provider.go

package gcloudiam

import (
	"errors"
	"fmt"
	"strings"

	"github.com/mitchellh/mapstructure"
	"github.com/raystack/guardian/core/provider"
	"github.com/raystack/guardian/domain"
	"golang.org/x/net/context"
)

//go:generate mockery --name=GcloudIamClient --exported --with-expecter
type GcloudIamClient interface {
	GetRoles() ([]*Role, error)
	GrantAccess(accountType, accountID, role string) error
	RevokeAccess(accountType, accountID, role string) error
	ListAccess(ctx context.Context, resources []*domain.Resource) (domain.MapResourceAccess, error)
}

//go:generate mockery --name=encryptor --exported --with-expecter
type encryptor interface {
	domain.Crypto
}

type Provider struct {
	provider.PermissionManager
	provider.UnimplementedClient

	typeName string
	Clients  map[string]GcloudIamClient
	crypto   encryptor
}

func NewProvider(typeName string, crypto encryptor) *Provider {
	return &Provider{
		typeName: typeName,
		Clients:  map[string]GcloudIamClient{},
		crypto:   crypto,
	}
}

func (p *Provider) GetType() string {
	return p.typeName
}

func (p *Provider) CreateConfig(pc *domain.ProviderConfig) error {
	c := NewConfig(pc, p.crypto)

	if err := c.ParseAndValidate(); err != nil {
		return err
	}

	client, err := p.getIamClient(pc)
	if err != nil {
		return err
	}

	for _, r := range c.ProviderConfig.Resources {
		if err := c.validatePermissions(r, client); err != nil {
			return err
		}
	}

	return c.EncryptCredentials()
}

func (p *Provider) GetResources(pc *domain.ProviderConfig) ([]*domain.Resource, error) {
	var creds Credentials
	if err := mapstructure.Decode(pc.Credentials, &creds); err != nil {
		return nil, err
	}

	var t string
	if strings.HasPrefix(creds.ResourceName, "project") {
		t = ResourceTypeProject
	} else if strings.HasPrefix(creds.ResourceName, "organization") {
		t = ResourceTypeOrganization
	}

	return []*domain.Resource{
		{
			ProviderType: pc.Type,
			ProviderURN:  pc.URN,
			Type:         t,
			URN:          creds.ResourceName,
			Name:         fmt.Sprintf("%s - GCP IAM", creds.ResourceName),
		},
	}, nil
}

func (p *Provider) GrantAccess(pc *domain.ProviderConfig, a domain.Grant) error {
	// TODO: validate provider config and appeal

	var creds Credentials
	if err := mapstructure.Decode(pc.Credentials, &creds); err != nil {
		return err
	}

	client, err := p.getIamClient(pc)
	if err != nil {
		return err
	}

	if a.Resource.Type == ResourceTypeProject || a.Resource.Type == ResourceTypeOrganization {
		for _, p := range a.Permissions {
			permission := fmt.Sprint(p)
			if err := client.GrantAccess(a.AccountType, a.AccountID, permission); err != nil {
				if !errors.Is(err, ErrPermissionAlreadyExists) {
					return err
				}
			}
		}

		return nil
	}

	return ErrInvalidResourceType
}

func (p *Provider) RevokeAccess(pc *domain.ProviderConfig, a domain.Grant) error {
	var creds Credentials
	if err := mapstructure.Decode(pc.Credentials, &creds); err != nil {
		return err
	}

	client, err := p.getIamClient(pc)
	if err != nil {
		return err
	}

	if a.Resource.Type == ResourceTypeProject || a.Resource.Type == ResourceTypeOrganization {
		for _, p := range a.Permissions {
			permission := fmt.Sprint(p)
			if err := client.RevokeAccess(a.AccountType, a.AccountID, permission); err != nil {
				if !errors.Is(err, ErrPermissionNotFound) {
					return err
				}
			}
		}

		return nil
	}

	return ErrInvalidResourceType
}

func (p *Provider) GetRoles(pc *domain.ProviderConfig, resourceType string) ([]*domain.Role, error) {
	if resourceType != ResourceTypeProject && resourceType != ResourceTypeOrganization {
		return nil, ErrInvalidResourceType
	}

	return provider.GetRoles(pc, resourceType)
}

func (p *Provider) GetPermissions(_pc *domain.ProviderConfig, _resourceType, role string) ([]interface{}, error) {
	// TODO: validate if role is a valid gcloud iam role
	return p.PermissionManager.GetPermissions(_pc, _resourceType, role)
}

func (p *Provider) GetAccountTypes() []string {
	return []string{
		AccountTypeUser,
		AccountTypeServiceAccount,
		AccountTypeGroup,
	}
}

func (p *Provider) ListAccess(ctx context.Context, pc domain.ProviderConfig, resources []*domain.Resource) (domain.MapResourceAccess, error) {
	var creds Credentials
	if err := mapstructure.Decode(pc.Credentials, &creds); err != nil {
		return nil, fmt.Errorf("parsing credentials: %w", err)
	}

	client, err := p.getIamClient(&pc)
	if err != nil {
		return nil, fmt.Errorf("initializing iam client: %w", err)
	}

	return client.ListAccess(ctx, resources)
}

func (p *Provider) getIamClient(pc *domain.ProviderConfig) (GcloudIamClient, error) {
	var credentials Credentials
	if err := mapstructure.Decode(pc.Credentials, &credentials); err != nil {
		return nil, err
	}
	providerURN := pc.URN

	if p.Clients[providerURN] != nil {
		return p.Clients[providerURN], nil
	}

	credentials.Decrypt(p.crypto)
	client, err := newIamClient([]byte(credentials.ServiceAccountKey), credentials.ResourceName)
	if err != nil {
		return nil, err
	}

	p.Clients[providerURN] = client
	return client, nil
}