An administrator reset your multi-factor authentication. Your MFA methods, backup codes and " + + "trusted devices were removed, and you were signed out.
" + + "Sign in again to set up a new method. If you didn't ask for this, contact your administrator.
" + if err := h.emailSender.Send(userEmail, subject, textBody, htmlBody); err != nil { + gtwlog.Errorf("users: MFA reset email to %s failed: %v", userEmail, err) + } +} diff --git a/internal/gateway/handlers/admin_users_mfa_reset_test.go b/internal/gateway/handlers/admin_users_mfa_reset_test.go new file mode 100644 index 00000000..06c25852 --- /dev/null +++ b/internal/gateway/handlers/admin_users_mfa_reset_test.go @@ -0,0 +1,118 @@ +package handlers + +import ( + "context" + "net/http" + "net/http/httptest" + "strings" + "testing" + "time" + + "github.com/gin-gonic/gin" + "github.com/stretchr/testify/require" + + "github.com/DocSpring/rack-gateway/internal/gateway/audit" + "github.com/DocSpring/rack-gateway/internal/gateway/auth" + "github.com/DocSpring/rack-gateway/internal/gateway/config" + "github.com/DocSpring/rack-gateway/internal/gateway/db" + "github.com/DocSpring/rack-gateway/internal/gateway/testutil/dbtest" +) + +type sentEmail struct{ to, subject string } + +type recordingEmailSender struct{ sent []sentEmail } + +func (r *recordingEmailSender) Send(to, subject, _, _ string) error { + r.sent = append(r.sent, sentEmail{to: to, subject: subject}) + return nil +} + +func (r *recordingEmailSender) SendMany(to []string, subject, textBody, htmlBody string) error { + for _, recipient := range to { + _ = r.Send(recipient, subject, textBody, htmlBody) + } + return nil +} + +func resetUserMFA(t *testing.T, h *AdminHandler, admin *db.User, email string) *httptest.ResponseRecorder { + t.Helper() + gin.SetMode(gin.TestMode) + w := httptest.NewRecorder() + c, _ := gin.CreateTestContext(w) + req := httptest.NewRequest(http.MethodPost, "/api/v1/users/"+email+"/mfa/reset", nil) + c.Request = req.WithContext(context.WithValue(req.Context(), auth.UserContextKey, &auth.User{ + Email: admin.Email, Name: admin.Name, Roles: admin.Roles, DBUser: admin, + })) + c.Params = gin.Params{{Key: "email", Value: email}} + c.Set("user_email", admin.Email) + h.ResetUserMFA(c) + return w +} + +// An admin's Reset MFA removes everything the user signs in with but keeps their API tokens. +func TestResetUserMFA(t *testing.T) { + database := dbtest.NewDatabase(t) + admin, err := database.CreateUser("admin@example.com", "Admin", []string{"admin"}) + require.NoError(t, err) + user, err := database.CreateUser("dev@example.com", "Dev", []string{"deployer"}) + require.NoError(t, err) + + method, err := database.CreateMFAMethod(user.ID, "totp", "Phone", "JBSWY3DPEHPK3PXP", nil, nil, nil, nil) + require.NoError(t, err) + require.NoError(t, database.ConfirmMFAMethod(method.ID, time.Now())) + require.NoError(t, database.SetUserMFAEnrolled(user.ID, true)) + require.NoError(t, database.ReplaceBackupCodes(user.ID, []string{strings.Repeat("1", 64)})) + deviceID := "3f2b9c1e-8d4a-4b6e-9f1a-2c7d5e8a1b0f" + _, err = database.CreateTrustedDevice(user.ID, deviceID, strings.Repeat("d", 64), time.Now().Add(time.Hour), + "127.0.0.1", "ua", nil) + require.NoError(t, err) + _, err = database.CreateUserSession(user.ID, strings.Repeat("e", 64), time.Now().Add(time.Hour), "web", + deviceID, "Laptop", "127.0.0.1", "ua", nil, nil) + require.NoError(t, err) + _, err = database.CreateAPIToken(strings.Repeat("f", 64), "dev-ci", user.ID, []string{"deployer"}, nil, nil) + require.NoError(t, err) + + emails := &recordingEmailSender{} + h := &AdminHandler{ + database: database, + auditLogger: audit.NewLogger(database), + config: &config.Config{}, + emailSender: emails, + } + + w := resetUserMFA(t, h, admin, admin.Email) + require.Equal(t, http.StatusBadRequest, w.Code) + require.Contains(t, w.Body.String(), "you can't reset your own MFA") + + w = resetUserMFA(t, h, admin, user.Email) + require.Equal(t, http.StatusOK, w.Code, w.Body.String()) + + methods, err := database.ListAllMFAMethods(user.ID) + require.NoError(t, err) + require.Empty(t, methods) + codes, err := database.ListBackupCodes(user.ID) + require.NoError(t, err) + require.Empty(t, codes) + devices, err := database.ListTrustedDevices(user.ID) + require.NoError(t, err) + for _, device := range devices { + require.NotNil(t, device.RevokedAt) + require.Equal(t, "admin_mfa_reset", device.RevokedReason) + } + sessions, err := database.ListActiveSessionsByUser(user.ID) + require.NoError(t, err) + require.Empty(t, sessions) + reloaded, err := database.GetUserByID(user.ID) + require.NoError(t, err) + require.False(t, reloaded.MFAEnrolled) + tokens, err := database.ListAPITokensByUser(user.ID) + require.NoError(t, err) + require.Len(t, tokens, 1) + + require.Equal(t, []sentEmail{{to: user.Email, subject: "Multi-factor authentication reset"}}, emails.sent) + logs, err := database.GetAuditLogs(admin.Email, time.Time{}, 10) + require.NoError(t, err) + require.NotEmpty(t, logs) + require.Equal(t, "user.mfa_reset", logs[0].Action) + require.Equal(t, audit.StatusSuccess, logs[0].Status) +} diff --git a/internal/gateway/handlers/deploy_approval_admin.go b/internal/gateway/handlers/deploy_approval_admin.go index da06ca84..ef04c6ac 100644 --- a/internal/gateway/handlers/deploy_approval_admin.go +++ b/internal/gateway/handlers/deploy_approval_admin.go @@ -125,21 +125,21 @@ func (h *AdminHandler) getDeployApprovalExpiry() time.Time { // @Param id path string true "Deploy approval request public ID" // @Param body body UpdateDeployApprovalRequestStatusRequest false "Approval notes" // @Success 200 {object} DeployApprovalRequestResponse +// @Failure 403 {object} ErrorResponse // @Failure 404 {object} ErrorResponse // @Failure 500 {object} ErrorResponse // @Security SessionCookie // @Router /deploy-approval-requests/{id}/approve [post] func (h *AdminHandler) ApproveDeployApprovalRequest(c *gin.Context) { - input, ok := h.parseDeployApprovalStatusUpdateRequest(c) + input, ok := h.parseApprovalWindowRequest(c) if !ok { return } - expiresAt := h.getDeployApprovalExpiry() record, err := h.database.ApproveDeployApprovalRequestByPublicID( input.publicID, input.approver.ID, - expiresAt, + input.expiresAt, input.notes, ) if err != nil { @@ -152,13 +152,7 @@ func (h *AdminHandler) ApproveDeployApprovalRequest(c *gin.Context) { } h.triggerCircleCIApprovalIfEnabled(c, record) - h.finishApprovalAction( - c, - record, - input, - rbac.ActionApprove.String(), - map[string]string{"expires_at": expiresAt.UTC().Format(time.RFC3339)}, - ) + h.finishApprovalAction(c, record, input.deployApprovalStatusInput, rbac.ActionApprove.String(), input.auditDetails) } // RejectDeployApprovalRequest godoc @@ -208,19 +202,19 @@ func (h *AdminHandler) RejectDeployApprovalRequest(c *gin.Context) { // @Param id path string true "Deploy approval request public ID" // @Param body body UpdateDeployApprovalRequestStatusRequest false "Extension notes" // @Success 200 {object} DeployApprovalRequestResponse +// @Failure 403 {object} ErrorResponse // @Failure 404 {object} ErrorResponse // @Failure 409 {object} ErrorResponse // @Failure 500 {object} ErrorResponse // @Security SessionCookie // @Router /deploy-approval-requests/{id}/extend [post] func (h *AdminHandler) ExtendDeployApprovalRequest(c *gin.Context) { - input, ok := h.parseDeployApprovalStatusUpdateRequest(c) + input, ok := h.parseApprovalWindowRequest(c) if !ok { return } - expiresAt := h.getDeployApprovalExpiry() - record, err := h.database.ExtendDeployApprovalRequestExpiry(input.publicID, expiresAt) + record, err := h.database.ExtendDeployApprovalRequestExpiry(input.publicID, input.expiresAt) if err != nil { if errors.Is(err, db.ErrDeployApprovalRequestNotFound) { c.JSON(http.StatusNotFound, gin.H{"error": "deploy approval request not found or not approved"}) @@ -236,13 +230,7 @@ func (h *AdminHandler) ExtendDeployApprovalRequest(c *gin.Context) { return } - h.finishApprovalAction( - c, - record, - input, - "extend", - map[string]string{"expires_at": expiresAt.UTC().Format(time.RFC3339)}, - ) + h.finishApprovalAction(c, record, input.deployApprovalStatusInput, "extend", input.auditDetails) } func (h *AdminHandler) triggerCircleCIApprovalIfEnabled(c *gin.Context, record *db.DeployApprovalRequest) { diff --git a/internal/gateway/handlers/deploy_approval_approver.go b/internal/gateway/handlers/deploy_approval_approver.go new file mode 100644 index 00000000..ea2b030e --- /dev/null +++ b/internal/gateway/handlers/deploy_approval_approver.go @@ -0,0 +1,82 @@ +package handlers + +import ( + "net/http" + "time" + + "github.com/gin-gonic/gin" + + "github.com/DocSpring/rack-gateway/internal/gateway/db" + gtwlog "github.com/DocSpring/rack-gateway/internal/gateway/logging" + "github.com/DocSpring/rack-gateway/internal/gateway/settings" +) + +// approvalWindowRequest is an approve or extend request: either opens an approval window, which runs to expiresAt. +type approvalWindowRequest struct { + *deployApprovalStatusInput + expiresAt time.Time + auditDetails map[string]string +} + +// parseApprovalWindowRequest parses an approve or extend request and checks its approver may open the window. +func (h *AdminHandler) parseApprovalWindowRequest(c *gin.Context) (*approvalWindowRequest, bool) { + input, ok := h.parseDeployApprovalStatusUpdateRequest(c) + if !ok { + return nil, false + } + differentApproverChecked, ok := h.requireDifferentApprover(c, input) + if !ok { + return nil, false + } + expiresAt := h.getDeployApprovalExpiry() + details := map[string]string{"expires_at": expiresAt.UTC().Format(time.RFC3339)} + if differentApproverChecked { + details[differentApproverAuditKey] = "true" + } + return &approvalWindowRequest{deployApprovalStatusInput: input, expiresAt: expiresAt, auditDetails: details}, true +} + +// differentApproverAuditKey marks an approval or extension that deploy_approval_require_different_approver checked. +const differentApproverAuditKey = "different_approver_required" + +// requireDifferentApprover refuses an approval or extension by the person who asked for the deploy, when +// deploy_approval_require_different_approver is on: the user who created the request, or the owner of the API token +// it's for. A setting it can't read refuses the request. checked says the setting applied, for the audit entry. +func (h *AdminHandler) requireDifferentApprover(c *gin.Context, input *deployApprovalStatusInput) (checked, ok bool) { + if h.settingsService == nil { + return false, true + } + required, err := h.settingsService.GetDeployApprovalRequireDifferentApprover() + if err != nil { + gtwlog.Errorf("deploy approvals: failed to read %s: %v", + settings.KeyDeployApprovalRequireDifferentApprover, err) + c.JSON(http.StatusInternalServerError, gin.H{"error": "failed to read deploy approval settings"}) + return false, false + } + if !required { + return false, true + } + record, ok := loadDeployApprovalRequest(c, h.database, input.publicID) + if !ok { + return false, false + } + if reason := ownDeployApprovalReason(record, input.approver.ID); reason != "" { + c.JSON(http.StatusForbidden, gin.H{ + "error": "this gateway requires a different person to approve a deploy: " + reason, + }) + return false, false + } + return true, true +} + +// ownDeployApprovalReason says why a user counts as the requester of a deploy approval request, or "" if they don't. +func ownDeployApprovalReason(record *db.DeployApprovalRequest, userID int64) string { + switch { + case sameID(record.CreatedByUserID, userID): + return "you created this request" + case sameID(record.TargetUserID, userID): + return "you own the API token this request is for" + default: + return "" + } +} diff --git a/internal/gateway/handlers/deploy_approval_approver_test.go b/internal/gateway/handlers/deploy_approval_approver_test.go new file mode 100644 index 00000000..79c141d5 --- /dev/null +++ b/internal/gateway/handlers/deploy_approval_approver_test.go @@ -0,0 +1,136 @@ +package handlers + +import ( + "context" + "encoding/json" + "fmt" + "net/http" + "net/http/httptest" + "strings" + "testing" + "time" + + "github.com/gin-gonic/gin" + "github.com/stretchr/testify/require" + + "github.com/DocSpring/rack-gateway/internal/gateway/audit" + "github.com/DocSpring/rack-gateway/internal/gateway/auth" + "github.com/DocSpring/rack-gateway/internal/gateway/config" + "github.com/DocSpring/rack-gateway/internal/gateway/db" + "github.com/DocSpring/rack-gateway/internal/gateway/settings" + "github.com/DocSpring/rack-gateway/internal/gateway/testutil/dbtest" +) + +type differentApproverFixture struct { + database *db.Database + handler *AdminHandler + alice *db.User // an admin who owns token + bob *db.User // another admin + token *db.APIToken + commits []string +} + +func newDifferentApproverFixture(t *testing.T, required bool) *differentApproverFixture { + t.Helper() + gin.SetMode(gin.TestMode) + database := dbtest.NewDatabase(t) + alice, err := database.CreateUser("alice@example.com", "Alice", []string{"admin"}) + require.NoError(t, err) + bob, err := database.CreateUser("bob@example.com", "Bob", []string{"admin"}) + require.NoError(t, err) + token, err := database.CreateAPIToken(strings.Repeat("c", 64), "alice-ci", alice.ID, []string{"deployer"}, nil, nil) + require.NoError(t, err) + require.NoError(t, database.UpsertSetting(nil, settings.KeyDeployApprovalRequireDifferentApprover, required, nil)) + + return &differentApproverFixture{ + database: database, + alice: alice, + bob: bob, + token: token, + handler: &AdminHandler{ + rbac: newAllowAllRBAC(alice, bob), + database: database, + auditLogger: audit.NewLogger(database), + config: &config.Config{}, + settingsService: settings.NewService(database), + }, + } +} + +// request creates a pending request for alice's token, made by creator. +func (f *differentApproverFixture) request(t *testing.T, creator *db.User) *db.DeployApprovalRequest { + t.Helper() + commit := strings.Repeat(fmt.Sprintf("%02x", len(f.commits)), 20) + f.commits = append(f.commits, commit) + req, err := f.database.CreateDeployApprovalRequest( + "Deploy", "myapp", commit, "main", "", []byte("{}"), creator.ID, nil, f.token.ID, + ) + require.NoError(t, err) + return req +} + +func callDeployApprovalAction( + t *testing.T, + handle gin.HandlerFunc, + approver *db.User, + req *db.DeployApprovalRequest, +) (int, string) { + t.Helper() + httpReq := httptest.NewRequest(http.MethodPost, "/deploy-approval-requests/"+req.PublicID+"/approve", nil) + httpReq = httpReq.WithContext(context.WithValue(httpReq.Context(), auth.UserContextKey, &auth.User{ + Email: approver.Email, Name: approver.Name, Roles: approver.Roles, + })) + w := httptest.NewRecorder() + c, _ := gin.CreateTestContext(w) + c.Request = httpReq + c.Params = gin.Params{{Key: "id", Value: req.PublicID}} + c.Set("user_email", approver.Email) + handle(c) + var body struct { + Error string `json:"error"` + } + _ = json.Unmarshal(w.Body.Bytes(), &body) + return w.Code, body.Error +} + +func TestApproveOwnDeployRequestAllowedByDefault(t *testing.T) { + f := newDifferentApproverFixture(t, false) + status, msg := callDeployApprovalAction(t, f.handler.ApproveDeployApprovalRequest, f.alice, f.request(t, f.alice)) + require.Equal(t, http.StatusOK, status, msg) +} + +func TestDifferentApproverRequired(t *testing.T) { + f := newDifferentApproverFixture(t, true) + + status, msg := callDeployApprovalAction(t, f.handler.ApproveDeployApprovalRequest, f.alice, f.request(t, f.alice)) + require.Equal(t, http.StatusForbidden, status) + require.Equal(t, "this gateway requires a different person to approve a deploy: you created this request", msg) + + // Bob asks for a deploy with alice's CI token: alice can't approve it either. + status, msg = callDeployApprovalAction(t, f.handler.ApproveDeployApprovalRequest, f.alice, f.request(t, f.bob)) + require.Equal(t, http.StatusForbidden, status) + require.Contains(t, msg, "you own the API token this request is for") + + req := f.request(t, f.alice) + status, msg = callDeployApprovalAction(t, f.handler.ApproveDeployApprovalRequest, f.bob, req) + require.Equal(t, http.StatusOK, status, msg) + logs, err := f.database.GetAuditLogs(f.bob.Email, time.Time{}, 10) + require.NoError(t, err) + require.NotEmpty(t, logs) + require.Equal(t, "deploy_approval_request.approve", logs[0].Action) + require.Contains(t, logs[0].Details, `"different_approver_required":"true"`) +} + +func TestDifferentApproverRequiredToExtend(t *testing.T) { + f := newDifferentApproverFixture(t, true) + req := f.request(t, f.alice) + _, err := f.database.ApproveDeployApprovalRequest(req.ID, f.bob.ID, time.Now().Add(-time.Minute), "") + require.NoError(t, err) + + status, msg := callDeployApprovalAction(t, f.handler.ExtendDeployApprovalRequest, f.alice, req) + require.Equal(t, http.StatusForbidden, status) + require.Contains(t, msg, "you created this request") + + status, msg = callDeployApprovalAction(t, f.handler.ExtendDeployApprovalRequest, f.bob, req) + require.Equal(t, http.StatusOK, status, msg) +} diff --git a/internal/gateway/openapi/generated/swagger.json b/internal/gateway/openapi/generated/swagger.json index d4c0bbb9..f860ca33 100644 --- a/internal/gateway/openapi/generated/swagger.json +++ b/internal/gateway/openapi/generated/swagger.json @@ -2828,6 +2828,12 @@ "$ref": "#/definitions/handlers.DeployApprovalRequestResponse" } }, + "403": { + "description": "Forbidden", + "schema": { + "$ref": "#/definitions/handlers.ErrorResponse" + } + }, "404": { "description": "Not Found", "schema": { @@ -2937,6 +2943,12 @@ "$ref": "#/definitions/handlers.DeployApprovalRequestResponse" } }, + "403": { + "description": "Forbidden", + "schema": { + "$ref": "#/definitions/handlers.ErrorResponse" + } + }, "404": { "description": "Not Found", "schema": { @@ -4045,6 +4057,61 @@ } } }, + "/users/{email}/mfa/reset": { + "post": { + "security": [ + { + "SessionCookie": [] + }, + { + "CSRFToken": [] + } + ], + "description": "Removes a user's MFA methods, backup codes and trusted devices and signs them out, so they can enroll\na new method at their next sign-in. Their API tokens are kept. An admin can't reset their own MFA.", + "produces": [ + "application/json" + ], + "tags": [ + "admin" + ], + "summary": "Reset a user's MFA", + "parameters": [ + { + "type": "string", + "description": "User email", + "name": "email", + "in": "path", + "required": true + } + ], + "responses": { + "200": { + "description": "OK", + "schema": { + "$ref": "#/definitions/handlers.StatusResponse" + } + }, + "400": { + "description": "Bad Request", + "schema": { + "$ref": "#/definitions/handlers.ErrorResponse" + } + }, + "404": { + "description": "Not Found", + "schema": { + "$ref": "#/definitions/handlers.ErrorResponse" + } + }, + "500": { + "description": "Internal Server Error", + "schema": { + "$ref": "#/definitions/handlers.ErrorResponse" + } + } + } + } + }, "/users/{email}/name": { "put": { "security": [ diff --git a/internal/gateway/rbac/audit_names.go b/internal/gateway/rbac/audit_names.go index 1f79e3bb..b6dda94c 100644 --- a/internal/gateway/rbac/audit_names.go +++ b/internal/gateway/rbac/audit_names.go @@ -25,6 +25,7 @@ type revealRoute struct { var auditActions = map[string]string{ "POST /api/v1/users/:email/lock": "user.lock", "POST /api/v1/users/:email/unlock": "user.unlock", + "POST /api/v1/users/:email/mfa/reset": "user.mfa_reset", "POST /api/v1/users/:email/sessions/:sessionID/revoke": "user.sessions.revoke", "POST /api/v1/users/:email/sessions/revoke_all": "user.sessions.revoke_all", "POST /api/v1/deploy-approval-requests/:id/reject": "deploy_approval_request.reject", diff --git a/internal/gateway/rbac/gateway_routes.go b/internal/gateway/rbac/gateway_routes.go index 54103f23..d435d3f5 100644 --- a/internal/gateway/rbac/gateway_routes.go +++ b/internal/gateway/rbac/gateway_routes.go @@ -161,6 +161,7 @@ var httpRouteSpecs = []RouteSpec{ newHTTPRoute("PUT", "/api/v1/users/:email/name", Gateway(ResourceUser, ActionUpdateName)), newHTTPRoute("POST", "/api/v1/users/:email/lock", Gateway(ResourceUser, ActionUpdate)), newHTTPRoute("POST", "/api/v1/users/:email/unlock", Gateway(ResourceUser, ActionUpdate)), + newHTTPRoute("POST", "/api/v1/users/:email/mfa/reset", Gateway(ResourceUser, ActionUpdate)), // Every user can see their own profile, sessions and audit trail, and sign out their own sessions. // Other users' records need the listed permission. Revoking keeps user:update's MFA level. newOwnUserRoute("GET", "/api/v1/users/:email", Gateway(ResourceUser, ActionRead)), diff --git a/internal/gateway/routes/route_registration.go b/internal/gateway/routes/route_registration.go index c8149f2b..12e04383 100644 --- a/internal/gateway/routes/route_registration.go +++ b/internal/gateway/routes/route_registration.go @@ -167,6 +167,7 @@ func registerUserManagementRoutes(authenticated *gin.RouterGroup, cfg *Config, h users.GET("/:email/audit-logs", h.admin.ListUserAuditLogs) users.POST("/:email/lock", h.admin.LockUser) users.POST("/:email/unlock", h.admin.UnlockUser) + users.POST("/:email/mfa/reset", h.admin.ResetUserMFA) auditLogs := authenticated.Group("/audit-logs") if cfg.SessionManager != nil { diff --git a/internal/gateway/settings/defaults.go b/internal/gateway/settings/defaults.go index 5ab51ba5..61097796 100644 --- a/internal/gateway/settings/defaults.go +++ b/internal/gateway/settings/defaults.go @@ -15,6 +15,7 @@ const ( GlobalSettingAllowDestructiveActions GlobalSettingKey = iota GlobalSettingDefaultCIProvider GlobalSettingDefaultVCSProvider + GlobalSettingDeployApprovalRequireDifferentApprover GlobalSettingDeployApprovalsEnabled GlobalSettingDeployApprovalWindowMinutes GlobalSettingMFARequireAllUsers @@ -26,20 +27,22 @@ const ( // Global setting key strings. GlobalSettingStepUpWindowMinutes and AppSettingSecretEnvVars have no Key constant: // gosec reads those names as hardcoded credentials. Use their String(). const ( - KeyAllowDestructiveActions = "allow_destructive_actions" - KeyDefaultCIProvider = "default_ci_provider" - KeyDefaultVCSProvider = "default_vcs_provider" - KeyDeployApprovalsEnabled = "deploy_approvals_enabled" - KeyDeployApprovalWindowMinutes = "deploy_approval_window_minutes" - KeyMFARequireAllUsers = "mfa_require_all_users" - KeySessionTimeoutMinutes = "session_timeout_minutes" - KeyTrustedDeviceTTLDays = "mfa_trusted_device_ttl_days" + KeyAllowDestructiveActions = "allow_destructive_actions" + KeyDefaultCIProvider = "default_ci_provider" + KeyDefaultVCSProvider = "default_vcs_provider" + KeyDeployApprovalRequireDifferentApprover = "deploy_approval_require_different_approver" + KeyDeployApprovalsEnabled = "deploy_approvals_enabled" + KeyDeployApprovalWindowMinutes = "deploy_approval_window_minutes" + KeyMFARequireAllUsers = "mfa_require_all_users" + KeySessionTimeoutMinutes = "session_timeout_minutes" + KeyTrustedDeviceTTLDays = "mfa_trusted_device_ttl_days" ) var globalSettingKeyToString = [...]string{ KeyAllowDestructiveActions, KeyDefaultCIProvider, KeyDefaultVCSProvider, + KeyDeployApprovalRequireDifferentApprover, KeyDeployApprovalsEnabled, KeyDeployApprovalWindowMinutes, KeyMFARequireAllUsers, @@ -176,6 +179,7 @@ var DefaultGlobalSettings = map[string]interface{}{ KeyAllowDestructiveActions: false, KeyDefaultCIProvider: "circleci", KeyDefaultVCSProvider: "github", + KeyDeployApprovalRequireDifferentApprover: false, KeyDeployApprovalsEnabled: true, KeyDeployApprovalWindowMinutes: DefaultDeployApprovalWindowMinutes, KeyMFARequireAllUsers: true, diff --git a/internal/gateway/settings/groups.go b/internal/gateway/settings/groups.go index 7ecde289..4e63ed16 100644 --- a/internal/gateway/settings/groups.go +++ b/internal/gateway/settings/groups.go @@ -30,6 +30,7 @@ var globalSettingGroupKeys = map[GlobalSettingGroup][]GlobalSettingKey{ GlobalSettingGroupDeployApprovals: { GlobalSettingDeployApprovalsEnabled, GlobalSettingDeployApprovalWindowMinutes, + GlobalSettingDeployApprovalRequireDifferentApprover, }, GlobalSettingGroupSessionConfiguration: { GlobalSettingSessionTimeoutMinutes, diff --git a/internal/gateway/settings/service_deploy.go b/internal/gateway/settings/service_deploy.go index f6ae180f..cc873106 100644 --- a/internal/gateway/settings/service_deploy.go +++ b/internal/gateway/settings/service_deploy.go @@ -1,31 +1,32 @@ package settings -// GetAllowDestructiveActions returns whether destructive actions are allowed. -func (s *Service) GetAllowDestructiveActions() (bool, error) { - setting, err := s.GetGlobalSetting(KeyAllowDestructiveActions, false) +// globalBool returns a boolean global setting, or defaultValue when it isn't a boolean. On error it returns +// defaultValue with the error, so the caller decides whether to fail closed. +func (s *Service) globalBool(key string, defaultValue bool) (bool, error) { + setting, err := s.GetGlobalSetting(key, defaultValue) if err != nil { - return false, err + return defaultValue, err } - if val, ok := setting.Value.(bool); ok { return val, nil } + return defaultValue, nil +} - return false, nil +// GetAllowDestructiveActions returns whether destructive actions are allowed. +func (s *Service) GetAllowDestructiveActions() (bool, error) { + return s.globalBool(KeyAllowDestructiveActions, false) } // GetDeployApprovalsEnabled returns whether deploy approvals are enabled. func (s *Service) GetDeployApprovalsEnabled() (bool, error) { - setting, err := s.GetGlobalSetting(KeyDeployApprovalsEnabled, true) - if err != nil { - return true, err - } - - if val, ok := setting.Value.(bool); ok { - return val, nil - } + return s.globalBool(KeyDeployApprovalsEnabled, true) +} - return true, nil +// GetDeployApprovalRequireDifferentApprover returns whether a deploy approval must be approved (and extended) by +// someone other than the user who requested it or owns its API token. +func (s *Service) GetDeployApprovalRequireDifferentApprover() (bool, error) { + return s.globalBool(KeyDeployApprovalRequireDifferentApprover, false) } // GetDeployApprovalWindowMinutes returns the deploy approval window in minutes. diff --git a/web/src/api/generated.ts b/web/src/api/generated.ts index 9f0c9aa5..4ff9189b 100644 --- a/web/src/api/generated.ts +++ b/web/src/api/generated.ts @@ -1432,6 +1432,23 @@ export const getRackGatewayAPI = () => { ); }; + /** + * Removes a user's MFA methods, backup codes and trusted devices and signs them out, so they can enroll + * a new method at their next sign-in. Their API tokens are kept. An admin can't reset their own MFA. + * @summary Reset a user's MFA + */ + const postUsersEmailMfaReset = ( + email: string, + options?: SecondParameter< + typeof createGatewayClient