Update guacamole-user-sync to v0.8.1

data_safe_haven/infrastructure/programs/declarative_sre.py

@@ -345,6 +345,7 @@ def __call__(self) -> None:
             "sre_remote_desktop",
             self.stack_name,
             SRERemoteDesktopProps(
+                admin_group_name=ldap_group_names["admin_group_name"],
                 allow_copy=self.config.sre.remote_desktop.allow_copy,
                 allow_paste=self.config.sre.remote_desktop.allow_paste,
                 database_password=data.password_user_database_admin,
@@ -366,6 +367,7 @@ def __call__(self) -> None:
                 storage_account_name=data.storage_account_data_configuration_name,
                 subnet_guacamole_containers_support=networking.subnet_guacamole_containers_support,
                 subnet_guacamole_containers=networking.subnet_guacamole_containers,
+                user_group_name=ldap_group_names["user_group_name"],
             ),
             tags=self.tags,
         )

data_safe_haven/infrastructure/programs/sre/remote_desktop.py

@@ -26,6 +26,7 @@ class SRERemoteDesktopProps:
 
     def __init__(
         self,
+        admin_group_name: Input[str],
         allow_copy: Input[bool],
         allow_paste: Input[bool],
         database_password: Input[str],
@@ -47,8 +48,10 @@ def __init__(
         storage_account_name: Input[str],
         subnet_guacamole_containers: Input[network.GetSubnetResult],
         subnet_guacamole_containers_support: Input[network.GetSubnetResult],
+        user_group_name: Input[str],
         database_username: Input[str] | None = "postgresadmin",
     ) -> None:
+        self.admin_group_name = admin_group_name
         self.database_password = database_password
         self.database_username = (
             database_username if database_username else "postgresadmin"
@@ -101,6 +104,7 @@ def __init__(
                 else []
             )
         )
+        self.user_group_name = user_group_name
 
 
 class SRERemoteDesktopComponent(ComponentResource):
@@ -163,7 +167,7 @@ def __init__(
         )
 
         # Define the container group with guacd, guacamole and caddy
-        container_group = containerinstance.ContainerGroup(
+        self.container_group = containerinstance.ContainerGroup(
             f"{self._name}_container_group",
             container_group_name=f"{stack_name}-container-group-remote-desktop",
             containers=[
@@ -288,9 +292,18 @@ def __init__(
                     ),
                 ),
                 containerinstance.ContainerArgs(
-                    image="ghcr.io/alan-turing-institute/guacamole-user-sync:v0.7.0",
+                    image="ghcr.io/alan-turing-institute/guacamole-user-sync:v0.8.1",
                     name="guacamole-user-sync"[:63],
                     environment_variables=[
+                        containerinstance.EnvironmentVariableArgs(
+                            name="GUACAMOLE_GROUP_PERMISSIONS",
+                            value=Output.concat(
+                                props.admin_group_name,
+                                "=READ,UPDATE,DELETE,ADMINISTER;",
+                                props.user_group_name,
+                                "=READ",
+                            ),
+                        ),
                         containerinstance.EnvironmentVariableArgs(
                             name="LDAP_GROUP_BASE_DN",
                             value=props.ldap_group_search_base,
@@ -415,7 +428,7 @@ def __init__(
         self.exports = {
             "connection_db_name": db_guacamole_connections,
             "connection_db_server_name": db_server_guacamole.db_server.name,
-            "container_group_name": container_group.name,
+            "container_group_name": self.container_group.name,
             "disable_copy": props.disable_copy,
             "disable_paste": props.disable_paste,
             "resource_group_name": props.resource_group_name,

tests/infrastructure/programs/sre/conftest.py

@@ -1,5 +1,6 @@
 import asyncio
 from typing import Any
+from unittest.mock import patch
 
 import pulumi
 import pulumi.runtime
@@ -25,6 +26,10 @@
     SRENetworkingComponent,
     SRENetworkingProps,
 )
+from data_safe_haven.infrastructure.programs.sre.remote_desktop import (
+    SRERemoteDesktopComponent,
+    SRERemoteDesktopProps,
+)
 
 
 class DataSafeHavenMocks(pulumi.runtime.Mocks):
@@ -42,12 +47,36 @@ def __init__(self) -> None:
     def new_resource(
         self, args: pulumi.runtime.MockResourceArgs
     ) -> tuple[str | None, dict[Any, Any]]:
-        resources = (args.name + "_id", args.inputs)
+        state = dict(args.inputs)
+
+        if args.typ == "azure-native:dns:Zone":
+            # Ensure a value is available for the nameservers
+            # Otherwise these come through as None and the tests fail
+            state["nameServers"] = [
+                "ns1.example.com",
+            ]
+        elif args.typ == "azure-native:network:VirtualNetwork":
+            # Ensure a value is set for the VirtualNetwork name
+            # Otherwise this comes through as None and the tests fail
+            state["name"] = state["virtualNetworkName"]
+
+        resources = (args.name + "_id", state)
         return resources
 
     def call(
-        self, _: pulumi.runtime.MockCallArgs
+        self, args: pulumi.runtime.MockCallArgs
     ) -> tuple[dict[Any, Any], list[tuple[str, str]] | None]:
+        if args.token == "azure-native:network:getSubnet":  # noqa: S105
+            # Ensure we return a validly formed subnet
+            # Otherwise this comes through as None and the tests fail
+            return (
+                {
+                    "id": "/subscriptions/test/subnets/subnet1",
+                    "name": "subnet1",
+                    "addressPrefix": "10.0.0.0/24",
+                },
+                [],
+            )
         return ({}, [])
 
 
@@ -57,6 +86,16 @@ def call(
 )
 
 
+## Avoids a delayed return value causing the tests to fail
+@fixture(autouse=True)
+def patch_ips() -> pulumi.Output[list[str]]:
+    with patch(
+        "data_safe_haven.infrastructure.components.composite.postgresql_database.get_ip_addresses_from_private_endpoint"
+    ) as mock:
+        mock.return_value = pulumi.Output.from_input(["10.0.0.0"])
+        yield mock
+
+
 #
 # Constants
 #
@@ -263,21 +302,50 @@ def dockerhub_credentials() -> DockerHubCredentials:
 
 
 @fixture
-def ldap_user_filter(ldap_group_search_base: str) -> str:
-    ldap_group_name_prefix = "Data Safe Haven SRE unit test"
-    ldap_group_names = {
-        "admin_group_name": f"{ldap_group_name_prefix} Administrators",
-        "privileged_user_group_name": f"{ldap_group_name_prefix} Privileged Users",
-        "user_group_name": f"{ldap_group_name_prefix} Users",
-    }
+def admin_group_name() -> str:
+    return "Data Safe Haven SRE unit test Administrators"
+
+
+@fixture
+def user_group_name() -> str:
+    return "Data Safe Haven SRE unit test Users"
+
+
+@fixture
+def ldap_user_filter(
+    admin_group_name: str, ldap_group_search_base: str, user_group_name: str
+) -> str:
     return "".join(
         [
             "(&",
             "(objectClass=posixAccount)",
             "(|",
             *(
                 f"(memberOf=CN={group_name},{ldap_group_search_base})"
-                for group_name in ldap_group_names.values()
+                for group_name in (admin_group_name, user_group_name)
+            ),
+            ")",
+            ")",
+        ]
+    )
+
+
+@fixture
+def ldap_group_filter(
+    admin_group_name: str, ldap_group_search_base: str, user_group_name: str
+) -> str:
+    return "".join(
+        [
+            "(&",
+            "(objectClass=posixGroup)",
+            "(|",
+            *(
+                f"(CN={group_name})"
+                for group_name in (admin_group_name, user_group_name)
+            ),
+            *(
+                f"(memberOf=CN=Primary user groups for {group_name},{ldap_group_search_base})"
+                for group_name in (admin_group_name, user_group_name)
             ),
             ")",
             ")",
@@ -371,3 +439,60 @@ def repository_data() -> ConfigSubsectionGiteaMirror:
     return ConfigSubsectionGiteaMirror(
         repositories=[],
     )
+
+
+@fixture
+def remote_desktop_props(
+    admin_group_name: str,
+    dns: SREDnsServerComponent,
+    dockerhub_credentials: DockerHubCredentials,
+    ldap_group_filter: str,
+    ldap_group_search_base: str,
+    ldap_server_hostname: str,
+    ldap_user_filter: str,
+    ldap_user_search_base: str,
+    location: str,
+    monitoring_elements: SREMonitoringElementsComponent,
+    networking: SRENetworkingComponent,
+    resource_group: resources.ResourceGroup,
+    user_group_name: str,
+) -> SRERemoteDesktopProps:
+    return SRERemoteDesktopProps(
+        admin_group_name=admin_group_name,
+        allow_copy=True,
+        allow_paste=True,
+        database_password="database_password",
+        dns_server_ip=dns.ip_address,
+        dockerhub_credentials=dockerhub_credentials,
+        entra_application_id="entra_application_id",
+        entra_application_url="https://entra-application.example.com",
+        entra_tenant_id="entra_tenant_id",
+        ldap_group_filter=ldap_group_filter,
+        ldap_group_search_base=ldap_group_search_base,
+        ldap_server_hostname=ldap_server_hostname,
+        ldap_server_port=9999,
+        ldap_user_filter=ldap_user_filter,
+        ldap_user_search_base=ldap_user_search_base,
+        location=location,
+        log_analytics_workspace=monitoring_elements.workspace_analytics,
+        resource_group_name=resource_group.name,
+        storage_account_key="storage_key",
+        storage_account_name="storage_account",
+        subnet_guacamole_containers=networking.subnet_guacamole_containers,
+        subnet_guacamole_containers_support=networking.subnet_guacamole_containers_support,
+        user_group_name=user_group_name,
+    )
+
+
+@fixture
+def remote_desktop_component(
+    remote_desktop_props: SRERemoteDesktopProps,
+    stack_name: str,
+    tags: dict[str, str],
+) -> SRERemoteDesktopComponent:
+    return SRERemoteDesktopComponent(
+        name="remote-desktop-name",
+        stack_name=stack_name,
+        props=remote_desktop_props,
+        tags=tags,
+    )

tests/infrastructure/programs/sre/test_remote_desktop.py

@@ -0,0 +1,112 @@
+from typing import Any
+
+import pulumi
+from packaging.version import Version
+
+from data_safe_haven.infrastructure.programs.sre.remote_desktop import (
+    SRERemoteDesktopComponent,
+)
+from tests.infrastructure.programs.resource_assertions import assert_equal
+
+
+def guacamole_user_sync_container(containers: list[Any]) -> dict[str, Any]:
+    return next(
+        container
+        for container in containers
+        if container["name"] == "guacamole-user-sync"
+    )
+
+
+def group_permissions(value: str) -> dict[str, set[str]]:
+    return {
+        group_name: set(permissions.split(","))
+        for group_name, permissions in (entry.split("=") for entry in value.split(";"))
+    }
+
+
+class TestSRERemoteDesktopProps:
+    @pulumi.runtime.test
+    def test_guacamole_user_sync_image_version(
+        self, remote_desktop_component: SRERemoteDesktopComponent
+    ) -> Any:
+        def check(containers: list[Any]) -> None:
+            container = guacamole_user_sync_container(containers)
+            image, _, tag = container["image"].rpartition(":")
+            assert_equal("ghcr.io/alan-turing-institute/guacamole-user-sync", image)
+            assert Version(tag) >= Version("0.8.1")
+
+        return remote_desktop_component.container_group.containers.apply(check)
+
+    @pulumi.runtime.test
+    def test_guacamole_group_permissions_env_var_present(
+        self, remote_desktop_component: SRERemoteDesktopComponent
+    ) -> Any:
+        def check(containers: list[Any]) -> None:
+            container = guacamole_user_sync_container(containers)
+            env_var = next(
+                env
+                for env in container["environment_variables"]
+                if env["name"] == "GUACAMOLE_GROUP_PERMISSIONS"
+            )
+            assert env_var["value"]
+            assert env_var.get("secure_value") is None
+
+        return remote_desktop_component.container_group.containers.apply(check)
+
+    @pulumi.runtime.test
+    def test_guacamole_group_permissions_admin_group(
+        self,
+        admin_group_name: str,
+        remote_desktop_component: SRERemoteDesktopComponent,
+    ) -> Any:
+        def check(containers: list[Any]) -> None:
+            container = guacamole_user_sync_container(containers)
+            value = next(
+                env["value"]
+                for env in container["environment_variables"]
+                if env["name"] == "GUACAMOLE_GROUP_PERMISSIONS"
+            )
+            assert_equal(
+                {"READ", "UPDATE", "DELETE", "ADMINISTER"},
+                group_permissions(value)[admin_group_name],
+            )
+
+        return remote_desktop_component.container_group.containers.apply(check)
+
+    @pulumi.runtime.test
+    def test_guacamole_group_permissions_user_group(
+        self,
+        remote_desktop_component: SRERemoteDesktopComponent,
+        user_group_name: str,
+    ) -> Any:
+        def check(containers: list[Any]) -> None:
+            container = guacamole_user_sync_container(containers)
+            value = next(
+                env["value"]
+                for env in container["environment_variables"]
+                if env["name"] == "GUACAMOLE_GROUP_PERMISSIONS"
+            )
+            assert_equal({"READ"}, group_permissions(value)[user_group_name])
+
+        return remote_desktop_component.container_group.containers.apply(check)
+
+    @pulumi.runtime.test
+    def test_guacamole_group_permissions_no_extra_groups(
+        self,
+        admin_group_name: str,
+        remote_desktop_component: SRERemoteDesktopComponent,
+        user_group_name: str,
+    ) -> Any:
+        def check(containers: list[Any]) -> None:
+            container = guacamole_user_sync_container(containers)
+            value = next(
+                env["value"]
+                for env in container["environment_variables"]
+                if env["name"] == "GUACAMOLE_GROUP_PERMISSIONS"
+            )
+            assert_equal(
+                {admin_group_name, user_group_name},
+                set(group_permissions(value).keys()),
+            )
+
+        return remote_desktop_component.container_group.containers.apply(check)