admin: store operators in config store, drop SSO-group role mapping (#840)

* admin: store operators in config store, drop SSO-group role mapping

Replace the Google/Cognito group-based admin role mapping with an
`operators` table in the config store. Roles are resolved per-request
from that table: an SSO-authenticated `@posthog.com` identity is admin
only if a matching `admin` operator row exists, else viewer. The
break-glass internal token still grants admin.

The Cognito/Google federation never forwarded Workspace group
membership, so the group claim was always empty and every SSO user
fell through to viewer.

The operators table is self-service. The first SSO login auto-provisions
a create-only viewer row for the caller, so an operator appears in the
config store just by logging in. To make the first admin, log in over
break-glass (internal-secret) and patch your row to admin under the new
Admin -> Operators section of the config-store explorer.

- configstore: Operator model (runtime schema, AutoMigrate) + CRUD
  (OperatorRole, List/Upsert/Delete, CountAdmins, SeedOperator)
- admin/authz: RoleResolver replaces SSOConfig; @posthog.com +
  email_verified hardening; groups removed from Identity
- admin: admin-only operators API with last-admin guards; Admin
  sidebar group after Runtime
- multitenant: resolver over OperatorRole with create-only viewer
  auto-provision; env reads for DUCKGRES_ADMIN_SSO_GROUP/ALLOW_ALL
  removed
- ui: Operators management view in the config-store Admin group

* configstore: create operators via goose migration, not AutoMigrate

Operators are authoritative admin-console RBAC principals — losing the
table means admin lockout, so it is not rebuildable/expirable runtime
state. Move it from the runtime schema (AutoMigrate) to the config
schema via a goose migration, alongside the other duckgres_ config
tables.

- new migration 000006_create_operators.sql creating duckgres_operators
- Operator.TableName() -> "duckgres_operators"
- drop the operators entry from autoMigrateRuntimeTables
- operators CRUD queries the bare config-schema table (no runtime
  qualification)
- models explorer descriptor: Runtime flag false (config schema)

* configstore: fix operators migration test parity

The goose-migration integration test asserted the latest version was 5
and compared every migrated config table against GORM model metadata.
Adding 000006 broke both:

- bump the expected latest goose version to 6 (and assert 6 recorded)
- add duckgres_operators to the four metadata-parity table lists and
  add Operator to the GORM comparison AutoMigrate set, so the table is
  covered by the model<->migration drift check
- align the Operator model and migration so they match exactly: size
  tags on the varchar columns, role NOT NULL, no string column default

Author: benben

CLAUDE.md

@@ -320,10 +320,18 @@ user). Design + decisions: `docs/design/admin-ui.md`; package details:
   **before** `go build`. Do not delete `.gitkeep` and do not commit `ui/dist`.
 - **Two-tier authz** (`authz.go`): `AuthMiddleware` resolves every `/api/v1`
   request to admin (valid `TokenSet` internal secret — service/break-glass) or to
-  an SSO identity from the ALB `X-Amzn-Oidc-Data` JWT (group `DUCKGRES_ADMIN_SSO_GROUP`
-  → admin, else viewer). `RoleGate` requires admin for all mutating verbs + the
-  audit GET. `AuditMiddleware` records every mutation. Keep new mutating routes
-  under this gate; never add a write path that bypasses RoleGate/audit.
+  an SSO identity from the ALB `X-Amzn-Oidc-Data` JWT. The SSO email
+  (`@posthog.com` + `email_verified != false`, else 401) is mapped to a role
+  **per-request** by a `RoleResolver` backed by the `duckgres_operators` config-schema
+  table (goose migration `000006_create_operators.sql`) — `admin` row → admin, else
+  viewer. Admins manage operators
+  under **Admin → Operators** (`/api/v1/operators`); the first SSO login
+  auto-provisions a create-only **viewer** row, and the first admin is minted by
+  logging in over the break-glass internal token and patching that row to `admin`
+  under **Admin → Operators**. `RoleGate` requires admin for
+  all mutating verbs + the audit GET. `AuditMiddleware` records every mutation.
+  Keep new mutating routes under this gate; never add a write path that bypasses
+  RoleGate/audit.
 - **Impersonation is a real session** (`impersonate.go` + `admin_providers.go`):
   it reuses `SessionManager.CreateSessionWithProtocol` (workers trust the CP — no
   password) and **always** `DestroySession` in a defer. Admin-only, every
@@ -335,9 +343,12 @@ user). Design + decisions: `docs/design/admin-ui.md`; package details:
   panel KEY, PromQL is built server-side from `rangePanels` (never an open PromQL
   relay) and forwarded to `DUCKGRES_PROMETHEUS_URL`. Org-labelled panels keep
   slicing enforced.
-- **Env-only knobs**: `DUCKGRES_ADMIN_SSO_GROUP`, `DUCKGRES_PROMETHEUS_URL` (read
-  in `multitenant.go`; set by the chart). The audit table `duckgres_admin_audit`
-  is AutoMigrated at startup (operational state, not goose-migrated tenant config).
+- **Env-only knobs**: `DUCKGRES_PROMETHEUS_URL` (read in
+  `multitenant.go`; set by the chart). The audit table `duckgres_admin_audit` is
+  AutoMigrated at startup (operational state, not goose-migrated tenant config).
+  The `duckgres_operators` table is authoritative access-control data, so it lives
+  in the config schema via goose migration `000006_create_operators.sql`, not
+  AutoMigrate.
 - `ManagedSession.Username` is populated at session create so the console can
   slice live sessions/queries by user; keep it set on every create path.
 - Touching any of the above → update `controlplane/admin/*_test.go` (esp

controlplane/admin/README.md

@@ -28,9 +28,16 @@ with a `Role`:
 - A valid `TokenSet` token (`X-Duckgres-Internal-Secret` header or the
   `duckgres_admin_token` cookie) → **admin**. This is the service-to-service /
   break-glass path (`RegisterLogin` mints the cookie via `POST /login`).
-- Otherwise the ALB-injected `X-Amzn-Oidc-Data` JWT (Cognito/Google) is decoded
-  to email + groups. Membership in `DUCKGRES_ADMIN_SSO_GROUP` → **admin**, else
-  **viewer**. (Unset group → admin for any SSO user, logged — set it in prod.)
+- Otherwise the ALB-injected `X-Amzn-Oidc-Data` JWT (Cognito/Google) yields the
+  caller's email (only `@posthog.com`, `email_verified != false`; otherwise
+  treated as unauthenticated). The role is then resolved **per-request** from the
+  `duckgres_operators` table in the config schema (goose migration
+  `000006_create_operators.sql`): an `admin` row →
+  **admin**, anything else (including no row) → **viewer**. Operators are managed
+  by admins under **Admin → Operators** in the config-store explorer (and the
+  `/api/v1/operators` API). The first SSO login auto-provisions a create-only
+  **viewer** operator row; to mint the first admin, log in over the break-glass
+  internal token and patch that row to `admin` under **Admin → Operators**.
 
 `RoleGate` enforces the split: mutating verbs (POST/PUT/PATCH/DELETE) and the
 audit-log GET require admin; other GETs allow viewer. `AuditMiddleware` records
@@ -61,6 +68,9 @@ Added for the console:
 | `GET /api/v1/orgs/:id/users/:username/secrets`, `DELETE .../:name` | viewer/admin | list/delete stored persistent secrets (ciphertext never returned) |
 | `POST /api/v1/orgs/:id/impersonate/query` | admin | run SQL as an org user on their worker |
 | `GET /api/v1/audit` | admin | admin action log |
+| `GET /api/v1/operators` | admin | list console operators (email → role) |
+| `POST /api/v1/operators` | admin | add/update an operator (`{email, role}`; last-admin demotion → 409) |
+| `DELETE /api/v1/operators/:email` | admin | remove an operator (removing the last admin → 409) |
 
 ### Cross-CP live-state aggregation (`live_aggregate.go` + `controlplane/live_aggregator.go`)
 

controlplane/admin/api.go

@@ -78,6 +78,9 @@ func RegisterAPI(r *gin.RouterGroup, store *configstore.ConfigStore, info OrgSta
 	// the concrete store directly because it needs the runtime schema name and
 	// raw DB for tables the typed apiStore interface doesn't surface.
 	registerModelsAPI(r, store)
+	// Admin-only Operators management (the admin-console access list). Each
+	// route self-gates with RequireAdmin; mutations are audited via the group.
+	registerOperatorsAPI(r, store)
 }
 
 func registerAPIWithStore(r *gin.RouterGroup, store apiStore, info OrgStackInfo, fetcher PeerFetcher) {

controlplane/admin/authz.go

@@ -39,24 +39,21 @@ const (
 	albOIDCIdentityHeader = "X-Amzn-Oidc-Identity"
 )
 
-// SSOConfig controls how the ALB/Cognito identity maps to a Role.
-type SSOConfig struct {
-	// AdminGroup is the Google Workspace / Cognito group whose members get the
-	// admin role. When empty, SSO users default to VIEWER (fail closed) unless
-	// AllowAllSSO is set. The break-glass internal-secret path is unaffected.
-	AdminGroup string
-	// AllowAllSSO, when true AND AdminGroup is empty, grants admin to every
-	// SSO-authenticated user (single-tier dev convenience). It must be opted
-	// into explicitly (DUCKGRES_ADMIN_SSO_ALLOW_ALL=true) so a missing group
-	// config in production cannot silently grant admin to everyone.
-	AllowAllSSO bool
-}
+// ssoEmailDomain is the only email domain accepted on the SSO path. SSO emails
+// outside this domain are treated as unauthenticated (defense in depth on top
+// of the ALB/Cognito allow-list and the operators table).
+const ssoEmailDomain = "@posthog.com"
+
+// RoleResolver maps an authenticated SSO email to a Role. It is injected into
+// AuthMiddleware so the auth layer stays free of any config-store dependency;
+// the control plane wires one backed by the operators table. A nil resolver
+// (or one that returns RoleViewer) means the caller is a viewer.
+type RoleResolver func(email string) Role
 
 // Identity is the resolved caller for an admin-UI request.
 type Identity struct {
-	Email  string   `json:"email"`
-	Groups []string `json:"groups"`
-	Role   Role     `json:"role"`
+	Email string `json:"email"`
+	Role  Role   `json:"role"`
 	// Source records how the identity was established (for audit): "sso" or
 	// "internal-secret".
 	Source string `json:"source"`
@@ -74,83 +71,84 @@ func IdentityFromContext(c *gin.Context) *Identity {
 
 // AuthMiddleware authenticates a request and resolves its Role. A valid
 // TokenSet bearer token (header/cookie) is the service-to-service / break-glass
-// path and always maps to admin. Otherwise the ALB-injected Cognito JWT is
-// decoded into an Identity. Unauthenticated requests are rejected 401.
-func AuthMiddleware(tokens TokenSet, sso SSOConfig) gin.HandlerFunc {
+// path and always maps to admin. Otherwise the ALB-injected Cognito JWT yields
+// the caller's email, and resolve (the operators-table lookup) maps that email
+// to a Role. Unauthenticated requests are rejected 401.
+func AuthMiddleware(tokens TokenSet, resolve RoleResolver) gin.HandlerFunc {
 	return func(c *gin.Context) {
-		// 1. Internal secret (header or login cookie) -> admin.
+		// 1. Internal secret (header or login cookie) -> admin (break-glass).
 		if tokens.Valid(requestAdminToken(c)) {
 			c.Set(ctxIdentityKey, &Identity{Email: "internal-secret", Role: RoleAdmin, Source: "internal-secret"})
 			c.Next()
 			return
 		}
-		// 2. ALB/Cognito SSO identity.
-		if id := identityFromOIDC(c, sso); id != nil {
-			c.Set(ctxIdentityKey, id)
-			c.Next()
+		// 2. ALB/Cognito SSO identity: extract the email, then resolve its role.
+		email := emailFromOIDC(c)
+		if email == "" {
+			c.AbortWithStatusJSON(http.StatusUnauthorized, gin.H{"error": "not authenticated"})
 			return
 		}
-		c.AbortWithStatusJSON(http.StatusUnauthorized, gin.H{"error": "not authenticated"})
+		role := RoleViewer
+		if resolve != nil {
+			role = resolve(email)
+		}
+		c.Set(ctxIdentityKey, &Identity{Email: email, Role: role, Source: "sso"})
+		c.Next()
 	}
 }
 
-// identityFromOIDC decodes the ALB OIDC data JWT (or falls back to the identity
-// header) into an Identity with a resolved Role. Returns nil if no SSO identity
-// is present.
+// emailFromOIDC extracts the caller's email from the ALB OIDC data JWT (falling
+// back to the `sub` claim, then to the identity-only header). It returns "" when
+// no usable SSO identity is present OR when the email fails domain hardening.
+//
+// Domain hardening: only @posthog.com emails are accepted, and a JWT
+// email_verified claim that is explicitly false rejects the identity. This is
+// defense in depth on top of the ALB/Cognito allow-list — a stray non-corporate
+// or unverified identity never becomes a logged-in (even viewer) caller.
 //
 // The JWT signature is NOT verified here: the request only reaches this pod via
 // the internal-scheme ALB (which signs and injects the header and strips
 // client-supplied copies) over a tailnet-restricted network. Verifying the
 // ALB's regional public key by `kid` is a hardening follow-up tracked in the
-// design doc; it does not change the role mapping below.
-func identityFromOIDC(c *gin.Context, sso SSOConfig) *Identity {
+// design doc.
+func emailFromOIDC(c *gin.Context) string {
 	raw := c.GetHeader(albOIDCDataHeader)
 	if raw == "" {
-		// Fallback: identity-only header (email/subject), no groups.
-		if email := c.GetHeader(albOIDCIdentityHeader); email != "" {
-			return resolveRole(&Identity{Email: email, Source: "sso"}, sso)
+		// Fallback: identity-only header (email/subject). The data JWT is absent,
+		// so there is no email_verified claim to consult — domain check still applies.
+		if email := c.GetHeader(albOIDCIdentityHeader); acceptableSSOEmail(email, true) {
+			return strings.ToLower(strings.TrimSpace(email))
 		}
-		return nil
+		return ""
 	}
 	claims, err := decodeJWTClaims(raw)
 	if err != nil {
 		slog.Warn("admin: failed to decode ALB OIDC data header", "error", err)
-		return nil
+		return ""
+	}
+	email := stringClaim(claims, "email")
+	if email == "" {
+		email = stringClaim(claims, "sub")
 	}
-	id := &Identity{
-		Email:  stringClaim(claims, "email"),
-		Groups: groupsClaim(claims),
-		Source: "sso",
+	// email_verified, when present, must not be false.
+	verified := true
+	if v, ok := claims["email_verified"]; ok {
+		if b, ok := v.(bool); ok {
+			verified = b
+		}
 	}
-	if id.Email == "" {
-		id.Email = stringClaim(claims, "sub")
+	if !acceptableSSOEmail(email, verified) {
+		return ""
 	}
-	return resolveRole(id, sso)
+	return strings.ToLower(strings.TrimSpace(email))
 }
 
-// resolveRole assigns admin/viewer based on group membership.
-func resolveRole(id *Identity, sso SSOConfig) *Identity {
-	if sso.AdminGroup == "" {
-		if sso.AllowAllSSO {
-			// Explicit opt-in (DUCKGRES_ADMIN_SSO_ALLOW_ALL): single-tier dev mode.
-			id.Role = RoleAdmin
-			slog.Warn("admin: DUCKGRES_ADMIN_SSO_GROUP unset and ALLOW_ALL set — granting admin to all SSO users", "email", id.Email)
-			return id
-		}
-		// Fail closed: without a configured admin group, SSO users are viewers.
-		// (The internal-secret / break-glass path still grants admin.)
-		id.Role = RoleViewer
-		slog.Warn("admin: DUCKGRES_ADMIN_SSO_GROUP unset — SSO user defaults to viewer (set the group, or DUCKGRES_ADMIN_SSO_ALLOW_ALL for dev)", "email", id.Email)
-		return id
+// acceptableSSOEmail enforces the domain + verification hardening rules.
+func acceptableSSOEmail(email string, verified bool) bool {
+	if !verified {
+		return false
 	}
-	id.Role = RoleViewer
-	for _, g := range id.Groups {
-		if strings.EqualFold(strings.TrimSpace(g), sso.AdminGroup) {
-			id.Role = RoleAdmin
-			break
-		}
-	}
-	return id
+	return strings.HasSuffix(strings.ToLower(strings.TrimSpace(email)), ssoEmailDomain)
 }
 
 // RoleGate enforces the viewer/admin split:
@@ -246,30 +244,3 @@ func stringClaim(claims map[string]any, key string) string {
 	}
 	return ""
 }
-
-// groupsClaim extracts group membership from the common claim shapes Cognito /
-// Google emit: a JSON array, or a space/comma-separated string. Checks several
-// claim names.
-func groupsClaim(claims map[string]any) []string {
-	for _, key := range []string{"cognito:groups", "custom:groups", "groups"} {
-		v, ok := claims[key]
-		if !ok {
-			continue
-		}
-		switch t := v.(type) {
-		case []any:
-			out := make([]string, 0, len(t))
-			for _, g := range t {
-				if s, ok := g.(string); ok {
-					out = append(out, s)
-				}
-			}
-			if len(out) > 0 {
-				return out
-			}
-		case string:
-			return strings.FieldsFunc(t, func(r rune) bool { return r == ' ' || r == ',' })
-		}
-	}
-	return nil
-}