Merge pull request #3350 from fosrl/dev

Make sure the rebuild actually executes

server/lib/blueprints/applyBlueprint.ts

@@ -172,9 +172,7 @@ export async function applyBlueprint({
     } catch (err) {
         blueprintSucceeded = false;
         blueprintMessage = `Blueprint applied with errors: ${err}`;
-        logger.debug(
-            `Org ${orgId} blueprint apply issues: ${blueprintMessage}`
-        );
+        logger.error(blueprintMessage);
         error = err;
     }
 

server/routers/olm/handleOlmRegisterMessage.ts

@@ -197,6 +197,15 @@ export const handleOlmRegisterMessage: MessageHandler = async (context) => {
             policyCheck
         });
 
+        if (policyCheck?.error) {
+            logger.error(
+                `[handleOlmRegisterMessage] Error checking access policies for olm user ${olm.userId} in org ${orgId}: ${policyCheck?.error}`,
+                { orgId: client.orgId, clientId: client.clientId }
+            );
+            sendOlmError(OlmErrorCodes.ORG_ACCESS_POLICY_DENIED, olm.olmId);
+            return;
+        }
+
         if (policyCheck.policies?.passwordAge?.compliant === false) {
             logger.warn(
                 `[handleOlmRegisterMessage] Olm user ${olm.userId} has non-compliant password age for org ${orgId}`,
@@ -229,7 +238,7 @@ export const handleOlmRegisterMessage: MessageHandler = async (context) => {
                 olm.olmId
             );
             return;
-        } else if (!policyCheck.allowed || policyCheck.error) {
+        } else if (!policyCheck.allowed) {
             logger.warn(
                 `[handleOlmRegisterMessage] Olm user ${olm.userId} does not pass access policies for org ${orgId}: ${policyCheck.error}`,
                 { orgId: client.orgId, clientId: client.clientId }

server/routers/policy/setResourcePolicyHeaderAuth.ts

@@ -76,15 +76,6 @@ export async function setResourcePolicyHeaderAuth(
         const { resourcePolicyId } = parsedParams.data;
         const { headerAuth } = parsedBody.data;
 
-        const headerAuthHash =
-            headerAuth !== null
-                ? await hashPassword(
-                      Buffer.from(
-                          `${headerAuth.user}:${headerAuth.password}`
-                      ).toString("base64")
-                  )
-                : null;
-
         await db.transaction(async (trx) => {
             await trx
                 .delete(resourcePolicyHeaderAuth)
@@ -95,7 +86,13 @@ export async function setResourcePolicyHeaderAuth(
                     )
                 );
 
-            if (headerAuth !== null && headerAuthHash !== null) {
+            if (headerAuth !== null) {
+                const headerAuthHash = await hashPassword(
+                    Buffer.from(
+                        `${headerAuth.user}:${headerAuth.password}`
+                    ).toString("base64")
+                );
+
                 await trx.insert(resourcePolicyHeaderAuth).values({
                     resourcePolicyId,
                     headerAuthHash,

server/routers/policy/setResourcePolicyRules.ts

@@ -1,7 +1,7 @@
 import { Request, Response, NextFunction } from "express";
 import { z } from "zod";
 import { db, resourcePolicyRules, resourcePolicies } from "@server/db";
-import { and, eq, notInArray } from "drizzle-orm";
+import { eq } from "drizzle-orm";
 import response from "@server/lib/response";
 import HttpCode from "@server/types/HttpCode";
 import createHttpError from "http-errors";
@@ -14,7 +14,6 @@ import {
 import { OpenAPITags, registry } from "@server/openApi";
 
 const ruleSchema = z.strictObject({
-    ruleId: z.int().positive().optional(),
     action: z.enum(["ACCEPT", "DROP", "PASS"]).openapi({
         type: "string",
         enum: ["ACCEPT", "DROP", "PASS"],
@@ -122,74 +121,17 @@ export async function setResourcePolicyRules(
                 .set({ applyRules })
                 .where(eq(resourcePolicies.resourcePolicyId, resourcePolicyId));
 
-            const incomingRuleIds = rules
-                .map((r) => r.ruleId)
-                .filter((id): id is number => id !== undefined);
+            await trx
+                .delete(resourcePolicyRules)
+                .where(
+                    eq(resourcePolicyRules.resourcePolicyId, resourcePolicyId)
+                );
 
-            // Delete rules that are no longer in the incoming list
-            if (incomingRuleIds.length > 0) {
-                await trx
-                    .delete(resourcePolicyRules)
-                    .where(
-                        and(
-                            eq(
-                                resourcePolicyRules.resourcePolicyId,
-                                resourcePolicyId
-                            ),
-                            notInArray(
-                                resourcePolicyRules.ruleId,
-                                incomingRuleIds
-                            )
-                        )
-                    );
-            } else {
-                await trx
-                    .delete(resourcePolicyRules)
-                    .where(
-                        eq(
-                            resourcePolicyRules.resourcePolicyId,
-                            resourcePolicyId
-                        )
-                    );
-            }
-
-            // Update existing rules (those with a ruleId)
-            const existingRules = rules.filter(
-                (r): r is typeof r & { ruleId: number } =>
-                    r.ruleId !== undefined
-            );
-            for (const rule of existingRules) {
-                await trx
-                    .update(resourcePolicyRules)
-                    .set({
-                        action: rule.action,
-                        match: rule.match,
-                        value: rule.value,
-                        priority: rule.priority,
-                        enabled: rule.enabled
-                    })
-                    .where(
-                        and(
-                            eq(resourcePolicyRules.ruleId, rule.ruleId),
-                            eq(
-                                resourcePolicyRules.resourcePolicyId,
-                                resourcePolicyId
-                            )
-                        )
-                    );
-            }
-
-            // Insert new rules (those without a ruleId)
-            const newRules = rules.filter((r) => r.ruleId === undefined);
-            if (newRules.length > 0) {
+            if (rules.length > 0) {
                 await trx.insert(resourcePolicyRules).values(
-                    newRules.map((rule) => ({
+                    rules.map((rule) => ({
                         resourcePolicyId,
-                        action: rule.action,
-                        match: rule.match,
-                        value: rule.value,
-                        priority: rule.priority,
-                        enabled: rule.enabled
+                        ...rule
                     }))
                 );
             }

server/routers/resource/setResourceHeaderAuth.ts

@@ -107,13 +107,6 @@ export async function setResourceHeaderAuth(
             resource.resourcePolicyId === null &&
             resource.defaultResourcePolicyId !== null;
 
-        const headerAuthHash =
-            user && password && extendedCompatibility !== null
-                ? await hashPassword(
-                      Buffer.from(`${user}:${password}`).toString("base64")
-                  )
-                : null;
-
         await db.transaction(async (trx) => {
             if (isInlinePolicy) {
                 const policyId = resource.defaultResourcePolicyId!;
@@ -123,7 +116,11 @@ export async function setResourceHeaderAuth(
                         eq(resourcePolicyHeaderAuth.resourcePolicyId, policyId)
                     );
 
-                if (headerAuthHash !== null && extendedCompatibility !== null) {
+                if (user && password && extendedCompatibility !== null) {
+                    const headerAuthHash = await hashPassword(
+                        Buffer.from(`${user}:${password}`).toString("base64")
+                    );
+
                     await trx.insert(resourcePolicyHeaderAuth).values({
                         resourcePolicyId: policyId,
                         headerAuthHash,
@@ -143,7 +140,11 @@ export async function setResourceHeaderAuth(
                         )
                     );
 
-                if (headerAuthHash !== null && extendedCompatibility !== null) {
+                if (user && password && extendedCompatibility !== null) {
+                    const headerAuthHash = await hashPassword(
+                        Buffer.from(`${user}:${password}`).toString("base64")
+                    );
+
                     await Promise.all([
                         trx
                             .insert(resourceHeaderAuth)

src/components/resource-policy/PolicyAccessRulesSection.tsx

@@ -340,8 +340,7 @@ function PolicyAccessRulesSectionEdit({
             ? rules.filter((rule) => !rule.fromPolicy)
             : rules;
         const rulesPayload = rulesToValidate.map(
-            ({ ruleId, action, match, value, priority, enabled, new: isNew }) => ({
-                ...(isNew ? {} : { ruleId }),
+            ({ action, match, value, priority, enabled }) => ({
                 action,
                 match,
                 value,