发布 0.1.0:通知渠道、告警规则、令牌版本与安全加固

internal/oci/tenantuser.go

@@ -6,6 +6,7 @@ import (
 	"errors"
 	"fmt"
 	"math/big"
+	"slices"
 	"strings"
 	"time"
 
@@ -28,11 +29,18 @@ type TenantUser struct {
 	LastLoginTime  *time.Time `json:"lastLoginTime,omitempty"`
 }
 
-// Oracle 预置的管理员角色与管理员组显示名。
-const (
-	domainAdminRoleName     = "Identity Domain Administrator"
-	administratorsGroupName = "Administrators"
-)
+// Oracle 预置的「身份域管理员」应用角色显示名。
+const domainAdminRoleName = "Identity Domain Administrator"
+
+// adminGroupNames 是租户管理员组候选名(按优先序):原生域为 Administrators,
+// IDCS 迁移域(idcs foundation,如 OracleIdentityCloudService)为 OCI_Administrators;
+// 迁移域另有 IDCS_Administrators 属身份域管理范畴,由上面的应用角色概念覆盖,不算在内。
+var adminGroupNames = []string{"Administrators", "OCI_Administrators"}
+
+// isAdminGroupName 判断组显示名是否为租户管理员组。
+func isAdminGroupName(name string) bool {
+	return slices.Contains(adminGroupNames, name)
+}
 
 // scimAppRolesAttr 是 SCIM 用户 appRoles 扩展属性的完整路径。
 const scimAppRolesAttr = "urn:ietf:params:scim:schemas:oracle:idcs:extension:user:User:appRoles"
@@ -48,8 +56,8 @@ type TenantUserDetail struct {
 }
 
 // GetTenantUserDetail 实现 Client：查用户域档案与管理员状态（编辑表单预填充用）。
-func (c *RealClient) GetTenantUserDetail(ctx context.Context, cred Credentials, homeRegion, userID string) (TenantUserDetail, error) {
-	dc, err := c.domainsClient(ctx, cred, homeRegion)
+func (c *RealClient) GetTenantUserDetail(ctx context.Context, cred Credentials, homeRegion, domainID, userID string) (TenantUserDetail, error) {
+	dc, err := c.domainsClient(ctx, cred, homeRegion, domainID)
 	if err != nil {
 		return TenantUserDetail{}, err
 	}
@@ -68,7 +76,7 @@ func toTenantUserDetail(u identitydomains.User) TenantUserDetail {
 		d.FamilyName = deref(u.Name.FamilyName)
 	}
 	for _, g := range u.Groups {
-		if deref(g.Display) == administratorsGroupName {
+		if isAdminGroupName(deref(g.Display)) {
 			d.InAdminGroup = true
 		}
 	}
@@ -94,8 +102,13 @@ func (c *RealClient) identityClientAt(cred Credentials, region string) (identity
 	return ic, nil
 }
 
-// ListTenantUsers 实现 Client：列出租户全部 IAM 用户。
-func (c *RealClient) ListTenantUsers(ctx context.Context, cred Credentials) ([]TenantUser, error) {
+// ListTenantUsers 实现 Client：列出租户 IAM 用户。
+// domainID 非空时经 Identity Domains SCIM 只列该域用户;
+// 为空时走经典 IAM(跨域拍平视图,兼容无域老租户)。
+func (c *RealClient) ListTenantUsers(ctx context.Context, cred Credentials, homeRegion, domainID string) ([]TenantUser, error) {
+	if domainID != "" {
+		return c.listDomainUsers(ctx, cred, homeRegion, domainID)
+	}
 	ic, err := c.identityClientAt(cred, "")
 	if err != nil {
 		return nil, err
@@ -117,6 +130,78 @@ func (c *RealClient) ListTenantUsers(ctx context.Context, cred Credentials) ([]T
 	}
 }
 
+// scimListAttrs 是按域列用户时请求的属性集:列表字段 + MFA 与最近登录扩展。
+const scimListAttrs = "id,ocid,userName,description,emails,active,meta.created," +
+	"urn:ietf:params:scim:schemas:oracle:idcs:extension:mfa:User:mfaStatus," +
+	"urn:ietf:params:scim:schemas:oracle:idcs:extension:userState:User:lastSuccessfulLoginDate"
+
+// maxScimUserPages 限制按域列用户的翻页数(每页 200,上限 5000 人)。
+const maxScimUserPages = 25
+
+// listDomainUsers 经 SCIM 按 startIndex 翻页列出域内全部用户。
+func (c *RealClient) listDomainUsers(ctx context.Context, cred Credentials, homeRegion, domainID string) ([]TenantUser, error) {
+	dc, err := c.domainsClient(ctx, cred, homeRegion, domainID)
+	if err != nil {
+		return nil, err
+	}
+	var users []TenantUser
+	attrs := scimListAttrs
+	count := 200
+	start := 1
+	for range maxScimUserPages {
+		req := identitydomains.ListUsersRequest{Attributes: &attrs, Count: &count, StartIndex: &start}
+		resp, err := dc.ListUsers(ctx, req)
+		if err != nil {
+			return nil, fmt.Errorf("list domain users: %w", err)
+		}
+		for _, u := range resp.Resources {
+			users = append(users, toDomainListUser(u, cred.UserOCID))
+		}
+		start += len(resp.Resources)
+		if resp.TotalResults == nil || start > *resp.TotalResults || len(resp.Resources) == 0 {
+			return orEmpty(users), nil
+		}
+	}
+	return orEmpty(users), nil
+}
+
+// toDomainListUser 把 SCIM 用户映射为列表 DTO;ID 用 IAM OCID
+// 保持与经典路径同一 id 语义(IsCurrentUser 比对、后续操作路由)。
+func toDomainListUser(u identitydomains.User, currentUserOCID string) TenantUser {
+	out := toDomainTenantUser(u)
+	out.IsCurrentUser = out.ID == currentUserOCID
+	if u.Active != nil && !*u.Active {
+		out.LifecycleState = "INACTIVE"
+	}
+	if u.Meta != nil {
+		out.TimeCreated = parseScimTime(u.Meta.Created)
+	}
+	if ext := u.UrnIetfParamsScimSchemasOracleIdcsExtensionMfaUser; ext != nil {
+		out.MfaActivated = ext.MfaStatus == identitydomains.ExtensionMfaUserMfaStatusEnrolled
+	}
+	if ext := u.UrnIetfParamsScimSchemasOracleIdcsExtensionUserStateUser; ext != nil {
+		out.LastLoginTime = parseScimTime(ext.LastSuccessfulLoginDate)
+	}
+	for _, e := range u.Emails {
+		if e.Primary != nil && *e.Primary {
+			out.EmailVerified = e.Verified != nil && *e.Verified
+		}
+	}
+	return out
+}
+
+// parseScimTime 解析 SCIM 的 RFC3339 时间串;空值或格式异常返回 nil。
+func parseScimTime(s *string) *time.Time {
+	if s == nil || *s == "" {
+		return nil
+	}
+	t, err := time.Parse(time.RFC3339, *s)
+	if err != nil {
+		return nil
+	}
+	return &t
+}
+
 // CreateTenantUserInput 是创建用户的输入；GivenName/FamilyName 走
 // Identity Domains SCIM（经典 IAM 无对应字段）。两个管理员选项同时勾选时
 // 先授身份域管理员角色，再加入 Administrators 组。
@@ -133,12 +218,13 @@ type CreateTenantUserInput struct {
 // CreateTenantUser 实现 Client：创建用户（须发往 home region）。
 // 优先 Identity Domains SCIM（支持姓名与管理员授权）；SCIM 不可用时回退
 // 经典 IAM API，此时管理员选项无法执行、姓名并入描述。
-func (c *RealClient) CreateTenantUser(ctx context.Context, cred Credentials, homeRegion string, in CreateTenantUserInput) (TenantUser, error) {
-	user, err := c.createUserViaDomain(ctx, cred, homeRegion, in)
+// domainID 非空表示用户显式选择了目标域,SCIM 失败不再回退(避免建错域)。
+func (c *RealClient) CreateTenantUser(ctx context.Context, cred Credentials, homeRegion, domainID string, in CreateTenantUserInput) (TenantUser, error) {
+	user, err := c.createUserViaDomain(ctx, cred, homeRegion, domainID, in)
 	if err == nil {
 		return user, nil
 	}
-	if in.GrantDomainAdmin || in.AddToAdminGroup {
+	if domainID != "" || in.GrantDomainAdmin || in.AddToAdminGroup {
 		return TenantUser{}, fmt.Errorf("create user via identity domain: %w", err)
 	}
 	return c.createUserClassic(ctx, cred, homeRegion, in)
@@ -170,8 +256,8 @@ func (c *RealClient) createUserClassic(ctx context.Context, cred Credentials, ho
 }
 
 // createUserViaDomain 通过 Identity Domains SCIM 创建用户并按选项授权。
-func (c *RealClient) createUserViaDomain(ctx context.Context, cred Credentials, homeRegion string, in CreateTenantUserInput) (TenantUser, error) {
-	dc, err := c.domainsClient(ctx, cred, homeRegion)
+func (c *RealClient) createUserViaDomain(ctx context.Context, cred Credentials, homeRegion, domainID string, in CreateTenantUserInput) (TenantUser, error) {
+	dc, err := c.domainsClient(ctx, cred, homeRegion, domainID)
 	if err != nil {
 		return TenantUser{}, err
 	}
@@ -373,9 +459,9 @@ type UpdateTenantUserInput struct {
 
 // UpdateTenantUser 实现 Client：编辑用户资料（须发往 home region）。
 // 优先 Identity Domains SCIM（支持姓名）；用户不在域中时回退经典
-// IAM API（仅备注与邮箱，姓名变更报错）。
-func (c *RealClient) UpdateTenantUser(ctx context.Context, cred Credentials, homeRegion, userID string, in UpdateTenantUserInput) (TenantUser, error) {
-	dc, err := c.domainsClient(ctx, cred, homeRegion)
+// IAM API（仅备注与邮箱，姓名变更报错）;domainID 非空时不回退。
+func (c *RealClient) UpdateTenantUser(ctx context.Context, cred Credentials, homeRegion, domainID, userID string, in UpdateTenantUserInput) (TenantUser, error) {
+	dc, err := c.domainsClient(ctx, cred, homeRegion, domainID)
 	if err != nil {
 		return TenantUser{}, err
 	}
@@ -394,6 +480,9 @@ func (c *RealClient) UpdateTenantUser(ctx context.Context, cred Credentials, hom
 		}
 		return user, nil
 	}
+	if domainID != "" {
+		return TenantUser{}, fmt.Errorf("update user %s: user not found in identity domain", userID)
+	}
 	if in.GivenName != nil || in.FamilyName != nil {
 		return TenantUser{}, fmt.Errorf("update user %s: 姓名仅身份域用户可修改（该用户不在身份域中）", userID)
 	}
@@ -495,7 +584,11 @@ func emailPatchOp(u identitydomains.User, email string) identitydomains.Operatio
 }
 
 // DeleteTenantUser 实现 Client：删除 IAM 用户（须发往 home region）。
-func (c *RealClient) DeleteTenantUser(ctx context.Context, cred Credentials, homeRegion, userID string) error {
+// domainID 非空时经该域 SCIM 删除(经典 API 对非默认域用户不生效)。
+func (c *RealClient) DeleteTenantUser(ctx context.Context, cred Credentials, homeRegion, domainID, userID string) error {
+	if domainID != "" {
+		return c.deleteDomainUser(ctx, cred, homeRegion, domainID, userID)
+	}
 	ic, err := c.identityClientAt(cred, homeRegion)
 	if err != nil {
 		return err
@@ -506,9 +599,31 @@ func (c *RealClient) DeleteTenantUser(ctx context.Context, cred Credentials, hom
 	return nil
 }
 
+// deleteDomainUser 经 SCIM 强制删除域用户(forceDelete 连带其授权与组成员关系)。
+func (c *RealClient) deleteDomainUser(ctx context.Context, cred Credentials, homeRegion, domainID, userID string) error {
+	dc, err := c.domainsClient(ctx, cred, homeRegion, domainID)
+	if err != nil {
+		return err
+	}
+	scimID, err := scimUserID(ctx, dc, userID)
+	if err != nil {
+		return err
+	}
+	force := true
+	_, err = dc.DeleteUser(ctx, identitydomains.DeleteUserRequest{UserId: &scimID, ForceDelete: &force})
+	if err != nil {
+		return fmt.Errorf("delete domain user %s: %w", userID, err)
+	}
+	return nil
+}
+
 // ResetTenantUserPassword 实现 Client：重置用户控制台密码并返回一次性新密码。
-// 优先经典 IAM API；新式租户（用户只存在于 Identity Domain）自动回退 SCIM。
-func (c *RealClient) ResetTenantUserPassword(ctx context.Context, cred Credentials, homeRegion, userID string) (string, error) {
+// domainID 非空直走该域 SCIM;为空优先经典 IAM API,
+// 新式租户（用户只存在于 Identity Domain）自动回退 SCIM。
+func (c *RealClient) ResetTenantUserPassword(ctx context.Context, cred Credentials, homeRegion, domainID, userID string) (string, error) {
+	if domainID != "" {
+		return c.resetPasswordViaDomain(ctx, cred, homeRegion, domainID, userID)
+	}
 	ic, err := c.identityClientAt(cred, homeRegion)
 	if err != nil {
 		return "", err
@@ -520,12 +635,12 @@ func (c *RealClient) ResetTenantUserPassword(ctx context.Context, cred Credentia
 	if !isClassicUnsupported(err) {
 		return "", fmt.Errorf("reset ui password of %s: %w", userID, err)
 	}
-	return c.resetPasswordViaDomain(ctx, cred, homeRegion, userID)
+	return c.resetPasswordViaDomain(ctx, cred, homeRegion, "", userID)
 }
 
 // resetPasswordViaDomain 通过 Identity Domains SCIM API 强设随机新密码。
-func (c *RealClient) resetPasswordViaDomain(ctx context.Context, cred Credentials, homeRegion, userID string) (string, error) {
-	dc, err := c.domainsClient(ctx, cred, homeRegion)
+func (c *RealClient) resetPasswordViaDomain(ctx context.Context, cred Credentials, homeRegion, domainID, userID string) (string, error) {
+	dc, err := c.domainsClient(ctx, cred, homeRegion, domainID)
 	if err != nil {
 		return "", err
 	}
@@ -558,7 +673,11 @@ func (c *RealClient) resetPasswordViaDomain(ctx context.Context, cred Credential
 
 // DeleteTenantUserMfaDevices 实现 Client：清除用户全部 MFA。
 // 先删经典 TOTP 设备，再通过 Identity Domains 移除全部认证因子（尽力）。
-func (c *RealClient) DeleteTenantUserMfaDevices(ctx context.Context, cred Credentials, homeRegion, userID string) (int, error) {
+func (c *RealClient) DeleteTenantUserMfaDevices(ctx context.Context, cred Credentials, homeRegion, domainID, userID string) (int, error) {
+	// 显式指定域时用户的认证因子只在域内,经典 TOTP 清理不适用
+	if domainID != "" {
+		return 0, c.removeDomainFactors(ctx, cred, homeRegion, domainID, userID)
+	}
 	ic, err := c.identityClientAt(cred, homeRegion)
 	if err != nil {
 		return 0, err
@@ -567,7 +686,7 @@ func (c *RealClient) DeleteTenantUserMfaDevices(ctx context.Context, cred Creden
 	if err != nil {
 		return deleted, err
 	}
-	if err := c.removeDomainFactors(ctx, cred, homeRegion, userID); err != nil {
+	if err := c.removeDomainFactors(ctx, cred, homeRegion, "", userID); err != nil {
 		return deleted, err
 	}
 	return deleted, nil
@@ -594,8 +713,8 @@ func deleteClassicTotpDevices(ctx context.Context, ic identity.IdentityClient, u
 
 // removeDomainFactors 通过 SCIM AuthenticationFactorsRemover 移除用户
 // 在 Identity Domain 注册的全部认证因子；用户不在域中时视为无事可做。
-func (c *RealClient) removeDomainFactors(ctx context.Context, cred Credentials, homeRegion, userID string) error {
-	dc, err := c.domainsClient(ctx, cred, homeRegion)
+func (c *RealClient) removeDomainFactors(ctx context.Context, cred Credentials, homeRegion, domainID, userID string) error {
+	dc, err := c.domainsClient(ctx, cred, homeRegion, domainID)
 	if err != nil {
 		return err
 	}