Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update invite_info protocol to support multiple greeters during a user invite #9078

Closed
vxgmichel opened this issue Dec 2, 2024 · 1 comment · Fixed by #9394
Closed

Update invite_info protocol to support multiple greeters during a user invite #9078

vxgmichel opened this issue Dec 2, 2024 · 1 comment · Fixed by #9394
Assignees
Labels
I-Rust Impact: Rust-related stuff

Comments

@vxgmichel
Copy link
Contributor

vxgmichel commented Dec 2, 2024

A couple of TODOs have been added to invite_info.json5:

// TODO: merge into `created_by`
"name": "greeter_user_id",
"type": "UserID"
},
{
// TODO: merge into `created_by`
"name": "greeter_human_handle",
"type": "HumanHandle"
}
// TODO: Add a `created_by` field and make it an `InviteInfoCreatedBy` type
// which is a nested variant of either:
// - OrganizationAdministrator<UserID, HumanHandle>
// - ExternalService<String>
//
// TODO: Add an `administrators` field and make it a `List<InviteInfoAdministrator>` type
// which is a nested type with the fields:
// - user_id: UserID
// - human_handle: HumanHandle
// - status: ONLINE | OFFLINE | UNKNOWN
]
},
{
"name": "Device",
"discriminant_value": "DEVICE",
"fields": [
{
// TODO: Rename to `claimer_user_id`
"name": "greeter_user_id",
"type": "UserID"
},
{
// TODO: Rename to `claimer_human_handle`
"name": "greeter_human_handle",
"type": "HumanHandle"

Those changes are part of several efforts that have been done to allow any administrator to greet a new user into an organisation.

The first of those changes was the addition of the greeter id field in the claimer command as part of the new invite protocol. This was obviously useful for the shamir invite, but it will also be useful for the user invite.

Once those TODOs are processed, the protocol should be fully ready for the more powerful user invite. There remains a couple of instances in the server where the term greeter is used instead of created_by (i.e the creator of the invitation, which is now potentially different from the claimer). This in particular affects the EventInvitation, but the greeter field is only used internally in the server (the event sent to the client does not include a greeter field). That means those changes can easily be done later. Similarly, the client does not support a choice of greeter for user invite, but this can be implemented later without changing the protocol.

We should use the opportunity of the API protocol version bump to version 5 to implement those changes.

One more note: those changes also lay the groundwork for the invitation to be created by an external service instead of an organization administrator. This is possible due to the invitation creation not being cryptographically secured by a certificate. That means that any service with an administration token could create an invitation and trigger the sending of the invite email (similar to the user freeze feature). This is useful for linking parsec to an existing directory, or for parsec auth to automatically create shamir recovery invitation.

Extra question: should all this go into a separate RFC?

@FirelightFlagboy FirelightFlagboy added the I-Rust Impact: Rust-related stuff label Dec 4, 2024
@mmmarcos
Copy link
Contributor

mmmarcos commented Dec 4, 2024

TL;DR this will allow:

  • A user to be greeted by an admin other than the one who created the invitation.
  • An external service (with auth token) to create invitations. For example an LDAP could automatically create invitations. They still need to be validated by an admin.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
I-Rust Impact: Rust-related stuff
Projects
None yet
Development

Successfully merging a pull request may close this issue.

3 participants