2021-05-03 19:48:20 +00:00
|
|
|
package nosql
|
|
|
|
|
|
|
|
import (
|
|
|
|
"context"
|
|
|
|
"encoding/json"
|
|
|
|
"time"
|
|
|
|
|
|
|
|
"github.com/pkg/errors"
|
|
|
|
"github.com/smallstep/certificates/authority/mgmt"
|
2021-05-25 23:52:06 +00:00
|
|
|
"github.com/smallstep/certificates/linkedca"
|
2021-05-03 19:48:20 +00:00
|
|
|
"github.com/smallstep/nosql"
|
|
|
|
)
|
|
|
|
|
|
|
|
// dbAdmin is the database representation of the Admin type.
|
|
|
|
type dbAdmin struct {
|
2021-05-25 23:52:06 +00:00
|
|
|
ID string `json:"id"`
|
|
|
|
AuthorityID string `json:"authorityID"`
|
|
|
|
ProvisionerID string `json:"provisionerID"`
|
|
|
|
Subject string `json:"subject"`
|
|
|
|
Type linkedca.Admin_Type `json:"type"`
|
|
|
|
CreatedAt time.Time `json:"createdAt"`
|
|
|
|
DeletedAt time.Time `json:"deletedAt"`
|
2021-05-03 19:48:20 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
func (dbp *dbAdmin) clone() *dbAdmin {
|
|
|
|
u := *dbp
|
|
|
|
return &u
|
|
|
|
}
|
|
|
|
|
|
|
|
func (db *DB) getDBAdminBytes(ctx context.Context, id string) ([]byte, error) {
|
|
|
|
data, err := db.db.Get(authorityAdminsTable, []byte(id))
|
|
|
|
if nosql.IsErrNotFound(err) {
|
|
|
|
return nil, mgmt.NewError(mgmt.ErrorNotFoundType, "admin %s not found", id)
|
|
|
|
} else if err != nil {
|
|
|
|
return nil, errors.Wrapf(err, "error loading admin %s", id)
|
|
|
|
}
|
|
|
|
return data, nil
|
|
|
|
}
|
|
|
|
|
|
|
|
func (db *DB) getDBAdmin(ctx context.Context, id string) (*dbAdmin, error) {
|
|
|
|
data, err := db.getDBAdminBytes(ctx, id)
|
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
dba, err := unmarshalDBAdmin(data, id)
|
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
if dba.AuthorityID != db.authorityID {
|
|
|
|
return nil, mgmt.NewError(mgmt.ErrorAuthorityMismatchType,
|
|
|
|
"admin %s is not owned by authority %s", dba.ID, db.authorityID)
|
|
|
|
}
|
|
|
|
return dba, nil
|
|
|
|
}
|
|
|
|
|
|
|
|
func unmarshalDBAdmin(data []byte, id string) (*dbAdmin, error) {
|
|
|
|
var dba = new(dbAdmin)
|
|
|
|
if err := json.Unmarshal(data, dba); err != nil {
|
|
|
|
return nil, errors.Wrapf(err, "error unmarshaling admin %s into dbAdmin", id)
|
|
|
|
}
|
2021-05-25 23:52:06 +00:00
|
|
|
if !dba.DeletedAt.IsZero() {
|
|
|
|
return nil, mgmt.NewError(mgmt.ErrorDeletedType, "admin %s is deleted", id)
|
|
|
|
}
|
2021-05-03 19:48:20 +00:00
|
|
|
return dba, nil
|
|
|
|
}
|
|
|
|
|
2021-05-25 23:52:06 +00:00
|
|
|
func unmarshalAdmin(data []byte, id string) (*linkedca.Admin, error) {
|
|
|
|
dba, err := unmarshalDBAdmin(data, id)
|
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
2021-05-03 19:48:20 +00:00
|
|
|
}
|
2021-05-25 23:52:06 +00:00
|
|
|
return &linkedca.Admin{
|
|
|
|
Id: dba.ID,
|
|
|
|
AuthorityId: dba.AuthorityID,
|
|
|
|
ProvisionerId: dba.ProvisionerID,
|
2021-05-18 04:07:25 +00:00
|
|
|
Subject: dba.Subject,
|
|
|
|
Type: dba.Type,
|
2021-05-25 23:52:06 +00:00
|
|
|
}, nil
|
2021-05-03 19:48:20 +00:00
|
|
|
}
|
|
|
|
|
2021-05-18 04:07:25 +00:00
|
|
|
// GetAdmin retrieves and unmarshals a admin from the database.
|
2021-05-25 23:52:06 +00:00
|
|
|
func (db *DB) GetAdmin(ctx context.Context, id string) (*linkedca.Admin, error) {
|
2021-05-18 04:07:25 +00:00
|
|
|
data, err := db.getDBAdminBytes(ctx, id)
|
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
adm, err := unmarshalAdmin(data, id)
|
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
2021-05-25 23:52:06 +00:00
|
|
|
if adm.AuthorityId != db.authorityID {
|
2021-05-18 04:07:25 +00:00
|
|
|
return nil, mgmt.NewError(mgmt.ErrorAuthorityMismatchType,
|
2021-05-25 23:52:06 +00:00
|
|
|
"admin %s is not owned by authority %s", adm.Id, db.authorityID)
|
2021-05-18 04:07:25 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
return adm, nil
|
|
|
|
}
|
|
|
|
|
2021-05-03 19:48:20 +00:00
|
|
|
// GetAdmins retrieves and unmarshals all active (not deleted) admins
|
|
|
|
// from the database.
|
|
|
|
// TODO should we be paginating?
|
2021-05-25 23:52:06 +00:00
|
|
|
func (db *DB) GetAdmins(ctx context.Context) ([]*linkedca.Admin, error) {
|
2021-05-03 19:48:20 +00:00
|
|
|
dbEntries, err := db.db.List(authorityAdminsTable)
|
|
|
|
if err != nil {
|
|
|
|
return nil, errors.Wrap(err, "error loading admins")
|
|
|
|
}
|
2021-05-25 23:52:06 +00:00
|
|
|
var admins = []*linkedca.Admin{}
|
2021-05-03 19:48:20 +00:00
|
|
|
for _, entry := range dbEntries {
|
|
|
|
adm, err := unmarshalAdmin(entry.Value, string(entry.Key))
|
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
2021-05-25 23:52:06 +00:00
|
|
|
if adm.AuthorityId != db.authorityID {
|
2021-05-03 19:48:20 +00:00
|
|
|
continue
|
|
|
|
}
|
|
|
|
admins = append(admins, adm)
|
|
|
|
}
|
|
|
|
return admins, nil
|
|
|
|
}
|
|
|
|
|
|
|
|
// CreateAdmin stores a new admin to the database.
|
2021-05-25 23:52:06 +00:00
|
|
|
func (db *DB) CreateAdmin(ctx context.Context, adm *linkedca.Admin) error {
|
2021-05-03 19:48:20 +00:00
|
|
|
var err error
|
2021-05-25 23:52:06 +00:00
|
|
|
adm.Id, err = randID()
|
2021-05-03 19:48:20 +00:00
|
|
|
if err != nil {
|
2021-05-18 04:07:25 +00:00
|
|
|
return mgmt.WrapErrorISE(err, "error generating random id for admin")
|
2021-05-03 19:48:20 +00:00
|
|
|
}
|
2021-05-25 23:52:06 +00:00
|
|
|
adm.AuthorityId = db.authorityID
|
2021-05-03 19:48:20 +00:00
|
|
|
|
|
|
|
dba := &dbAdmin{
|
2021-05-25 23:52:06 +00:00
|
|
|
ID: adm.Id,
|
2021-05-06 06:02:42 +00:00
|
|
|
AuthorityID: db.authorityID,
|
2021-05-25 23:52:06 +00:00
|
|
|
ProvisionerID: adm.ProvisionerId,
|
2021-05-18 04:07:25 +00:00
|
|
|
Subject: adm.Subject,
|
|
|
|
Type: adm.Type,
|
2021-05-06 06:02:42 +00:00
|
|
|
CreatedAt: clock.Now(),
|
2021-05-03 19:48:20 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
return db.save(ctx, dba.ID, dba, nil, "admin", authorityAdminsTable)
|
|
|
|
}
|
|
|
|
|
|
|
|
// UpdateAdmin saves an updated admin to the database.
|
2021-05-25 23:52:06 +00:00
|
|
|
func (db *DB) UpdateAdmin(ctx context.Context, adm *linkedca.Admin) error {
|
|
|
|
old, err := db.getDBAdmin(ctx, adm.Id)
|
2021-05-03 19:48:20 +00:00
|
|
|
if err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
|
|
|
|
nu := old.clone()
|
2021-05-25 23:52:06 +00:00
|
|
|
nu.Type = adm.Type
|
|
|
|
|
|
|
|
return db.save(ctx, old.ID, nu, old, "admin", authorityAdminsTable)
|
|
|
|
}
|
2021-05-03 19:48:20 +00:00
|
|
|
|
2021-05-25 23:52:06 +00:00
|
|
|
// DeleteAdmin saves an updated admin to the database.
|
|
|
|
func (db *DB) DeleteAdmin(ctx context.Context, id string) error {
|
|
|
|
old, err := db.getDBAdmin(ctx, id)
|
|
|
|
if err != nil {
|
|
|
|
return err
|
2021-05-03 19:48:20 +00:00
|
|
|
}
|
2021-05-25 23:52:06 +00:00
|
|
|
|
|
|
|
nu := old.clone()
|
|
|
|
nu.DeletedAt = clock.Now()
|
2021-05-03 19:48:20 +00:00
|
|
|
|
|
|
|
return db.save(ctx, old.ID, nu, old, "admin", authorityAdminsTable)
|
|
|
|
}
|