diff --git a/api/types/statichostuser/statichostuser.go b/api/types/statichostuser/statichostuser.go deleted file mode 100644 index 8dc52817f0888..0000000000000 --- a/api/types/statichostuser/statichostuser.go +++ /dev/null @@ -1,87 +0,0 @@ -/* - * Teleport - * Copyright (C) 2024 Gravitational, Inc. - * - * This program is free software: you can redistribute it and/or modify - * it under the terms of the GNU Affero General Public License as published by - * the Free Software Foundation, either version 3 of the License, or - * (at your option) any later version. - * - * This program is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - * GNU Affero General Public License for more details. - * - * You should have received a copy of the GNU Affero General Public License - * along with this program. If not, see . - */ - -package statichostuser - -import ( - "strconv" - - "github.com/gravitational/trace" - - headerv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/header/v1" - userprovisioningpb "github.com/gravitational/teleport/api/gen/proto/go/teleport/userprovisioning/v1" - "github.com/gravitational/teleport/api/types" -) - -// NewStaticHostUser creates a new host user to be applied to matching SSH nodes. -func NewStaticHostUser(name string, spec *userprovisioningpb.StaticHostUserSpec) (*userprovisioningpb.StaticHostUser, error) { - hostUser := &userprovisioningpb.StaticHostUser{ - Kind: types.KindStaticHostUser, - Version: types.V1, - Metadata: &headerv1.Metadata{ - Name: name, - }, - Spec: spec, - } - if err := ValidateStaticHostUser(hostUser); err != nil { - return nil, trace.Wrap(err) - } - return hostUser, nil -} - -func isValidUidOrGid(s string) bool { - // No uid/gid is OK - if s == "" { - return true - } - // If uid/gid is present, it must be an integer (uid/gid are strings instead - // of ints to match user traits). - _, err := strconv.Atoi(s) - return err == nil -} - -// ValidateStaticHostUser checks that required parameters are set for the -// specified StaticHostUser. -func ValidateStaticHostUser(u *userprovisioningpb.StaticHostUser) error { - if u == nil { - return trace.BadParameter("StaticHostUser is nil") - } - if u.Metadata == nil { - return trace.BadParameter("Metadata is nil") - } - if u.Spec == nil { - return trace.BadParameter("Spec is nil") - } - if u.Spec.Login == "" { - return trace.BadParameter("missing login") - } - if u.Spec.NodeLabels != nil { - for key, value := range u.Spec.NodeLabels.Values { - if key == types.Wildcard && !(len(value.Values) == 1 && value.Values[0] == types.Wildcard) { - return trace.BadParameter("selector *: is not supported") - } - } - } - if !isValidUidOrGid(u.Spec.Uid) { - return trace.BadParameter("invalid uid: %q", u.Spec.Uid) - } - if !isValidUidOrGid(u.Spec.Gid) { - return trace.BadParameter("invalid gid: %q", u.Spec.Gid) - } - return nil -} diff --git a/api/types/statichostuser/statichostuser_test.go b/api/types/statichostuser/statichostuser_test.go deleted file mode 100644 index 5bd84148e748a..0000000000000 --- a/api/types/statichostuser/statichostuser_test.go +++ /dev/null @@ -1,131 +0,0 @@ -/* - * Teleport - * Copyright (C) 2024 Gravitational, Inc. - * - * This program is free software: you can redistribute it and/or modify - * it under the terms of the GNU Affero General Public License as published by - * the Free Software Foundation, either version 3 of the License, or - * (at your option) any later version. - * - * This program is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - * GNU Affero General Public License for more details. - * - * You should have received a copy of the GNU Affero General Public License - * along with this program. If not, see . - */ - -package statichostuser - -import ( - "testing" - - "github.com/stretchr/testify/require" - - userprovisioningpb "github.com/gravitational/teleport/api/gen/proto/go/teleport/userprovisioning/v1" - "github.com/gravitational/teleport/api/types" - "github.com/gravitational/teleport/api/types/wrappers" -) - -func TestValidateStaticHostUser(t *testing.T) { - t.Parallel() - - nodeLabels := func(labels map[string]string) *wrappers.LabelValues { - if len(labels) == 0 { - return nil - } - values := &wrappers.LabelValues{ - Values: make(map[string]wrappers.StringValues, len(labels)), - } - for k, v := range labels { - values.Values[k] = wrappers.StringValues{ - Values: []string{v}, - } - } - return values - } - - makeStaticHostUser := func(name string, spec *userprovisioningpb.StaticHostUserSpec) *userprovisioningpb.StaticHostUser { - // Errors will come from validation, which we will check later - hostUser, _ := NewStaticHostUser(name, spec) - if name == "" { - hostUser.Metadata = nil - } - return hostUser - } - - tests := []struct { - name string - hostUser *userprovisioningpb.StaticHostUser - assert require.ErrorAssertionFunc - }{ - { - name: "nil user", - assert: require.Error, - }, - { - name: "no metadata", - hostUser: makeStaticHostUser("", &userprovisioningpb.StaticHostUserSpec{ - Login: "alice", - }), - assert: require.Error, - }, - { - name: "no spec", - hostUser: makeStaticHostUser("alice_user", nil), - assert: require.Error, - }, - { - name: "missing login", - hostUser: makeStaticHostUser("alice_user", &userprovisioningpb.StaticHostUserSpec{}), - assert: require.Error, - }, - { - name: "invalid node labels", - hostUser: makeStaticHostUser("alice_user", &userprovisioningpb.StaticHostUserSpec{ - Login: "alice", - NodeLabels: nodeLabels(map[string]string{types.Wildcard: "bar"}), - }), - assert: require.Error, - }, - { - name: "non-numeric uid", - hostUser: makeStaticHostUser("alice_user", &userprovisioningpb.StaticHostUserSpec{ - Login: "alice", - Groups: []string{"foo", "bar"}, - Uid: "abcd", - Gid: "1234", - NodeLabels: nodeLabels(map[string]string{"foo": "bar"}), - }), - assert: require.Error, - }, - { - name: "non-numeric gid", - hostUser: makeStaticHostUser("alice_user", &userprovisioningpb.StaticHostUserSpec{ - Login: "alice", - Groups: []string{"foo", "bar"}, - Uid: "1234", - Gid: "abcd", - NodeLabels: nodeLabels(map[string]string{"foo": "bar"}), - }), - assert: require.Error, - }, - { - name: "ok", - hostUser: makeStaticHostUser("alice_user", &userprovisioningpb.StaticHostUserSpec{ - Login: "alice", - Groups: []string{"foo", "bar"}, - Uid: "1234", - Gid: "5678", - NodeLabels: nodeLabels(map[string]string{"foo": "bar"}), - }), - assert: require.NoError, - }, - } - for _, tc := range tests { - t.Run(tc.name, func(t *testing.T) { - tc.assert(t, ValidateStaticHostUser(tc.hostUser)) - }) - } -}