|
| 1 | +package rules |
| 2 | + |
| 3 | +import ( |
| 4 | + "github.com/octopusdeploy/octopus-permissions-controller/api/v1beta1" |
| 5 | +) |
| 6 | + |
| 7 | +// GenerateAllScopesWithPermissions creates ServiceAccounts for all unique scope combinations |
| 8 | +func GenerateAllScopesWithPermissions(wsas []v1beta1.WorkloadServiceAccount) map[Scope]v1beta1.WorkloadServiceAccountPermissions { |
| 9 | + if len(wsas) == 0 { |
| 10 | + return nil |
| 11 | + } |
| 12 | + |
| 13 | + result := make(map[Scope]v1beta1.WorkloadServiceAccountPermissions) |
| 14 | + |
| 15 | + // Get all unique scope values (including wildcards) |
| 16 | + projectSet, environmentSet, tenantSet, stepSet := getAllScopeValues(wsas) |
| 17 | + |
| 18 | + // Generate all possible scope combinations |
| 19 | + allScopeCombinations := generateAllScopeCombinations(projectSet, environmentSet, tenantSet, stepSet) |
| 20 | + |
| 21 | + // For each scope combination find WSAs that match the scope and merge their permissions |
| 22 | + // If no WSAs match the scope, no ServiceAccount is created for that scope |
| 23 | + for _, scope := range allScopeCombinations { |
| 24 | + matchingWSAs := getMatchingWSAsForScope(scope, wsas) |
| 25 | + if len(matchingWSAs) > 0 { |
| 26 | + var mergedPermissions v1beta1.WorkloadServiceAccountPermissions |
| 27 | + for _, wsa := range matchingWSAs { |
| 28 | + mergedPermissions = mergePermissions(mergedPermissions, wsa.Spec.Permissions) |
| 29 | + } |
| 30 | + result[scope] = mergedPermissions |
| 31 | + } |
| 32 | + } |
| 33 | + |
| 34 | + return result |
| 35 | +} |
| 36 | + |
| 37 | +// getAllScopeValues extracts all unique scope values from all WSAs |
| 38 | +func getAllScopeValues(wsas []v1beta1.WorkloadServiceAccount) (projects, environments, tenants, steps map[string]struct{}) { |
| 39 | + projects = make(map[string]struct{}) |
| 40 | + environments = make(map[string]struct{}) |
| 41 | + tenants = make(map[string]struct{}) |
| 42 | + steps = make(map[string]struct{}) |
| 43 | + |
| 44 | + hasWildcardProjects := false |
| 45 | + hasWildcardEnvironments := false |
| 46 | + hasWildcardTenants := false |
| 47 | + hasWildcardSteps := false |
| 48 | + |
| 49 | + for _, wsa := range wsas { |
| 50 | + processScopeValues(wsa.Spec.Scope.Projects, projects, &hasWildcardProjects) |
| 51 | + processScopeValues(wsa.Spec.Scope.Environments, environments, &hasWildcardEnvironments) |
| 52 | + processScopeValues(wsa.Spec.Scope.Tenants, tenants, &hasWildcardTenants) |
| 53 | + processScopeValues(wsa.Spec.Scope.Steps, steps, &hasWildcardSteps) |
| 54 | + } |
| 55 | + |
| 56 | + if hasWildcardProjects { |
| 57 | + projects["*"] = struct{}{} |
| 58 | + } |
| 59 | + if hasWildcardEnvironments { |
| 60 | + environments["*"] = struct{}{} |
| 61 | + } |
| 62 | + if hasWildcardTenants { |
| 63 | + tenants["*"] = struct{}{} |
| 64 | + } |
| 65 | + if hasWildcardSteps { |
| 66 | + steps["*"] = struct{}{} |
| 67 | + } |
| 68 | + |
| 69 | + return projects, environments, tenants, steps |
| 70 | +} |
| 71 | + |
| 72 | +func processScopeValues(slice []string, valueSet map[string]struct{}, hasWildcard *bool) { |
| 73 | + if !*hasWildcard && len(slice) == 0 { |
| 74 | + *hasWildcard = true |
| 75 | + } else { |
| 76 | + for _, value := range slice { |
| 77 | + valueSet[value] = struct{}{} |
| 78 | + } |
| 79 | + } |
| 80 | +} |
| 81 | + |
| 82 | +// generateAllScopeCombinations generates all possible scope combinations |
| 83 | +func generateAllScopeCombinations(projects, environments, tenants, steps map[string]struct{}) []Scope { |
| 84 | + capacity := len(projects) * len(environments) * len(tenants) * len(steps) |
| 85 | + scopes := make([]Scope, 0, capacity) |
| 86 | + |
| 87 | + for project := range projects { |
| 88 | + for environment := range environments { |
| 89 | + for tenant := range tenants { |
| 90 | + for step := range steps { |
| 91 | + scope := Scope{ |
| 92 | + Project: project, |
| 93 | + Environment: environment, |
| 94 | + Tenant: tenant, |
| 95 | + Step: step, |
| 96 | + } |
| 97 | + scopes = append(scopes, scope) |
| 98 | + } |
| 99 | + } |
| 100 | + } |
| 101 | + } |
| 102 | + |
| 103 | + return scopes |
| 104 | +} |
| 105 | + |
| 106 | +// getMatchingWSAsForScope returns all WSAs that apply to the given concrete scope |
| 107 | +func getMatchingWSAsForScope(scope Scope, wsas []v1beta1.WorkloadServiceAccount) []v1beta1.WorkloadServiceAccount { |
| 108 | + var matchingWSAs []v1beta1.WorkloadServiceAccount |
| 109 | + |
| 110 | + for _, wsa := range wsas { |
| 111 | + if scopeMatchesWSA(scope, wsa) { |
| 112 | + matchingWSAs = append(matchingWSAs, wsa) |
| 113 | + } |
| 114 | + } |
| 115 | + |
| 116 | + return matchingWSAs |
| 117 | +} |
| 118 | + |
| 119 | +// scopeMatchesWSA checks if a WSA applies to a concrete scope |
| 120 | +func scopeMatchesWSA(scope Scope, wsa v1beta1.WorkloadServiceAccount) bool { |
| 121 | + return hasMatchingScopeValue(wsa.Spec.Scope.Projects, scope.Project) && |
| 122 | + hasMatchingScopeValue(wsa.Spec.Scope.Environments, scope.Environment) && |
| 123 | + hasMatchingScopeValue(wsa.Spec.Scope.Tenants, scope.Tenant) && |
| 124 | + hasMatchingScopeValue(wsa.Spec.Scope.Steps, scope.Step) |
| 125 | +} |
| 126 | + |
| 127 | +// hasMatchingScopeValue checks if a WSA dimension matches a concrete scope value |
| 128 | +func hasMatchingScopeValue(wsaScopes []string, scopeValue string) bool { |
| 129 | + // Empty WSA scope list means wildcard (matches any value) |
| 130 | + if len(wsaScopes) == 0 { |
| 131 | + return true |
| 132 | + } |
| 133 | + |
| 134 | + for _, value := range wsaScopes { |
| 135 | + if value == scopeValue { |
| 136 | + return true |
| 137 | + } |
| 138 | + } |
| 139 | + |
| 140 | + return false |
| 141 | +} |
| 142 | + |
| 143 | +// mergePermissions combines permissions from multiple WSAs for the same scope |
| 144 | +func mergePermissions(existing, new v1beta1.WorkloadServiceAccountPermissions) v1beta1.WorkloadServiceAccountPermissions { |
| 145 | + merged := v1beta1.WorkloadServiceAccountPermissions{ |
| 146 | + ClusterRoles: append(existing.ClusterRoles, new.ClusterRoles...), |
| 147 | + Roles: append(existing.Roles, new.Roles...), |
| 148 | + Permissions: append(existing.Permissions, new.Permissions...), |
| 149 | + } |
| 150 | + |
| 151 | + // TODO: Deduplicate identical roles and permissions |
| 152 | + |
| 153 | + return merged |
| 154 | +} |
0 commit comments