mirror of
https://github.com/SigNoz/signoz.git
synced 2026-03-09 23:12:20 +00:00
6de4520a95
## Summary
- Adds root user support with environment-based provisioning, protection guards, and automatic reconciliation. A root user is a special admin user that is provisioned via configuration (environment variables) rather than the UI, designed for automated/headless deployments.
## Key Features
- Environment-based provisioning: Configure root user via user.root.enabled, user.root.email, user.root.password, and user.root.org_name settings
- Automatic reconciliation: A background service runs on startup that:
- Looks up the organization by configured org_name
- If no matching org exists, creates the organization and root user via CreateFirstUser
- If the org exists, reconciles the root user (creates, promotes existing user, or updates email/password to match config)
- Retries every 10 seconds until successful
- Protection guards: Root users cannot be:
- Updated or deleted through the API
- Invited or have their password changed through the UI
- Authenticated via SSO/SAML (password-only authentication enforced)
- Self-registration disabled: When root user provisioning is enabled, the self-registration endpoint (/register) is blocked to prevent creating duplicate organizations
- Idempotent password sync: On every reconciliation, the root user's password is synced with the configured value — if it differs, it's updated; if it matches, no-op
81 lines
1.9 KiB
Go
81 lines
1.9 KiB
Go
package sqlmigration
|
|
|
|
import (
|
|
"context"
|
|
|
|
"github.com/SigNoz/signoz/pkg/factory"
|
|
"github.com/SigNoz/signoz/pkg/sqlschema"
|
|
"github.com/SigNoz/signoz/pkg/sqlstore"
|
|
"github.com/uptrace/bun"
|
|
"github.com/uptrace/bun/migrate"
|
|
)
|
|
|
|
type addRootUser struct {
|
|
sqlstore sqlstore.SQLStore
|
|
sqlschema sqlschema.SQLSchema
|
|
}
|
|
|
|
func NewAddRootUserFactory(sqlstore sqlstore.SQLStore, sqlschema sqlschema.SQLSchema) factory.ProviderFactory[SQLMigration, Config] {
|
|
return factory.NewProviderFactory(factory.MustNewName("add_root_user"), func(ctx context.Context, providerSettings factory.ProviderSettings, config Config) (SQLMigration, error) {
|
|
return &addRootUser{
|
|
sqlstore: sqlstore,
|
|
sqlschema: sqlschema,
|
|
}, nil
|
|
})
|
|
}
|
|
|
|
func (migration *addRootUser) Register(migrations *migrate.Migrations) error {
|
|
if err := migrations.Register(migration.Up, migration.Down); err != nil {
|
|
return err
|
|
}
|
|
|
|
return nil
|
|
}
|
|
|
|
func (migration *addRootUser) Up(ctx context.Context, db *bun.DB) error {
|
|
if err := migration.sqlschema.ToggleFKEnforcement(ctx, db, false); err != nil {
|
|
return err
|
|
}
|
|
|
|
tx, err := db.BeginTx(ctx, nil)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
|
|
defer func() {
|
|
_ = tx.Rollback()
|
|
}()
|
|
|
|
table, uniqueConstraints, err := migration.sqlschema.GetTable(ctx, sqlschema.TableName("users"))
|
|
if err != nil {
|
|
return err
|
|
}
|
|
|
|
column := &sqlschema.Column{
|
|
Name: sqlschema.ColumnName("is_root"),
|
|
DataType: sqlschema.DataTypeBoolean,
|
|
Nullable: false,
|
|
}
|
|
|
|
sqls := migration.sqlschema.Operator().AddColumn(table, uniqueConstraints, column, false)
|
|
for _, sql := range sqls {
|
|
if _, err := tx.ExecContext(ctx, string(sql)); err != nil {
|
|
return err
|
|
}
|
|
}
|
|
|
|
if err := tx.Commit(); err != nil {
|
|
return err
|
|
}
|
|
|
|
if err := migration.sqlschema.ToggleFKEnforcement(ctx, db, true); err != nil {
|
|
return err
|
|
}
|
|
|
|
return nil
|
|
}
|
|
|
|
func (migration *addRootUser) Down(ctx context.Context, db *bun.DB) error {
|
|
return nil
|
|
}
|