Refactor data structures in spar related to user-identifying information

cassandra-schema.cql

@@ -663,7 +663,18 @@ CREATE TABLE brig_test.user (
     provider uuid,
     searchable boolean,
     service uuid,
-    sso_id text,
+    --
+    -- NOTE(fisx): i'm breaking this on purpose to make it more obvious where i'm going with the schema migration.
+    -- we'll regenerate this file once we're done.
+    --
+    sso_id text, -- deprecated, but honored for compatibility if it is non-null and the following 3 fields are all null.
+    saml_entity_id text, -- issuer from UserRef, can be null
+    saml_name_id text, -- name id from UserRef, can be null
+    scim_external_id text, -- what you think it is, can be null
+    --
+    -- NOTE(fisx): cassandra does not prevent illegal cases like "entity_id null and name_id non-null".
+    -- i wouldn't know how, so that's the job of all parsers of incoming data, see `ValidUAuthIdF`
+    --
     status int,
     supported_protocols int,
     team uuid
@@ -2204,4 +2215,3 @@ CREATE TABLE spar_test.user (
     AND min_index_interval = 128
     AND read_repair_chance = 0.0
     AND speculative_retry = '99PERCENTILE';
-

libs/brig-types/src/Brig/Types/User/Event.hs

@@ -81,7 +81,7 @@ data UserUpdatedData = UserUpdatedData
     eupHandle :: !(Maybe Handle),
     eupLocale :: !(Maybe Locale),
     eupManagedBy :: !(Maybe ManagedBy),
-    eupSSOId :: !(Maybe UserSSOId),
+    eupSSOId :: !(Maybe LegacyUserSSOId), -- FUTUREWORK: add fields `eupUAuthId`?  (this can replace both SSOId and SSOIdRemoved, but beware of backward compatibility issues when removing those!)
     eupSSOIdRemoved :: Bool,
     eupSupportedProtocols :: !(Maybe (Set BaseProtocolTag))
   }

libs/wire-api/src/Wire/API/Deprecated.hs

@@ -30,6 +30,8 @@ import Servant.Client
 import Servant.OpenApi
 
 -- Annotate that the route is deprecated
+--
+-- FUTUREWORK: give this a message string that explains how to migrate away from the deprecated end-point!
 data Deprecated deriving (Typeable)
 
 -- All of these instances are very similar to the instances

libs/wire-api/src/Wire/API/Routes/Internal/Brig.hs

@@ -53,6 +53,7 @@ import Servant hiding (Handler, WithStatus, addHeader, respond)
 import Servant.OpenApi (HasOpenApi (toOpenApi))
 import Servant.OpenApi.Internal.Orphans ()
 import Wire.API.Connection
+import Wire.API.Deprecated
 import Wire.API.Error
 import Wire.API.Error.Brig
 import Wire.API.MLS.CipherSuite
@@ -338,10 +339,11 @@ type AccountAPI =
            )
     :<|> Named
            "iPutUserSsoId"
-           ( "users"
+           ( Deprecated -- use `iPutUAuthId` instead
+               :> "users"
                :> Capture "uid" UserId
                :> "sso-id"
-               :> ReqBody '[Servant.JSON] UserSSOId
+               :> ReqBody '[Servant.JSON] LegacyUserSSOId
                :> MultiVerb
                     'PUT
                     '[Servant.JSON]
@@ -352,7 +354,8 @@ type AccountAPI =
            )
     :<|> Named
            "iDeleteUserSsoId"
-           ( "users"
+           ( Deprecated -- use `iDeleteUAuthId` instead
+               :> "users"
                :> Capture "uid" UserId
                :> "sso-id"
                :> MultiVerb
@@ -363,6 +366,33 @@ type AccountAPI =
                      ]
                     UpdateSSOIdResponse
            )
+    :<|> Named
+           "iPutUAuthId"
+           ( "users"
+               :> Capture "uid" UserId
+               :> "uauthid"
+               :> ReqBody '[Servant.JSON] PartialUAuthId
+               :> MultiVerb
+                    'PUT
+                    '[Servant.JSON]
+                    '[ RespondEmpty 200 "UpdateSSOIdSuccess",
+                       RespondEmpty 404 "UpdateSSOIdNotFound"
+                     ]
+                    UpdateSSOIdResponse
+           )
+    :<|> Named
+           "iDeleteUAuthId"
+           ( "users"
+               :> Capture "uid" UserId
+               :> "uauthid"
+               :> MultiVerb
+                    'DELETE
+                    '[Servant.JSON]
+                    '[ RespondEmpty 200 "UpdateSSOIdSuccess",
+                       RespondEmpty 404 "UpdateSSOIdNotFound"
+                     ]
+                    UpdateSSOIdResponse
+           )
     :<|> Named
            "iPutManagedBy"
            ( "users"

libs/wire-api/src/Wire/API/User.hs

@@ -739,31 +739,33 @@ userEmail = emailIdentity <=< userIdentity
 userPhone :: User -> Maybe Phone
 userPhone = phoneIdentity <=< userIdentity
 
-userSSOId :: User -> Maybe UserSSOId
+userSSOId :: User -> Maybe PartialUAuthId
 userSSOId = ssoIdentity <=< userIdentity
 
 userSCIMExternalId :: User -> Maybe Text
 userSCIMExternalId usr = scimExternalId (userManagedBy usr) =<< userSSOId usr
 
 -- FUTUREWORK: this is only ignoring case in the email format, and emails should be
 -- handled case-insensitively.  https://wearezeta.atlassian.net/browse/SQSERVICES-909
-scimExternalId :: ManagedBy -> UserSSOId -> Maybe Text
-scimExternalId _ (UserScimExternalId extId) = Just extId
-scimExternalId ManagedByScim (UserSSOId (SAML.UserRef _ nameIdXML)) = Just . CI.original . SAML.unsafeShowNameID $ nameIdXML
-scimExternalId ManagedByWire (UserSSOId _) = Nothing
-
-ssoIssuerAndNameId :: UserSSOId -> Maybe (Text, Text)
-ssoIssuerAndNameId (UserSSOId (SAML.UserRef (SAML.Issuer uri) nameIdXML)) = Just (fromUri uri, fromNameId nameIdXML)
+scimExternalId :: ManagedBy -> PartialUAuthId -> Maybe Text
+scimExternalId _ (UAuthId _ (Just extId) _ _) = Just extId
+scimExternalId ManagedByScim (UAuthId (Just (SAML.UserRef _ nameIdXML)) _ _ _) = Just . CI.original . SAML.unsafeShowNameID $ nameIdXML
+scimExternalId ManagedByWire (UAuthId {}) = Nothing
+-- TODO: Check that this makes sense.
+scimExternalId _ _ = Nothing
+
+ssoIssuerAndNameId :: PartialUAuthId -> Maybe (Text, Text)
+ssoIssuerAndNameId (UAuthId (Just (SAML.UserRef (SAML.Issuer uri) nameIdXML)) _ _ _) = Just (fromUri uri, fromNameId nameIdXML)
   where
     fromUri = cs . toLazyByteString . serializeURIRef
     fromNameId = CI.original . SAML.unsafeShowNameID
-ssoIssuerAndNameId (UserScimExternalId _) = Nothing
+ssoIssuerAndNameId (UAuthId {}) = Nothing
 
 userIssuer :: User -> Maybe SAML.Issuer
 userIssuer user = userSSOId user >>= fromSSOId
   where
-    fromSSOId :: UserSSOId -> Maybe SAML.Issuer
-    fromSSOId (UserSSOId (SAML.UserRef issuer _)) = Just issuer
+    fromSSOId :: PartialUAuthId -> Maybe SAML.Issuer
+    fromSSOId (UAuthId (Just (SAML.UserRef issuer _)) _ _ _) = Just issuer
     fromSSOId _ = Nothing
 
 connectedProfile :: User -> UserLegalHoldStatus -> UserProfile
@@ -1006,7 +1008,7 @@ errFromEither (Right e) = CreateUserSparRegistrationError e
 
 data NewUserSpar = NewUserSpar
   { newUserSparUUID :: UUID,
-    newUserSparSSOId :: UserSSOId,
+    newUserSparSSOId :: PartialUAuthId,
     newUserSparDisplayName :: Name,
     newUserSparTeamId :: TeamId,
     newUserSparManagedBy :: ManagedBy,
@@ -1046,7 +1048,7 @@ newUserFromSpar new =
   NewUser
     { newUserDisplayName = newUserSparDisplayName new,
       newUserUUID = Just $ newUserSparUUID new,
-      newUserIdentity = Just $ SSOIdentity (newUserSparSSOId new) Nothing Nothing,
+      newUserIdentity = Just $ UAuthIdentity $ newUserSparSSOId new,
       newUserPict = Nothing,
       newUserAssets = [],
       newUserAccentId = Nothing,
@@ -1112,9 +1114,15 @@ data NewUserRaw = NewUserRaw
     newUserRawUUID :: Maybe UUID,
     newUserRawEmail :: Maybe Email,
     newUserRawPhone :: Maybe Phone,
-    newUserRawSSOId :: Maybe UserSSOId,
-    -- | DEPRECATED
-    newUserRawPict :: Maybe Pict,
+    newUserRawSSOId ::
+      -- DEPRECATED (use newUserRawUAuthId instead)
+      Maybe LegacyUserSSOId,
+    newUserRawUAuthId ::
+      -- NOTE(fisx): This defines a json object under a json field, just like newUserRawSSOId.  no inlining!
+      Maybe PartialUAuthId,
+    newUserRawPict ::
+      -- DEPRECATED
+      Maybe Pict,
     newUserRawAssets :: [Asset],
     newUserRawAccentId :: Maybe ColourId,
     newUserRawEmailCode :: Maybe ActivationCode,
@@ -1144,6 +1152,8 @@ newUserRawObjectSchema =
       .= maybe_ (optField "phone" schema)
     <*> newUserRawSSOId
       .= maybe_ (optField "sso_id" genericToSchema)
+    <*> newUserRawUAuthId
+      .= maybe_ (optField "uauthid" genericToSchema)
     <*> newUserRawPict
       .= maybe_ (optField "picture" schema)
     <*> newUserRawAssets
@@ -1187,7 +1197,8 @@ newUserToRaw NewUser {..} =
           newUserRawUUID = newUserUUID,
           newUserRawEmail = emailIdentity =<< newUserIdentity,
           newUserRawPhone = phoneIdentity =<< newUserIdentity,
-          newUserRawSSOId = ssoIdentity =<< newUserIdentity,
+          newUserRawSSOId = _,
+          newUserRawUAuthId = ssoIdentity =<< newUserIdentity,
           newUserRawPict = newUserPict,
           newUserRawAssets = newUserAssets,
           newUserRawAccentId = newUserAccentId,
@@ -1213,7 +1224,13 @@ newUserFromRaw NewUserRaw {..} = do
         (isJust newUserRawPassword)
         (isJust newUserRawSSOId)
         (newUserRawInvitationCode, newUserRawTeamCode, newUserRawTeam, newUserRawTeamId)
-  let identity = maybeUserIdentityFromComponents (newUserRawEmail, newUserRawPhone, newUserRawSSOId)
+  let identity =
+        maybeUserIdentityFromComponents
+          ( newUserRawEmail,
+            newUserRawPhone,
+            newUserRawSSOId,
+            newUserRawUAuthId
+          )
   expiresIn <-
     case (newUserRawExpiresIn, identity) of
       (Just _, Just _) -> fail "Only users without an identity can expire"
@@ -1260,7 +1277,7 @@ instance Arbitrary NewUser where
       genUserOrigin newUserIdentity = do
         teamid <- arbitrary
         let hasSSOId = case newUserIdentity of
-              Just SSOIdentity {} -> True
+              Just UAuthIdentity {} -> True
               _ -> False
             ssoOrigin = Just (NewUserOriginTeamUser (NewTeamMemberSSO teamid))
             isSsoOrigin (Just (NewUserOriginTeamUser (NewTeamMemberSSO _))) = True
@@ -1270,7 +1287,7 @@ instance Arbitrary NewUser where
           else arbitrary `QC.suchThat` (not . isSsoOrigin)
       genUserPassword newUserIdentity newUserOrigin = do
         let hasSSOId = case newUserIdentity of
-              Just SSOIdentity {} -> True
+              Just UAuthIdentity {} -> True
               _ -> False
             isTeamUser = case newUserOrigin of
               Just (NewUserOriginTeamUser _) -> True
@@ -1295,7 +1312,7 @@ newUserEmail = emailIdentity <=< newUserIdentity
 newUserPhone :: NewUser -> Maybe Phone
 newUserPhone = phoneIdentity <=< newUserIdentity
 
-newUserSSOId :: NewUser -> Maybe UserSSOId
+newUserSSOId :: NewUser -> Maybe PartialUAuthId
 newUserSSOId = ssoIdentity <=< newUserIdentity
 
 --------------------------------------------------------------------------------