resource_vulnerability_policy.go

package cloudsmith

import (
	"context"
	"fmt"
	"strings"
	"time"

	"github.com/cloudsmith-io/cloudsmith-api-go"
	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
)

const (
	MinSeverity          string = "min_severity"
	AllowUnknownSeverity string = "allow_unknown_severity"
)

func importVulnerabilityPolicy(ctx context.Context, d *schema.ResourceData, m interface{}) ([]*schema.ResourceData, error) {
	idParts := strings.Split(d.Id(), ".")
	if len(idParts) != 2 {
		return nil, fmt.Errorf(
			"invalid import ID, must be of the form <organization_slug>.<policy_slug_perm>, got: %s", d.Id(),
		)
	}

	d.Set(Organization, idParts[0])
	d.SetId(idParts[1])
	return []*schema.ResourceData{d}, nil
}

func resourceVulnerabilityPolicyCreate(d *schema.ResourceData, m interface{}) error {
	pc := m.(*providerConfig)

	org := requiredString(d, Organization)

	req := pc.APIClient.OrgsApi.OrgsVulnerabilityPolicyCreate(pc.Auth, org)
	req = req.Data(cloudsmith.OrganizationPackageVulnerabilityPolicyRequest{
		MinSeverity:           optionalString(d, MinSeverity),
		AllowUnknownSeverity:  optionalBool(d, AllowUnknownSeverity),
		Description:           nullableString(d, Description),
		Name:                  requiredString(d, Name),
		OnViolationQuarantine: optionalBool(d, OnViolationQuarantine),
		PackageQueryString:    nullableString(d, PackageQueryString),
	})

	vulnerabilityPolicy, _, err := pc.APIClient.OrgsApi.OrgsVulnerabilityPolicyCreateExecute(req)
	if err != nil {
		return err
	}

	d.SetId(vulnerabilityPolicy.GetSlugPerm())

	checkerFunc := func() error {
		req := pc.APIClient.OrgsApi.OrgsVulnerabilityPolicyRead(pc.Auth, org, d.Id())
		if _, resp, err := pc.APIClient.OrgsApi.OrgsVulnerabilityPolicyReadExecute(req); err != nil {
			if is404(resp) {
				return errKeepWaiting
			}
			return err
		}
		return nil
	}
	if err := waiter(checkerFunc, defaultCreationTimeout, defaultCreationInterval); err != nil {
		return fmt.Errorf("error waiting for vulnerability policy (%s) to be created: %s", d.Id(), err)
	}

	return resourceVulnerabilityPolicyRead(d, m)
}

func resourceVulnerabilityPolicyUpdate(d *schema.ResourceData, m interface{}) error {
	pc := m.(*providerConfig)

	org := requiredString(d, Organization)

	req := pc.APIClient.OrgsApi.OrgsVulnerabilityPolicyUpdate(pc.Auth, org, d.Id())
	req = req.Data(cloudsmith.OrganizationPackageVulnerabilityPolicyRequest{
		MinSeverity:           optionalString(d, MinSeverity),
		AllowUnknownSeverity:  optionalBool(d, AllowUnknownSeverity),
		Description:           nullableString(d, Description),
		Name:                  requiredString(d, Name),
		OnViolationQuarantine: optionalBool(d, OnViolationQuarantine),
		PackageQueryString:    nullableString(d, PackageQueryString),
	})

	vulnerabilityPolicy, _, err := pc.APIClient.OrgsApi.OrgsVulnerabilityPolicyUpdateExecute(req)
	if err != nil {
		return err
	}

	d.SetId(vulnerabilityPolicy.GetSlugPerm())

	checkerFunc := func() error {
		// this is somewhat of a hack until we have a better way to poll for a
		// policy being updated (changes incoming on the API side)
		time.Sleep(time.Second * 5)
		return nil
	}
	if err := waiter(checkerFunc, defaultUpdateTimeout, defaultUpdateInterval); err != nil {
		return fmt.Errorf("error waiting for vulnerability policy (%s) to be updated: %w", d.Id(), err)
	}

	return resourceVulnerabilityPolicyRead(d, m)
}

func resourceVulnerabilityPolicyDelete(d *schema.ResourceData, m interface{}) error {
	pc := m.(*providerConfig)

	org := requiredString(d, Organization)

	req := pc.APIClient.OrgsApi.OrgsVulnerabilityPolicyDelete(pc.Auth, org, d.Id())
	_, err := pc.APIClient.OrgsApi.OrgsVulnerabilityPolicyDeleteExecute(req)
	if err != nil {
		return err
	}

	checkerFunc := func() error {
		req := pc.APIClient.OrgsApi.OrgsVulnerabilityPolicyRead(pc.Auth, org, d.Id())
		if _, resp, err := pc.APIClient.OrgsApi.OrgsVulnerabilityPolicyReadExecute(req); err != nil {
			if is404(resp) {
				return nil
			}
			return err
		}
		return errKeepWaiting
	}
	if err := waiter(checkerFunc, defaultDeletionTimeout, defaultDeletionInterval); err != nil {
		return fmt.Errorf("error waiting for vulnerability policy (%s) to be deleted: %w", d.Id(), err)
	}

	return nil
}

func resourceVulnerabilityPolicyRead(d *schema.ResourceData, m interface{}) error {
	pc := m.(*providerConfig)

	org := requiredString(d, Organization)

	req := pc.APIClient.OrgsApi.OrgsVulnerabilityPolicyRead(pc.Auth, org, d.Id())

	vulnerabilityPolicy, resp, err := pc.APIClient.OrgsApi.OrgsVulnerabilityPolicyReadExecute(req)
	if err != nil {
		if is404(resp) {
			d.SetId("")
			return nil
		}

		return err
	}

	_ = d.Set(CreatedAt, vulnerabilityPolicy.GetCreatedAt().String())
	_ = d.Set(Description, vulnerabilityPolicy.GetDescription())
	_ = d.Set(Name, vulnerabilityPolicy.GetName())
	_ = d.Set(OnViolationQuarantine, vulnerabilityPolicy.GetOnViolationQuarantine())
	_ = d.Set(SlugPerm, vulnerabilityPolicy.GetSlugPerm())
	_ = d.Set(MinSeverity, vulnerabilityPolicy.GetMinSeverity())
	_ = d.Set(AllowUnknownSeverity, vulnerabilityPolicy.GetAllowUnknownSeverity())
	_ = d.Set(PackageQueryString, vulnerabilityPolicy.GetPackageQueryString())
	_ = d.Set(UpdatedAt, vulnerabilityPolicy.GetUpdatedAt().String())

	// organization is not returned from the read
	// endpoint, so we can use the values stored in resource state. We rely on
	// ForceNew to ensure if either changes a new resource is created.
	_ = d.Set(Organization, org)

	return nil
}

//nolint:funlen
func resourceVulnerabilityPolicy() *schema.Resource {
	return &schema.Resource{
		Create: resourceVulnerabilityPolicyCreate,
		Read:   resourceVulnerabilityPolicyRead,
		Update: resourceVulnerabilityPolicyUpdate,
		Delete: resourceVulnerabilityPolicyDelete,

		Importer: &schema.ResourceImporter{
			StateContext: importVulnerabilityPolicy,
		},

		Schema: map[string]*schema.Schema{
			CreatedAt: {
				Type:        schema.TypeString,
				Description: "The time the policy was created at.",
				Computed:    true,
			},
			Description: {
				Type:         schema.TypeString,
				Description:  "The description of the vulnerability policy.",
				Optional:     true,
				ValidateFunc: validation.StringIsNotEmpty,
			},
			Name: {
				Type:         schema.TypeString,
				Description:  "The name of the vulnerability policy.",
				Required:     true,
				ValidateFunc: validation.StringIsNotEmpty,
			},
			OnViolationQuarantine: {
				Type:        schema.TypeBool,
				Description: "On violation of the vulnerability policy, quarantine violating packages.",
				Optional:    true,
				Computed:    true,
			},
			SlugPerm: {
				Type:        schema.TypeString,
				Description: "Slug-perm of the vulnerability policy",
				Computed:    true,
			},
			MinSeverity: {
				Type:         schema.TypeString,
				Description:  "The minimum severity level where a policy violation will be flagged.",
				Optional:     true,
				Computed:     true,
				ValidateFunc: validation.StringInSlice([]string{"Low", "Medium", "High", "Critical"}, false),
			},
			AllowUnknownSeverity: {
				Type:        schema.TypeBool,
				Description: "Allow an unknown severity level.",
				Optional:    true,
				Computed:    true,
			},
			PackageQueryString: {
				Type:        schema.TypeString,
				Description: "A search / filter string of packages to include in the policy.",
				Optional:    true,
			},
			UpdatedAt: {
				Type:        schema.TypeString,
				Description: "The time the policy last updated at.",
				Computed:    true,
			},
			Organization: {
				Type:         schema.TypeString,
				Description:  "Organization to which this policy belongs.",
				Required:     true,
				ForceNew:     true,
				ValidateFunc: validation.StringIsNotEmpty,
			},
		},
	}
}