feat: user management

package.json

@@ -23,6 +23,7 @@
     "envalid": "7.3.1",
     "express": "4.18.1",
     "fs-extra": "9.1.0",
+    "generate-password": "^1.7.1",
     "ignore-walk": "3.0.4",
     "lodash": "4.17.21",
     "node-fetch": "2.6.7",

src/cmd/bootstrap.test.ts

@@ -22,6 +22,7 @@ describe('Bootstrapping values', () => {
     apps: { 'cert-manager': { issuer: 'custom-ca' } },
     cluster: { name: 'bla', provider: 'dida' },
   }
+  const users = [{ id: 'user1', initialPassword: 'existing-password' }, { id: 'user2' }]
   const secrets = { secret: 'true', deep: { nested: 'secret' } }
   const ageKeys = { publicKey: 'agePublicKey', privateKey: 'agePrivateKey' }
   const kmsValues = {
@@ -241,6 +242,11 @@ describe('Bootstrapping values', () => {
   })
   describe('processing values', () => {
     const generatedSecrets = { gen: 'x' }
+    const generatedPassword = 'generated-password'
+    const usersWithPasswords = [
+      { id: 'user1', initialPassword: 'existing-password' },
+      { id: 'user2', initialPassword: generatedPassword },
+    ]
     const ca = { a: 'cert' }
     const mergedValues = merge(cloneDeep(values), cloneDeep(secrets))
     const mergedSecretsWithCa = merge(cloneDeep(secrets), cloneDeep(ca))
@@ -262,6 +268,7 @@ describe('Bootstrapping values', () => {
         terminal,
         validateValues: jest.fn().mockReturnValue(true),
         writeValues: jest.fn(),
+        generatePassword: jest.fn().mockReturnValue(generatedPassword),
       }
     })
     describe('Creating CA', () => {
@@ -335,10 +342,15 @@ describe('Bootstrapping values', () => {
         expect(res).toEqual(mergedValues)
       })
       it('should merge original with generated values and write them to env dir', async () => {
-        const writtenValues = merge(cloneDeep(values), cloneDeep(mergedSecretsWithGenAndCa))
-        deps.loadYaml.mockReturnValue(values)
+        const writtenValues = merge(
+          cloneDeep(values),
+          cloneDeep(mergedSecretsWithGenAndCa),
+          cloneDeep({ users: usersWithPasswords }),
+        )
+        deps.loadYaml.mockReturnValue({ ...values, users })
         deps.getStoredClusterSecrets.mockReturnValue(secrets)
         deps.generateSecrets.mockReturnValue(generatedSecrets)
+        deps.generatePassword.mockReturnValue(generatedPassword)
         await processValues(deps)
         expect(deps.writeValues).toHaveBeenNthCalledWith(2, writtenValues)
       })

src/cmd/bootstrap.ts

@@ -1,5 +1,6 @@
 import { copy, pathExists } from 'fs-extra'
 import { copyFile, mkdir, readFile, writeFile } from 'fs/promises'
+import { generate as generatePassword } from 'generate-password'
 import { cloneDeep, get, merge } from 'lodash'
 import { pki } from 'node-forge'
 import path from 'path'
@@ -252,6 +253,7 @@ export const processValues = async (
     generateSecrets,
     createK8sSecret,
     createCustomCA,
+    generatePassword,
   },
 ): Promise<Record<string, any> | undefined> => {
   const d = deps.terminal(`cmd:${cmdName}:processValues`)
@@ -287,8 +289,21 @@ export const processValues = async (
   }
   // merge existing secrets over newly generated ones to keep them
   const allSecrets = merge(cloneDeep(caSecrets), cloneDeep(storedSecrets), cloneDeep(generatedSecrets))
+  // generate initial passwords for users if they don't have one
+  const users = get(originalInput, 'users', [])
+  for (const user of users) {
+    if (!user.initialPassword) {
+      user.initialPassword = deps.generatePassword({
+        length: 16,
+        numbers: true,
+        symbols: true,
+        lowercase: true,
+        uppercase: true,
+      })
+    }
+  }
   // we have generated all we need, now store everything by merging the original values over all the secrets
-  await deps.writeValues(merge(cloneDeep(allSecrets), cloneDeep(originalInput)))
+  await deps.writeValues(merge(cloneDeep(allSecrets), cloneDeep(originalInput), cloneDeep({ users })))
   // and do some context dependent post processing:
   if (deps.isChart) {
     // to support potential failing chart install we store secrets on cluster

tests/fixtures/env/secrets.users.yaml

@@ -3,17 +3,20 @@ users:
       firstName: platform
       lastName: admin
       isPlatformAdmin: true
-      isTeamAdmin: false
-      teams: ['admin', 'demo']
+      isTeamAdmin: true
+      teams: ['demo']
+      initialPassword: 'platform-admin-password'
     - email: [email protected]
       firstName: team
       lastName: admin
       isPlatformAdmin: false
       isTeamAdmin: true
       teams: ['demo']
+      initialPassword: 'team-admin-password'
     - email: [email protected]
       firstName: team
       lastName: member
       isPlatformAdmin: false
       isTeamAdmin: false
       teams: ['demo']
+      initialPassword: 'team-member-password'

values-schema.yaml

@@ -1464,8 +1464,6 @@ definitions:
       - email
       - firstName
       - lastName
-      - isPlatformAdmin
-      - isTeamAdmin
 
 properties:
   alerts:

values/apl-keycloak-operator/apl-keycloak-operator-raw.gotmpl

@@ -18,7 +18,14 @@
 {{- $k := $c | get "keycloak" }}
 {{- $doms := tpl (readFile "../../helmfile.d/snippets/domains.gotmpl") $v | fromYaml }}
 {{- $joinTpl := readFile "../../helmfile.d/utils/joinListWithSep.gotmpl" }}
-{{- $users := $v.users }}
+{{ $users := list }}
+{{- range $user := $v.users }}
+  {{ $groups := list }}
+  {{- if $user.isPlatformAdmin }}{{ $groups = append $groups "platform-admin" }}{{ end }}
+  {{- if $user.isTeamAdmin }}{{ $groups = append $groups "team-admin" }}{{ end }}
+  {{- range $team := $user.teams }}{{ $groups = append $groups (print "team-" $team) }}{{ end }}
+  {{- $users = append $users (dict "email" $user.email "firstName" $user.firstName "lastName" $user.lastName "initialPassword" $user.initialPassword "groups" $groups) }}
+{{- end }}
 {{- $users := $users | toJson }}
 
 resources: