SAAS-175 Auth API

.devcontainer/setup.py

@@ -81,7 +81,9 @@ def install_tools():
             go mod init tools && \
             env GOPROXY=https://proxy.golang.org go get -v \
                 github.com/go-delve/delve/cmd/dlv@latest \
-                golang.org/x/tools/gopls@latest"
+                golang.org/x/tools/gopls@latest \
+                mvdan.cc/gofumpt@latest \
+                mvdan.cc/gofumpt/gofumports"
     ])
 
 

Gopkg.toml

@@ -18,6 +18,10 @@ required = [
   name = "github.com/percona/pmm"
   branch = "PMM-2.0"
 
+[[constraint]]
+  name = "github.com/percona-platform/saas"
+  branch = "main"
+
 # to prevent unexpected downgrades; see https://github.com/percona/exporter_shared/releases/tag/v0.6.0
 [[constraint]]
   name = "github.com/percona/exporter_shared"

main.go

@@ -68,6 +68,7 @@ import (
 	inventorygrpc "github.com/percona/pmm-managed/services/inventory/grpc"
 	"github.com/percona/pmm-managed/services/management"
 	managementgrpc "github.com/percona/pmm-managed/services/management/grpc"
+	"github.com/percona/pmm-managed/services/platform"
 	"github.com/percona/pmm-managed/services/prometheus"
 	"github.com/percona/pmm-managed/services/qan"
 	"github.com/percona/pmm-managed/services/server"
@@ -538,12 +539,15 @@ func main() {
 	checksService := checks.New(agentsRegistry, alertsRegistry, db)
 	prom.MustRegister(checksService)
 
+	platformService := platform.New(db)
+
 	serverParams := &server.Params{
 		DB:                      db,
 		Prometheus:              prometheus,
 		Alertmanager:            alertmanager,
 		Supervisord:             supervisord,
 		TelemetryService:        telemetry,
+		PlatformService:         platformService,
 		AwsInstanceChecker:      awsInstanceChecker,
 		GrafanaClient:           grafanaClient,
 		PrometheusAlertingRules: alertingRules,
@@ -607,6 +611,12 @@ func main() {
 		checksService.Run(ctx)
 	}()
 
+	wg.Add(1)
+	go func() {
+		defer wg.Done()
+		platformService.Run(ctx)
+	}()
+
 	wg.Add(1)
 	go func() {
 		defer wg.Done()

models/settings.go

@@ -51,6 +51,10 @@ type Settings struct {
 
 	// Saas config options
 	SaaS struct {
+		// Percona Platform user email
+		Email string `json:"email"`
+		// Percona Platform session Id
+		SessionID string `json:"session_id"`
 		// Security Threat Tool enabled
 		STTEnabled bool `json:"stt_enabled"`
 	} `json:"sass"`

models/settings_helpers.go

@@ -71,6 +71,13 @@ type ChangeSettingsParams struct {
 	EnableSTT bool
 	// Disable Security Threat Tool
 	DisableSTT bool
+
+	// Percona Platform user email
+	Email string
+	// Percona Platform session Id
+	SessionID string
+	// LogOut user from Percona Platform, i.e. remove user email and session id
+	LogOut bool
 }
 
 // UpdateSettings updates only non-zero, non-empty values.
@@ -128,6 +135,18 @@ func UpdateSettings(q reform.DBTX, params *ChangeSettingsParams) (*Settings, err
 	if params.EnableSTT {
 		settings.SaaS.STTEnabled = true
 	}
+	if params.LogOut {
+		settings.SaaS.SessionID = ""
+		settings.SaaS.Email = ""
+	}
+
+	if params.SessionID != "" {
+		settings.SaaS.SessionID = params.SessionID
+	}
+
+	if params.Email != "" {
+		settings.SaaS.Email = params.Email
+	}
 
 	err = SaveSettings(q, settings)
 	if err != nil {
@@ -139,10 +158,10 @@ func UpdateSettings(q reform.DBTX, params *ChangeSettingsParams) (*Settings, err
 // ValidateSettings validates settings changes.
 func ValidateSettings(params *ChangeSettingsParams) error {
 	if params.EnableTelemetry && params.DisableTelemetry {
-		return fmt.Errorf("Both enable_telemetry and disable_telemetry are present.")
+		return fmt.Errorf("Both enable_telemetry and disable_telemetry are present.") //nolint:golint,stylecheck
 	}
 	if params.EnableSTT && params.DisableSTT {
-		return fmt.Errorf("Both enable_stt and disable_stt are present.")
+		return fmt.Errorf("Both enable_stt and disable_stt are present.") //nolint:golint,stylecheck
 	}
 
 	checkCases := []struct {
@@ -190,22 +209,22 @@ func ValidateSettings(params *ChangeSettingsParams) error {
 
 	if params.AlertManagerURL != "" {
 		if params.RemoveAlertManagerURL {
-			return fmt.Errorf("Both alert_manager_url and remove_alert_manager_url are present.")
+			return fmt.Errorf("Both alert_manager_url and remove_alert_manager_url are present.") //nolint:golint,stylecheck
 		}
 
 		// custom validation for typical error that is not handled well by url.Parse
 		if !strings.Contains(params.AlertManagerURL, "//") {
-			return fmt.Errorf("Invalid alert_manager_url: %s - missing protocol scheme.", params.AlertManagerURL)
+			return fmt.Errorf("Invalid alert_manager_url: %s - missing protocol scheme.", params.AlertManagerURL) //nolint:golint,stylecheck
 		}
 		u, err := url.Parse(params.AlertManagerURL)
 		if err != nil {
-			return fmt.Errorf("Invalid alert_manager_url: %s.", err)
+			return fmt.Errorf("Invalid alert_manager_url: %s.", err) //nolint:golint,stylecheck
 		}
 		if u.Scheme == "" {
-			return fmt.Errorf("Invalid alert_manager_url: %s - missing protocol scheme.", params.AlertManagerURL)
+			return fmt.Errorf("Invalid alert_manager_url: %s - missing protocol scheme.", params.AlertManagerURL) //nolint:golint,stylecheck
 		}
 		if u.Host == "" {
-			return fmt.Errorf("Invalid alert_manager_url: %s - missing host.", params.AlertManagerURL)
+			return fmt.Errorf("Invalid alert_manager_url: %s - missing host.", params.AlertManagerURL) //nolint:golint,stylecheck
 		}
 	}
 
@@ -214,13 +233,17 @@ func ValidateSettings(params *ChangeSettingsParams) error {
 
 func validateSettingsConflicts(params *ChangeSettingsParams, settings *Settings) error {
 	if params.EnableSTT && !params.EnableTelemetry && settings.Telemetry.Disabled {
-		return fmt.Errorf("Cannot enable STT while telemetry is disabled.")
+		return fmt.Errorf("Cannot enable STT while telemetry is disabled.") //nolint:golint,stylecheck
 	}
 	if params.EnableSTT && params.DisableTelemetry {
-		return fmt.Errorf("Cannot enable STT while disabling telemetry.")
+		return fmt.Errorf("Cannot enable STT while disabling telemetry.") //nolint:golint,stylecheck
 	}
 	if params.DisableTelemetry && !params.DisableSTT && settings.SaaS.STTEnabled {
-		return fmt.Errorf("Cannot disable telemetry while STT is enabled.")
+		return fmt.Errorf("Cannot disable telemetry while STT is enabled.") //nolint:golint,stylecheck
+	}
+
+	if params.LogOut && (params.Email != "" || params.SessionID != "") {
+		return fmt.Errorf("Cannot loguot while updating Percona Platform user data.") //nolint:golint,stylecheck
 	}
 
 	return nil

models/settings_helpers_test.go

@@ -20,6 +20,7 @@ import (
 	"testing"
 	"time"
 
+	"github.com/brianvoe/gofakeit"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
@@ -240,5 +241,49 @@ func TestSettings(t *testing.T) {
 			require.NoError(t, err)
 			assert.Empty(t, ns.Telemetry.UUID)
 		})
+
+		t.Run("Percona Platform auth ", func(t *testing.T) {
+			email := gofakeit.Email()
+			sessionID := gofakeit.UUID()
+
+			// User logged in
+			ns, err := models.UpdateSettings(sqlDB, &models.ChangeSettingsParams{
+				Email:     email,
+				SessionID: sessionID,
+			})
+			require.NoError(t, err)
+			assert.Equal(t, email, ns.SaaS.Email)
+			assert.Equal(t, sessionID, ns.SaaS.SessionID)
+
+			// Logout with email update
+			_, err = models.UpdateSettings(sqlDB, &models.ChangeSettingsParams{
+				LogOut: true,
+				Email:  gofakeit.Email(),
+			})
+			assert.Error(t, err, "Cannot logout while updating Percona Platform user data.")
+
+			// Logout with session ID update
+			_, err = models.UpdateSettings(sqlDB, &models.ChangeSettingsParams{
+				LogOut:    true,
+				SessionID: gofakeit.UUID(),
+			})
+			assert.Error(t, err, "Cannot logout while updating Percona Platform user data.")
+
+			// Logout with email and session ID update
+			_, err = models.UpdateSettings(sqlDB, &models.ChangeSettingsParams{
+				LogOut:    true,
+				Email:     gofakeit.Email(),
+				SessionID: gofakeit.UUID(),
+			})
+			assert.Error(t, err, "Cannot logout while updating Percona Platform user data.")
+
+			// Normal logout
+			ns, err = models.UpdateSettings(sqlDB, &models.ChangeSettingsParams{
+				LogOut: true,
+			})
+			require.NoError(t, err)
+			assert.Empty(t, ns.SaaS.Email)
+			assert.Empty(t, ns.SaaS.SessionID)
+		})
 	})
 }

packages.dot

@@ -9,6 +9,7 @@ digraph packages {
 	"/" -> "/services/inventory/grpc";
 	"/" -> "/services/management";
 	"/" -> "/services/management/grpc";
+	"/" -> "/services/platform";
 	"/" -> "/services/prometheus";
 	"/" -> "/services/qan";
 	"/" -> "/services/server";

services/grafana/auth_server.go

@@ -52,6 +52,7 @@ var rules = map[string]role{
 	"/v1/AWSInstanceCheck":    none, // special case - used before Grafana can be accessed
 	"/v1/Updates/":            admin,
 	"/v1/Settings/":           admin,
+	"/v1/Platform/":           admin,
 
 	// must be available without authentication for health checking
 	"/v1/readyz": none,

services/grafana/auth_server_test.go

@@ -208,6 +208,8 @@ func TestAuthServerAuthenticate(t *testing.T) {
 		"/v1/Updates/Status":                               none,
 		"/v1/Settings/Get":                                 admin,
 		"/v1/AWSInstanceCheck":                             none,
+		"/v1/Platform/SignUp":                              admin,
+		"/v1/Platform/SingIn":                              admin,
 
 		"/v1/readyz": none,
 		"/ping":      none,