feat(authorization): Trigger migration automatically

Instead of doing a synchronization of roles in Keycloak, trigger a
migration to new access rights structures on startup of the core
component.

Signed-off-by: Oliver Heger <[email protected]>

Author: oheger-bosch

core/src/main/kotlin/di/Module.kt

@@ -22,11 +22,13 @@ package org.eclipse.apoapsis.ortserver.core.di
 import com.typesafe.config.ConfigFactory
 
 import io.ktor.server.config.ApplicationConfig
+import io.ktor.server.config.tryGetString
 
 import kotlinx.serialization.json.Json
 
 import org.eclipse.apoapsis.ortserver.clients.keycloak.DefaultKeycloakClient
 import org.eclipse.apoapsis.ortserver.clients.keycloak.KeycloakClient
+import org.eclipse.apoapsis.ortserver.components.authorization.keycloak.migration.RolesToDbMigration
 import org.eclipse.apoapsis.ortserver.components.authorization.service.AuthorizationService
 import org.eclipse.apoapsis.ortserver.components.authorization.service.DbAuthorizationService
 import org.eclipse.apoapsis.ortserver.components.authorization.service.KeycloakUserService
@@ -210,4 +212,17 @@ fun ortServerModule(config: ApplicationConfig, db: Database?, authorizationServi
     singleOf(::PluginService)
     singleOf(::PluginTemplateEventStore)
     singleOf(::PluginTemplateService)
+
+    single { RolesToDbMigration(get(), get(), getKeycloakGroupPrefix(config), get()) }
 }
+
+/**
+ * Retrieve the prefix for Keycloak groups representing roles for hierarchy elements from the given [config]. This is
+ * needed for the migration of roles managed by Keycloak to roles stored in the database. The prefix is obtained from
+ * the configuration of the authorization component based on Keycloak. It is, however, possible to override it via a
+ * special property for the migration. This is useful for instance, to test the migration on different ORT Server
+ * deployments, e.g. a test environment.
+ */
+private fun getKeycloakGroupPrefix(config: ApplicationConfig): String =
+    config.tryGetString("keycloak.migrationGroupPrefix")
+        ?: config.tryGetString("keycloak.groupPrefix").orEmpty()

core/src/main/kotlin/plugins/Lifecycle.kt

@@ -26,8 +26,8 @@ import kotlin.concurrent.thread
 
 import kotlinx.coroutines.Dispatchers
 import kotlinx.coroutines.launch
+import org.eclipse.apoapsis.ortserver.components.authorization.keycloak.migration.RolesToDbMigration
 
-import org.eclipse.apoapsis.ortserver.components.authorization.keycloak.service.AuthorizationService
 import org.eclipse.apoapsis.ortserver.utils.logging.runBlocking
 import org.eclipse.apoapsis.ortserver.utils.logging.withMdcContext
 
@@ -41,26 +41,28 @@ import org.slf4j.MDC
  */
 fun Application.configureLifecycle() {
     monitor.subscribe(ApplicationStarted) {
-        val authorizationService by inject<AuthorizationService>()
+        val rolesMigration by inject<RolesToDbMigration>()
 
         val mdcContext = MDC.getCopyOfContextMap()
 
         thread {
             MDC.setContextMap(mdcContext)
             runBlocking(Dispatchers.IO) {
-                syncRoles(authorizationService)
+                migrateRoles(rolesMigration)
             }
         }
     }
 }
 
 /**
- * Trigger the synchronization of permissions and roles in Keycloak. The synchronization then runs in the background.
+ * Perform a migration to new database-based structures for access rights if necessary. This makes sure that the
+ * new structures are populated once when switching from access rights stored in Keycloak to the new storage in the
+ * database. The migration then runs in the background.
  */
-private suspend fun syncRoles(authorizationService: AuthorizationService) {
+private suspend fun migrateRoles(migration: RolesToDbMigration) {
     withMdcContext("component" to "core") {
         launch {
-            authorizationService.ensureSuperuserAndSynchronizeRolesAndPermissions()
+            migration.migrateRolesToDb()
         }
     }
 }

core/src/main/resources/application.conf

@@ -74,6 +74,7 @@ keycloak {
   subjectClientId = ${?KEYCLOAK_SUBJECT_CLIENT_ID}
   groupPrefix = ""
   groupPrefix = ${?KEYCLOAK_GROUP_PREFIX}
+  migrationGroupPrefix = ${?KEYCLOAK_MIGRATION_GROUP_PREFIX}
   timeoutSeconds = 60
   timeoutSeconds = ${?KEYCLOAK_TIMEOUT_SECONDS}
 }