resource_security_group.go

package provider

import (
	"context"
	"errors"
	"fmt"
	"reflect"
	"strings"

	"github.com/hashicorp/go-cty/cty"
	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
	"github.com/krystal/go-katapult"
	"github.com/krystal/go-katapult/core"
)

func resourceSecurityGroup() *schema.Resource { //nolint:funlen
	ruleSchema := resourceSecurityGroupRule().Schema
	delete(ruleSchema, "security_group_id")

	directionSchema := ruleSchema["direction"]
	ruleSchema["direction"] = &schema.Schema{
		Type:        directionSchema.Type,
		Computed:    true,
		Description: directionSchema.Description,
	}

	return &schema.Resource{
		CreateContext: resourceSecurityGroupCreate,
		ReadContext:   resourceSecurityGroupRead,
		UpdateContext: resourceSecurityGroupUpdate,
		DeleteContext: resourceSecurityGroupDelete,
		Importer: &schema.ResourceImporter{
			StateContext: schema.ImportStatePassthroughContext,
		},
		Description: "Allows management of security groups, their rules, and " +
			"their associations. By default all traffic is blocked, both " +
			"inbound and outbound. To allow traffic you must explicitly add " +
			"rules to the security group. You can also allow all traffic by " +
			"setting the `allow_all_inbound` and `allow_all_outbound` " +
			"attributes to `true`.",
		Schema: map[string]*schema.Schema{
			"id": {
				Type:     schema.TypeString,
				Computed: true,
				Description: "The ID of the security group. This is " +
					"automatically generated by the API.",
			},
			"name": {
				Type:         schema.TypeString,
				Required:     true,
				Description:  "The name of the security group.",
				ValidateFunc: validation.StringIsNotEmpty,
			},
			"associations": {
				Type:     schema.TypeSet,
				Optional: true,
				Description: "The resource IDs to apply this security group " +
					"to. Accepts IDs of virtual machines, virtual machine " +
					"groups, and tags.",
				Elem: &schema.Schema{
					Type:         schema.TypeString,
					ValidateFunc: validation.StringIsNotEmpty,
				},
			},
			"allow_all_inbound": {
				Type:     schema.TypeBool,
				Optional: true,
				Default:  false,
				Description: "Whether or not to allow all inbound traffic. " +
					"If not explicitly set, it defaults to false, blocking " +
					"all inbound traffic not covered by a inbound rule. " +
					"If changed to true on a existing security group, all " +
					"existing inbound rules will be deleted, hence it " +
					"cannot be enabled while any inbound rules are defined.",
			},
			"allow_all_outbound": {
				Type:     schema.TypeBool,
				Optional: true,
				Default:  false,
				Description: "Whether or not to allow all outbound traffic. " +
					"If not explicitly set, it defaults to false, blocking " +
					"all outbound traffic not covered by a outbound rule. " +
					"If changed to true on a existing security group, all " +
					"existing outbound rules will be deleted, hence it " +
					"cannot be enabled while any outbound rules are defined.",
			},
			"external_rules": {
				Type:     schema.TypeBool,
				Optional: true,
				Description: "When enabled, The full list of rules are not " +
					"managed by Terraform. Induvidual rules can still be " +
					"managed with the `katapult_security_group_rule` " +
					"resource. This is required to prevent Terraform from " +
					"deleting rules managed outside of Terraform. Defaults " +
					"to `false`.",
				ConflictsWith: []string{"inbound_rule", "outbound_rule"},
			},
			"inbound_rule": {
				Type:          schema.TypeList,
				Optional:      true,
				Elem:          &schema.Resource{Schema: ruleSchema},
				ConflictsWith: []string{"external_rules"},
				Description: "Zero or more inbound rules to apply to the " +
					"security group. Each rule specifies inbound traffic " +
					"which should be allowed.",
			},
			"outbound_rule": {
				Type:          schema.TypeList,
				Optional:      true,
				Elem:          &schema.Resource{Schema: ruleSchema},
				ConflictsWith: []string{"external_rules"},
				Description: "Zero or more outbound rules to apply to the " +
					"security group. Each rule specifies outbound traffic " +
					"which should be allowed.",
			},
		},
	}
}

//
// CRUD
//

func resourceSecurityGroupCreate(
	ctx context.Context,
	d *schema.ResourceData,
	meta interface{},
) diag.Diagnostics {
	m := meta.(*Meta)

	diags := validateSecurityGroupRules(d)
	if len(diags) > 0 {
		return diags
	}

	associations := schemaSetToSlice[string](
		d.Get("associations").(*schema.Set),
	)
	allowAllInbound := d.Get("allow_all_inbound").(bool)
	allowAllOutbound := d.Get("allow_all_outbound").(bool)

	args := &core.SecurityGroupCreateArguments{
		Name:             d.Get("name").(string),
		Associations:     &associations,
		AllowAllInbound:  &allowAllInbound,
		AllowAllOutbound: &allowAllOutbound,
	}

	sg, _, err := m.Core.SecurityGroups.Create(
		ctx, m.OrganizationRef, args,
	)
	if err != nil {
		return diag.FromErr(err)
	}

	d.SetId(sg.ID)

	if !d.Get("external_rules").(bool) {
		err = updateSecurityGroupRules(ctx, d, m, "inbound")
		if err != nil {
			return diag.FromErr(err)
		}

		err = updateSecurityGroupRules(ctx, d, m, "outbound")
		if err != nil {
			return diag.FromErr(err)
		}
	}

	return resourceSecurityGroupRead(ctx, d, meta)
}

func resourceSecurityGroupRead(
	ctx context.Context,
	d *schema.ResourceData,
	meta interface{},
) diag.Diagnostics {
	m := meta.(*Meta)
	var diags diag.Diagnostics

	sg, _, err := m.Core.SecurityGroups.GetByID(ctx, d.Id())
	if err != nil {
		if errors.Is(err, katapult.ErrNotFound) {
			d.SetId("")

			return diags
		}

		return diag.FromErr(err)
	}

	_ = d.Set("name", sg.Name)
	_ = d.Set("allow_all_inbound", sg.AllowAllInbound)
	_ = d.Set("allow_all_outbound", sg.AllowAllOutbound)

	err = d.Set("associations", stringSliceToSchemaSet(sg.Associations))
	if err != nil {
		diags = append(diags, diag.FromErr(err)...)
	}

	// Skip rule handling if external_rules is enabled.
	if d.Get("external_rules").(bool) {
		return diags
	}

	// Warn the user if external_rules was disabled. Due to the previous read
	// before the update not knowing about the change, any existing rules
	// managed outside of Terraform will not be known to Terraform until the
	// next refresh.
	if d.HasChange("external_rules") {
		diags = append(diags, diag.Diagnostic{
			Severity: diag.Warning,
			Summary: fmt.Sprintf(
				"security group %q (%s): external_rules option has been "+
					"disabled.",
				sg.Name, sg.ID,
			),
			Detail: "Please run \"terraform plan\" or \"terraform apply\" " +
				"again to ensure all rules are in sync with Terraform " +
				"definitions.",
		})
	}

	inbound, outbound, err := getAllFlattenedSecurityGroupRules(
		ctx, m, sg.Ref(),
	)
	if err != nil {
		return diag.FromErr(err)
	}

	err = d.Set("inbound_rule", inbound)
	if err != nil {
		diags = append(diags, diag.FromErr(err)...)
	}

	err = d.Set("outbound_rule", outbound)
	if err != nil {
		diags = append(diags, diag.FromErr(err)...)
	}

	return diags
}

func resourceSecurityGroupUpdate(
	ctx context.Context,
	d *schema.ResourceData,
	meta interface{},
) diag.Diagnostics {
	m := meta.(*Meta)

	diags := validateSecurityGroupRules(d)
	if len(diags) > 0 {
		return diags
	}

	sgRef := core.SecurityGroupRef{ID: d.Id()}
	args := &core.SecurityGroupUpdateArguments{}

	if d.HasChange("name") {
		args.Name = d.Get("name").(string)
	}

	if d.HasChange("associations") {
		raw := d.Get("associations").(*schema.Set)
		assocs := schemaSetToSlice[string](raw)

		args.Associations = &assocs
	}

	if d.HasChange("allow_all_inbound") {
		allowAllInbound := d.Get("allow_all_inbound").(bool)
		args.AllowAllInbound = &allowAllInbound
	}

	if d.HasChange("allow_all_outbound") {
		allowAllOutbound := d.Get("allow_all_outbound").(bool)
		args.AllowAllOutbound = &allowAllOutbound
	}

	_, _, err := m.Core.SecurityGroups.Update(ctx, sgRef, args)
	if err != nil {
		return diag.FromErr(err)
	}

	// Handle rules if external_rules is disabled, or if it was changed to
	// enabled now, in which case we need to remove all rules.
	handleRules := !d.Get("external_rules").(bool) ||
		d.HasChange("external_rules")

	// Calculate the changes to inbound and outbound rules, and
	// create/update/delete rules as needed.
	if handleRules {
		err = updateSecurityGroupRules(ctx, d, m, "inbound")
		if err != nil {
			return diag.FromErr(err)
		}

		err = updateSecurityGroupRules(ctx, d, m, "outbound")
		if err != nil {
			return diag.FromErr(err)
		}
	}

	return resourceSecurityGroupRead(ctx, d, meta)
}

func resourceSecurityGroupDelete(
	ctx context.Context,
	d *schema.ResourceData,
	meta interface{},
) diag.Diagnostics {
	m := meta.(*Meta)

	sgRef := core.SecurityGroupRef{ID: d.Id()}
	_, _, err := m.Core.SecurityGroups.Delete(ctx, sgRef)
	if err != nil {
		return diag.FromErr(err)
	}

	return diag.Diagnostics{}
}

//
// Helpers
//

// validateSecurityGroupRules makes sure that if one of the allow_all_*
// attributes are enabled, then no rules are defined for the same direction.
func validateSecurityGroupRules(d *schema.ResourceData) diag.Diagnostics {
	var diags diag.Diagnostics

	name := fmt.Sprintf("%q", d.Get("name").(string))
	if v := d.Id(); v != "" {
		name += " (" + v + ")"
	}

	if d.Get("allow_all_inbound").(bool) &&
		len(d.Get("inbound_rule").([]any)) > 0 {
		diags = append(diags, diag.Diagnostic{
			Severity: diag.Error,
			Summary: fmt.Sprintf(
				"security group %s: cannot enable allow_all_inbound "+
					"while also specifyng one or more inbound_rule",
				name,
			),
			AttributePath: cty.GetAttrPath("inbound_rule"),
		})
	}

	if d.Get("allow_all_outbound").(bool) &&
		len(d.Get("outbound_rule").([]any)) > 0 {
		diags = append(diags, diag.Diagnostic{
			Severity: diag.Error,
			Summary: fmt.Sprintf(
				"security group %s: cannot enable allow_all_outbound "+
					"while also specifyng one or more outbound_rule",
				name,
			),
			AttributePath: cty.GetAttrPath("outbound_rule"),
		})
	}

	return diags
}

// updateSecurityGroupRules updates the inbound or outbound rules for a security
// group. This function will create, update, and delete rules as needed.
func updateSecurityGroupRules(
	ctx context.Context,
	d *schema.ResourceData,
	m *Meta,
	direction string,
) error {
	attr := fmt.Sprintf("%s_rule", direction)
	if !d.HasChange(attr) {
		return nil
	}

	rawOld, rawNew := d.GetChange(attr)
	create, update, del := diffSecurityGroupRules(
		rawOld.([]any), rawNew.([]any),
	)

	sgRef := core.SecurityGroupRef{ID: d.Id()}

	for _, r := range create {
		ports := r["ports"].(string)
		targets := schemaSetToSlice[string](r["targets"].(*schema.Set))
		notes := r["notes"].(string)

		args := &core.SecurityGroupRuleArguments{
			Direction: direction,
			Protocol:  strings.ToUpper(r["protocol"].(string)),
			Ports:     &ports,
			Targets:   &targets,
			Notes:     &notes,
		}

		_, _, err := m.Core.SecurityGroupRules.Create(ctx, sgRef, args)
		if err != nil {
			return err
		}
	}

	for _, r := range update {
		id := r["id"].(string)
		ruleRef := core.SecurityGroupRuleRef{ID: id}

		ports := r["ports"].(string)
		targets := schemaSetToSlice[string](r["targets"].(*schema.Set))
		notes := r["notes"].(string)

		args := &core.SecurityGroupRuleArguments{
			Protocol: strings.ToUpper(r["protocol"].(string)),
			Ports:    &ports,
			Targets:  &targets,
			Notes:    &notes,
		}

		_, _, err := m.Core.SecurityGroupRules.Update(ctx, ruleRef, args)
		if err != nil {
			return err
		}
	}

	for _, r := range del {
		id := r["id"].(string)
		ruleRef := core.SecurityGroupRuleRef{ID: id}

		_, _, err := m.Core.SecurityGroupRules.Delete(ctx, ruleRef)
		if err != nil && !errors.Is(err, katapult.ErrNotFound) {
			return err
		}
	}

	return nil
}

func diffSecurityGroupRules(
	oldRuleList []any,
	newRuleList []any,
) (create, update, del []map[string]any) {
	oldRules := securityGroupRuleListToMaps(oldRuleList)
	newRules := securityGroupRuleListToMaps(newRuleList)

	existing := map[string]map[string]any{}
	for _, r := range oldRules {
		if id, ok := r["id"].(string); ok && id != "" {
			existing[id] = r
		}
	}

	for _, newRule := range newRules {
		id, ok := newRule["id"].(string)
		if !ok || id == "" {
			create = append(create, newRule)
			continue
		}

		oldRule, ok := existing[id]
		delete(existing, id)

		if !ok || diffSecurityGroupRule(oldRule, newRule) {
			update = append(update, newRule)
		}
	}

	for _, oldRule := range existing {
		del = append(del, oldRule)
	}

	return create, update, del
}

func securityGroupRuleListToMaps(l []any) []map[string]any {
	var out []map[string]any

	for _, v := range l {
		if m, ok := v.(map[string]any); ok {
			out = append(out, m)
		}
	}

	return out
}

func diffSecurityGroupRule(oldRule, newRule map[string]any) bool {
	if oldRule == nil && newRule == nil {
		return false
	}

	if oldRule == nil || newRule == nil {
		return true
	}

	// If the length of the keys is different, then the rules are different.
	if len(oldRule) != len(newRule) {
		return true
	}

	// If the list of keys are different (ignoring order), then the rules are
	// different.
	if !stringsEqual(mapKeys(oldRule), mapKeys(newRule)) {
		return true
	}

	// If any of the values are different, then the rules are different. We
	// treat string slice values as a special case, ignoring the order of the
	// items, as long as they contain the same set of items.
	for k, v := range newRule {
		if diffSchemaSetOrAny(oldRule[k], v) {
			return true
		}
	}

	return false
}

// diffSchemaSetOrAny compares two values, returning true if they are not equal.
//
// If the values are both string slices, they are compared as sets, ignoring the
// order of the elements. Otherwise they are compared using reflect.DeepEqual.
func diffSchemaSetOrAny(a, b any) bool {
	aSet, aOK := a.(*schema.Set)
	bSet, bOK := b.(*schema.Set)
	if aOK && bOK {
		return !aSet.Equal(bSet)
	}

	return !reflect.DeepEqual(a, b)
}

func getAllFlattenedSecurityGroupRules(
	ctx context.Context,
	m *Meta,
	sgRef core.SecurityGroupRef,
) (inbound []map[string]any, outbound []map[string]any, err error) {
	inbound = []map[string]any{}
	outbound = []map[string]any{}

	totalPages := 2

	for pageNum := 1; pageNum <= totalPages; pageNum++ {
		pageResult, resp, err := m.Core.SecurityGroupRules.List(
			ctx, sgRef, &core.ListOptions{Page: pageNum},
		)
		if err != nil {
			return nil, nil, err
		}

		totalPages = resp.Pagination.TotalPages

		for _, rule := range pageResult {
			flattened := flattenSecurityGroupRule(rule)

			switch rule.Direction {
			case "inbound":
				inbound = append(inbound, flattened)
			case "outbound":
				outbound = append(outbound, flattened)
			}
		}
	}

	return inbound, outbound, nil
}

func flattenSecurityGroupRule(rule *core.SecurityGroupRule) map[string]any {
	return map[string]any{
		"id":        rule.ID,
		"direction": rule.Direction,
		"protocol":  rule.Protocol,
		"ports":     rule.Ports,
		"targets":   rule.Targets,
		"notes":     rule.Notes,
	}
}