path_roles.go

package vault_plugin_secrets_grafana

import (
	"context"
	"encoding/json"
	"fmt"
	"time"

	"github.com/hashicorp/vault/sdk/framework"
	"github.com/hashicorp/vault/sdk/logical"
)

const (
	roleCloudAccessPolicy     = "cloud_access_policy"
	roleGrafanaServiceAccount = "grafana_service_account"
)

type realm struct {
	RealmType     string `json:"type"`
	Identifier    string `json:"identifier"`
	LabelPolicies []struct {
		Selector string `json:"selector"`
	} `json:"labelPolicies"`
}

type grafanaRoleEntry struct {
	Type           string        `json:"type"`            // Set when configuration type is "cloud". Should be "cloud_access_policy" or "grafana_service_account"
	Stack          string        `json:"stack"`           // For Grafana service accounts where configuration type is "cloud"
	Region         string        `json:"region"`          // For Grafana Cloud access policies
	Scopes         []string      `json:"scopes"`          // For Grafana Cloud access policies
	Realms         string        `json:"realms"`          // For Grafana Cloud access policies
	AllowedSubnets []string      `json:"allowed_subnets"` // For Grafana Cloud access policies
	Role           string        `json:"role"`            // For Grafana service accounts
	RBACRoles      []string      `json:"rbac_roles"`      // For Grafana service accounts
	TTL            time.Duration `json:"ttl"`
	MaxTTL         time.Duration `json:"max_ttl"`
}

func (r *grafanaRoleEntry) validate(configType string) error {
	if configType == GrafanaCloudType {
		if r.Type != roleCloudAccessPolicy && r.Type != roleGrafanaServiceAccount {
			return fmt.Errorf(`type must be "%s" or "%s"`, roleCloudAccessPolicy, roleGrafanaServiceAccount)
		}

		if r.Type == roleGrafanaServiceAccount && r.Stack == "" {
			return fmt.Errorf(`stack_id must be set when type is "%s"`, roleGrafanaServiceAccount)
		}

		if r.Type == roleCloudAccessPolicy {

			if r.Region == "" {
				return fmt.Errorf(`region must be set when type is "%s"`, roleCloudAccessPolicy)
			}

			if len(r.Scopes) <= 0 {
				return fmt.Errorf(`at least one scope must be set when type is "%s"`, roleCloudAccessPolicy)
			}

			var realms []realm

			if err := json.Unmarshal([]byte(r.Realms), &realms); err != nil {
				return fmt.Errorf("realms must be a valid JSON string")
			}

			if len(realms) <= 0 {
				return fmt.Errorf(`at least one realm must be set when type is "%s"`, roleCloudAccessPolicy)
			}
		}
	}

	return nil
}

func (r *grafanaRoleEntry) toResponseData() map[string]interface{} {
	respData := map[string]interface{}{
		"type":       r.Type,
		"stack":      r.Stack,
		"region":     r.Region,
		"scopes":     r.Scopes,
		"realms":     r.Realms,
		"role":       r.Role,
		"rbac_roles": r.RBACRoles,
		"ttl":        r.TTL.Seconds(),
		"max_ttl":    r.MaxTTL.Seconds(),
	}
	return respData

}

func pathRole(b *grafanaBackend) []*framework.Path {
	return []*framework.Path{
		{
			Pattern: "roles/" + framework.GenericNameRegex("name"),
			Fields: map[string]*framework.FieldSchema{
				"name": {
					Type:        framework.TypeString,
					Description: "Name of the role",
					Required:    true,
				},
				"type": {
					Type:        framework.TypeString,
					Description: `The type of Grafana Cloud credentials generated by the role, "cloud_access_policy" or "grafana_service_account"`,
					Required:    false,
				},
				"stack": {
					Type:        framework.TypeString,
					Description: "The stack slug of the Grafana Cloud instance to generate credentials for",
					Required:    false,
				},
				"region": {
					Type:        framework.TypeString,
					Description: "The region where the Grafana Cloud API is deployed, generally where the stack is deployed",
					Required:    false,
				},
				"scopes": {
					Type:        framework.TypeCommaStringSlice,
					Description: "The scopes to grant to the Grafana Cloud access policy",
					Required:    false,
				},
				"realms": {
					Type:        framework.TypeString,
					Description: "The realms to grant to the Grafana Cloud access policy",
					Required:    false,
				},
				"allowed_subnets": {
					Type:        framework.TypeCommaStringSlice,
					Description: "The allowed subnets to grant to the Grafana Cloud access policy",
					Required:    false,
				},
				"role": {
					Type:        framework.TypeString,
					Description: "The role to grant to the Grafana service account",
					Required:    false,
				},
				"rbac_roles": {
					Type:        framework.TypeCommaStringSlice,
					Description: "The RBAC roles to grant to the Grafana service account",
					Required:    false,
				},
				"ttl": {
					Type:        framework.TypeDurationSecond,
					Description: "Default lease for generated credentials. If not set or set to 0, will use system default.",
				},
				"max_ttl": {
					Type:        framework.TypeDurationSecond,
					Description: "Maximum time for role. If not set or set to 0, will use system default.",
				},
			},
			Operations: map[logical.Operation]framework.OperationHandler{
				logical.ReadOperation: &framework.PathOperation{
					Callback: b.pathRolesRead,
				},
				logical.CreateOperation: &framework.PathOperation{
					Callback: b.pathRolesWrite,
				},
				logical.UpdateOperation: &framework.PathOperation{
					Callback: b.pathRolesWrite,
				},
				logical.DeleteOperation: &framework.PathOperation{
					Callback: b.pathRolesDelete,
				},
			},
			ExistenceCheck:  b.pathRoleExistenceCheck,
			HelpSynopsis:    pathRoleHelpSynopsis,
			HelpDescription: pathRoleHelpDescription,
		},
		{
			Pattern: "roles/?$",
			Operations: map[logical.Operation]framework.OperationHandler{
				logical.ListOperation: &framework.PathOperation{
					Callback: b.pathRolesList,
				},
			},
			HelpSynopsis:    pathRoleListHelpSynopsis,
			HelpDescription: pathRoleListHelpDescription,
		},
	}
}

func (b *grafanaBackend) pathRoleExistenceCheck(ctx context.Context, req *logical.Request, d *framework.FieldData) (bool, error) {
	entry, err := b.getRole(ctx, req.Storage, d.Get("name").(string))
	if err != nil {
		return false, err
	}

	return entry != nil, nil
}

func (b *grafanaBackend) pathRolesList(ctx context.Context, req *logical.Request, _ *framework.FieldData) (*logical.Response, error) {
	entries, err := req.Storage.List(ctx, "roles/")
	if err != nil {
		return nil, err
	}

	return logical.ListResponse(entries), nil
}

func (b *grafanaBackend) pathRolesRead(ctx context.Context, req *logical.Request, d *framework.FieldData) (*logical.Response, error) {
	entry, err := b.getRole(ctx, req.Storage, d.Get("name").(string))
	if err != nil {
		return nil, err
	}

	if entry == nil {
		return nil, nil
	}

	return &logical.Response{
		Data: entry.toResponseData(),
	}, nil
}

func (b *grafanaBackend) pathRolesWrite(ctx context.Context, req *logical.Request, d *framework.FieldData) (*logical.Response, error) {
	name, ok := d.GetOk("name")
	if !ok {
		return logical.ErrorResponse("missing role name"), nil
	}

	config, err := getConfig(ctx, req.Storage)
	if err != nil {
		return nil, err
	}

	if config == nil {
		return nil, fmt.Errorf("cannot write role when backend configuration is unset")
	}

	roleEntry, err := b.getRole(ctx, req.Storage, name.(string))
	if err != nil {
		return nil, err
	}

	if roleEntry == nil {
		roleEntry = &grafanaRoleEntry{}
	}

	createOperation := req.Operation == logical.CreateOperation

	if roleType, ok := d.GetOk("type"); ok {
		roleEntry.Type = roleType.(string)
	}

	if stack, ok := d.GetOk("stack"); ok {
		roleEntry.Stack = stack.(string)
	}

	if region, ok := d.GetOk("region"); ok {
		roleEntry.Region = region.(string)
	}

	if roleType, ok := d.GetOk("scopes"); ok {
		roleEntry.Scopes = roleType.([]string)
	}

	if roleType, ok := d.GetOk("realms"); ok {
		roleEntry.Realms = roleType.(string)
	}

	if roleType, ok := d.GetOk("allowed_subnets"); ok {
		roleEntry.AllowedSubnets = roleType.([]string)
	}

	if roleType, ok := d.GetOk("role"); ok {
		roleEntry.Role = roleType.(string)
	}

	if roleType, ok := d.GetOk("rbac_roles"); ok {
		roleEntry.RBACRoles = roleType.([]string)
	}

	if err := roleEntry.validate(config.Type); err != nil {
		return logical.ErrorResponse(err.Error()), nil
	}

	if ttlRaw, ok := d.GetOk("ttl"); ok {
		roleEntry.TTL = time.Duration(ttlRaw.(int)) * time.Second
	} else if createOperation {
		roleEntry.TTL = time.Duration(d.Get("ttl").(int)) * time.Second
	}

	if maxTTLRaw, ok := d.GetOk("max_ttl"); ok {
		roleEntry.MaxTTL = time.Duration(maxTTLRaw.(int)) * time.Second
	} else if createOperation {
		roleEntry.MaxTTL = time.Duration(d.Get("max_ttl").(int)) * time.Second
	}

	if roleEntry.MaxTTL != 0 && roleEntry.TTL > roleEntry.MaxTTL {
		return logical.ErrorResponse("ttl cannot be greater than max_ttl"), nil
	}

	if err := setRole(ctx, req.Storage, name.(string), roleEntry); err != nil {
		return nil, err
	}

	return nil, nil
}

func (b *grafanaBackend) pathRolesDelete(ctx context.Context, req *logical.Request, d *framework.FieldData) (*logical.Response, error) {
	roleName := d.Get("name").(string)
	if roleName == "" {
		return logical.ErrorResponse("missing role"), nil
	}

	err := req.Storage.Delete(ctx, "roles/"+roleName)
	if err != nil {
		return nil, fmt.Errorf("error deleting grafana role: %w", err)
	}

	return nil, nil
}

func setRole(ctx context.Context, s logical.Storage, name string, roleEntry *grafanaRoleEntry) error {
	entry, err := logical.StorageEntryJSON("roles/"+name, roleEntry)
	if err != nil {
		return err
	}

	if entry == nil {
		return fmt.Errorf("failed to create storage entry for role")
	}

	if err := s.Put(ctx, entry); err != nil {
		return err
	}

	return nil
}

func (b *grafanaBackend) getRole(ctx context.Context, s logical.Storage, name string) (*grafanaRoleEntry, error) {
	if name == "" {
		return nil, fmt.Errorf("missing role name")
	}

	entry, err := s.Get(ctx, "roles/"+name)
	if err != nil {
		return nil, err
	}

	if entry == nil {
		return nil, nil
	}

	var role grafanaRoleEntry

	if err := entry.DecodeJSON(&role); err != nil {
		return nil, err
	}
	return &role, nil
}

const (
	pathRoleHelpSynopsis    = `Manages the Vault role for generating Grafana Cloud and Grafana credentials.`
	pathRoleHelpDescription = `
This path allows you to read and write roles used to generate Grafana Cloud and Grafana credentials.
`

	pathRoleListHelpSynopsis    = `List the existing roles in Grafana backend`
	pathRoleListHelpDescription = `Roles will be listed by the role name.`
)