add create, delete, list for idp org policy

server/routers/external.ts

@@ -519,6 +519,24 @@ authenticated.get(
     idp.getIdp
 );
 
+authenticated.put(
+    "/idp/:idpId/org/:orgId",
+    verifyUserIsServerAdmin,
+    idp.createIdpOrgPolicy
+);
+
+authenticated.delete(
+    "/idp/:idpId/org/:orgId",
+    verifyUserIsServerAdmin,
+    idp.deleteIdpOrgPolicy
+);
+
+authenticated.get(
+    "/idp/:idpId/org",
+    verifyUserIsServerAdmin,
+    idp.listIdpOrgPolicies
+);
+
 // Auth routes
 export const authRouter = Router();
 unauthenticated.use("/auth", authRouter);

server/routers/idp/createIdpOrgPolicy.ts

@@ -0,0 +1,121 @@
+import { Request, Response, NextFunction } from "express";
+import { z } from "zod";
+import { db } from "@server/db";
+import response from "@server/lib/response";
+import HttpCode from "@server/types/HttpCode";
+import createHttpError from "http-errors";
+import logger from "@server/logger";
+import { fromError } from "zod-validation-error";
+import { OpenAPITags, registry } from "@server/openApi";
+import config from "@server/lib/config";
+import { eq, and } from "drizzle-orm";
+import { idp, idpOrg } from "@server/db/schemas";
+
+const paramsSchema = z
+    .object({
+        idpId: z.coerce.number(),
+        orgId: z.string()
+    })
+    .strict();
+
+const bodySchema = z
+    .object({
+        roleMapping: z.string().optional(),
+        orgMapping: z.string().optional()
+    })
+    .strict();
+
+export type CreateIdpOrgPolicyResponse = {};
+
+registry.registerPath({
+    method: "put",
+    path: "/idp/{idpId}/org/{orgId}",
+    description: "Create an IDP policy for an existing IDP on an organization.",
+    tags: [OpenAPITags.Idp],
+    request: {
+        params: paramsSchema,
+        body: {
+            content: {
+                "application/json": {
+                    schema: bodySchema
+                }
+            }
+        }
+    },
+    responses: {}
+});
+
+export async function createIdpOrgPolicy(
+    req: Request,
+    res: Response,
+    next: NextFunction
+): Promise<any> {
+    try {
+        const parsedBody = bodySchema.safeParse(req.body);
+        if (!parsedBody.success) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    fromError(parsedBody.error).toString()
+                )
+            );
+        }
+
+        const parsedParams = paramsSchema.safeParse(req.params);
+        if (!parsedParams.success) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    fromError(parsedParams.error).toString()
+                )
+            );
+        }
+
+        const { idpId, orgId } = parsedParams.data;
+        const { roleMapping, orgMapping } = parsedBody.data;
+
+        const [existing] = await db
+            .select()
+            .from(idp)
+            .leftJoin(idpOrg, eq(idpOrg.orgId, orgId))
+            .where(and(eq(idp.idpId, idpId), eq(idpOrg.orgId, orgId)));
+
+        if (!existing.idp) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    "An IDP with this ID does not exist."
+                )
+            );
+        }
+
+        if (existing.idpOrg) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    "An IDP org policy already exists."
+                )
+            );
+        }
+
+        await db.insert(idpOrg).values({
+            idpId,
+            orgId,
+            roleMapping,
+            orgMapping
+        });
+
+        return response<CreateIdpOrgPolicyResponse>(res, {
+            data: {},
+            success: true,
+            error: false,
+            message: "Idp created successfully",
+            status: HttpCode.CREATED
+        });
+    } catch (error) {
+        logger.error(error);
+        return next(
+            createHttpError(HttpCode.INTERNAL_SERVER_ERROR, "An error occurred")
+        );
+    }
+}

server/routers/idp/deleteIdp.ts

@@ -18,17 +18,11 @@ const paramsSchema = z
 
 registry.registerPath({
     method: "delete",
-    path: "/org/{orgId}/idp/oidc",
+    path: "/idp/{idpId}",
-    description: "Create an OIDC IdP for an organization.",
+    description: "Delete IDP.",
-    tags: [OpenAPITags.Org, OpenAPITags.Idp],
+    tags: [OpenAPITags.Idp],
     request: {
-        body: {
+        params: paramsSchema
-            content: {
-                "application/json": {
-                    schema: bodySchema
-                }
-            }
-        }
     },
     responses: {}
 });

server/routers/idp/deleteIdpOrgPolicy.ts

@@ -0,0 +1,90 @@
+import { Request, Response, NextFunction } from "express";
+import { z } from "zod";
+import { db } from "@server/db";
+import response from "@server/lib/response";
+import HttpCode from "@server/types/HttpCode";
+import createHttpError from "http-errors";
+import logger from "@server/logger";
+import { fromError } from "zod-validation-error";
+import { idp, idpOrg } from "@server/db/schemas";
+import { eq, and } from "drizzle-orm";
+import { OpenAPITags, registry } from "@server/openApi";
+
+const paramsSchema = z
+    .object({
+        idpId: z.coerce.number(),
+        orgId: z.string()
+    })
+    .strict();
+
+registry.registerPath({
+    method: "delete",
+    path: "/idp/{idpId}/org/{orgId}",
+    description: "Create an OIDC IdP for an organization.",
+    tags: [OpenAPITags.Idp],
+    request: {
+        params: paramsSchema
+    },
+    responses: {}
+});
+
+export async function deleteIdpOrgPolicy(
+    req: Request,
+    res: Response,
+    next: NextFunction
+): Promise<any> {
+    try {
+        const parsedParams = paramsSchema.safeParse(req.params);
+        if (!parsedParams.success) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    fromError(parsedParams.error).toString()
+                )
+            );
+        }
+
+        const { idpId, orgId } = parsedParams.data;
+
+        const [existing] = await db
+            .select()
+            .from(idp)
+            .leftJoin(idpOrg, eq(idpOrg.orgId, orgId))
+            .where(and(eq(idp.idpId, idpId), eq(idpOrg.orgId, orgId)));
+
+        if (!existing.idp) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    "An IDP with this ID does not exist."
+                )
+            );
+        }
+
+        if (!existing.idpOrg) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    "A policy for this IDP and org does not exist."
+                )
+            );
+        }
+
+        await db
+            .delete(idpOrg)
+            .where(and(eq(idpOrg.idpId, idpId), eq(idpOrg.orgId, orgId)));
+
+        return response<null>(res, {
+            data: null,
+            success: true,
+            error: false,
+            message: "Policy deleted successfully",
+            status: HttpCode.OK
+        });
+    } catch (error) {
+        logger.error(error);
+        return next(
+            createHttpError(HttpCode.INTERNAL_SERVER_ERROR, "An error occurred")
+        );
+    }
+}

server/routers/idp/getIdp.ts

@@ -9,6 +9,8 @@ import createHttpError from "http-errors";
 import logger from "@server/logger";
 import { fromError } from "zod-validation-error";
 import { OpenAPITags, registry } from "@server/openApi";
+import config from "@server/lib/config";
+import { decrypt } from "@server/lib/crypto";
 
 const paramsSchema = z
     .object({
@@ -63,6 +65,22 @@ export async function getIdp(
             return next(createHttpError(HttpCode.NOT_FOUND, "Idp not found"));
         }
 
+        const key = config.getRawConfig().server.secret;
+
+        if (idpRes.idp.type === "oidc") {
+            const clientSecret = idpRes.idpOidcConfig!.clientSecret;
+            const clientId = idpRes.idpOidcConfig!.clientId;
+
+            idpRes.idpOidcConfig!.clientSecret = decrypt(
+                clientSecret,
+                key
+            );
+            idpRes.idpOidcConfig!.clientId = decrypt(
+                clientId,
+                key
+            );
+        }
+
         return response<GetIdpResponse>(res, {
             data: idpRes,
             success: true,

server/routers/idp/index.ts

@@ -4,3 +4,6 @@ export * from "./listIdps";
 export * from "./generateOidcUrl";
 export * from "./validateOidcCallback";
 export * from "./getIdp";
+export * from "./createIdpOrgPolicy";
+export * from "./deleteIdpOrgPolicy";
+export * from "./listIdpOrgPolicies";

server/routers/idp/listIdpOrgPolicies.ts

@@ -0,0 +1,116 @@
+import { Request, Response, NextFunction } from "express";
+import { z } from "zod";
+import { db } from "@server/db";
+import { idpOrg } from "@server/db/schemas";
+import response from "@server/lib/response";
+import HttpCode from "@server/types/HttpCode";
+import createHttpError from "http-errors";
+import { eq, sql } from "drizzle-orm";
+import logger from "@server/logger";
+import { fromError } from "zod-validation-error";
+import { OpenAPITags, registry } from "@server/openApi";
+
+const paramsSchema = z.object({
+    idpId: z.coerce.number()
+});
+
+const querySchema = z
+    .object({
+        limit: z
+            .string()
+            .optional()
+            .default("1000")
+            .transform(Number)
+            .pipe(z.number().int().nonnegative()),
+        offset: z
+            .string()
+            .optional()
+            .default("0")
+            .transform(Number)
+            .pipe(z.number().int().nonnegative())
+    })
+    .strict();
+
+async function query(idpId: number, limit: number, offset: number) {
+    const res = await db
+        .select()
+        .from(idpOrg)
+        .where(eq(idpOrg.idpId, idpId))
+        .limit(limit)
+        .offset(offset);
+    return res;
+}
+
+export type ListIdpOrgPoliciesResponse = {
+    policies: NonNullable<Awaited<ReturnType<typeof query>>>;
+    pagination: { total: number; limit: number; offset: number };
+};
+
+registry.registerPath({
+    method: "get",
+    path: "/idp/{idpId}/org",
+    description: "List all org policies on an IDP.",
+    tags: [OpenAPITags.Idp],
+    request: {
+        params: paramsSchema,
+        query: querySchema
+    },
+    responses: {}
+});
+
+export async function listIdpOrgPolicies(
+    req: Request,
+    res: Response,
+    next: NextFunction
+): Promise<any> {
+    try {
+        const parsedParams = paramsSchema.safeParse(req.params);
+        if (!parsedParams.success) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    fromError(parsedParams.error).toString()
+                )
+            );
+        }
+        const { idpId } = parsedParams.data;
+
+        const parsedQuery = querySchema.safeParse(req.query);
+        if (!parsedQuery.success) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    fromError(parsedQuery.error).toString()
+                )
+            );
+        }
+        const { limit, offset } = parsedQuery.data;
+
+        const list = await query(idpId, limit, offset);
+
+        const [{ count }] = await db
+            .select({ count: sql<number>`count(*)` })
+            .from(idpOrg)
+            .where(eq(idpOrg.idpId, idpId));
+
+        return response<ListIdpOrgPoliciesResponse>(res, {
+            data: {
+                policies: list,
+                pagination: {
+                    total: count,
+                    limit,
+                    offset
+                }
+            },
+            success: true,
+            error: false,
+            message: "Policies retrieved successfully",
+            status: HttpCode.OK
+        });
+    } catch (error) {
+        logger.error(error);
+        return next(
+            createHttpError(HttpCode.INTERNAL_SERVER_ERROR, "An error occurred")
+        );
+    }
+}

server/routers/idp/listIdps.ts

@@ -1,7 +1,7 @@
 import { Request, Response, NextFunction } from "express";
 import { z } from "zod";
 import { db } from "@server/db";
-import { domains, orgDomains, users } from "@server/db/schemas";
+import { domains, idp, orgDomains, users } from "@server/db/schemas";
 import response from "@server/lib/response";
 import HttpCode from "@server/types/HttpCode";
 import createHttpError from "http-errors";
@@ -69,7 +69,7 @@ export async function listIdps(
 
         const [{ count }] = await db
             .select({ count: sql<number>`count(*)` })
-            .from(domains);
+            .from(idp);
 
         return response<ListIdpResponse>(res, {
             data: {

server/routers/user/listUsers.ts

@@ -5,7 +5,7 @@ import { idp, roles, userOrgs, users } from "@server/db/schemas";
 import response from "@server/lib/response";
 import HttpCode from "@server/types/HttpCode";
 import createHttpError from "http-errors";
-import { sql } from "drizzle-orm";
+import { and, sql } from "drizzle-orm";
 import logger from "@server/logger";
 import { fromZodError } from "zod-validation-error";
 import { OpenAPITags, registry } from "@server/openApi";
@@ -114,7 +114,8 @@ export async function listUsers(
 
         const [{ count }] = await db
             .select({ count: sql<number>`count(*)` })
-            .from(users);
+            .from(users)
+            .where(eq(userOrgs.orgId, orgId));
 
         return response<ListUsersResponse>(res, {
             data: {