully deleted ${selectedRows.length} rows`) selectedRows = [] await fetch.refresh() } catch (error) { - notifications.error("Error deleting rows") + notifications.error("Error deleting users") } } @@ -320,8 +326,6 @@ Import
- {:else} - {/if}
@@ -330,7 +334,7 @@ item="user" on:updaterows {selectedRows} - {deleteRows} + deleteRows={deleteUsers} /> {/if}
@@ -346,6 +350,7 @@ {customRenderers} loading={!$fetch.loaded || !groupsLoaded} /> + + { - const response = await API.saveGroup(group) + const { _scimInfo, ...dataToSave } = group + const response = await API.saveGroup(dataToSave) group._id = response._id group._rev = response._rev updateStore(group) diff --git a/packages/pro b/packages/pro index 80a4d8ff99..4e66a0f704 160000 --- a/packages/pro +++ b/packages/pro @@ -1 +1 @@ -Subproject commit 80a4d8ff998895fc298ee510158a82ce7daebc67 +Subproject commit 4e66a0f7042652763c238b10367310b168905f87 diff --git a/packages/types/package.json b/packages/types/package.json index 558e55a632..f4c7b13344 100644 --- a/packages/types/package.json +++ b/packages/types/package.json @@ -23,6 +23,6 @@ "typescript": "5.2.2" }, "dependencies": { - "scim-patch": "^0.7.0" + "scim-patch": "^0.8.1" } } diff --git a/packages/worker/src/api/routes/global/tests/scim.spec.ts b/packages/worker/src/api/routes/global/tests/scim.spec.ts index ae0abadc5d..3d5a884579 100644 --- a/packages/worker/src/api/routes/global/tests/scim.spec.ts +++ b/packages/worker/src/api/routes/global/tests/scim.spec.ts @@ -10,25 +10,20 @@ import { import { TestConfiguration } from "../../../../tests" import { events } from "@budibase/backend-core" -// this test can 409 - retries reduce issues with this -jest.retryTimes(2, { logErrorsBeforeRetry: true }) jest.setTimeout(30000) describe("scim", () => { - beforeAll(async () => { - tk.freeze(mocks.date.MOCK_DATE) - mocks.licenses.useScimIntegration() - - await config.setSCIMConfig(true) - }) - - beforeEach(async () => { + async function setup() { jest.resetAllMocks() tk.freeze(mocks.date.MOCK_DATE) mocks.licenses.useScimIntegration() + mocks.licenses.useGroups() await config.setSCIMConfig(true) - }) + } + + beforeAll(setup) + beforeEach(setup) const config = new TestConfiguration() @@ -367,13 +362,77 @@ describe("scim", () => { }) }) - it("creating an existing user name returns a conflict", async () => { - const body = structures.scim.createUserRequest() + it("creating an external user that conflicts an internal one syncs the existing user", async () => { + const { body: internalUser } = await config.api.users.saveUser( + structures.users.user() + ) - await postScimUser({ body }) + const scimUserData = { + externalId: structures.uuid(), + email: internalUser.email, + firstName: structures.generator.first(), + lastName: structures.generator.last(), + username: structures.generator.name(), + } + const scimUserRequest = structures.scim.createUserRequest(scimUserData) - const res = await postScimUser({ body }, { expect: 409 }) - expect((res as any).message).toBe("Email already in use") + const res = await postScimUser( + { body: scimUserRequest }, + { expect: 200 } + ) + + const expectedScimUser: ScimUserResponse = { + schemas: ["urn:ietf:params:scim:schemas:core:2.0:User"], + id: internalUser._id!, + externalId: scimUserRequest.externalId, + meta: { + resourceType: "User", + // @ts-ignore + created: mocks.date.MOCK_DATE.toISOString(), + // @ts-ignore + lastModified: mocks.date.MOCK_DATE.toISOString(), + }, + userName: scimUserData.username, + name: { + formatted: `${scimUserData.firstName} ${scimUserData.lastName}`, + familyName: scimUserData.lastName, + givenName: scimUserData.firstName, + }, + active: true, + emails: [ + { + value: internalUser.email, + type: "work", + primary: true, + }, + ], + } + + expect(res).toEqual(expectedScimUser) + }) + + it("a user cannot be SCIM synchronised with another SCIM user", async () => { + const { body: internalUser } = await config.api.users.saveUser( + structures.users.user() + ) + + await postScimUser( + { + body: structures.scim.createUserRequest({ + email: internalUser.email, + }), + }, + { expect: 200 } + ) + + await postScimUser( + { + body: structures.scim.createUserRequest({ + email: internalUser.email, + }), + }, + { expect: 409 } + ) }) }) @@ -656,7 +715,6 @@ describe("scim", () => { }) it("can fetch groups even if internal groups exist", async () => { - mocks.licenses.useGroups() await config.api.groups.saveGroup(structures.userGroups.userGroup()) await config.api.groups.saveGroup(structures.userGroups.userGroup()) @@ -722,6 +780,43 @@ describe("scim", () => { ) }) }) + + it("creating an external group that conflicts an internal one syncs the existing group", async () => { + const groupToSave = structures.userGroups.userGroup() + const { body: internalGroup } = await config.api.groups.saveGroup( + groupToSave + ) + + const scimGroupData = { + externalId: structures.uuid(), + displayName: groupToSave.name, + } + + const res = await postScimGroup( + { body: structures.scim.createGroupRequest(scimGroupData) }, + { expect: 200 } + ) + + expect(res).toEqual( + expect.objectContaining({ + id: internalGroup._id!, + externalId: scimGroupData.externalId, + displayName: scimGroupData.displayName, + }) + ) + }) + + it("a group cannot be SCIM synchronised with another SCIM group", async () => { + const groupToSave = structures.userGroups.userGroup() + await config.api.groups.saveGroup(groupToSave) + + const createGroupRequest = structures.scim.createGroupRequest({ + displayName: groupToSave.name, + }) + await postScimGroup({ body: createGroupRequest }, { expect: 200 }) + + await postScimGroup({ body: createGroupRequest }, { expect: 409 }) + }) }) describe("GET /api/global/scim/v2/groups/:id", () => { diff --git a/yarn.lock b/yarn.lock index 4025a537a3..235e28e85e 100644 --- a/yarn.lock +++ b/yarn.lock @@ -5666,6 +5666,13 @@ dependencies: undici-types "~5.26.4" +"@types/node@^20.4.5": + version "20.11.25" + resolved "https://registry.yarnpkg.com/@types/node/-/node-20.11.25.tgz#0f50d62f274e54dd7a49f7704cc16bfbcccaf49f" + integrity sha512-TBHyJxk2b7HceLVGFcpAUjsa5zIdsPWlR6XHfyGzd0SFu+/NFgQgMAl96MSDZgQDvJAvV6BKsFOrt6zIL09JDw== + dependencies: + undici-types "~5.26.4" + "@types/nodemailer@^6.4.4": version "6.4.14" resolved "https://registry.yarnpkg.com/@types/nodemailer/-/nodemailer-6.4.14.tgz#5c81a5e856db7f8ede80013e6dbad7c5fb2283e2" @@ -19491,11 +19498,12 @@ schema-utils@^3.1.1, schema-utils@^3.1.2: ajv "^6.12.5" ajv-keywords "^3.5.2" -scim-patch@^0.7.0: - version "0.7.0" - resolved "https://registry.yarnpkg.com/scim-patch/-/scim-patch-0.7.0.tgz#3f6d94256c07be415a74a49c0ff48dc91e4e0219" - integrity sha512-wXKcsZl+aLfE0yId7MjiOd91v8as6dEYLFvm1gGu3yJxSPhl1Fl3vWiNN4V3D68UKpqO/umK5rwWc8wGpBaOHw== +scim-patch@^0.8.1: + version "0.8.1" + resolved "https://registry.yarnpkg.com/scim-patch/-/scim-patch-0.8.1.tgz#611bfdb5538f6d8b97aba0ab0f8bd01055b70c1c" + integrity sha512-JRYTA+mJZ8Z5DJGO7kkFc0lGCDs100rNs7iN77mld7gQajTp1R1xjUzMfZTOMAkBDA75GSdbMmfdfMqMJCn/Yg== dependencies: + "@types/node" "^20.4.5" fast-deep-equal "3.1.3" scim2-parse-filter "0.2.8"