chenchenandClaude Opus 4.8
ae251cf70e
Resource binding backend (CRUD + secret-to-KV) is now fully functional after provisioning the Key Vault. Added vm/database/blob to allowedResourceTypes for the desktop binding set (gitea/github use type=git + provider). git binding + KV secret write verified end-to-end (secret lands in heicode-kv). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
952 lines
28 KiB
Go
952 lines
28 KiB
Go
package controller
|
|
|
|
import (
|
|
"crypto/sha256"
|
|
"encoding/hex"
|
|
"errors"
|
|
"fmt"
|
|
"net/http"
|
|
"sort"
|
|
"strings"
|
|
|
|
"github.com/heicode/manager/common"
|
|
"github.com/heicode/manager/model"
|
|
|
|
"github.com/gin-gonic/gin"
|
|
"gorm.io/gorm"
|
|
)
|
|
|
|
var allowedResourceTypes = map[string]bool{
|
|
"git": true, // github / gitea — distinguished by provider
|
|
"vm": true, // 虚拟机 (ssh)
|
|
"database": true, // 数据库
|
|
"blob": true, // 对象存储
|
|
"sk": true,
|
|
"project_document": true,
|
|
"cloud_account": true,
|
|
"cloud_resource": true,
|
|
}
|
|
|
|
var allowedResourceStatuses = map[string]bool{
|
|
"active": true,
|
|
"disabled": true,
|
|
"revoked": true,
|
|
}
|
|
|
|
var secretLikeKeys = map[string]bool{
|
|
"access_key": true,
|
|
"access_key_id": true,
|
|
"api_key": true,
|
|
"client_secret": true,
|
|
"database_password": true,
|
|
"db_password": true,
|
|
"newapi_key": true,
|
|
"password": true,
|
|
"private_key": true,
|
|
"refresh_token": true,
|
|
"secret": true,
|
|
"secret_key": true,
|
|
"ssh_key": true,
|
|
"token": true,
|
|
}
|
|
|
|
const azureKeyVaultSecretNameMaxLen = 127
|
|
const azureKeyVaultSecretNameHashLen = 16
|
|
|
|
type resourcePayload struct {
|
|
TenantId string `json:"tenant_id"`
|
|
ProjectId string `json:"project_id"`
|
|
BindingScope string `json:"binding_scope"`
|
|
Name string `json:"name"`
|
|
ResourceType string `json:"resource_type"`
|
|
Provider string `json:"provider"`
|
|
ExternalId string `json:"external_id"`
|
|
SecretRef string `json:"secret_ref"`
|
|
Metadata map[string]any `json:"metadata"`
|
|
PermissionScope map[string]any `json:"permission_scope"`
|
|
Constraints map[string]any `json:"constraints"`
|
|
Status string `json:"status"`
|
|
}
|
|
|
|
type resourceSecretPayload struct {
|
|
Data map[string]any `json:"data"`
|
|
}
|
|
|
|
type resourceResponse struct {
|
|
Id int `json:"id"`
|
|
UserId int `json:"user_id"`
|
|
TenantId string `json:"tenant_id"`
|
|
ProjectId string `json:"project_id"`
|
|
BindingScope string `json:"binding_scope"`
|
|
Name string `json:"name"`
|
|
ResourceType string `json:"resource_type"`
|
|
Provider string `json:"provider"`
|
|
ExternalId string `json:"external_id"`
|
|
SecretRef string `json:"secret_ref"`
|
|
Metadata map[string]any `json:"metadata"`
|
|
PermissionScope map[string]any `json:"permission_scope"`
|
|
Constraints map[string]any `json:"constraints"`
|
|
Status string `json:"status"`
|
|
CreatedAt int64 `json:"created_at"`
|
|
UpdatedAt int64 `json:"updated_at"`
|
|
}
|
|
|
|
type resourceGrantPayload struct {
|
|
TenantId string `json:"tenant_id"`
|
|
ProjectId string `json:"project_id"`
|
|
BindingScope string `json:"binding_scope"`
|
|
ResourceId int `json:"resource_id"`
|
|
Role string `json:"role"`
|
|
AgentId string `json:"agent_id"`
|
|
PermissionScope map[string]any `json:"permission_scope"`
|
|
Constraints map[string]any `json:"constraints"`
|
|
Status string `json:"status"`
|
|
}
|
|
|
|
type resourceGrantResponse struct {
|
|
Id int `json:"id"`
|
|
UserId int `json:"user_id"`
|
|
TenantId string `json:"tenant_id"`
|
|
ProjectId string `json:"project_id"`
|
|
BindingScope string `json:"binding_scope"`
|
|
ResourceId int `json:"resource_id"`
|
|
Role string `json:"role"`
|
|
AgentId string `json:"agent_id"`
|
|
PermissionScope map[string]any `json:"permission_scope"`
|
|
Constraints map[string]any `json:"constraints"`
|
|
Status string `json:"status"`
|
|
RevokedAt int64 `json:"revoked_at"`
|
|
Resource *resourceResponse `json:"resource,omitempty"`
|
|
CreatedAt int64 `json:"created_at"`
|
|
UpdatedAt int64 `json:"updated_at"`
|
|
}
|
|
|
|
type resourceGrantManifestGrant struct {
|
|
GrantId int `json:"grant_id"`
|
|
ResourceId int `json:"resource_id"`
|
|
ResourceType string `json:"resource_type"`
|
|
ResourceRef string `json:"resource_ref"`
|
|
AllowedActions []any `json:"allowed_actions"`
|
|
PermissionScope map[string]any `json:"permission_scope"`
|
|
Constraints map[string]any `json:"constraints"`
|
|
SecretRef string `json:"secret_ref,omitempty"`
|
|
Status string `json:"status"`
|
|
}
|
|
|
|
type resourceGrantManifestResponse struct {
|
|
UserId int `json:"user_id"`
|
|
BindingScope string `json:"binding_scope"`
|
|
AgentRole string `json:"agent_role"`
|
|
TargetAgentRef string `json:"target_agent_ref"`
|
|
ResourceGrants []resourceGrantManifestGrant `json:"resource_grants"`
|
|
}
|
|
|
|
func normalizeResourcePayload(p resourcePayload) (resourcePayload, error) {
|
|
p.TenantId = strings.TrimSpace(p.TenantId)
|
|
p.ProjectId = strings.TrimSpace(p.ProjectId)
|
|
p.BindingScope = strings.TrimSpace(p.BindingScope)
|
|
p.Name = strings.TrimSpace(p.Name)
|
|
p.ResourceType = strings.ToLower(strings.TrimSpace(p.ResourceType))
|
|
p.Provider = strings.TrimSpace(p.Provider)
|
|
p.ExternalId = strings.TrimSpace(p.ExternalId)
|
|
p.SecretRef = strings.TrimSpace(p.SecretRef)
|
|
p.Status = strings.ToLower(strings.TrimSpace(p.Status))
|
|
|
|
if p.BindingScope == "" {
|
|
p.BindingScope = inferResourceBindingScope(p)
|
|
}
|
|
if p.Name == "" {
|
|
return p, errors.New("name required")
|
|
}
|
|
if !allowedResourceTypes[p.ResourceType] {
|
|
return p, fmt.Errorf("resource_type must be one of %s", strings.Join(sortedResourceTypes(), ", "))
|
|
}
|
|
if p.Provider == "" {
|
|
p.Provider = "custom"
|
|
}
|
|
if p.Status == "" {
|
|
p.Status = "active"
|
|
}
|
|
if !allowedResourceStatuses[p.Status] {
|
|
return p, errors.New("status must be active, disabled, or revoked")
|
|
}
|
|
if p.SecretRef != "" && !strings.HasPrefix(p.SecretRef, "azkv://") {
|
|
return p, errors.New("secret_ref must use azkv://<vault>/secrets/<name> Azure Key Vault reference")
|
|
}
|
|
if p.Metadata == nil {
|
|
p.Metadata = map[string]any{}
|
|
}
|
|
if p.PermissionScope == nil {
|
|
p.PermissionScope = map[string]any{}
|
|
}
|
|
if p.Constraints == nil {
|
|
p.Constraints = map[string]any{}
|
|
}
|
|
if containsPlaintextSecret(p.Metadata) || containsPlaintextSecret(p.PermissionScope) || containsPlaintextSecret(p.Constraints) {
|
|
return p, errors.New("plaintext secrets are not allowed; store credentials in Secret Store and provide secret_ref only")
|
|
}
|
|
return p, nil
|
|
}
|
|
|
|
func normalizeResourceGrantPayload(p resourceGrantPayload) (resourceGrantPayload, error) {
|
|
p.TenantId = strings.TrimSpace(p.TenantId)
|
|
p.ProjectId = strings.TrimSpace(p.ProjectId)
|
|
p.BindingScope = strings.TrimSpace(p.BindingScope)
|
|
p.Role = strings.TrimSpace(p.Role)
|
|
p.AgentId = strings.TrimSpace(p.AgentId)
|
|
p.Status = strings.ToLower(strings.TrimSpace(p.Status))
|
|
|
|
if p.ResourceId <= 0 {
|
|
return p, errors.New("resource_id required")
|
|
}
|
|
if p.Role == "" {
|
|
return p, errors.New("role required")
|
|
}
|
|
if p.AgentId == "" {
|
|
return p, errors.New("agent_id required")
|
|
}
|
|
if p.Status == "" {
|
|
p.Status = "active"
|
|
}
|
|
if !allowedResourceStatuses[p.Status] {
|
|
return p, errors.New("status must be active, disabled, or revoked")
|
|
}
|
|
if p.PermissionScope == nil {
|
|
p.PermissionScope = map[string]any{}
|
|
}
|
|
if p.Constraints == nil {
|
|
p.Constraints = map[string]any{}
|
|
}
|
|
if containsPlaintextSecret(p.PermissionScope) || containsPlaintextSecret(p.Constraints) {
|
|
return p, errors.New("plaintext secrets are not allowed; store credentials in Secret Store and provide secret_ref only")
|
|
}
|
|
return p, nil
|
|
}
|
|
|
|
func inferResourceBindingScope(p resourcePayload) string {
|
|
switch {
|
|
case p.ExternalId != "":
|
|
return p.ExternalId
|
|
case p.ProjectId != "":
|
|
return p.ProjectId
|
|
case p.TenantId != "":
|
|
return p.TenantId
|
|
case p.Name != "":
|
|
return p.Name
|
|
default:
|
|
return "resource"
|
|
}
|
|
}
|
|
|
|
func sortedResourceTypes() []string {
|
|
types := make([]string, 0, len(allowedResourceTypes))
|
|
for resourceType := range allowedResourceTypes {
|
|
types = append(types, resourceType)
|
|
}
|
|
sort.Strings(types)
|
|
return types
|
|
}
|
|
|
|
func containsPlaintextSecret(value any) bool {
|
|
switch v := value.(type) {
|
|
case map[string]any:
|
|
for key, child := range v {
|
|
if isSecretLikeKey(key) {
|
|
return true
|
|
}
|
|
if containsPlaintextSecret(child) {
|
|
return true
|
|
}
|
|
}
|
|
case []any:
|
|
for _, child := range v {
|
|
if containsPlaintextSecret(child) {
|
|
return true
|
|
}
|
|
}
|
|
case string:
|
|
return valueLooksLikeSecret(v)
|
|
}
|
|
return false
|
|
}
|
|
|
|
func isSecretLikeKey(key string) bool {
|
|
normalized := strings.ToLower(strings.TrimSpace(key))
|
|
normalized = strings.ReplaceAll(normalized, "-", "_")
|
|
normalized = strings.ReplaceAll(normalized, " ", "_")
|
|
if secretLikeKeys[normalized] {
|
|
return true
|
|
}
|
|
return strings.HasSuffix(normalized, "_token") || strings.HasSuffix(normalized, "_secret") || strings.HasSuffix(normalized, "_password") || strings.HasSuffix(normalized, "_private_key")
|
|
}
|
|
|
|
// valueLooksLikeSecret scans a string VALUE (not just a key name) for high-
|
|
// confidence plaintext credential patterns, so a secret hidden under an
|
|
// innocuous key (e.g. {"note":"sk-live-..."}) is still rejected. Patterns are
|
|
// kept deliberately tight to avoid false positives on ordinary content. An
|
|
// azkv:// secret_ref never matches any of these, so references stay allowed.
|
|
func valueLooksLikeSecret(value string) bool {
|
|
s := strings.TrimSpace(value)
|
|
if len(s) < 12 {
|
|
return false
|
|
}
|
|
if strings.Contains(s, "PRIVATE KEY-----") {
|
|
return true
|
|
}
|
|
prefixes := []struct {
|
|
p string
|
|
min int
|
|
}{
|
|
{"sk-", 20}, {"sk_live_", 20}, {"sk_test_", 20},
|
|
{"ghp_", 24}, {"gho_", 24}, {"github_pat_", 24},
|
|
{"xoxb-", 24}, {"xoxp-", 24}, {"xoxa-", 24},
|
|
{"AKIA", 16}, {"ASIA", 16}, {"AIza", 24},
|
|
}
|
|
for _, pf := range prefixes {
|
|
if len(s) >= pf.min && strings.HasPrefix(s, pf.p) {
|
|
return true
|
|
}
|
|
}
|
|
return looksLikeJWT(s)
|
|
}
|
|
|
|
func looksLikeJWT(s string) bool {
|
|
if !strings.HasPrefix(s, "eyJ") {
|
|
return false
|
|
}
|
|
parts := strings.Split(s, ".")
|
|
if len(parts) != 3 {
|
|
return false
|
|
}
|
|
for _, p := range parts {
|
|
if len(p) < 8 {
|
|
return false
|
|
}
|
|
}
|
|
return true
|
|
}
|
|
|
|
func marshalResourceJSON(value map[string]any) (string, error) {
|
|
if value == nil {
|
|
value = map[string]any{}
|
|
}
|
|
data, err := common.Marshal(value)
|
|
if err != nil {
|
|
return "", err
|
|
}
|
|
return string(data), nil
|
|
}
|
|
|
|
func unmarshalResourceJSON(raw string) map[string]any {
|
|
if strings.TrimSpace(raw) == "" {
|
|
return map[string]any{}
|
|
}
|
|
var value map[string]any
|
|
if err := common.UnmarshalJsonStr(raw, &value); err != nil || value == nil {
|
|
return map[string]any{}
|
|
}
|
|
return value
|
|
}
|
|
|
|
func resourceToResponse(resource model.ResourceBinding) resourceResponse {
|
|
return resourceResponse{
|
|
Id: resource.Id,
|
|
UserId: resource.UserId,
|
|
TenantId: resource.TenantId,
|
|
ProjectId: resource.ProjectId,
|
|
BindingScope: resource.BindingScope,
|
|
Name: resource.Name,
|
|
ResourceType: resource.ResourceType,
|
|
Provider: resource.Provider,
|
|
ExternalId: resource.ExternalId,
|
|
SecretRef: resource.SecretRef,
|
|
Metadata: unmarshalResourceJSON(resource.Metadata),
|
|
PermissionScope: unmarshalResourceJSON(resource.PermissionScope),
|
|
Constraints: unmarshalResourceJSON(resource.Constraints),
|
|
Status: resource.Status,
|
|
CreatedAt: resource.CreatedAt,
|
|
UpdatedAt: resource.UpdatedAt,
|
|
}
|
|
}
|
|
|
|
func resourceGrantToResponse(grant model.ResourceGrant, resource *model.ResourceBinding) resourceGrantResponse {
|
|
resp := resourceGrantResponse{
|
|
Id: grant.Id,
|
|
UserId: grant.UserId,
|
|
TenantId: grant.TenantId,
|
|
ProjectId: grant.ProjectId,
|
|
BindingScope: grant.BindingScope,
|
|
ResourceId: grant.ResourceId,
|
|
Role: grant.Role,
|
|
AgentId: grant.AgentId,
|
|
PermissionScope: unmarshalResourceJSON(grant.PermissionScope),
|
|
Constraints: unmarshalResourceJSON(grant.Constraints),
|
|
Status: grant.Status,
|
|
RevokedAt: grant.RevokedAt,
|
|
CreatedAt: grant.CreatedAt,
|
|
UpdatedAt: grant.UpdatedAt,
|
|
}
|
|
if resource != nil {
|
|
resourceResp := resourceToResponse(*resource)
|
|
resp.Resource = &resourceResp
|
|
}
|
|
return resp
|
|
}
|
|
|
|
func resourceGrantToManifestGrant(grant model.ResourceGrant, resource model.ResourceBinding) resourceGrantManifestGrant {
|
|
permissionScope := unmarshalResourceJSON(grant.PermissionScope)
|
|
return resourceGrantManifestGrant{
|
|
GrantId: grant.Id,
|
|
ResourceId: grant.ResourceId,
|
|
ResourceType: resource.ResourceType,
|
|
ResourceRef: resourceManifestRef(resource),
|
|
AllowedActions: manifestAllowedActions(permissionScope),
|
|
PermissionScope: permissionScope,
|
|
Constraints: unmarshalResourceJSON(grant.Constraints),
|
|
SecretRef: resource.SecretRef,
|
|
Status: grant.Status,
|
|
}
|
|
}
|
|
|
|
func resourceManifestRef(resource model.ResourceBinding) string {
|
|
for _, value := range []string{resource.ExternalId, resource.BindingScope, resource.Name} {
|
|
if strings.TrimSpace(value) != "" {
|
|
return value
|
|
}
|
|
}
|
|
return fmt.Sprintf("resource:%d", resource.Id)
|
|
}
|
|
|
|
func manifestAllowedActions(permissionScope map[string]any) []any {
|
|
actions, ok := permissionScope["actions"]
|
|
if !ok {
|
|
return []any{}
|
|
}
|
|
switch v := actions.(type) {
|
|
case []any:
|
|
return v
|
|
case []string:
|
|
out := make([]any, 0, len(v))
|
|
for _, action := range v {
|
|
out = append(out, action)
|
|
}
|
|
return out
|
|
case string:
|
|
if strings.TrimSpace(v) == "" {
|
|
return []any{}
|
|
}
|
|
return []any{v}
|
|
default:
|
|
return []any{}
|
|
}
|
|
}
|
|
|
|
func ListResources(c *gin.Context) {
|
|
userId := c.GetInt("id")
|
|
query := model.DB.Where("user_id = ?", userId)
|
|
if tenantId := strings.TrimSpace(c.Query("tenant_id")); tenantId != "" {
|
|
query = query.Where("tenant_id = ?", tenantId)
|
|
}
|
|
if projectId := strings.TrimSpace(c.Query("project_id")); projectId != "" {
|
|
query = query.Where("project_id = ?", projectId)
|
|
}
|
|
if bindingScope := strings.TrimSpace(c.Query("binding_scope")); bindingScope != "" {
|
|
query = query.Where("binding_scope = ?", bindingScope)
|
|
}
|
|
resourceType := strings.TrimSpace(c.Query("resource_type"))
|
|
if resourceType == "" {
|
|
resourceType = strings.TrimSpace(c.Query("type"))
|
|
}
|
|
if resourceType != "" {
|
|
query = query.Where("resource_type = ?", strings.ToLower(resourceType))
|
|
}
|
|
if status := strings.TrimSpace(c.Query("status")); status != "" {
|
|
query = query.Where("status = ?", strings.ToLower(status))
|
|
}
|
|
var resources []model.ResourceBinding
|
|
if err := query.Order("id desc").Find(&resources).Error; err != nil {
|
|
common.ApiError(c, err)
|
|
return
|
|
}
|
|
items := make([]resourceResponse, 0, len(resources))
|
|
for _, resource := range resources {
|
|
items = append(items, resourceToResponse(resource))
|
|
}
|
|
common.ApiSuccess(c, gin.H{"items": items})
|
|
}
|
|
|
|
func CreateResource(c *gin.Context) {
|
|
userId := c.GetInt("id")
|
|
var payload resourcePayload
|
|
if err := c.ShouldBindJSON(&payload); err != nil {
|
|
c.JSON(http.StatusOK, gin.H{"success": false, "message": "invalid params"})
|
|
return
|
|
}
|
|
payload, err := normalizeResourcePayload(payload)
|
|
if err != nil {
|
|
common.ApiError(c, err)
|
|
return
|
|
}
|
|
metadata, permissionScope, constraints, err := marshalResourcePayloadJSON(payload)
|
|
if err != nil {
|
|
common.ApiError(c, err)
|
|
return
|
|
}
|
|
resource := model.ResourceBinding{
|
|
UserId: userId,
|
|
TenantId: payload.TenantId,
|
|
ProjectId: payload.ProjectId,
|
|
BindingScope: payload.BindingScope,
|
|
Name: payload.Name,
|
|
ResourceType: payload.ResourceType,
|
|
Provider: payload.Provider,
|
|
ExternalId: payload.ExternalId,
|
|
SecretRef: payload.SecretRef,
|
|
Metadata: metadata,
|
|
PermissionScope: permissionScope,
|
|
Constraints: constraints,
|
|
Status: payload.Status,
|
|
}
|
|
if err := model.DB.Create(&resource).Error; err != nil {
|
|
common.ApiError(c, err)
|
|
return
|
|
}
|
|
common.ApiSuccess(c, resourceToResponse(resource))
|
|
}
|
|
|
|
func UpdateResource(c *gin.Context) {
|
|
userId := c.GetInt("id")
|
|
var resource model.ResourceBinding
|
|
if err := model.DB.Where("id = ? AND user_id = ?", c.Param("id"), userId).First(&resource).Error; err != nil {
|
|
if errors.Is(err, gorm.ErrRecordNotFound) {
|
|
common.ApiErrorMsg(c, "resource not found")
|
|
return
|
|
}
|
|
common.ApiError(c, err)
|
|
return
|
|
}
|
|
var payload resourcePayload
|
|
if err := c.ShouldBindJSON(&payload); err != nil {
|
|
c.JSON(http.StatusOK, gin.H{"success": false, "message": "invalid params"})
|
|
return
|
|
}
|
|
payload, err := normalizeResourcePayload(payload)
|
|
if err != nil {
|
|
common.ApiError(c, err)
|
|
return
|
|
}
|
|
metadata, permissionScope, constraints, err := marshalResourcePayloadJSON(payload)
|
|
if err != nil {
|
|
common.ApiError(c, err)
|
|
return
|
|
}
|
|
resource.TenantId = payload.TenantId
|
|
resource.ProjectId = payload.ProjectId
|
|
resource.BindingScope = payload.BindingScope
|
|
resource.Name = payload.Name
|
|
resource.ResourceType = payload.ResourceType
|
|
resource.Provider = payload.Provider
|
|
resource.ExternalId = payload.ExternalId
|
|
resource.SecretRef = payload.SecretRef
|
|
resource.Metadata = metadata
|
|
resource.PermissionScope = permissionScope
|
|
resource.Constraints = constraints
|
|
resource.Status = payload.Status
|
|
if err := model.DB.Save(&resource).Error; err != nil {
|
|
common.ApiError(c, err)
|
|
return
|
|
}
|
|
common.ApiSuccess(c, resourceToResponse(resource))
|
|
}
|
|
|
|
func DeleteResource(c *gin.Context) {
|
|
userId := c.GetInt("id")
|
|
var resource model.ResourceBinding
|
|
if err := model.DB.Where("id = ? AND user_id = ?", c.Param("id"), userId).First(&resource).Error; err != nil {
|
|
if errors.Is(err, gorm.ErrRecordNotFound) {
|
|
common.ApiErrorMsg(c, "resource not found")
|
|
return
|
|
}
|
|
common.ApiError(c, err)
|
|
return
|
|
}
|
|
now := common.GetTimestamp()
|
|
err := model.DB.Transaction(func(tx *gorm.DB) error {
|
|
resource.Status = "revoked"
|
|
if err := tx.Save(&resource).Error; err != nil {
|
|
return err
|
|
}
|
|
return tx.Model(&model.ResourceGrant{}).
|
|
Where("user_id = ? AND resource_id = ? AND status <> ?", userId, resource.Id, "revoked").
|
|
Updates(map[string]any{
|
|
"status": "revoked",
|
|
"revoked_at": now,
|
|
}).Error
|
|
})
|
|
if err != nil {
|
|
common.ApiError(c, err)
|
|
return
|
|
}
|
|
common.ApiSuccess(c, resourceToResponse(resource))
|
|
}
|
|
|
|
func UpsertResourceSecret(c *gin.Context) {
|
|
userId := c.GetInt("id")
|
|
var resource model.ResourceBinding
|
|
if err := model.DB.Where("id = ? AND user_id = ?", c.Param("id"), userId).First(&resource).Error; err != nil {
|
|
if errors.Is(err, gorm.ErrRecordNotFound) {
|
|
common.ApiErrorMsg(c, "resource not found")
|
|
return
|
|
}
|
|
common.ApiError(c, err)
|
|
return
|
|
}
|
|
var payload resourceSecretPayload
|
|
if err := c.ShouldBindJSON(&payload); err != nil {
|
|
c.JSON(http.StatusOK, gin.H{"success": false, "message": "invalid params"})
|
|
return
|
|
}
|
|
if len(payload.Data) == 0 {
|
|
common.ApiErrorMsg(c, "secret data required")
|
|
return
|
|
}
|
|
client, err := newSecretStoreClientFromEnv()
|
|
if err != nil {
|
|
common.ApiError(c, err)
|
|
return
|
|
}
|
|
secretName := resourceSecretName(resource)
|
|
secretRef, err := client.putSecret(secretName, payload.Data)
|
|
if err != nil {
|
|
common.ApiError(c, err)
|
|
return
|
|
}
|
|
resource.SecretRef = secretRef
|
|
if err := model.DB.Save(&resource).Error; err != nil {
|
|
common.ApiError(c, err)
|
|
return
|
|
}
|
|
common.ApiSuccess(c, gin.H{
|
|
"resource": resourceToResponse(resource),
|
|
"secret_ref": resource.SecretRef,
|
|
})
|
|
}
|
|
|
|
func resourceSecretName(resource model.ResourceBinding) string {
|
|
scope := resource.BindingScope
|
|
if strings.TrimSpace(scope) == "" {
|
|
scope = resource.ExternalId
|
|
}
|
|
if strings.TrimSpace(scope) == "" {
|
|
scope = resource.Name
|
|
}
|
|
return compactAzureSecretName(
|
|
fmt.Sprintf("users-%d-bindings-", resource.UserId),
|
|
sanitizeSecretPathSegment(scope),
|
|
fmt.Sprintf("-resources-%d", resource.Id),
|
|
)
|
|
}
|
|
|
|
func sanitizeSecretPathSegment(value string) string {
|
|
value = strings.TrimSpace(value)
|
|
if value == "" {
|
|
return "resource"
|
|
}
|
|
var b strings.Builder
|
|
for _, r := range value {
|
|
switch {
|
|
case r >= 'a' && r <= 'z':
|
|
b.WriteRune(r)
|
|
case r >= 'A' && r <= 'Z':
|
|
b.WriteRune(r)
|
|
case r >= '0' && r <= '9':
|
|
b.WriteRune(r)
|
|
case r == '-':
|
|
b.WriteRune(r)
|
|
default:
|
|
b.WriteRune('-')
|
|
}
|
|
}
|
|
return b.String()
|
|
}
|
|
|
|
func compactAzureSecretName(prefix string, segment string, suffix string) string {
|
|
name := prefix + segment + suffix
|
|
if len(name) <= azureKeyVaultSecretNameMaxLen {
|
|
return name
|
|
}
|
|
hash := sha256.Sum256([]byte(segment))
|
|
hashSuffix := hex.EncodeToString(hash[:])[:azureKeyVaultSecretNameHashLen]
|
|
maxSegmentLen := azureKeyVaultSecretNameMaxLen - len(prefix) - len(suffix) - 1 - azureKeyVaultSecretNameHashLen
|
|
if maxSegmentLen < 1 {
|
|
maxSegmentLen = 1
|
|
}
|
|
if len(segment) > maxSegmentLen {
|
|
segment = segment[:maxSegmentLen]
|
|
}
|
|
segment = strings.Trim(segment, "-")
|
|
if segment == "" {
|
|
segment = "resource"
|
|
if len(segment) > maxSegmentLen {
|
|
segment = segment[:maxSegmentLen]
|
|
}
|
|
}
|
|
return prefix + segment + "-" + hashSuffix + suffix
|
|
}
|
|
|
|
func marshalResourcePayloadJSON(payload resourcePayload) (string, string, string, error) {
|
|
metadata, err := marshalResourceJSON(payload.Metadata)
|
|
if err != nil {
|
|
return "", "", "", err
|
|
}
|
|
permissionScope, err := marshalResourceJSON(payload.PermissionScope)
|
|
if err != nil {
|
|
return "", "", "", err
|
|
}
|
|
constraints, err := marshalResourceJSON(payload.Constraints)
|
|
if err != nil {
|
|
return "", "", "", err
|
|
}
|
|
return metadata, permissionScope, constraints, nil
|
|
}
|
|
|
|
func ListResourceGrants(c *gin.Context) {
|
|
userId := c.GetInt("id")
|
|
query := model.DB.Where("user_id = ?", userId)
|
|
if tenantId := strings.TrimSpace(c.Query("tenant_id")); tenantId != "" {
|
|
query = query.Where("tenant_id = ?", tenantId)
|
|
}
|
|
if projectId := strings.TrimSpace(c.Query("project_id")); projectId != "" {
|
|
query = query.Where("project_id = ?", projectId)
|
|
}
|
|
if bindingScope := strings.TrimSpace(c.Query("binding_scope")); bindingScope != "" {
|
|
query = query.Where("binding_scope = ?", bindingScope)
|
|
}
|
|
if agentId := strings.TrimSpace(c.Query("agent_id")); agentId != "" {
|
|
query = query.Where("agent_id = ?", agentId)
|
|
}
|
|
if resourceId := strings.TrimSpace(c.Query("resource_id")); resourceId != "" {
|
|
query = query.Where("resource_id = ?", resourceId)
|
|
}
|
|
if status := strings.TrimSpace(c.Query("status")); status != "" {
|
|
query = query.Where("status = ?", strings.ToLower(status))
|
|
}
|
|
var grants []model.ResourceGrant
|
|
if err := query.Order("id desc").Find(&grants).Error; err != nil {
|
|
common.ApiError(c, err)
|
|
return
|
|
}
|
|
items := make([]resourceGrantResponse, 0, len(grants))
|
|
for _, grant := range grants {
|
|
items = append(items, resourceGrantToResponse(grant, nil))
|
|
}
|
|
common.ApiSuccess(c, gin.H{"items": items})
|
|
}
|
|
|
|
func GenerateResourceGrantManifest(c *gin.Context) {
|
|
userId := c.GetInt("id")
|
|
bindingScope := strings.TrimSpace(c.Query("binding_scope"))
|
|
agentId := strings.TrimSpace(c.Query("agent_id"))
|
|
role := strings.TrimSpace(c.Query("role"))
|
|
|
|
query := model.DB.Where("user_id = ? AND status = ?", userId, "active")
|
|
if bindingScope != "" {
|
|
query = query.Where("binding_scope = ?", bindingScope)
|
|
}
|
|
if agentId != "" {
|
|
query = query.Where("agent_id = ?", agentId)
|
|
}
|
|
if role != "" {
|
|
query = query.Where("role = ?", role)
|
|
}
|
|
|
|
var grants []model.ResourceGrant
|
|
if err := query.Order("id asc").Find(&grants).Error; err != nil {
|
|
common.ApiError(c, err)
|
|
return
|
|
}
|
|
|
|
items := make([]resourceGrantManifestGrant, 0, len(grants))
|
|
for _, grant := range grants {
|
|
var resource model.ResourceBinding
|
|
if err := model.DB.Where("id = ? AND user_id = ? AND status = ?", grant.ResourceId, userId, "active").First(&resource).Error; err != nil {
|
|
if errors.Is(err, gorm.ErrRecordNotFound) {
|
|
continue
|
|
}
|
|
common.ApiError(c, err)
|
|
return
|
|
}
|
|
items = append(items, resourceGrantToManifestGrant(grant, resource))
|
|
}
|
|
|
|
common.ApiSuccess(c, resourceGrantManifestResponse{
|
|
UserId: userId,
|
|
BindingScope: bindingScope,
|
|
AgentRole: role,
|
|
TargetAgentRef: agentId,
|
|
ResourceGrants: items,
|
|
})
|
|
}
|
|
|
|
func CreateResourceGrant(c *gin.Context) {
|
|
userId := c.GetInt("id")
|
|
var payload resourceGrantPayload
|
|
if err := c.ShouldBindJSON(&payload); err != nil {
|
|
c.JSON(http.StatusOK, gin.H{"success": false, "message": "invalid params"})
|
|
return
|
|
}
|
|
payload, err := normalizeResourceGrantPayload(payload)
|
|
if err != nil {
|
|
common.ApiError(c, err)
|
|
return
|
|
}
|
|
resource, err := findGrantResource(userId, payload.ResourceId, payload.BindingScope)
|
|
if err != nil {
|
|
common.ApiError(c, err)
|
|
return
|
|
}
|
|
payload = inheritResourceGrantScope(payload, resource)
|
|
permissionScope, constraints, err := marshalResourceGrantPayloadJSON(payload)
|
|
if err != nil {
|
|
common.ApiError(c, err)
|
|
return
|
|
}
|
|
grant := model.ResourceGrant{
|
|
UserId: userId,
|
|
TenantId: payload.TenantId,
|
|
ProjectId: payload.ProjectId,
|
|
BindingScope: payload.BindingScope,
|
|
ResourceId: payload.ResourceId,
|
|
Role: payload.Role,
|
|
AgentId: payload.AgentId,
|
|
PermissionScope: permissionScope,
|
|
Constraints: constraints,
|
|
Status: payload.Status,
|
|
}
|
|
if err := model.DB.Create(&grant).Error; err != nil {
|
|
common.ApiError(c, err)
|
|
return
|
|
}
|
|
common.ApiSuccess(c, resourceGrantToResponse(grant, &resource))
|
|
}
|
|
|
|
func UpdateResourceGrant(c *gin.Context) {
|
|
userId := c.GetInt("id")
|
|
var grant model.ResourceGrant
|
|
if err := model.DB.Where("id = ? AND user_id = ?", c.Param("id"), userId).First(&grant).Error; err != nil {
|
|
if errors.Is(err, gorm.ErrRecordNotFound) {
|
|
common.ApiErrorMsg(c, "resource grant not found")
|
|
return
|
|
}
|
|
common.ApiError(c, err)
|
|
return
|
|
}
|
|
var payload resourceGrantPayload
|
|
if err := c.ShouldBindJSON(&payload); err != nil {
|
|
c.JSON(http.StatusOK, gin.H{"success": false, "message": "invalid params"})
|
|
return
|
|
}
|
|
payload, err := normalizeResourceGrantPayload(payload)
|
|
if err != nil {
|
|
common.ApiError(c, err)
|
|
return
|
|
}
|
|
resource, err := findGrantResource(userId, payload.ResourceId, payload.BindingScope)
|
|
if err != nil {
|
|
common.ApiError(c, err)
|
|
return
|
|
}
|
|
payload = inheritResourceGrantScope(payload, resource)
|
|
permissionScope, constraints, err := marshalResourceGrantPayloadJSON(payload)
|
|
if err != nil {
|
|
common.ApiError(c, err)
|
|
return
|
|
}
|
|
grant.TenantId = payload.TenantId
|
|
grant.ProjectId = payload.ProjectId
|
|
grant.BindingScope = payload.BindingScope
|
|
grant.ResourceId = payload.ResourceId
|
|
grant.Role = payload.Role
|
|
grant.AgentId = payload.AgentId
|
|
grant.PermissionScope = permissionScope
|
|
grant.Constraints = constraints
|
|
grant.Status = payload.Status
|
|
if payload.Status == "revoked" && grant.RevokedAt == 0 {
|
|
grant.RevokedAt = common.GetTimestamp()
|
|
}
|
|
if payload.Status != "revoked" {
|
|
grant.RevokedAt = 0
|
|
}
|
|
if err := model.DB.Save(&grant).Error; err != nil {
|
|
common.ApiError(c, err)
|
|
return
|
|
}
|
|
common.ApiSuccess(c, resourceGrantToResponse(grant, &resource))
|
|
}
|
|
|
|
func DeleteResourceGrant(c *gin.Context) {
|
|
userId := c.GetInt("id")
|
|
var grant model.ResourceGrant
|
|
if err := model.DB.Where("id = ? AND user_id = ?", c.Param("id"), userId).First(&grant).Error; err != nil {
|
|
if errors.Is(err, gorm.ErrRecordNotFound) {
|
|
common.ApiErrorMsg(c, "resource grant not found")
|
|
return
|
|
}
|
|
common.ApiError(c, err)
|
|
return
|
|
}
|
|
grant.Status = "revoked"
|
|
if grant.RevokedAt == 0 {
|
|
grant.RevokedAt = common.GetTimestamp()
|
|
}
|
|
if err := model.DB.Save(&grant).Error; err != nil {
|
|
common.ApiError(c, err)
|
|
return
|
|
}
|
|
var resource model.ResourceBinding
|
|
resourcePtr := (*model.ResourceBinding)(nil)
|
|
if err := model.DB.Where("id = ? AND user_id = ?", grant.ResourceId, userId).First(&resource).Error; err == nil {
|
|
resourcePtr = &resource
|
|
}
|
|
common.ApiSuccess(c, resourceGrantToResponse(grant, resourcePtr))
|
|
}
|
|
|
|
func marshalResourceGrantPayloadJSON(payload resourceGrantPayload) (string, string, error) {
|
|
permissionScope, err := marshalResourceJSON(payload.PermissionScope)
|
|
if err != nil {
|
|
return "", "", err
|
|
}
|
|
constraints, err := marshalResourceJSON(payload.Constraints)
|
|
if err != nil {
|
|
return "", "", err
|
|
}
|
|
return permissionScope, constraints, nil
|
|
}
|
|
|
|
func inheritResourceGrantScope(payload resourceGrantPayload, resource model.ResourceBinding) resourceGrantPayload {
|
|
if payload.BindingScope == "" {
|
|
payload.BindingScope = resource.BindingScope
|
|
}
|
|
if payload.TenantId == "" {
|
|
payload.TenantId = resource.TenantId
|
|
}
|
|
if payload.ProjectId == "" {
|
|
payload.ProjectId = resource.ProjectId
|
|
}
|
|
return payload
|
|
}
|
|
|
|
func findGrantResource(userId int, resourceId int, bindingScope string) (model.ResourceBinding, error) {
|
|
var resource model.ResourceBinding
|
|
if err := model.DB.Where("id = ? AND user_id = ?", resourceId, userId).First(&resource).Error; err != nil {
|
|
if errors.Is(err, gorm.ErrRecordNotFound) {
|
|
return resource, errors.New("resource not found")
|
|
}
|
|
return resource, err
|
|
}
|
|
if bindingScope != "" && resource.BindingScope != "" && resource.BindingScope != bindingScope {
|
|
return resource, errors.New("resource binding_scope does not match grant binding_scope")
|
|
}
|
|
return resource, nil
|
|
}
|