56 lines
4.6 KiB
Go
56 lines
4.6 KiB
Go
package postgres
|
|
|
|
import (
|
|
"context"
|
|
"fmt"
|
|
"time"
|
|
|
|
"git.cin.su/m/Assistant/contracts/authority"
|
|
"github.com/jackc/pgx/v5/pgxpool"
|
|
)
|
|
|
|
type AuthorityRepository struct{ pool *pgxpool.Pool }
|
|
|
|
func OpenAuthority(ctx context.Context, c ContinuityConfig) (*AuthorityRepository, error) {
|
|
p, e := openPool(ctx, c)
|
|
if e != nil {
|
|
return nil, e
|
|
}
|
|
return &AuthorityRepository{p}, nil
|
|
}
|
|
func (r *AuthorityRepository) Close() { r.pool.Close() }
|
|
func (r *AuthorityRepository) LoadGrant(ctx context.Context, id authority.GrantID) (authority.AuthorityGrant, authority.Scope, error) {
|
|
var grant authority.AuthorityGrant
|
|
var scope authority.Scope
|
|
err := r.pool.QueryRow(ctx, `SELECT g.grant_id, g.actor_id, g.principal_id, g.scope_id, g.grant_class, g.revision, g.active, s.scope_id, s.global_scope, s.label FROM authority.authority_grants g JOIN authority.scopes s ON s.scope_id=g.scope_id WHERE g.grant_id=$1`, id).Scan(&grant.ID, &grant.ActorID, &grant.PrincipalID, &grant.ScopeID, &grant.Class, &grant.Revision, &grant.Active, &scope.ID, &scope.Global, &scope.Label)
|
|
if err != nil {
|
|
return authority.AuthorityGrant{}, authority.Scope{}, fmt.Errorf("load authority grant: %w", err)
|
|
}
|
|
return grant, scope, nil
|
|
}
|
|
|
|
func (r *AuthorityRepository) LoadDelegatedControlPlaneGrant(ctx context.Context, id authority.GrantID) (authority.DelegatedControlPlaneGrant, error) {
|
|
var grant authority.DelegatedControlPlaneGrant
|
|
err := r.pool.QueryRow(ctx, `SELECT grant_id,service_actor_id,service_principal_id,issuer_principal_id,task_id,task_revision,operations,COALESCE(binding_id,''),COALESCE(provider_instance_id,''),COALESCE(model_descriptor_id,''),candidate_release_set_id,candidate_slot,candidate_capability_id,candidate_resource_scope,candidate_mode,candidate_target_kind,candidate_target_ref,candidate_target_digest,issued_at_unix_millis,expires_at_unix_millis,architecture_revision,nonce,revision,status FROM authority.delegated_control_plane_grants WHERE grant_id=$1`, id).Scan(&grant.ID, &grant.ServiceActorID, &grant.ServicePrincipalID, &grant.IssuerPrincipalID, &grant.TaskID, &grant.TaskRevision, &grant.Operations, &grant.Resource.BindingID, &grant.Resource.ProviderInstanceID, &grant.Resource.ModelDescriptorID, &grant.CandidateResource.ReleaseSetID, &grant.CandidateResource.Slot, &grant.CandidateResource.CapabilityID, &grant.CandidateResource.ResourceScope, &grant.CandidateResource.Mode, &grant.CandidateResource.TargetKind, &grant.CandidateResource.TargetRef, &grant.CandidateResource.TargetDigest, &grant.IssuedAtUnixMillis, &grant.ExpiresAtUnixMillis, &grant.ArchitectureRevision, &grant.Nonce, &grant.Revision, &grant.Status)
|
|
if err != nil {
|
|
return authority.DelegatedControlPlaneGrant{}, fmt.Errorf("load delegated control-plane grant: %w", err)
|
|
}
|
|
return grant, nil
|
|
}
|
|
|
|
func (r *AuthorityRepository) RecordDelegatedControlPlaneAudit(ctx context.Context, audit authority.DelegatedControlPlaneAudit) error {
|
|
_, err := r.pool.Exec(ctx, `INSERT INTO authority.delegated_control_plane_audit (audit_id,grant_id,service_actor_id,service_principal_id,task_id,task_revision,operation,binding_id,provider_instance_id,model_descriptor_id,candidate_release_set_id,candidate_slot,candidate_capability_id,candidate_resource_scope,candidate_mode,candidate_target_kind,candidate_target_ref,candidate_target_digest,decision,outcome,recorded_at_unix_millis) VALUES ($1,$2,$3,$4,$5,$6,$7,NULLIF($8,''),NULLIF($9,''),NULLIF($10,''),$11,$12,$13,$14,$15,$16,$17,$18,$19,$20,$21)`, audit.AuditID, audit.GrantID, audit.ServiceActorID, audit.ServicePrincipalID, audit.TaskID, audit.TaskRevision, audit.Operation, audit.Resource.BindingID, audit.Resource.ProviderInstanceID, audit.Resource.ModelDescriptorID, audit.CandidateResource.ReleaseSetID, audit.CandidateResource.Slot, audit.CandidateResource.CapabilityID, audit.CandidateResource.ResourceScope, audit.CandidateResource.Mode, audit.CandidateResource.TargetKind, audit.CandidateResource.TargetRef, audit.CandidateResource.TargetDigest, audit.Decision, audit.Outcome, audit.RecordedAtUnixMillis)
|
|
if err != nil {
|
|
return fmt.Errorf("record delegated control-plane audit: %w", err)
|
|
}
|
|
return nil
|
|
}
|
|
|
|
func (r *AuthorityRepository) RevokeDelegatedControlPlaneGrant(ctx context.Context, id authority.GrantID, issuer string) (bool, error) {
|
|
result, err := r.pool.Exec(ctx, `UPDATE authority.delegated_control_plane_grants SET status='REVOKED',revision=revision+1,revoked_at_unix_millis=$3 WHERE grant_id=$1 AND issuer_principal_id=$2 AND status='ACTIVE'`, id, issuer, time.Now().UnixMilli())
|
|
if err != nil {
|
|
return false, fmt.Errorf("revoke delegated control-plane grant: %w", err)
|
|
}
|
|
return result.RowsAffected() == 1, nil
|
|
}
|