introduce functionality to assign/create team via group claim

specify error on teams model, add more declarative error

specify error message on ErrOIDCTeamDoesNotExist

@@ -1194,0 +1201,4 @@
+}
+
+func (err ErrTeamsDoNotExist) Error() string {
+	return fmt.Sprintf("Team does not exist [Team Name: %v]", err.Name)

@@ -1194,0 +1205,4 @@
+}
+
+// ErrCodeTeamDoesNotExist holds the unique world-error code of this error
+const ErrCodeTeamsDoNotExist = 6008

@@ -1194,0 +1209,4 @@
+
+// HTTPError holds the http error description
+func (err ErrTeamsDoNotExist) HTTPError() web.HTTPError {
+	return web.HTTPError{HTTPCode: http.StatusNotFound, Code: ErrCodeTeamDoesNotExist, Message: "No team with given name exists."}

@@ -1194,0 +1224,4 @@
+}
+
+func (err ErrOIDCTeamsDoNotExistForUser) Error() string {
+	return fmt.Sprintf("No Oidc exists for User [User ID: %d]", err.UserID)

@@ -110,2 +110,4 @@
 }
 
+func (tm *TeamMember) CheckMembership(s *xorm.Session) (exists bool, err error) {
+	member, err := user2.GetUserByUsername(s, tm.Username)

@@ -80,3 +83,3 @@
 
 // TableName makes beautiful table names
-func (*TeamMember) TableName() string {
+func (TeamMember) TableName() string {

@@ -91,6 +94,12 @@ type TeamUser struct {
 	TeamID int64 `json:"-"`
 }
 
+type TeamData struct {

@@ -123,0 +158,4 @@
+	if exists && err == nil {
+		return team, nil
+	}
+	return team, ErrTeamsDoNotExist{oidcID}

@@ -123,0 +166,4 @@
+		Table("team_members").
+		Where("user_id = ? ", userID).
+		Join("RIGHT", "teams", "teams.id = team_members.team_id").
+		Where("teams.oidc_id != ?", "").

@@ -123,0 +172,4 @@
+	if ts == nil || err != nil {
+		return ts, ErrOIDCTeamsDoNotExistForUser{userID}
+	}
+	return ts, nil

@@ -273,2 +328,2 @@
-	// Insert the current user as member and admin
-	tm := TeamMember{TeamID: t.ID, Username: doer.Username, Admin: true}
+	var admin = true
+	tm := TeamMember{TeamID: t.ID, Username: doer.Username, Admin: admin}

@@ -283,2 +338,4 @@
 }
 
+func (t *Team) ManageAdminRight(teamMember TeamMember, admin bool) {
+	// Insert the current user as member and admin

@@ -58,3 +60,3 @@
 	Oauth2Config    *oauth2.Config `json:"-"`
 }
-
+type TeamData struct {

@@ -66,0 +69,4 @@
+	Name              string      `json:"name"`
+	PreferredUsername string      `json:"preferred_username"`
+	Nickname          string      `json:"nickname"`
+	Teams             []string    `json:"groups"`

@@ -66,0 +70,4 @@
+	PreferredUsername string      `json:"preferred_username"`
+	Nickname          string      `json:"nickname"`
+	Teams             []string    `json:"groups"`
+	VikunjaGroups     interface{} `json:"vikunja_groups"`

@@ -189,22 +198,150 @@ func HandleCallback(c echo.Context) error {
 
 	// Check if we have seen this user before
 	u, err := getOrCreateUser(s, cl, idToken.Issuer, idToken.Subject)
+

@@ -201,2 +213,4 @@
 	}
 
+	//find old teams for user through oidc
+	oldOidcTeams, _ := models.FindAllOidcTeamIDsForUser(s, u.ID)

@@ -203,0 +230,4 @@
+			if !exists {
+				err = tm.Create(s, u)
+				if err != nil {
+					log.Debugf("Could not assign %v to %v. %v", u.Username, team.Name, err)

@@ -204,3 +249,4 @@
 	return auth.NewUserAuthTokenResponse(u, c, false)
 }
 
+func SignOutFromOrDeleteTeamsByID(s *xorm.Session, u *user.User, teamIDs []int64) {

@@ -207,0 +256,4 @@
+		if err != nil {
+			team, err := models.GetTeamByID(s, teamID)
+			if err != nil {
+				log.Errorf("Cannot find team with id: %v, err: %v", teamID, err)

@@ -207,0 +263,4 @@
+					log.Errorf("Cannot delete team %v", err)
+				}
+			}
+		}

@@ -207,0 +270,4 @@
+func getTeamDataFromToken(groups interface{}, provider *Provider) (teamData []TeamData, err error) {
+	teamData = []TeamData{}
+	if groups != nil {
+		el := groups.([]interface{})

@@ -207,0 +285,4 @@
+			if team["oidcID"] != nil {
+				switch t := team["oidcID"].(type) {
+				case int64:
+					oidcID = fmt.Sprintf("%v", team["oidcID"])

@@ -207,0 +290,4 @@
+					oidcID = string(team["oidcID"].(string))
+				case float64:
+					fl := float64(team["oidcID"].(float64))
+					oidcID = fmt.Sprintf("%v", fl)

@@ -207,0 +297,4 @@
+			}
+			if name == "" || oidcID == "" {
+				log.Errorf("Claim of your custom scope does not hold name or oidcID for automatic group assignment through oidc provider. Please check %s", provider.Name)
+				return teamData, &user.ErrOpenIDCustomScopeMalformed{}

@@ -207,0 +311,4 @@
+		Description: teamData.Description,
+		OidcID:      teamData.OidcID,
+	}
+	log.Debugf("Teams: %v", tea.OidcID)

@@ -207,0 +319,4 @@
+
+// this functions creates an array of existing teams that was generated from the oidc data.
+func GetOrCreateTeamsByOIDCAndNames(s *xorm.Session, teamData []TeamData, u *user.User) (te []models.Team, err error) {
+	te = []models.Team{}

@@ -207,0 +336,4 @@
+		}
+
+	}
+	log.Debugf("Array: %v", te)

@@ -277,1 +414,4 @@
 }
+
+// find the elements which appear in slice1,but not in slice2
+func notIn(slice1 []int64, slice2 []int64) []int64 {

@@ -278,0 +425,4 @@
+				break
+			}
+		}
+		// String not found. We add it to return slice

@@ -0,0 +1,99 @@
+regarding:

@@ -0,0 +5,4 @@
+This PR adds the functionality to assign users to teams via oidc.
+Read carefully and brief your administrators to use this feature.
+Tested with oidc provider authentik.
+To distinguish between groups created in vikunja and groups generated via oidc, there is an attribute neccessary, which is called: *oidcID*

@@ -0,0 +8,4 @@
+To distinguish between groups created in vikunja and groups generated via oidc, there is an attribute neccessary, which is called: *oidcID*
+
+## Setup
+Edit config.yml to include scope: openid profile email vikunja_scope

@@ -0,0 +50,4 @@
+- You will see "(sso: XXXXX)" written next to each team you were asigned through oidc.
+
+
+## IMPORTANT NOTES: 

@@ -113,1 +113,4 @@
 | 6007 | 403 | The team does not have access to the list to perform that action. |
+| 6008 | 400 | There are no teams found with that team name |
+| 6009 | 400 | There is no oidc team with that team name and oidcId |
+| 6010 | 400 | There are no oidc teams found for the user |

@@ -1073,4 +1073,3 @@
 }
 
-// ErrTeamDoesNotExist represents an error where a team does not exist
 type ErrTeamDoesNotExist struct {

@@ -1191,6 +1190,75 @@ func (err ErrTeamDoesNotHaveAccessToList) HTTPError() web.HTTPError {
 	return web.HTTPError{HTTPCode: http.StatusForbidden, Code: ErrCodeTeamDoesNotHaveAccessToList, Message: "This team does not have access to the list."}
 }
 
+type ErrTeamsDoNotExist struct {

@@ -112,0 +111,4 @@
+func (tm *TeamMember) CheckMembership(s *xorm.Session) (exists bool, err error) {
+	exists, err = s.
+		Where("team_id = ? AND user_id = ?", tm.TeamID, tm.UserID).
+		Get(&TeamMember{})

@@ -112,0 +120,4 @@
+	err = s.
+		Where("team_id = ?", tm.TeamID).
+		Cols("user_id").
+		Find(&members)

@@ -91,6 +94,13 @@ type TeamUser struct {
 	TeamID int64 `json:"-"`
 }
 
+// TeamData is the relevant data for a team and is delivered by oidc token

@@ -207,0 +256,4 @@
+	for _, teamID := range teamIDs {
+		tm := models.TeamMember{TeamID: teamID, UserID: u.ID, Username: u.Username}
+		exists, _ := tm.CheckMembership(s)
+		memberCount, _ := tm.GetMemberCount(s)

@@ -112,0 +117,4 @@
+
+func (tm *TeamMember) GetMemberCount(s *xorm.Session) (memberCount int64, err error) {
+	member := TeamMember{}
+	memberCount, err = s.

@@ -123,0 +136,4 @@
+		return teams, ErrTeamsDoNotExist{name}
+	}
+
+	var ts []*Team

@@ -123,0 +151,4 @@
+// GetTeamByOidcIDAndName gets teams where oidc_id and name match parameters
+// For oidc team creation oidcID and Name need to be set
+func GetTeamByOidcIDAndName(s *xorm.Session, oidcID string, teamName string) (team Team, err error) {
+	exists, err := s.

@@ -123,0 +154,4 @@
+	exists, err := s.
+		Table("teams").
+		Where("oidc_id = ? AND name = ?", oidcID, teamName).
+		Get(&team)

@@ -197,1 +200,4 @@
 
+	// does the oidc token contain well formed "vikunja_groups" through vikunja_scope
+	teamData, errs := getTeamDataFromToken(cl.VikunjaGroups, provider)
+	for _, err := range errs {

@@ -207,0 +252,4 @@
+	return oidcTeams, err
+
+}
+func SignOutFromTeamsByID(s *xorm.Session, u *user.User, teamIDs []int64) (errs []error) {

@@ -207,0 +267,4 @@
+		err = tm.Delete(s, u)
+		// if you cannot delete the team_member
+		if err != nil {
+			errs = append(errs, err)

@@ -196,2 +199,4 @@
 	}
 
+	// does the oidc token contain well formed "vikunja_groups" through vikunja_scope
+	teamData, errs := getTeamDataFromToken(cl.VikunjaGroups, provider)

@@ -205,2 +229,4 @@
 }
 
+func AssignOrCreateUserToTeams(s *xorm.Session, u *user.User, teamData []models.OIDCTeamData) (oidcTeams []int64, err error) {
+	if len(teamData) > 0 {

@@ -207,0 +310,4 @@
+}
+
+func CreateTeamWithData(s *xorm.Session, teamData models.OIDCTeamData, u *user.User) (team *models.Team, err error) {
+	tea := &models.Team{

@@ -207,0 +322,4 @@
+// this functions creates an array of existing teams that was generated from the oidc data.
+func GetOrCreateTeamsByOIDCAndNames(s *xorm.Session, teamData []models.OIDCTeamData, u *user.User) (te []*models.Team, err error) {
+	te = []*models.Team{}
+	// Procedure can only be successful if oidcID is set and converted to string

@@ -0,0 +1,96 @@
+# Assign teams via oidc
+This PR adds the functionality to assign users to teams via oidc.

@@ -1221,0 +1239,4 @@
+
+// HTTPError holds the http error description
+func (err ErrOIDCTeamDoesNotExist) HTTPError() web.HTTPError {
+	return web.HTTPError{HTTPCode: http.StatusNotFound, Code: ErrCodeTeamDoesNotExist, Message: "No Team with that name and valid property oidcId could be found."}

@@ -122,1 +131,4 @@
 
+// GetTeamByOidcIDAndName gets teams where oidc_id and name match parameters
+// For oidc team creation oidcID and Name need to be set
+func GetTeamByOidcIDAndName(s *xorm.Session, oidcID string, teamName string) (team Team, err error) {

@@ -206,0 +245,4 @@
+		if !exists {
+			err = tm.Create(s, u)
+			if err != nil {
+				log.Errorf("Could not assign %v to %v. %v", u.Username, team.Name, err)

@@ -429,0 +441,4 @@
+}
+
+// ErrCodeNoOpenIDEmailProvided holds the unique world-error code of this error
+const ErrCodeOpenIDCustomScopeMalformed = 1022

@@ -0,0 +1,98 @@
+# Assign teams via oidc

@@ -0,0 +4,4 @@
+You need to configure your oidc provider as explained in the documentation below to make this feature work.
+Tested with oidc provider authentik.
+To distinguish between teams created in vikunja and teams generated via oidc, a string attribute for vikunja teams is introduced, which is called: *oidcID*
+You should conigure your provider to send an oidcID to vikunja.

@@ -0,0 +6,4 @@
+To distinguish between teams created in vikunja and teams generated via oidc, a string attribute for vikunja teams is introduced, which is called: *oidcID*
+You should conigure your provider to send an oidcID to vikunja.
+
+## Setup

@@ -0,0 +47,4 @@
+You should see "the description you entered in the oidc provider's admin area"
+
+- Log in and go to teams.
+- You will see "(sso: XXXXX)" written next to each team you were asigned through oidc.

@@ -0,0 +53,4 @@
+## IMPORTANT NOTES: 
+* **SSO/OIDC teams cannot be edited.**
+
+* **It is crucial to call the element "vikunja_groups" since this is the name vikunja is looking for.**

@@ -0,0 +55,4 @@
+
+* **It is crucial to call the element "vikunja_groups" since this is the name vikunja is looking for.**
+
+* **Additionally, make sure to deliver an "oidcID" and a "name".**

@@ -0,0 +59,4 @@
+
+
+
+____________________________________________________________________________

@@ -0,0 +63,4 @@
+
+## BEHAVIOR
+
+*(.. examples for "team1" ..)*

@@ -0,0 +5,4 @@
+
+To distinguish between teams created in Vikunja and teams generated automatically via oidc, generated teams have an `oidcID` assigned internally.
+
+## Setup for atuhentik

@@ -0,0 +25,4 @@
+```
+
+```
+output example:

@@ -0,0 +42,4 @@
+Now when you log into Vikunja via oidc there will be a list of scopes you are claiming from your oidc provider.
+You should see the description you entered in the oidc provider's admin area.
+
+Log in and go to teams.

@@ -0,0 +43,4 @@
+You should see the description you entered in the oidc provider's admin area.
+
+Log in and go to teams.
+You should see "(sso: XXXXX)" written next to each team you were asigned through oidc.

@@ -0,0 +46,4 @@
+You should see "(sso: XXXXX)" written next to each team you were asigned through oidc.
+
+## IMPORTANT NOTES: 
+* **SSO/OIDC teams cannot be edited.**

@@ -0,0 +54,4 @@
+
+
+
+---

@@ -0,0 +56,4 @@
+
+---
+
+## BEHAVIOR

@@ -0,0 +61,4 @@
+*All examples assume one team called "team 1"*
+
+1. *Token delivers team.name +team.oidcId  and Vikunja team does not exist:* \
+New team will be created called "team 1" with attribute oidcId: "33929"

@@ -123,0 +138,4 @@
+		Where("oidc_id = ? AND name = ?", oidcID, teamName).
+		Asc("id").
+		Limit(1).
+		Get(team)

@@ -197,0 +207,4 @@
+		//find old teams for user through oidc
+		oldOidcTeams, err := models.FindAllOidcTeamIDsForUser(s, u.ID)
+		if err != nil {
+			log.Errorf("No Oidc Teams found for user %v", err)

@@ -197,0 +215,4 @@
+		}
+		errs = RemoveUserFromTeamsByIds(s, u, utils.NotIn(oldOidcTeams, oidcTeams))
+		for _, err := range errs {
+			log.Errorf("Found Error while signing out from teams %v", err)

@@ -206,0 +255,4 @@
+
+func RemoveUserFromTeamsByIds(s *xorm.Session, u *user.User, teamIDs []int64) (errs []error) {
+	errs = []error{}
+	for _, teamID := range teamIDs {

@@ -206,0 +310,4 @@
+	return teamData, errs
+}
+
+func CreateTeamWithData(s *xorm.Session, teamData models.OIDCTeamData, u *user.User) (team *models.Team, err error) {

@@ -317,2 +317,4 @@
         # The client secret used to authenticate Vikunja at the OpenID Connect provider.
         clientsecret:
+        # The scope necessary to use oidc.
+        # If you want to use the Feature to create and assign to vikunja teams via oidc, you have to add the custom "vikunja_scope" and check [openid.md](https://kolaente.dev/vikunja/api/src/branch/main/pkg/modules/auth/openid/openid.md)

@@ -0,0 +18,4 @@
+
+
+```python
+groupsDict = {"vikunja_groups": []}

@@ -1054,3 +1053,3 @@
 }
 
-// ErrTeamAlreadyHasAccess represents an error where a team already has access to a project
+// ErrTeamAlreadyHasAccess represents an error where a team already has access to a list/namespace

@@ -198,0 +221,4 @@
+		if err != nil {
+			log.Errorf("Found error while leaving teams %v", err)
+		}
+		errors := RemoveEmptySSOTeams(s, teamIDsToLeave)

@@ -207,0 +289,4 @@
+	}
+
+	log.Debugf("Removing team_member with user_id %v from team_ids %v", u.ID, strings.Join(strSlice, ","))
+	_, err = s.Where("team_id IN (?) AND user_id = ?", strings.Join(strSlice, ","), u.ID).Delete(&models.TeamMember{})

@@ -207,0 +300,4 @@
+		var name string
+		var description string
+		var oidcID string
+		if team["name"] != nil {

@@ -132,6 +136,7 @@ func getProviderFromMap(pi map[string]interface{}) (provider *Provider, err erro
 		OriginalAuthURL: pi["authurl"].(string),
 		ClientSecret:    pi["clientsecret"].(string),
 		LogoutURL:       logoutURL,
+		Scope:           scope,

@@ -0,0 +27,4 @@
+1. Edit [your config]({{< ref "config.md">}}) to include the following scopes: `openid profile email vikunja_scope`
+2. Open `<your authentik url>/if/admin/#/core/property-mappings`
+3. Create a new property mapping called `vikunja_scope` as scope mapping. There is a field `expression` to enter python expressions that will be delivered with the oidc token.
+4. Write a small script like the following to add group information to `vikunja_scope`:

@@ -109,0 +112,4 @@
+| 6010 | 400 | There are no oidc teams found for the user. |
+
+
+| ErrorCode | HTTP Status Code | Description |