access_rules.go

// Copyright 2020 StrongDM Inc
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//     http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
//

package sdm

// Code generated by protogen. DO NOT EDIT.
import (
	"encoding/json"
	"strings"
)

// An AccessRule grants access to a set of Resources. There are two kinds of
// AccessRules:
//
// - Dynamic: a rule which identifies Resources based on their type or tags
// - Static: a rule which contains an explicit list of Resource IDs
type AccessRule struct {

	// IDs is a list of Resource IDs granted by this AccessRule. If this field
	// is set, the rule is a static access rule. No other fields can be set on a
	// static access rule.
	IDs []string `json:"ids,omitempty"`

	// Type specifies a Resource type. You can set this field by itself to grant
	// access to all Resources of a certain type. You can also use it in
	// conjunction with the Tags field to further narrow down the scope of
	// Resources granted.
	//
	// See the following link for a list of possible values for this field:
	// https://www.strongdm.com/docs/automation/getting-started/filters#h-potentialresourcetypevalues
	Type string `json:"type,omitempty"`

	// Tags specifies a list of key/value pairs. You can set this field by
	// itself to grant access to all Resources which have all the given tags.
	// You can also use it in conjunction with the Type field to further narrow
	// down the scope of Resources granted.
	Tags Tags `json:"tags,omitempty"`

	// Privileges specify different privilege levels one can utilize with a set
	// of resources.
	Privileges Privileges `json:"privileges,omitempty"`
}

// Privileges specify different privilege levels one can utilize with a
// set of resources.
type Privileges struct {
	// K8s specifies a collection of privileges
	// for any resource defined in an access rule that is of the
	// kubernetes type.
	K8s K8sPrivileges `json:"k8s,omitempty"`
}

// K8sPrivileges specifies different privilege level constructs
// for kubernetes resources.
type K8sPrivileges struct {
	// Groups are the list of RBAC groups one will impersonate into
	// when attempting a connection to a k8s cluster.
	Groups []string `json:"groups,omitempty"`
}

// AccessRules define which Resources can be accessed by members of a Role.
type AccessRules []AccessRule

func convertAccessRulesToPorcelain(rules string) (AccessRules, error) {
	if rules == "" {
		return nil, nil
	}
	result := AccessRules{}
	decoder := json.NewDecoder(strings.NewReader(rules))
	// We want to disallow unknown fields because if we just drop them
	// it could change the nature of an access rule if the client just
	// sends it back to the server.
	decoder.DisallowUnknownFields()
	if err := decoder.Decode(&result); err != nil {
		return nil, err
	}
	return result, nil
}

func convertAccessRulesToPlumbing(rules AccessRules) string {
	if rules == nil {
		rules = AccessRules{}
	}
	result, _ := json.Marshal(rules)
	return string(result)
}

// ParseAccessRulesJSON parses the given access rules JSON string.
func ParseAccessRulesJSON(data string) (AccessRules, error) {
	result := AccessRules{}
	decoder := json.NewDecoder(strings.NewReader(data))
	// We want to disallow unknown fields because if we just drop them
	// it could change the nature of an access rule if the client just
	// sends it back to the server.
	decoder.DisallowUnknownFields()
	if err := decoder.Decode(&result); err != nil {
		return nil, err
	}
	return result, nil
}

func convertAccessRuleToPorcelain(rule string) (AccessRule, error) {
	if rule == "" {
		return AccessRule{}, nil
	}
	result := AccessRule{}
	decoder := json.NewDecoder(strings.NewReader(rule))
	// We want to disallow unknown fields because if we just drop them
	// it could change the nature of an access rule if the client just
	// sends it back to the server.
	decoder.DisallowUnknownFields()
	if err := decoder.Decode(&result); err != nil {
		return AccessRule{}, err
	}
	return result, nil
}

func convertAccessRuleToPlumbing(rule AccessRule) string {
	result, _ := json.Marshal(rule)
	return string(result)
}

// ParseAccessRuleJSON parses the given access rule JSON string.
func ParseAccessRuleJSON(data string) (AccessRule, error) {
	result := AccessRule{}
	decoder := json.NewDecoder(strings.NewReader(data))
	// We want to disallow unknown fields because if we just drop them
	// it could change the nature of an access rule if the client just
	// sends it back to the server.
	decoder.DisallowUnknownFields()
	if err := decoder.Decode(&result); err != nil {
		return AccessRule{}, err
	}
	return result, nil
}