secrets.go

// Copyright 2022 Namespace Labs Inc; All rights reserved.
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.

package deploy

import (
	"context"
	"errors"
	"fmt"
	"io/fs"
	"os"
	"strings"

	"namespacelabs.dev/foundation/framework/rpcerrors/multierr"
	"namespacelabs.dev/foundation/internal/fnerrors"
	"namespacelabs.dev/foundation/internal/fnfs"
	"namespacelabs.dev/foundation/internal/keys"
	"namespacelabs.dev/foundation/internal/planning"
	"namespacelabs.dev/foundation/internal/runtime"
	"namespacelabs.dev/foundation/internal/secrets"
	"namespacelabs.dev/foundation/schema"
	"namespacelabs.dev/foundation/std/cfg"
	"namespacelabs.dev/foundation/std/pkggraph"
	"namespacelabs.dev/foundation/std/tasks"
)

type secretSource struct {
	Server  planning.Server
	Secrets []*schema.PackageRef
}

func loadSecrets(ctx context.Context, env cfg.Context, sources ...secretSource) (*runtime.GroundedSecrets, error) {
	return tasks.Return(ctx, tasks.Action("planning.load-secrets"), func(ctx context.Context) (*runtime.GroundedSecrets, error) {
		keyDir, err := keys.KeysDir()
		if err != nil {
			if errors.Is(err, keys.ErrKeyGen) {
				keyDir = nil
			} else {
				return nil, err
			}
		}

		var userSecrets *secrets.Bundle

		if fsys := env.Workspace().ReadOnlyFS(); fsys != nil {
			loaded, err := loadSecretsFile(ctx, keyDir, env.Workspace().ModuleName(), fsys, secrets.UserBundleName)
			if err != nil {
				return nil, err
			}
			userSecrets = loaded
		}

		workspaceSecrets := map[string]*secrets.Bundle{}

		g := &runtime.GroundedSecrets{}

		var missing []*schema.PackageRef
		var missingSpecs []*schema.SecretSpec
		var missingServer []schema.PackageName
		for _, ps := range sources {
			srv := ps.Server

			if len(ps.Secrets) == 0 {
				continue
			}

			specs, err := loadSecretSpecs(ctx, srv.SealedContext(), ps.Secrets...)
			if err != nil {
				return nil, err
			}

			if _, has := workspaceSecrets[srv.Module().ModuleName()]; !has {
				wss, err := loadWorkspaceSecrets(ctx, keyDir, srv.Module())
				if err != nil {
					// XXX print a warning?
					if !errors.Is(err, keys.ErrKeyGen) {
						return nil, err
					}
				} else {
					workspaceSecrets[srv.Module().ModuleName()] = wss
				}
			}

			srvSecrets, err := loadServerSecrets(ctx, keyDir, srv)
			if err != nil {
				return nil, err
			}

			for k, secretRef := range ps.Secrets {
				gsec := runtime.GroundedSecret{
					Ref:  secretRef,
					Spec: specs[k],
				}

				if gsec.Spec.Generate == nil {
					value, err := lookupSecret(ctx, env.Environment(), secretRef, userSecrets, srvSecrets, workspaceSecrets[srv.Module().ModuleName()])
					if err != nil {
						return nil, err
					}

					if value == nil {
						missing = append(missing, secretRef)
						missingSpecs = append(missingSpecs, gsec.Spec)
						missingServer = append(missingServer, srv.PackageName())
						continue
					}

					gsec.Value = value
				}

				g.Secrets = append(g.Secrets, gsec)
			}
		}

		if len(missing) > 0 {
			labels := make([]string, len(missing))

			for k, secretRef := range missing {
				labels[k] = fmt.Sprintf("  # Description: %s\n  # Server: %s\n  ns secrets set --secret %s", missingSpecs[k].Description, missingServer[k], secretRef.Canonical())
			}

			return nil, fnerrors.UsageError(
				fmt.Sprintf("Please run:\n\n%s", strings.Join(labels, "\n")),
				"There are secrets required which have not been specified")

		}

		return g, nil
	})
}

func loadWorkspaceSecrets(ctx context.Context, keyDir fs.FS, module *pkggraph.Module) (*secrets.Bundle, error) {
	return loadSecretsFile(ctx, keyDir, module.ModuleName(), module.ReadOnlyFS(), secrets.WorkspaceBundleName)
}

func loadSecretsFile(ctx context.Context, keyDir fs.FS, name string, fsys fs.FS, sourceFile string) (*secrets.Bundle, error) {
	contents, err := fs.ReadFile(fsys, sourceFile)
	if err != nil {
		if os.IsNotExist(err) {
			return nil, nil
		}
		return nil, fnerrors.InternalError("%s: failed to read %q: %w", name, sourceFile, err)
	}

	return secrets.LoadBundle(ctx, keyDir, contents)
}

func loadServerSecrets(ctx context.Context, keyDir fnfs.LocalFS, srv planning.Server) (*secrets.Bundle, error) {
	contents, err := fs.ReadFile(srv.Location.Module.ReadOnlyFS(), srv.Location.Rel(secrets.ServerBundleName))
	if err != nil {
		if os.IsNotExist(err) {
			return nil, nil
		}
		return nil, fnerrors.InternalError("%s: failed to read %q: %w", srv.PackageName(), secrets.ServerBundleName, err)
	}

	bundle, err := secrets.LoadBundle(ctx, keyDir, contents)
	if err != nil {
		if !errors.Is(err, keys.ErrKeyGen) {
			return nil, err
		}
	}
	return bundle, nil
}

func lookupSecret(ctx context.Context, env *schema.Environment, secretRef *schema.PackageRef, user, server, workspace *secrets.Bundle) (*schema.FileContents, error) {
	key := &secrets.ValueKey{PackageName: secretRef.PackageName, Key: secretRef.Name, EnvironmentName: env.Name}

	for _, src := range []*secrets.Bundle{user, server, workspace} {
		if src != nil {
			value, err := src.Lookup(ctx, key)
			if err != nil {
				return nil, err
			}

			if value != nil {
				return &schema.FileContents{Contents: value, Utf8: true}, nil
			}
		}
	}

	return nil, nil
}

func loadSecretSpecs(ctx context.Context, pl pkggraph.PackageLoader, secrets ...*schema.PackageRef) ([]*schema.SecretSpec, error) {
	var errs []error
	var specs []*schema.SecretSpec // Same indexing as secrets.
	for _, ref := range secrets {
		secretPackage, err := pl.LoadByName(ctx, ref.AsPackageName())
		if err != nil {
			errs = append(errs, err)
		} else {
			if spec := secretPackage.LookupSecret(ref.Name); spec == nil {
				errs = append(errs, fnerrors.NewWithLocation(ref.AsPackageName(), "no such secret %q", ref.Name))
			} else {
				if spec.Generate != nil {
					if spec.Generate.UniqueId == "" {
						errs = append(errs, fnerrors.NewWithLocation(ref.AsPackageName(), "%s: missing unique id", ref.Name))
					} else if spec.Generate.RandomByteCount <= 0 {
						errs = append(errs, fnerrors.NewWithLocation(ref.AsPackageName(), "%s: randomByteCount must be > 0", ref.Name))
					}
				}

				specs = append(specs, spec)
			}
		}
	}

	if err := multierr.New(errs...); err != nil {
		return nil, err
	}

	return specs, nil
}