fix: add owner registration logic

internal/broker/config.go

@@ -1,6 +1,7 @@
 package broker
 
 import (
+	"embed"
 	"errors"
 	"fmt"
 	"io/fs"
@@ -39,8 +40,21 @@ const (
 	AllUsersKey = "ALL"
 	// OwnerUserKey is the key for allowing access to the owner
 	OwnerUserKey = "OWNER"
+
+	// ownerAutoregistrationConfigPath is the name of the file that will be auto-generated to register the owner
+	ownerRegistrationConfigPath     = "20-owner-autoregistration.conf"
+	ownerRegistrationConfigTemplate = "templates/20-owner-autoregistration.conf.tmpl"
+)
+
+var (
+	//go:embed templates/20-owner-autoregistration.conf.tmpl
+	ownerRegistrationConfig embed.FS
 )
 
+type templateEnv struct {
+	Owner string
+}
+
 type userConfig struct {
 	clientID     string
 	clientSecret string
@@ -53,9 +67,13 @@ type userConfig struct {
 	allowedSSHSuffixes []string
 }
 
+func getDropInDir(cfgPath string) string {
+	return cfgPath + ".d"
+}
+
 func getDropInFiles(cfgPath string) ([]any, error) {
 	// Check if a .d directory exists and return the paths to the files in it.
-	dropInDir := cfgPath + ".d"
+	dropInDir := getDropInDir(cfgPath)
 	files, err := os.ReadDir(dropInDir)
 	if errors.Is(err, fs.ErrNotExist) {
 		return nil, nil

internal/broker/templates/20-owner-autoregistration.conf.tmpl

@@ -0,0 +1,13 @@
+## This file was generated automatically by the broker. DO NOT EDIT.
+##
+## This file registers the first authenticated user as the owner of
+## this device.
+##
+## The 'owner' option is only considered for authentication if
+## 'allowed_users' contains the 'OWNER' keyword.
+##
+## To register a different owner for the machine on the next
+## successful authentication, delete this file.
+
+[users]
+owner = {{ .Owner }}

internal/broker/testdata/golden/TestPersistOwner/broker.conf

@@ -0,0 +1,4 @@
+
+[oidc]
+issuer = https://issuer.url.com
+client_id = client_id

internal/broker/testdata/golden/TestPersistOwner/broker.conf.d/20-owner-autoregistration.conf

@@ -0,0 +1,13 @@
+## This file was generated automatically by the broker. DO NOT EDIT.
+##
+## This file registers the first authenticated user as the owner of
+## this device.
+##
+## The 'owner' option is only considered for authentication if
+## 'allowed_users' contains the 'OWNER' keyword.
+##
+## To register a different owner for the machine on the next
+## successful authentication, delete this file.
+
+[users]
+owner = owner_name