Server.Utils.AddUser

name: Server.Utils.AddUser
description: |
  Creates a new Velociraptor GUI user with a specified role and a
  randomly generated password.

  The new randomly-generated password is stored in the server metadata
  object, to ensure it cannot be seen in the output of the artifact
  itself. The Administrator can share this password with the user
  later.

  When using SSO (e.g. oauth) this password is not used and can be
  ignored, because the SSO provider will do the authentication.

type: SERVER

parameters:
  - name: UserName
    description: The new username to add

  - name: ResetPassword
    type: bool
    default: "Y"
    description: |
      Reset the user's password. This must be set when
      creating the user in the first place.

  - name: Role
    description: The role to grant the new user.
    type: choices
    default: reader
    choices:
      - reader
      - analyst
      - investigator
      - administrator

sources:
  - query: |
      LET Password <= format(format="%02x", args=rand(range=0xffffffffffff))
      LET ServerMetadataKey <= "User Password " + UserName

      LET DoIt = SELECT * FROM if(condition=ResetPassword,
      then={
        SELECT
          server_set_metadata(metadata=set(
             item=server_metadata(),
             field=ServerMetadataKey, value=Password)),
          user_create(roles=Role, user=UserName, password=Password)
        FROM scope()
        WHERE log(message="New password for user is stored in server metadata under key " + ServerMetadataKey)
      }, else={
        -- Just grant the user the specified role
        SELECT user_create(roles=Role, user=UserName)
        FROM scope()
      })

      SELECT * FROM if(condition=UserName,
      then={
        SELECT * FROM foreach(row=DoIt,
        query={
           SELECT * FROM gui_users()
           WHERE name =~ UserName
        })
      }, else={
        SELECT * FROM scope()
        WHERE log(message="A Username must be set") AND FALSE
      })