boundary/internal/iam/resource.go

package iam

import (
	"context"
	"errors"
	"fmt"

	"github.com/hashicorp/watchtower/internal/db"
)

// Resource declares the shared behavior of IAM Resources
type Resource interface {
	// GetPublicId is the resource ID used to access the resource via an API
	GetPublicId() string

	// GetName is the optional friendly name used to
	// access the resource via an API
	GetName() string

	// GetDescription is the optional description of the resource
	GetDescription() string

	// GetScope is the Scope that owns the Resource
	GetScope(ctx context.Context, r db.Reader) (*Scope, error)

	// Type of Resource (Target, Policy, User, Group, etc)
	ResourceType() ResourceType

	// Actions that can be assigned permissions for
	// the Resource in Policies. Action String() is key for
	// the map of Actions returned.
	Actions() map[string]Action
}

// ResourceType defines the types of resources in the system
type ResourceType int

const (
	ResourceTypeUnknown           ResourceType = 0
	ResourceTypeScope             ResourceType = 1
	ResourceTypeUser              ResourceType = 2
	ResourceTypeGroup             ResourceType = 3
	ResourceTypeRole              ResourceType = 4
	ResourceTypeOrganization      ResourceType = 5
	ResourceTypeGroupMember       ResourceType = 6
	ResourceTypeGroupUserMember   ResourceType = 7
	ResourceTypeAssignedRole      ResourceType = 8
	ResourceTypeAssignedUserRole  ResourceType = 9
	ResourceTypeAssignedGroupRole ResourceType = 10
	ResourceTypeRoleGrant         ResourceType = 11
	ResourceTypeAuthMethod        ResourceType = 12
	ResourceTypeProject           ResourceType = 13
)

func (r ResourceType) String() string {
	return [...]string{
		"unknown",
		"scope",
		"user",
		"group",
		"role",
		"organization",
		"group member",
		"group user member",
		"assigned role",
		"assigned user role",
		"assigned group role",
		"role grant",
		"auth method",
		"project",
	}[r]
}

type Clonable interface {
	Clone() interface{}
}

// ResourceWithScope defines an interface for Resources that have a scope
type ResourceWithScope interface {
	GetPublicId() string
	GetScopeId() string
	validScopeTypes() []ScopeType
}

// LookupScope looks up the resource's  scope
func LookupScope(ctx context.Context, reader db.Reader, resource ResourceWithScope) (*Scope, error) {
	if reader == nil {
		return nil, errors.New("error reader is nil for LookupScope")
	}
	if resource == nil {
		return nil, errors.New("error resource is nil for LookupScope")
	}
	if resource.GetPublicId() == "" {
		return nil, errors.New("error resource has an unset public id")
	}
	if resource.GetScopeId() == "" {
		// try to retrieve it from db with it's scope id
		if err := reader.LookupByPublicId(ctx, resource); err != nil {
			return nil, fmt.Errorf("unable to get resource by public id: %w", err)
		}
		// if it's still not set after getting it from the db...
		if resource.GetScopeId() == "" {
			return nil, errors.New("error scope is unset for LookupScope")
		}
	}
	var p Scope
	if err := reader.LookupWhere(ctx, &p, "public_id = ?", resource.GetScopeId()); err != nil {
		return nil, err
	}
	return &p, nil
}

// validateScopeForWrite will validate that the scope is okay for db write operations
func validateScopeForWrite(ctx context.Context, r db.Reader, resource ResourceWithScope, opType db.OpType, opt ...db.Option) error {
	opts := db.GetOpts(opt...)

	if opType == db.CreateOp {
		if resource.GetScopeId() == "" {
			return errors.New("error scope id not set for user write")
		}
		ps, err := LookupScope(ctx, r, resource)
		if err != nil {
			if errors.Is(err, db.ErrRecordNotFound) {
				return errors.New("scope is not found")
			}
			return err
		}
		validScopeType := false
		for _, t := range resource.validScopeTypes() {
			if ps.Type == t.String() {
				validScopeType = true
			}
		}
		if !validScopeType {
			return fmt.Errorf("%s not a valid scope type for this resource", ps.Type)
		}

	}
	if opType == db.UpdateOp && resource.GetScopeId() != "" {
		if contains(opts.WithFieldMaskPaths, "ScopeId") || contains(opts.WithNullPaths, "ScopeId") {
			return errors.New("not allowed to change a resource's scope")
		}
	}
	return nil
}