Merge branch 'master' into expand-resource-labels

.github/workflows/main.yml

@@ -16,7 +16,7 @@ jobs:
       - uses: actions/checkout@v4
       - uses: actions/setup-node@v4
         with:
-          node-version: '16'
+          node-version: '22'
       - run: make yarn
       - run: 'echo "nodeLinker: node-modules" >>.yarnrc.yml'
       - run: yarn install

.storybook/preview.ts

@@ -1,15 +1,61 @@
 import type { Preview } from '@storybook/react'
 import DefaultDecorator from '../web/src/app/storybook/decorators'
 import { initialize, mswLoader } from 'msw-storybook-addon'
-import {
-  handleDefaultConfig,
-  handleExpFlags,
-} from '../web/src/app/storybook/graphql'
+import { defaultConfig } from '../web/src/app/storybook/graphql'
+import { graphql, HttpResponse } from 'msw'
 
 initialize({
   onUnhandledRequest: 'bypass',
 })
 
+export type GraphQLRequestHandler = (variables: unknown) => object
+export type GraphQLParams = Record<string, GraphQLRequestHandler>
+
+const componentConfig: Record<string, GraphQLParams> = {}
+
+export const mswHandler = graphql.operation((params) => {
+  const url = new URL(params.request.url)
+  const gql = componentConfig[url.pathname]
+  const handler = gql[params.operationName]
+  if (!handler) {
+    return HttpResponse.json({
+      errors: [
+        { message: `No mock defined for operation '${params.operationName}'.` },
+      ],
+    })
+  }
+
+  if (typeof handler === 'function') {
+    return HttpResponse.json(handler(params.variables))
+  }
+
+  return HttpResponse.json(handler)
+})
+
+interface LoaderArg {
+  id: string
+  parameters: {
+    graphql?: GraphQLParams
+  }
+}
+
+/**
+ * graphqlLoader is a loader function that sets up the GraphQL mocks for the
+ * component. It stores them in a global object, componentConfig, which is used
+ * by the mswHandler to resolve the mocks.
+ *
+ * We need to do this because the browser will render all components at once,
+ * and so we need to handle all GraphQL mocks at once.
+ *
+ * The way this works is that each component get's a unique URL for GraphQL
+ * (see decorators.tsx). This URL is used to store the GraphQL mocks for that
+ * component in componentConfig.
+ */
+export function graphQLLoader(arg: LoaderArg): void {
+  const path = '/' + encodeURIComponent(arg.id) + '/api/graphql'
+  componentConfig[path] = arg.parameters.graphql || {}
+}
+
 const preview: Preview = {
   parameters: {
     controls: {
@@ -18,12 +64,15 @@ const preview: Preview = {
         date: /Date$/i,
       },
     },
-    msw: {
-      handlers: [handleDefaultConfig, handleExpFlags()],
+    graphql: {
+      // default GraphQL handlers
+      RequireConfig: { data: defaultConfig },
+      useExpFlag: { data: { experimentalFlags: [] } },
     },
+    msw: { handlers: [mswHandler] },
   },
   decorators: [DefaultDecorator],
-  loaders: [mswLoader],
+  loaders: [graphQLLoader, mswLoader],
 }
 
 export default preview

.yarnrc.yml

@@ -1,5 +1,9 @@
+compressionLevel: mixed
+
 defaultSemverRangePrefix: ''
 
+enableGlobalCache: false
+
 packageExtensions:
   jest-playwright-preset@*:
     dependencies:
@@ -10,4 +14,4 @@ packageExtensions:
 
 pnpEnableEsmLoader: true
 
-yarnPath: .yarn/releases/yarn-3.6.3.cjs
+yarnPath: .yarn/releases/yarn-4.3.1.cjs

Makefile

@@ -22,7 +22,7 @@ SWO_DB_URL_NEXT = $(shell go run ./devtools/scripts/db-url "$(DB_URL)" "$(SWO_DB
 
 LOG_DIR=
 GOPATH:=$(shell go env GOPATH)
-YARN_VERSION=3.6.3
+YARN_VERSION=4.3.1
 PG_VERSION=13
 
 # add all files except those under web/src/build and web/src/cypress
@@ -351,10 +351,7 @@ new-migration:
 vscode: $(NODE_DEPS) 
 	yarn dlx @yarnpkg/sdks vscode
 
-.yarn/plugins/@yarnpkg/plugin-interactive-tools.cjs: $(NODE_DEPS)
-	yarn plugin import interactive-tools
-
-upgrade-js: .yarn/plugins/@yarnpkg/plugin-interactive-tools.cjs ## Interactively upgrade javascript packages
+upgrade-js: ## Interactively upgrade javascript packages
 	yarn upgrade-interactive
 
 test/coverage/total.out: test/coverage/integration/*/* test/coverage/*/* Makefile

apikey/policy.go

@@ -3,6 +3,13 @@ package apikey
 import "github.com/target/goalert/permission"
 
 // GQLPolicy is a GraphQL API key policy.
+//
+// Any changes to existing fields MUST require the version to be incremented.
+//
+// If new fields are added, they MUST be set to `omitempty`
+// to ensure existing keys don't break.
+//
+// It MUST be possible to unmarshal & re-marshal the policy without changing the data for existing keys.
 type GQLPolicy struct {
 	Version int
 	Query   string

apikey/policyinfo.go

@@ -16,6 +16,25 @@ type policyInfo struct {
 	Policy GQLPolicy
 }
 
+func parsePolicyInfo(data []byte) (*policyInfo, error) {
+	var info policyInfo
+	err := json.Unmarshal(data, &info.Policy)
+	if err != nil {
+		return nil, err
+	}
+
+	// re-encode policy to get a consistent hash
+	data, err = json.Marshal(info.Policy)
+	if err != nil {
+		return nil, err
+	}
+
+	h := sha256.Sum256(data)
+	info.Hash = h[:]
+
+	return &info, nil
+}
+
 // _fetchPolicyInfo will fetch the policyInfo for the given key.
 func (s *Store) _fetchPolicyInfo(ctx context.Context, id uuid.UUID) (*policyInfo, bool, error) {
 	polData, err := gadb.New(s.db).APIKeyAuthPolicy(ctx, id)
@@ -26,14 +45,10 @@ func (s *Store) _fetchPolicyInfo(ctx context.Context, id uuid.UUID) (*policyInfo
 		return nil, false, err
 	}
 
-	var info policyInfo
-	err = json.Unmarshal(polData, &info.Policy)
+	info, err := parsePolicyInfo(polData)
 	if err != nil {
 		return nil, false, err
 	}
 
-	h := sha256.Sum256(polData)
-	info.Hash = h[:]
-
-	return &info, true, nil
+	return info, true, nil
 }

apikey/policyinfo_test.go

@@ -0,0 +1,38 @@
+package apikey
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestParsePolicyInfo(t *testing.T) {
+	expected := &policyInfo{
+		// Never change this hash -- it is used to verify future changes wont break existing keys.
+		Hash: []byte{0x2d, 0x6d, 0xef, 0x3b, 0xfa, 0xd8, 0xef, 0x9d, 0x7e, 0x6c, 0xf4, 0xed, 0xd1, 0x81, 0x16, 0xf4, 0x23, 0xaa, 0x4a, 0xaf, 0x70, 0x1b, 0xfd, 0x1b, 0x26, 0x1d, 0xb3, 0x1, 0x4f, 0xdc, 0xa1, 0x61},
+		Policy: GQLPolicy{
+			Version: 1,
+			Query:   "query",
+			Role:    "admin",
+		},
+	}
+
+	info, err := parsePolicyInfo([]byte(`{"Version":1,"Query":"query","Role":"admin"}`))
+	assert.NoError(t, err)
+	assert.Equal(t, expected, info)
+
+	// add spaces and re-order keys
+	info, err = parsePolicyInfo([]byte(`{ "Role":"admin", "Query":"query","Version":1}`))
+	assert.NoError(t, err)
+	assert.Equal(t, expected, info)
+
+	// add extra field
+	info, err = parsePolicyInfo([]byte(`{"Version":1,"Query":"query","Role":"admin","Extra":true}`))
+	assert.NoError(t, err)
+	assert.Equal(t, expected, info)
+
+	// changed query
+	info, err = parsePolicyInfo([]byte(`{"Version":1,"Query":"query2","Role":"admin"}`))
+	assert.NoError(t, err)
+	assert.NotEqual(t, expected.Hash, info.Hash) // NOT equal
+}

app/app.go

@@ -25,6 +25,7 @@ import (
 	"github.com/target/goalert/graphql2/graphqlapp"
 	"github.com/target/goalert/heartbeat"
 	"github.com/target/goalert/integrationkey"
+	"github.com/target/goalert/integrationkey/uik"
 	"github.com/target/goalert/keyring"
 	"github.com/target/goalert/label"
 	"github.com/target/goalert/limit"
@@ -99,6 +100,7 @@ type App struct {
 	ServiceStore        *service.Store
 	EscalationStore     *escalation.Store
 	IntegrationKeyStore *integrationkey.Store
+	UIKHandler          *uik.Handler
 	ScheduleRuleStore   *rule.Store
 	NotificationStore   *notification.Store
 	ScheduleStore       *schedule.Store

app/inithttp.go

@@ -9,6 +9,7 @@ import (
 
 	"github.com/prometheus/client_golang/prometheus/promhttp"
 	"github.com/target/goalert/config"
+	"github.com/target/goalert/expflag"
 	"github.com/target/goalert/genericapi"
 	"github.com/target/goalert/grafana"
 	"github.com/target/goalert/mailgun"
@@ -142,6 +143,9 @@ func (app *App) initHTTP(ctx context.Context) error {
 	mux.HandleFunc("/api/v2/identity/providers/oidc", oidcAuth)
 	mux.HandleFunc("/api/v2/identity/providers/oidc/callback", oidcAuth)
 
+	if expflag.ContextHas(ctx, expflag.UnivKeys) {
+		mux.HandleFunc("POST /api/v2/uik", app.UIKHandler.ServeHTTP)
+	}
 	mux.HandleFunc("/api/v2/mailgun/incoming", mailgun.IngressWebhooks(app.AlertStore, app.IntegrationKeyStore))
 	mux.HandleFunc("/api/v2/grafana/incoming", grafana.GrafanaToEventsAPI(app.AlertStore, app.IntegrationKeyStore))
 	mux.HandleFunc("/api/v2/site24x7/incoming", site24x7.Site24x7ToEventsAPI(app.AlertStore, app.IntegrationKeyStore))

app/initstores.go

@@ -16,6 +16,7 @@ import (
 	"github.com/target/goalert/escalation"
 	"github.com/target/goalert/heartbeat"
 	"github.com/target/goalert/integrationkey"
+	"github.com/target/goalert/integrationkey/uik"
 	"github.com/target/goalert/keyring"
 	"github.com/target/goalert/label"
 	"github.com/target/goalert/limit"
@@ -217,7 +218,7 @@ func (app *App) initStores(ctx context.Context) error {
 	}
 
 	if app.IntegrationKeyStore == nil {
-		app.IntegrationKeyStore = integrationkey.NewStore(ctx, app.db)
+		app.IntegrationKeyStore = integrationkey.NewStore(ctx, app.db, app.APIKeyring)
 	}
 
 	if app.ScheduleRuleStore == nil {
@@ -299,5 +300,7 @@ func (app *App) initStores(ctx context.Context) error {
 		return errors.Wrap(err, "init API key store")
 	}
 
+	app.UIKHandler = uik.NewHandler(app.db, app.IntegrationKeyStore, app.AlertStore)
+
 	return nil
 }

auth/authtoken/encode.go

@@ -34,6 +34,12 @@ func (t Token) Encode(signFn SignFunc) (string, error) {
 		b[2] = byte(t.Type)
 		copy(b[3:], t.ID[:])
 		binary.BigEndian.PutUint64(b[19:], uint64(t.CreatedAt.Unix()))
+	case 3:
+		b = make([]byte, 19)
+		b[0] = 'V' // versioned header format
+		b[1] = 3
+		b[2] = byte(t.Type)
+		copy(b[3:], t.ID[:])
 	default:
 		return "", validation.NewFieldError("Type", "unsupported version")
 	}

auth/authtoken/parse.go

@@ -73,6 +73,20 @@ func Parse(s string, verifyFn VerifyFunc) (*Token, bool, error) {
 	}
 
 	switch data[1] {
+	case 3:
+		if len(data) < 19 {
+			return nil, false, validation.NewGenericError("invalid length")
+		}
+		t := &Token{
+			Version: 3,
+			Type:    Type(data[2]),
+		}
+		valid, isOldKey := verifyFn(t.Type, data[:19], data[19:])
+		if !valid {
+			return nil, false, validation.NewGenericError("invalid signature")
+		}
+		copy(t.ID[:], data[3:])
+		return t, isOldKey, nil
 	case 2:
 		if len(data) < 27 {
 			return nil, false, validation.NewGenericError("invalid length")

auth/authtoken/type.go

@@ -8,4 +8,5 @@ const (
 	TypeUnknown Type = iota // always make the zero-value Unknown
 	TypeSession
 	TypeCalSub
+	TypeUIK
 )

auth/handler.go

@@ -564,6 +564,15 @@ func (h *Handler) authWithToken(w http.ResponseWriter, req *http.Request, next h
 		next.ServeHTTP(w, req.WithContext(ctx))
 		return true
 	}
+	if req.URL.Path == "/api/v2/uik" && strings.HasPrefix(tokStr, "ey") {
+		ctx, err = h.cfg.IntKeyStore.AuthorizeUIK(ctx, tokStr)
+		if errutil.HTTPError(req.Context(), w, err) {
+			return true
+		}
+
+		next.ServeHTTP(w, req.WithContext(ctx))
+		return true
+	}
 
 	tok, _, err := authtoken.Parse(tokStr, func(t authtoken.Type, p, sig []byte) (bool, bool) {
 		if t == authtoken.TypeSession {

cmd/goalert-slack-email-sync/main.go

@@ -39,7 +39,7 @@ func main() {
 		creds = credentials.NewTLS(cfg)
 	}
 
-	conn, err := grpc.Dial(*api, grpc.WithTransportCredentials(creds))
+	conn, err := grpc.NewClient(*api, grpc.WithTransportCredentials(creds))
 	if err != nil {
 		log.Fatal("connect to GoAlert:", err)
 	}

devtools/gqltsgen/run.go

@@ -144,6 +144,9 @@ func main() {
 			if def.Name == "WeekdayFilter" {
 				typeName = "[boolean, boolean, boolean, boolean, boolean, boolean, boolean]"
 			}
+			if strings.HasSuffix(def.Name, "Map") {
+				typeName = "Record<string, string>"
+			}
 			fmt.Fprintf(w, "export type %s = %s\n\n", def.Name, typeName)
 		case ast.Union:
 			sort.Strings(def.Types)