implement simpler RBAC solution

instead of running the OIDC claims against a generic expression
evaluator (like Grafana does), we simple calculate the user
roles based on the group membership.

this is similar to how ArgoCD, ElasticSearch, and other perform
their permission mapping.

Author: UiP9AV6Y

api/oidc.go

@@ -19,7 +19,6 @@ import (
 	"github.com/gotify/server/v3/database"
 	"github.com/gotify/server/v3/decaymap"
 	"github.com/gotify/server/v3/model"
-	jmespath "github.com/jmespath-community/go-jmespath/pkg/api"
 	"github.com/rs/zerolog"
 	"github.com/rs/zerolog/log"
 	"github.com/zitadel/oidc/v3/pkg/client/rp"
@@ -58,20 +57,22 @@ func NewOIDC(conf *config.Configuration, db *database.GormDatabase, userChangeNo
 		log.Fatal().Err(err).Msg("failed to initialize OIDC provider")
 	}
 
-	var roleExpression jmespath.JMESPath
-	if conf.OIDC.RoleExpression != "" {
-		roleExpression, err = jmespath.Compile(conf.OIDC.RoleExpression)
-		if err != nil {
-			log.Fatal().Err(err).Msg("unable to compile role claim JMESPath expression")
-		}
+	var rbacResolver RBACResolver
+	// no need to perform any mapping if the input is empty
+	if conf.OIDC.GroupsClaim != "" {
+		rbacResolver = NewSimpleRBACResolver(
+			conf.OIDC.GroupsUser,
+			conf.OIDC.GroupsAdmin,
+		)
 	}
 
 	return &OIDCAPI{
 		DB:                 db,
 		Provider:           provider,
 		UserChangeNotifier: userChangeNotifier,
 		UsernameClaim:      conf.OIDC.UsernameClaim,
-		RoleExpression:     roleExpression,
+		GroupsClaim:        conf.OIDC.GroupsClaim,
+		RBACResolver:       rbacResolver,
 		PasswordStrength:   conf.PassStrength,
 		SecureCookie:       conf.Server.SecureCookie,
 		AutoRegister:       conf.OIDC.AutoRegister,
@@ -101,7 +102,8 @@ type OIDCAPI struct {
 	Provider           rp.RelyingParty
 	UserChangeNotifier *UserChangeNotifier
 	UsernameClaim      string
-	RoleExpression     jmespath.JMESPath
+	GroupsClaim        string
+	RBACResolver       RBACResolver
 	PasswordStrength   int
 	SecureCookie       bool
 	AutoRegister       bool
@@ -554,19 +556,14 @@ func (a *OIDCAPI) popPendingSession(key string) (*pendingOIDCSession, bool) {
 }
 
 func (a *OIDCAPI) parseUserRole(fallback model.Role, claims map[string]any) (model.Role, error) {
-	if a.RoleExpression == nil {
+	if a.RBACResolver == nil || a.GroupsClaim == "" {
 		return fallback, nil
 	}
 
-	roleData, err := a.RoleExpression.Search(claims)
-	if err != nil {
-		return fallback, err
-	}
-
-	roleStr, ok := roleData.(string)
+	groupsRaw, ok := claims[a.GroupsClaim]
 	if !ok {
-		return fallback, fmt.Errorf("role claim expression expected string, got %T", roleData)
+		return fallback, fmt.Errorf("groups claim %q is missing", a.GroupsClaim)
 	}
 
-	return model.ParseRole(roleStr)
+	return a.RBACResolver.ResolveRole(groupsRaw)
 }

api/oidc_test.go

@@ -16,7 +16,6 @@ import (
 	"github.com/gotify/server/v3/mode"
 	"github.com/gotify/server/v3/model"
 	"github.com/gotify/server/v3/test/testdb"
-	jmespath "github.com/jmespath-community/go-jmespath/pkg/api"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/suite"
 	"github.com/zitadel/oidc/v3/pkg/client/rp"
@@ -322,7 +321,9 @@ func (s *OIDCSuite) Test_ResolveUser_CustomClaim() {
 	assert.NotNil(s.T(), user.OIDCID)
 }
 
-func (s *OIDCSuite) Test_ResolveUser_NoRoleExpression() {
+func (s *OIDCSuite) Test_ResolveUser_NoRBACResolver() {
+	s.a.GroupsClaim = "roles"
+
 	info := &oidc.UserInfo{Subject: "sub-1", Claims: map[string]any{"preferred_username": "test-user", "roles": []string{"tester"}}}
 	user, status, err := s.a.resolveUser(testIssuer, info)
 
@@ -333,10 +334,23 @@ func (s *OIDCSuite) Test_ResolveUser_NoRoleExpression() {
 	assert.NotNil(s.T(), user.OIDCID)
 }
 
-func (s *OIDCSuite) Test_ResolveUser_AdminRoleExpression() {
-	role, err := jmespath.Compile("contains(roles[*], 'admin') && 'Admin' || 'User'")
+func (s *OIDCSuite) Test_ResolveUser_NoRBACClaim() {
+	// canary to proof that this resolver is never actually used
+	s.a.RBACResolver = NewStaticRBACResolver(model.RoleAdmin)
+
+	info := &oidc.UserInfo{Subject: "sub-1", Claims: map[string]any{"preferred_username": "test-user", "roles": []string{"tester"}}}
+	user, status, err := s.a.resolveUser(testIssuer, info)
+
 	assert.NoError(s.T(), err)
-	s.a.RoleExpression = role
+	assert.Equal(s.T(), 0, status)
+	assert.Equal(s.T(), "test-user", user.Name)
+	assert.Equal(s.T(), false, user.Admin)
+	assert.NotNil(s.T(), user.OIDCID)
+}
+
+func (s *OIDCSuite) Test_ResolveUser_AdminRBACResolver() {
+	s.a.GroupsClaim = "roles"
+	s.a.RBACResolver = NewSimpleAdminRBACResolver("admin")
 
 	info := &oidc.UserInfo{Subject: "sub-1", Claims: map[string]any{"preferred_username": "admin-user", "roles": []string{"admin"}}}
 	user, status, err := s.a.resolveUser(testIssuer, info)
@@ -348,10 +362,9 @@ func (s *OIDCSuite) Test_ResolveUser_AdminRoleExpression() {
 	assert.NotNil(s.T(), user.OIDCID)
 }
 
-func (s *OIDCSuite) Test_ResolveUser_UserRoleExpression() {
-	role, err := jmespath.Compile("contains(roles[*], 'admin') && 'Admin' || 'User'")
-	assert.NoError(s.T(), err)
-	s.a.RoleExpression = role
+func (s *OIDCSuite) Test_ResolveUser_UserRBACResolver() {
+	s.a.GroupsClaim = "roles"
+	s.a.RBACResolver = NewSimpleAdminRBACResolver("admin")
 
 	info := &oidc.UserInfo{Subject: "sub-1", Claims: map[string]any{"preferred_username": "test-user", "roles": []string{"tester"}}}
 	user, status, err := s.a.resolveUser(testIssuer, info)
@@ -363,10 +376,9 @@ func (s *OIDCSuite) Test_ResolveUser_UserRoleExpression() {
 	assert.NotNil(s.T(), user.OIDCID)
 }
 
-func (s *OIDCSuite) Test_ResolveUser_ForbiddenRoleExpression() {
-	role, err := jmespath.Compile("contains(roles[*], 'gotify') && 'User' || 'None'")
-	assert.NoError(s.T(), err)
-	s.a.RoleExpression = role
+func (s *OIDCSuite) Test_ResolveUser_ForbiddenRBACResolver() {
+	s.a.GroupsClaim = "roles"
+	s.a.RBACResolver = NewSimpleUserRBACResolver("users")
 
 	info := &oidc.UserInfo{Subject: "sub-1", Claims: map[string]any{"preferred_username": "test-user", "roles": []string{"tester"}}}
 	_, status, err := s.a.resolveUser(testIssuer, info)
@@ -375,34 +387,31 @@ func (s *OIDCSuite) Test_ResolveUser_ForbiddenRoleExpression() {
 	assert.Equal(s.T(), 403, status)
 }
 
-func (s *OIDCSuite) Test_ResolveUser_InvalidRoleExpression() {
-	role, err := jmespath.Compile("contains(roles[*], 'gotify') && 'User' || 'FooBar'")
-	assert.NoError(s.T(), err)
-	s.a.RoleExpression = role
+func (s *OIDCSuite) Test_ResolveUser_GroupsClaimMissing() {
+	s.a.GroupsClaim = "roles"
+	s.a.RBACResolver = NewSimpleUserRBACResolver("users")
 
-	info := &oidc.UserInfo{Subject: "sub-1", Claims: map[string]any{"preferred_username": "test-user", "roles": []string{"tester"}}}
+	info := &oidc.UserInfo{Subject: "sub-1", Claims: map[string]any{"preferred_username": "test-user"}}
 	_, status, err := s.a.resolveUser(testIssuer, info)
 
-	assert.EqualError(s.T(), err, `role claim mapping error: invalid role "FooBar"`)
+	assert.EqualError(s.T(), err, `role claim mapping error: groups claim "roles" is missing`)
 	assert.Equal(s.T(), 500, status)
 }
 
-func (s *OIDCSuite) Test_ResolveUser_MalformedRoleExpression() {
-	role, err := jmespath.Compile("contains(roles[*], 'gotify')")
-	assert.NoError(s.T(), err)
-	s.a.RoleExpression = role
+func (s *OIDCSuite) Test_ResolveUser_MalformedRBACResolver() {
+	s.a.GroupsClaim = "admin"
+	s.a.RBACResolver = NewSimpleUserRBACResolver("users")
 
-	info := &oidc.UserInfo{Subject: "sub-1", Claims: map[string]any{"preferred_username": "test-user", "roles": []string{"tester"}}}
+	info := &oidc.UserInfo{Subject: "sub-1", Claims: map[string]any{"preferred_username": "test-user", "admin": true}}
 	_, status, err := s.a.resolveUser(testIssuer, info)
 
-	assert.EqualError(s.T(), err, `role claim mapping error: role claim expression expected string, got bool`)
+	assert.EqualError(s.T(), err, `role claim mapping error: RBAC resolver expected strings, got bool`)
 	assert.Equal(s.T(), 500, status)
 }
 
-func (s *OIDCSuite) Test_ResolveUser_PromoteRoleExpression() {
-	role, err := jmespath.Compile("contains(roles[*], 'admin') && 'Admin' || 'User'")
-	assert.NoError(s.T(), err)
-	s.a.RoleExpression = role
+func (s *OIDCSuite) Test_ResolveUser_PromoteRBACResolver() {
+	s.a.GroupsClaim = "roles"
+	s.a.RBACResolver = NewSimpleAdminRBACResolver("admin")
 
 	oidcID := testIssuer + "#sub-1"
 	s.db.CreateUser(&model.User{ID: 1, Name: "alice", OIDCID: &oidcID})
@@ -419,10 +428,9 @@ func (s *OIDCSuite) Test_ResolveUser_PromoteRoleExpression() {
 	assert.False(s.T(), s.notified)
 }
 
-func (s *OIDCSuite) Test_ResolveUser_DemoteRoleExpression() {
-	role, err := jmespath.Compile("contains(roles[*], 'admin') && 'Admin' || 'User'")
-	assert.NoError(s.T(), err)
-	s.a.RoleExpression = role
+func (s *OIDCSuite) Test_ResolveUser_DemoteRBACResolver() {
+	s.a.GroupsClaim = "roles"
+	s.a.RBACResolver = NewSimpleAdminRBACResolver("admin")
 
 	oidcID := testIssuer + "#sub-1"
 	s.db.CreateUser(&model.User{ID: 1, Name: "alice", Admin: true, OIDCID: &oidcID})

api/rbac.go

@@ -0,0 +1,104 @@
+package api
+
+import (
+	"fmt"
+	"slices"
+
+	"github.com/gotify/server/v3/model"
+)
+
+// RBACResolver allows for arbitrary input to be mapped to roles for
+// use in a permission system.
+type RBACResolver interface {
+	// ResolveRole determines the role associated with the given subject.
+	// Input type support differs between resolver implementations.
+	ResolveRole(subject any) (model.Role, error)
+}
+
+// StaticRBACResolver is a [RBACResolver] implementation which
+// always returns the same value for resolver requests.
+type StaticRBACResolver model.Role
+
+// NewStaticRBACResolver returns a RBAC resolver which
+// unconditionally resolves all requests to the provided
+// role.
+func NewStaticRBACResolver(r model.Role) StaticRBACResolver {
+	return StaticRBACResolver(r)
+}
+
+// ResolveRole returns the role defined during construction.
+func (r StaticRBACResolver) ResolveRole(_ any) (model.Role, error) {
+	return model.Role(r), nil
+}
+
+// SimpleRBACResolver is a [RBACResolver] implementation which
+// determines roles based on user and admin rules.
+type SimpleRBACResolver struct {
+	userRoles  []string
+	adminRoles []string
+}
+
+// NewSimpleRBACResolver creates a new [SimpleRBACResolver] instance using
+// the provided role comparisons.
+func NewSimpleRBACResolver(userRoles, adminRoles []string) *SimpleRBACResolver {
+	r := &SimpleRBACResolver{
+		userRoles:  userRoles,
+		adminRoles: adminRoles,
+	}
+
+	return r
+}
+
+// NewSimpleAdminRBACResolver calls NewSimpleRBACResolver(nil, adminRoles)
+func NewSimpleAdminRBACResolver(adminRoles ...string) *SimpleRBACResolver {
+	return NewSimpleRBACResolver(nil, adminRoles)
+}
+
+// NewSimpleUserRBACResolver calls NewSimpleRBACResolver(userRoles, nil)
+func NewSimpleUserRBACResolver(userRoles ...string) *SimpleRBACResolver {
+	return NewSimpleRBACResolver(userRoles, nil)
+}
+
+// ResolveRole expects either a string or []string as input, otherwise
+// an error is returned.
+// Requests are first compared against the admin roles to determine
+// eligibility to [RoleAdmin]. An empty user role list or a match
+// with the list will yield [RoleUser], otherwise [RoleNone] is returned.
+func (r *SimpleRBACResolver) ResolveRole(subject any) (model.Role, error) {
+	if subject == nil {
+		return r.resolveSlice(nil), nil
+	}
+
+	switch roles := subject.(type) {
+	case string:
+		return r.resolveSlice([]string{roles}), nil
+	case []string:
+		return r.resolveSlice(roles), nil
+	default:
+		return model.RoleNone, fmt.Errorf("RBAC resolver expected strings, got %T", subject)
+	}
+}
+
+func (r *SimpleRBACResolver) resolveSlice(roles []string) model.Role {
+	if slicesIntersect(r.adminRoles, roles) {
+		return model.RoleAdmin
+	} else if len(r.userRoles) == 0 || slicesIntersect(r.userRoles, roles) {
+		return model.RoleUser
+	}
+
+	return model.RoleNone
+}
+
+func slicesIntersect(haystack, needle []string) bool {
+	if len(needle) == 0 || len(haystack) == 0 {
+		return false
+	}
+
+	for _, n := range needle {
+		if slices.Contains(haystack, n) {
+			return true
+		}
+	}
+
+	return false
+}