feat: added initial server sso key rotation semantics (#2696)

src/core/server/graph/tenant/mutators/Settings.ts

@@ -9,9 +9,10 @@ export const Settings = ({
   tenantCache,
   tenant,
   config,
+  now,
 }: TenantContext) => ({
   update: (input: GQLUpdateSettingsInput): Promise<Tenant | null> =>
     update(mongo, redis, tenantCache, config, tenant, input.settings),
   regenerateSSOKey: (): Promise<Tenant | null> =>
-    regenerateSSOKey(mongo, redis, tenantCache, tenant),
+    regenerateSSOKey(mongo, redis, tenantCache, tenant, now),
 });

src/core/server/graph/tenant/resolvers/SSOAuthIntegration.ts

@@ -0,0 +1,30 @@
+import * as settings from "coral-server/models/settings";
+
+import { GQLSSOAuthIntegrationTypeResolver } from "coral-server/graph/tenant/schema/__generated__/types";
+
+function getActiveSSOKey(keys: settings.SSOKey[]) {
+  return keys.find(
+    key => Boolean(key.secret) && !key.deletedAt && !key.deprecateAt
+  );
+}
+
+export const SSOAuthIntegration: GQLSSOAuthIntegrationTypeResolver<
+  settings.SSOAuthIntegration
+> = {
+  key: ({ keys }) => {
+    const key = getActiveSSOKey(keys);
+    if (key) {
+      return key.secret;
+    }
+
+    return null;
+  },
+  keyGeneratedAt: ({ keys }) => {
+    const key = getActiveSSOKey(keys);
+    if (key) {
+      return key.createdAt;
+    }
+
+    return null;
+  },
+};

src/core/server/graph/tenant/resolvers/index.ts

@@ -1,6 +1,7 @@
 import Cursor from "coral-server/graph/common/scalars/cursor";
 import Locale from "coral-server/graph/common/scalars/locale";
 import Time from "coral-server/graph/common/scalars/time";
+
 import { GQLResolver } from "coral-server/graph/tenant/schema/__generated__/types";
 
 import { ApproveCommentPayload } from "./ApproveCommentPayload";
@@ -36,6 +37,7 @@ import { Profile } from "./Profile";
 import { Query } from "./Query";
 import { RecentCommentHistory } from "./RecentCommentHistory";
 import { RejectCommentPayload } from "./RejectCommentPayload";
+import { SSOAuthIntegration } from "./SSOAuthIntegration";
 import { Story } from "./Story";
 import { StorySettings } from "./StorySettings";
 import { Subscription } from "./Subscription";
@@ -56,10 +58,10 @@ const Resolvers: GQLResolver = {
   Comment,
   CommentCounts,
   CommentCreatedPayload,
-  CommentReleasedPayload,
   CommentEnteredModerationQueuePayload,
   CommentLeftModerationQueuePayload,
   CommentModerationAction,
+  CommentReleasedPayload,
   CommentReplyCreatedPayload,
   CommentRevision,
   CommentStatusUpdatedPayload,
@@ -71,8 +73,10 @@ const Resolvers: GQLResolver = {
   GoogleAuthIntegration,
   Invite,
   LiveConfiguration,
+  Locale,
   ModerationQueue,
   ModerationQueues,
+  ModeratorNote,
   Mutation,
   OIDCAuthIntegration,
   PremodStatus,
@@ -81,19 +85,18 @@ const Resolvers: GQLResolver = {
   Query,
   RecentCommentHistory,
   RejectCommentPayload,
+  SSOAuthIntegration,
   Story,
   StorySettings,
   Subscription,
   SuspensionStatus,
   SuspensionStatusHistory,
-  UsernameHistory,
   Tag,
   Time,
-  Locale,
   User,
-  UserStatus,
+  UsernameHistory,
   UsernameStatus,
-  ModeratorNote,
+  UserStatus,
 };
 
 export default Resolvers;

src/core/server/graph/tenant/subscriptions/server.ts

@@ -15,7 +15,7 @@ import {
 } from "subscriptions-transport-ws";
 
 import { ACCESS_TOKEN_PARAM, CLIENT_ID_PARAM } from "coral-common/constants";
-import { Omit } from "coral-common/types";
+import { Omit, RequireProperty } from "coral-common/types";
 import { AppOptions } from "coral-server/app";
 import { getHostname } from "coral-server/app/helpers/hostname";
 import {
@@ -36,12 +36,13 @@ import {
 } from "coral-server/graph/common/extensions";
 import { getOperationMetadata } from "coral-server/graph/common/extensions/helpers";
 import { getPersistedQuery } from "coral-server/graph/common/persisted";
-import { GQLUSER_ROLE } from "coral-server/graph/tenant/schema/__generated__/types";
 import logger from "coral-server/logger";
 import { PersistedQuery } from "coral-server/models/queries";
 import { hasStaffRole } from "coral-server/models/user/helpers";
 import { extractTokenFromRequest } from "coral-server/services/jwt";
 
+import { GQLUSER_ROLE } from "coral-server/graph/tenant/schema/__generated__/types";
+
 import TenantContext, { TenantContextOptions } from "../context";
 
 type OnConnectFn = (
@@ -77,11 +78,10 @@ export function extractClientID(connectionParams: OperationMessagePayload) {
   return null;
 }
 
-export type OnConnectOptions = Omit<
-  TenantContextOptions,
-  "tenant" | "signingConfig" | "disableCaching"
-> &
-  Required<Pick<TenantContextOptions, "signingConfig">>;
+export type OnConnectOptions = RequireProperty<
+  Omit<TenantContextOptions, "tenant" | "disableCaching">,
+  "signingConfig"
+>;
 
 export function onConnect(options: OnConnectOptions): OnConnectFn {
   // Create the JWT verifiers that will be used to verify all the requests