feat: reading resources file

.gitignore

@@ -7,6 +7,7 @@ proxies/*.yml
 .temp
 temp
 shield
+!proto/*
 .shield.yaml
 dist
 coverage.txt

.shield.sample.yaml

@@ -26,4 +26,5 @@ proxy:
       # secret string "val://user:password"
       #
       # +optional
-      # ruleset_secret: env://TEST_RULESET_SECRET
+      # ruleset_secret: env://TEST_RULESET_SECRET
+      resources_config_path: file://absolute_path_to_rules_directory

cmd/serve_proxy.go

@@ -58,18 +58,38 @@ func proxyCommand(logger log.Logger, appConfig *config.Shield) *cli.Command {
 			var cleanUpFunc []func() error
 			var cleanUpProxies []func(ctx context.Context) error
 			for _, service := range appConfig.Proxy.Services {
+				if service.ResourcesConfigPath == "" {
+					return errors.New("ruleset field cannot be left empty")
+				}
+				resoucesConfigFS, err := (&blobFactory{}).New(baseCtx, service.ResourcesConfigPath, service.ResourcesConfigPathSecret)
+				if err != nil {
+					return err
+				}
+
+				resoucesRepo := blobstore.NewResourcesRepository(logger, resoucesConfigFS)
+
+				if err := resoucesRepo.InitCache(baseCtx, ruleCacheRefreshDelay); err != nil {
+					return err
+				}
+
+				// @TODO: Use this to get resources config
+				_, err = resoucesRepo.GetAll(baseCtx)
+				if err != nil {
+					return err
+				}
+
 				if service.RulesPath == "" {
 					return errors.New("ruleset field cannot be left empty")
 				}
-				blobFS, err := (&blobFactory{}).New(baseCtx, service.RulesPath, service.RulesPathSecret)
+				ruleFS, err := (&blobFactory{}).New(baseCtx, service.RulesPath, service.RulesPathSecret)
 				if err != nil {
 					return err
 				}
 
 				// TODO: option to use default http round tripper for http1.1 backends
 				h2cProxy := proxy.NewH2c(proxy.NewH2cRoundTripper(logger), proxy.NewDirector())
 
-				ruleRepo := blobstore.NewRuleRepository(logger, blobFS)
+				ruleRepo := blobstore.NewRuleRepository(logger, ruleFS)
 				if err := ruleRepo.InitCache(baseCtx, ruleCacheRefreshDelay); err != nil {
 					return err
 				}

config/config.go

@@ -47,6 +47,13 @@ type Service struct {
 
 	// Headers which will have user's email id
 	IdentityProxyHeader string `yaml:"identity_proxy_header" mapstructure:"identity_proxy_header"`
+
+	// ResourcesPath is a directory path where resources is defined
+	// that this service should implement
+	ResourcesConfigPath string `yaml:"resources_config_path" mapstructure:"resources_config_path"`
+	// ResourcesPathSecretSecret could be a env name, file path or actual value required
+	// to access ResourcesPathSecretPath files
+	ResourcesConfigPathSecret string `yaml:"resources_config_path_secret" mapstructure:"resources_config_path_secret"`
 }
 
 type NewRelic struct {

resources_config/resources.yaml

@@ -0,0 +1,18 @@
+resources:
+  - name: dagger
+    actions:
+      read:
+        - team_admin
+        - dagger_manager
+        - org_admin
+      delete:
+        - team_admin
+        - org_admin
+  - name: firehose
+    actions:
+      read:
+        - team_admin
+        - firehose_manager
+      delete:
+        - team_admin
+        - org_admin

store/blob/resources_repository.go

@@ -0,0 +1,128 @@
+package blob
+
+import (
+	"context"
+	"io"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/odpf/salt/log"
+
+	"github.com/robfig/cron/v3"
+
+	"github.com/ghodss/yaml"
+	"github.com/odpf/shield/store"
+	"github.com/odpf/shield/structs"
+	"github.com/pkg/errors"
+	"gocloud.dev/blob"
+)
+
+type Resources struct {
+	Resources []Resource `json:"resources" yaml:"resources"`
+}
+
+type Resource struct {
+	Name    string              `json:"name" yaml:"name"`
+	Actions map[string][]string `json:"actions" yaml:"actions"`
+}
+
+type ResourcesRepository struct {
+	log log.Logger
+	mu  *sync.Mutex
+
+	cron   *cron.Cron
+	bucket store.Bucket
+	cached []structs.Resource
+}
+
+func (repo *ResourcesRepository) GetAll(ctx context.Context) ([]structs.Resource, error) {
+	repo.mu.Lock()
+	currentCache := repo.cached
+	repo.mu.Unlock()
+	if repo.cron != nil {
+		// cache must have been refreshed automatically, just return
+		return currentCache, nil
+	}
+
+	err := repo.refresh(ctx)
+	return repo.cached, err
+}
+
+func (repo *ResourcesRepository) refresh(ctx context.Context) error {
+	var resources []structs.Resource
+
+	// get all items
+	it := repo.bucket.List(&blob.ListOptions{})
+	for {
+		obj, err := it.Next(ctx)
+		if err != nil {
+			if err == io.EOF {
+				break
+			}
+			return err
+		}
+
+		if obj.IsDir {
+			continue
+		}
+		if !(strings.HasSuffix(obj.Key, ".yaml") || strings.HasSuffix(obj.Key, ".yml")) {
+			continue
+		}
+		fileBytes, err := repo.bucket.ReadAll(ctx, obj.Key)
+		if err != nil {
+			return errors.Wrap(err, "bucket.ReadAll: "+obj.Key)
+		}
+
+		var resource Resources
+		if err := yaml.Unmarshal(fileBytes, &resource); err != nil {
+			return errors.Wrap(err, "yaml.Unmarshal: "+obj.Key)
+		}
+		if len(resource.Resources) == 0 {
+			continue
+		}
+
+		for _, res := range resource.Resources {
+			resources = append(resources, structs.Resource{
+				Name:    res.Name,
+				Actions: res.Actions,
+			})
+		}
+	}
+
+	repo.mu.Lock()
+	repo.cached = resources
+	repo.mu.Unlock()
+	repo.log.Debug("resource config cache refreshed", "resource_config_count", len(repo.cached))
+	return nil
+}
+
+func (repo *ResourcesRepository) InitCache(ctx context.Context, refreshDelay time.Duration) error {
+	repo.cron = cron.New(cron.WithChain(
+		cron.SkipIfStillRunning(cron.DefaultLogger),
+	))
+	if _, err := repo.cron.AddFunc("@every "+refreshDelay.String(), func() {
+		if err := repo.refresh(ctx); err != nil {
+			repo.log.Warn("failed to refresh resource config repository", "err", err)
+		}
+	}); err != nil {
+		return err
+	}
+	repo.cron.Start()
+
+	// do it once right now
+	return repo.refresh(ctx)
+}
+
+func (repo *ResourcesRepository) Close() error {
+	<-repo.cron.Stop().Done()
+	return repo.bucket.Close()
+}
+
+func NewResourcesRepository(logger log.Logger, b store.Bucket) *ResourcesRepository {
+	return &ResourcesRepository{
+		log:    logger,
+		bucket: b,
+		mu:     new(sync.Mutex),
+	}
+}

structs/resources.go

@@ -0,0 +1,6 @@
+package structs
+
+type Resource struct {
+	Name    string              `json:"name" yaml:"name"`
+	Actions map[string][]string `json:"actions" yaml:"actions"`
+}