WPB-14306 [enterprise login] Implement common prerequisites for multiple endpoints

cassandra-schema.cql

@@ -245,9 +245,11 @@ CREATE TABLE brig_test.mls_key_package_refs (
     AND read_repair_chance = 0.0
     AND speculative_retry = '99PERCENTILE';
 
-CREATE TABLE brig_test.excluded_phones (
-    prefix text PRIMARY KEY,
-    comment text
+CREATE TABLE brig_test.oauth_client (
+    id uuid PRIMARY KEY,
+    name text,
+    redirect_uri blob,
+    secret blob
 ) WITH bloom_filter_fp_chance = 0.01
     AND caching = {'keys': 'ALL', 'rows_per_partition': 'NONE'}
     AND comment = ''
@@ -432,6 +434,24 @@ CREATE TABLE brig_test.user_keys (
     AND read_repair_chance = 0.0
     AND speculative_retry = '99PERCENTILE';
 
+CREATE TABLE brig_test.excluded_phones (
+    prefix text PRIMARY KEY,
+    comment text
+) WITH bloom_filter_fp_chance = 0.01
+    AND caching = {'keys': 'ALL', 'rows_per_partition': 'NONE'}
+    AND comment = ''
+    AND compaction = {'class': 'org.apache.cassandra.db.compaction.SizeTieredCompactionStrategy', 'max_threshold': '32', 'min_threshold': '4'}
+    AND compression = {'chunk_length_in_kb': '64', 'class': 'org.apache.cassandra.io.compress.LZ4Compressor'}
+    AND crc_check_chance = 1.0
+    AND dclocal_read_repair_chance = 0.1
+    AND default_time_to_live = 0
+    AND gc_grace_seconds = 864000
+    AND max_index_interval = 2048
+    AND memtable_flush_period_in_ms = 0
+    AND min_index_interval = 128
+    AND read_repair_chance = 0.0
+    AND speculative_retry = '99PERCENTILE';
+
 CREATE TABLE brig_test.mls_public_keys (
     user uuid,
     client text,
@@ -534,11 +554,14 @@ CREATE TABLE brig_test.federation_remote_teams (
     AND read_repair_chance = 0.0
     AND speculative_retry = '99PERCENTILE';
 
-CREATE TABLE brig_test.oauth_client (
-    id uuid PRIMARY KEY,
-    name text,
-    redirect_uri blob,
-    secret blob
+CREATE TABLE brig_test.domain_registration (
+    domain text PRIMARY KEY,
+    backend_url blob,
+    dns_verification_token ascii,
+    domain_redirect int,
+    idp_id uuid,
+    team uuid,
+    team_invite int
 ) WITH bloom_filter_fp_chance = 0.01
     AND caching = {'keys': 'ALL', 'rows_per_partition': 'NONE'}
     AND comment = ''

charts/brig/templates/configmap.yaml

@@ -368,5 +368,8 @@ data:
       setOAuthMaxActiveRefreshTokens: {{ .setOAuthMaxActiveRefreshTokens }}
       {{- end }}
       setPasswordHashingOptions: {{ toYaml .setPasswordHashingOptions | nindent 8 }}
+      {{- if .setAuditRecipient }}
+      setAuditRecipient: {{ .setAuditRecipient }}
+      {{- end }}
     {{- end }}
   {{- end }}

charts/brig/values.yaml

@@ -156,6 +156,7 @@ config:
       # iterations: <iterations>
       # parallelism: <paralellism>
       # memory: <memory used in KiB>
+    # setAuditRecipient: [email protected]
   smtp:
     passwordFile: /etc/wire/brig/secrets/smtp-password.txt
   proxy: {}

docs/src/developer/reference/config-options.md

@@ -822,6 +822,17 @@ brig:
       accountPages: https://account.wire.com
 ```
 
+### Enterprise Login Audit Log
+
+Audit logs for any update (POST, PUT, DELETE) of a domain registration via the internal API are sent via email to the specified email address. If not specified no audit logs will be sent.
+
+```yaml
+brig:
+  config:
+    optSettings:
+      setAuditRecipient: [email protected]
+```
+
 ## Settings in cargohold
 
 AWS S3 (or an alternative provider / service) is used to upload and download

integration/integration.cabal

@@ -120,6 +120,7 @@ library
     Test.Conversation
     Test.Demo
     Test.EJPD
+    Test.EnterpriseLogin
     Test.Errors
     Test.Events
     Test.ExternalPartner

integration/test/API/BrigInternal.hs

@@ -329,3 +329,38 @@ putSSOId user args = do
           "subject" .= args.subject,
           "tenant" .= args.tenant
         ]
+
+domainRegistrationLock :: (HasCallStack, MakesValue domain) => domain -> String -> App Response
+domainRegistrationLock domain registrationDomain = do
+  req <- baseRequest domain Brig Unversioned $ joinHttpPath ["i", "domain-registration", registrationDomain, "lock"]
+  submit "POST" req
+
+domainRegistrationUnlock :: (HasCallStack, MakesValue domain) => domain -> String -> App Response
+domainRegistrationUnlock domain registrationDomain = do
+  req <- baseRequest domain Brig Unversioned $ joinHttpPath ["i", "domain-registration", registrationDomain, "unlock"]
+  submit "POST" req
+
+domainRegistrationPreAuthorize :: (HasCallStack, MakesValue domain) => domain -> String -> App Response
+domainRegistrationPreAuthorize domain registrationDomain = do
+  req <- baseRequest domain Brig Unversioned $ joinHttpPath ["i", "domain-registration", registrationDomain, "preauthorize"]
+  submit "POST" req
+
+domainRegistrationUnAuthorize :: (HasCallStack, MakesValue domain) => domain -> String -> App Response
+domainRegistrationUnAuthorize domain registrationDomain = do
+  req <- baseRequest domain Brig Unversioned $ joinHttpPath ["i", "domain-registration", registrationDomain, "unauthorize"]
+  submit "POST" req
+
+updateDomainRegistration :: (HasCallStack, MakesValue domain) => domain -> String -> Value -> App Response
+updateDomainRegistration domain registrationDomain payload = do
+  req <- baseRequest domain Brig Unversioned $ joinHttpPath ["i", "domain-registration", registrationDomain]
+  submit "PUT" $ req & addJSON payload
+
+deleteDomainRegistration :: (HasCallStack, MakesValue domain) => domain -> String -> App Response
+deleteDomainRegistration domain registrationDomain = do
+  req <- baseRequest domain Brig Unversioned $ joinHttpPath ["i", "domain-registration", registrationDomain]
+  submit "DELETE" req
+
+getDomainRegistration :: (HasCallStack, MakesValue domain) => domain -> String -> App Response
+getDomainRegistration domain registrationDomain = do
+  req <- baseRequest domain Brig Unversioned $ joinHttpPath ["i", "domain-registration", registrationDomain]
+  submit "GET" req

integration/test/API/Common.hs

@@ -20,6 +20,11 @@ randomEmail = do
   u <- randomName
   pure $ u <> "@example.com"
 
+randomDomain :: App String
+randomDomain = do
+  u <- randomName
+  pure $ (fmap toLower u) <> ".com"
+
 randomExternalId :: App String
 randomExternalId = liftIO $ do
   -- external ID has no constraints, but we only generate human-readable samples