feat(sso): send groups to event bus (#2227)

Signed-off-by: Miguel Martinez <miguel@chainloop.dev>

Author: migmartri

app/controlplane/internal/service/auth.go

@@ -259,9 +259,10 @@ type upstreamOIDCclaims struct {
 	// It might show the user's proxy email used during login
 	// https://learn.microsoft.com/en-us/entra/identity/authentication/howto-authentication-use-email-signin
 	// https://learn.microsoft.com/en-us/entra/identity-platform/id-token-claims-reference
-	PreferredUsername string `json:"preferred_username"`
-	FamilyName        string `json:"family_name"`
-	GivenName         string `json:"given_name"`
+	PreferredUsername string   `json:"preferred_username"`
+	FamilyName        string   `json:"family_name"`
+	GivenName         string   `json:"given_name"`
+	Groups            []string `json:"groups"`
 }
 
 // Will retrieve the email from the preferred username if it's a valid email
@@ -309,6 +310,7 @@ func callbackHandler(svc *AuthService, w http.ResponseWriter, r *http.Request) *
 	u, err := svc.userUseCase.UpsertByEmail(ctx, claims.preferredEmail(), &biz.UpsertByEmailOpts{
 		FirstName: &claims.GivenName,
 		LastName:  &claims.FamilyName,
+		SSOGroups: claims.Groups,
 	})
 	if err != nil {
 		return newOauthResp(http.StatusInternalServerError, fmt.Errorf("failed to find or create user: %w", err), false)

app/controlplane/pkg/auditor/events/user.go

@@ -1,5 +1,5 @@
 //
-// Copyright 2024 The Chainloop Authors.
+// Copyright 2024-2025 The Chainloop Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -38,8 +38,9 @@ const (
 
 // UserBase is the base struct for policy events
 type UserBase struct {
-	UserID *uuid.UUID `json:"user_id,omitempty"`
-	Email  string     `json:"email,omitempty"`
+	UserID    *uuid.UUID `json:"user_id,omitempty"`
+	Email     string     `json:"email,omitempty"`
+	SSOGroups []string   `json:"sso_groups,omitempty"`
 }
 
 func (p *UserBase) RequiresActor() bool {

app/controlplane/pkg/biz/user.go

@@ -1,5 +1,5 @@
 //
-// Copyright 2024 The Chainloop Authors.
+// Copyright 2024-2025 The Chainloop Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -120,6 +120,7 @@ type UpsertByEmailOpts struct {
 	DisableAutoOnboarding *bool
 	FirstName             *string
 	LastName              *string
+	SSOGroups             []string
 }
 
 // UpsertByEmail finds or creates a user by email. By default, it will auto-onboard the user
@@ -147,17 +148,19 @@ func (uc *UserUseCase) UpsertByEmail(ctx context.Context, email string, opts *Up
 		ctx = entities.WithCurrentUser(ctx, &entities.User{Email: u.Email, ID: u.ID})
 		uc.auditorUC.Dispatch(ctx, &events.UserSignedUp{
 			UserBase: &events.UserBase{
-				UserID: ToPtr(uuid.MustParse(u.ID)),
-				Email:  u.Email,
+				UserID:    ToPtr(uuid.MustParse(u.ID)),
+				Email:     u.Email,
+				SSOGroups: opts.SSOGroups,
 			},
 		}, nil)
 	} else {
 		// Login case
 		ctx = entities.WithCurrentUser(ctx, &entities.User{Email: u.Email, ID: u.ID})
 		uc.auditorUC.Dispatch(ctx, &events.UserLoggedIn{
 			UserBase: &events.UserBase{
-				UserID: ToPtr(uuid.MustParse(u.ID)),
-				Email:  u.Email,
+				UserID:    ToPtr(uuid.MustParse(u.ID)),
+				Email:     u.Email,
+				SSOGroups: opts.SSOGroups,
 			},
 			LoggedIn: time.Now(),
 		}, nil)