From 1c7f3bc4401e08bafe8ccb6f86d2afa07337d9a2 Mon Sep 17 00:00:00 2001
From: Kristoffer Dalby <kristoffer@dalby.cc>
Date: Sat, 1 Feb 2025 09:40:37 +0000
Subject: [PATCH] no edit of oidc users, minimum hostname length (#2393)

* return an error when renaming users from OIDC
* set minimum hostname length of 2
---
 CHANGELOG.md          | 4 ++++
 hscontrol/db/users.go | 6 ++++++
 hscontrol/util/dns.go | 5 +++++
 3 files changed, 15 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index e1b3468f..9d5c2245 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -20,6 +20,10 @@
   [#2350](https://github.com/juanfont/headscale/pull/2350)
 - Print Tailscale version instead of capability versions for outdated nodes
   [#2391](https://github.com/juanfont/headscale/pull/2391)
+- Do not allow renaming of users from OIDC
+  [#2393](https://github.com/juanfont/headscale/pull/2393)
+- Change minimum hostname length to 2
+  [#2393](https://github.com/juanfont/headscale/pull/2393)
 - Pre auth keys belonging to a user are no longer deleted with the user
   [#2396](https://github.com/juanfont/headscale/pull/2396)
 - Pre auth keys that are used by a node can no longer be deleted
diff --git a/hscontrol/db/users.go b/hscontrol/db/users.go
index c359174d..d7f31e5b 100644
--- a/hscontrol/db/users.go
+++ b/hscontrol/db/users.go
@@ -81,6 +81,8 @@ func (hsdb *HSDatabase) RenameUser(uid types.UserID, newName string) error {
 	})
 }
 
+var ErrCannotChangeOIDCUser = errors.New("cannot edit OIDC user")
+
 // RenameUser renames a User. Returns error if the User does
 // not exist or if another User exists with the new name.
 func RenameUser(tx *gorm.DB, uid types.UserID, newName string) error {
@@ -94,6 +96,10 @@ func RenameUser(tx *gorm.DB, uid types.UserID, newName string) error {
 		return err
 	}
 
+	if oldUser.Provider == util.RegisterMethodOIDC {
+		return ErrCannotChangeOIDCUser
+	}
+
 	oldUser.Name = newName
 
 	if err := tx.Save(&oldUser).Error; err != nil {
diff --git a/hscontrol/util/dns.go b/hscontrol/util/dns.go
index c87714d0..54a9452d 100644
--- a/hscontrol/util/dns.go
+++ b/hscontrol/util/dns.go
@@ -65,6 +65,11 @@ func ValidateUsername(username string) error {
 }
 
 func CheckForFQDNRules(name string) error {
+	// Ensure the username meets the minimum length requirement
+	if len(name) < 2 {
+		return errors.New("name must be at least 2 characters long")
+	}
+
 	if len(name) > LabelHostnameLength {
 		return fmt.Errorf(
 			"DNS segment must not be over 63 chars. %v doesn't comply with this rule: %w",