2023-03-15 19:00:52 +03:00
// Copyright (c) HashiCorp, Inc.
2024-01-02 21:36:20 +03:00
// SPDX-License-Identifier: BUSL-1.1
2023-03-15 19:00:52 +03:00
2017-10-11 20:21:20 +03:00
package vault
import (
2018-01-08 21:31:38 +03:00
"context"
2018-08-09 23:37:36 +03:00
"errors"
2017-10-11 20:21:20 +03:00
"fmt"
"strings"
2022-08-10 16:10:02 +03:00
"github.com/hashicorp/go-multierror"
2017-10-11 20:21:20 +03:00
"github.com/golang/protobuf/ptypes"
memdb "github.com/hashicorp/go-memdb"
2021-07-16 03:17:31 +03:00
"github.com/hashicorp/go-secure-stdlib/strutil"
2017-10-11 20:21:20 +03:00
"github.com/hashicorp/vault/helper/identity"
2019-10-22 16:57:24 +03:00
"github.com/hashicorp/vault/helper/identity/mfa"
2018-09-18 06:03:00 +03:00
"github.com/hashicorp/vault/helper/namespace"
2017-10-11 20:21:20 +03:00
"github.com/hashicorp/vault/helper/storagepacker"
2019-04-13 10:44:06 +03:00
"github.com/hashicorp/vault/sdk/framework"
"github.com/hashicorp/vault/sdk/helper/consts"
2019-04-13 00:54:35 +03:00
"github.com/hashicorp/vault/sdk/logical"
2017-10-11 20:21:20 +03:00
)
2018-09-25 22:28:28 +03:00
func entityPathFields ( ) map [ string ] * framework . FieldSchema {
return map [ string ] * framework . FieldSchema {
"id" : {
Type : framework . TypeString ,
Description : "ID of the entity. If set, updates the corresponding existing entity." ,
} ,
"name" : {
Type : framework . TypeString ,
Description : "Name of the entity" ,
} ,
"metadata" : {
Type : framework . TypeKVPairs ,
Description : ` Metadata to be associated with the entity .
In CLI , this parameter can be repeated multiple times , and it all gets merged together .
For example :
vault < command > < path > metadata = key1 = value1 metadata = key2 = value2
` ,
} ,
"policies" : {
Type : framework . TypeCommaStringSlice ,
Description : "Policies to be tied to the entity." ,
} ,
"disabled" : {
Type : framework . TypeBool ,
Description : "If set true, tokens tied to this identity will not be able to be used (but will not be revoked)." ,
} ,
}
}
2017-10-11 20:21:20 +03:00
// entityPaths returns the API endpoints supported to operate on entities.
// Following are the paths supported:
// entity - To register a new entity
// entity/id - To lookup, modify, delete and list entities based on ID
// entity/merge - To merge entities based on ID
func entityPaths ( i * IdentityStore ) [ ] * framework . Path {
return [ ] * framework . Path {
{
Pattern : "entity$" ,
2023-04-12 22:44:43 +03:00
DisplayAttrs : & framework . DisplayAttributes {
OperationPrefix : "entity" ,
OperationVerb : "create" ,
} ,
Fields : entityPathFields ( ) ,
2023-12-01 16:36:54 +03:00
Operations : map [ logical . Operation ] framework . OperationHandler {
logical . UpdateOperation : & framework . PathOperation {
Callback : i . handleEntityUpdateCommon ( ) ,
} ,
2017-10-11 20:21:20 +03:00
} ,
HelpSynopsis : strings . TrimSpace ( entityHelp [ "entity" ] [ 0 ] ) ,
HelpDescription : strings . TrimSpace ( entityHelp [ "entity" ] [ 1 ] ) ,
} ,
{
2019-07-03 15:56:01 +03:00
Pattern : "entity/name/(?P<name>.+)" ,
2023-04-12 22:44:43 +03:00
DisplayAttrs : & framework . DisplayAttributes {
OperationPrefix : "entity" ,
OperationSuffix : "by-name" ,
} ,
Fields : entityPathFields ( ) ,
Operations : map [ logical . Operation ] framework . OperationHandler {
logical . UpdateOperation : & framework . PathOperation {
Callback : i . handleEntityUpdateCommon ( ) ,
DisplayAttrs : & framework . DisplayAttributes {
OperationVerb : "update" ,
} ,
} ,
logical . ReadOperation : & framework . PathOperation {
Callback : i . pathEntityNameRead ( ) ,
DisplayAttrs : & framework . DisplayAttributes {
OperationVerb : "read" ,
} ,
} ,
logical . DeleteOperation : & framework . PathOperation {
Callback : i . pathEntityNameDelete ( ) ,
DisplayAttrs : & framework . DisplayAttributes {
OperationVerb : "delete" ,
} ,
} ,
2017-10-11 20:21:20 +03:00
} ,
2018-09-25 22:28:28 +03:00
HelpSynopsis : strings . TrimSpace ( entityHelp [ "entity-name" ] [ 0 ] ) ,
HelpDescription : strings . TrimSpace ( entityHelp [ "entity-name" ] [ 1 ] ) ,
} ,
{
Pattern : "entity/id/" + framework . GenericNameRegex ( "id" ) ,
2023-04-12 22:44:43 +03:00
DisplayAttrs : & framework . DisplayAttributes {
OperationPrefix : "entity" ,
OperationSuffix : "by-id" ,
} ,
Fields : entityPathFields ( ) ,
Operations : map [ logical . Operation ] framework . OperationHandler {
logical . UpdateOperation : & framework . PathOperation {
Callback : i . handleEntityUpdateCommon ( ) ,
DisplayAttrs : & framework . DisplayAttributes {
OperationVerb : "update" ,
} ,
} ,
logical . ReadOperation : & framework . PathOperation {
Callback : i . pathEntityIDRead ( ) ,
DisplayAttrs : & framework . DisplayAttributes {
OperationVerb : "read" ,
} ,
} ,
logical . DeleteOperation : & framework . PathOperation {
Callback : i . pathEntityIDDelete ( ) ,
DisplayAttrs : & framework . DisplayAttributes {
OperationVerb : "delete" ,
} ,
} ,
2017-10-11 20:21:20 +03:00
} ,
HelpSynopsis : strings . TrimSpace ( entityHelp [ "entity-id" ] [ 0 ] ) ,
HelpDescription : strings . TrimSpace ( entityHelp [ "entity-id" ] [ 1 ] ) ,
} ,
2020-04-24 01:25:13 +03:00
{
Pattern : "entity/batch-delete" ,
2023-04-12 22:44:43 +03:00
DisplayAttrs : & framework . DisplayAttributes {
OperationPrefix : "entity" ,
OperationVerb : "batch-delete" ,
} ,
2020-04-24 01:25:13 +03:00
Fields : map [ string ] * framework . FieldSchema {
"entity_ids" : {
Type : framework . TypeCommaStringSlice ,
Description : "Entity IDs to delete" ,
} ,
} ,
2023-04-12 22:44:43 +03:00
2023-12-01 16:36:54 +03:00
Operations : map [ logical . Operation ] framework . OperationHandler {
logical . UpdateOperation : & framework . PathOperation {
Callback : i . handleEntityBatchDelete ( ) ,
} ,
2020-04-24 01:25:13 +03:00
} ,
HelpSynopsis : strings . TrimSpace ( entityHelp [ "batch-delete" ] [ 0 ] ) ,
HelpDescription : strings . TrimSpace ( entityHelp [ "batch-delete" ] [ 1 ] ) ,
} ,
2018-09-25 22:28:28 +03:00
{
Pattern : "entity/name/?$" ,
2023-04-12 22:44:43 +03:00
DisplayAttrs : & framework . DisplayAttributes {
OperationPrefix : "entity" ,
OperationSuffix : "by-name" ,
} ,
2023-12-01 16:36:54 +03:00
Operations : map [ logical . Operation ] framework . OperationHandler {
logical . ListOperation : & framework . PathOperation {
Callback : i . pathEntityNameList ( ) ,
} ,
2018-09-25 22:28:28 +03:00
} ,
HelpSynopsis : strings . TrimSpace ( entityHelp [ "entity-name-list" ] [ 0 ] ) ,
HelpDescription : strings . TrimSpace ( entityHelp [ "entity-name-list" ] [ 1 ] ) ,
} ,
2017-10-11 20:21:20 +03:00
{
Pattern : "entity/id/?$" ,
2023-04-12 22:44:43 +03:00
DisplayAttrs : & framework . DisplayAttributes {
OperationPrefix : "entity" ,
OperationSuffix : "by-id" ,
} ,
2023-12-01 16:36:54 +03:00
Operations : map [ logical . Operation ] framework . OperationHandler {
logical . ListOperation : & framework . PathOperation {
Callback : i . pathEntityIDList ( ) ,
} ,
2017-10-11 20:21:20 +03:00
} ,
HelpSynopsis : strings . TrimSpace ( entityHelp [ "entity-id-list" ] [ 0 ] ) ,
HelpDescription : strings . TrimSpace ( entityHelp [ "entity-id-list" ] [ 1 ] ) ,
} ,
{
Pattern : "entity/merge/?$" ,
2023-04-12 22:44:43 +03:00
DisplayAttrs : & framework . DisplayAttributes {
OperationPrefix : "entity" ,
OperationVerb : "merge" ,
} ,
2017-10-11 20:21:20 +03:00
Fields : map [ string ] * framework . FieldSchema {
"from_entity_ids" : {
Type : framework . TypeCommaStringSlice ,
2022-08-10 16:10:02 +03:00
Description : "Entity IDs which need to get merged" ,
2017-10-11 20:21:20 +03:00
} ,
"to_entity_id" : {
Type : framework . TypeString ,
Description : "Entity ID into which all the other entities need to get merged" ,
} ,
2022-08-10 16:10:02 +03:00
"conflicting_alias_ids_to_keep" : {
Type : framework . TypeCommaStringSlice ,
Description : "Alias IDs to keep in case of conflicting aliases. Ignored if no conflicting aliases found" ,
} ,
2017-10-11 20:21:20 +03:00
"force" : {
Type : framework . TypeBool ,
Description : "Setting this will follow the 'mine' strategy for merging MFA secrets. If there are secrets of the same type both in entities that are merged from and in entity into which all others are getting merged, secrets in the destination will be unaltered. If not set, this API will throw an error containing all the conflicts." ,
} ,
} ,
2023-12-01 16:36:54 +03:00
Operations : map [ logical . Operation ] framework . OperationHandler {
logical . UpdateOperation : & framework . PathOperation {
2023-12-01 18:11:04 +03:00
Callback : i . pathEntityMergeID ( ) ,
ForwardPerformanceStandby : true ,
2023-12-01 16:36:54 +03:00
} ,
2017-10-11 20:21:20 +03:00
} ,
HelpSynopsis : strings . TrimSpace ( entityHelp [ "entity-merge-id" ] [ 0 ] ) ,
HelpDescription : strings . TrimSpace ( entityHelp [ "entity-merge-id" ] [ 1 ] ) ,
} ,
}
}
// pathEntityMergeID merges two or more entities into a single entity
2018-01-08 21:31:38 +03:00
func ( i * IdentityStore ) pathEntityMergeID ( ) framework . OperationFunc {
return func ( ctx context . Context , req * logical . Request , d * framework . FieldData ) ( * logical . Response , error ) {
2022-08-10 16:10:02 +03:00
toEntityIDInterface , ok := d . GetOk ( "to_entity_id" )
if ! ok || toEntityIDInterface == "" {
2018-01-08 21:31:38 +03:00
return logical . ErrorResponse ( "missing entity id to merge to" ) , nil
}
2022-08-10 16:10:02 +03:00
toEntityID := toEntityIDInterface . ( string )
2017-10-11 20:21:20 +03:00
2022-08-10 16:10:02 +03:00
fromEntityIDsInterface , ok := d . GetOk ( "from_entity_ids" )
if ! ok || len ( fromEntityIDsInterface . ( [ ] string ) ) == 0 {
2018-01-08 21:31:38 +03:00
return logical . ErrorResponse ( "missing entity ids to merge from" ) , nil
}
2022-08-10 16:10:02 +03:00
fromEntityIDs := fromEntityIDsInterface . ( [ ] string )
var conflictingAliasIDsToKeep [ ] string
if conflictingAliasIDsToKeepInterface , ok := d . GetOk ( "conflicting_alias_ids_to_keep" ) ; ok {
conflictingAliasIDsToKeep = conflictingAliasIDsToKeepInterface . ( [ ] string )
}
2017-10-11 20:21:20 +03:00
2022-08-10 16:10:02 +03:00
var force bool
if forceInterface , ok := d . GetOk ( "force" ) ; ok {
force = forceInterface . ( bool )
}
2017-10-11 20:21:20 +03:00
2018-01-08 21:31:38 +03:00
// Create a MemDB transaction to merge entities
2021-02-10 19:05:16 +03:00
i . lock . Lock ( )
defer i . lock . Unlock ( )
2018-01-08 21:31:38 +03:00
txn := i . db . Txn ( true )
defer txn . Abort ( )
2017-10-11 20:21:20 +03:00
2018-01-08 21:31:38 +03:00
toEntity , err := i . MemDBEntityByID ( toEntityID , true )
2017-10-11 20:21:20 +03:00
if err != nil {
return nil , err
}
2022-10-17 21:46:25 +03:00
userErr , intErr , aliases := i . mergeEntity ( ctx , txn , toEntity , fromEntityIDs , conflictingAliasIDsToKeep , force , false , false , true , false )
2018-08-09 23:37:36 +03:00
if userErr != nil {
2022-10-17 21:46:25 +03:00
// Not an error due to alias clash, return like normal
if len ( aliases ) == 0 {
return logical . ErrorResponse ( userErr . Error ( ) ) , nil
}
// Alias clash error, so include additional details
resp := & logical . Response {
Data : map [ string ] interface { } {
"error" : userErr . Error ( ) ,
"data" : aliases ,
} ,
}
return resp , nil
2017-10-11 20:21:20 +03:00
}
2018-08-09 23:37:36 +03:00
if intErr != nil {
return nil , intErr
2018-01-08 21:31:38 +03:00
}
2017-10-11 20:21:20 +03:00
2018-01-08 21:31:38 +03:00
// Committing the transaction *after* successfully performing storage
// persistence
txn . Commit ( )
2017-10-11 20:21:20 +03:00
2018-01-08 21:31:38 +03:00
return nil , nil
2017-10-11 20:21:20 +03:00
}
}
2018-07-25 05:01:58 +03:00
// handleEntityUpdateCommon is used to update an entity
func ( i * IdentityStore ) handleEntityUpdateCommon ( ) framework . OperationFunc {
2018-01-08 21:31:38 +03:00
return func ( ctx context . Context , req * logical . Request , d * framework . FieldData ) ( * logical . Response , error ) {
2018-07-25 05:01:58 +03:00
i . lock . Lock ( )
defer i . lock . Unlock ( )
2017-10-11 20:21:20 +03:00
2018-09-18 06:03:00 +03:00
entity := new ( identity . Entity )
2018-07-25 05:01:58 +03:00
var err error
2017-10-11 20:21:20 +03:00
2018-01-08 21:31:38 +03:00
entityID := d . Get ( "id" ) . ( string )
2018-07-25 05:01:58 +03:00
if entityID != "" {
entity , err = i . MemDBEntityByID ( entityID , true )
if err != nil {
return nil , err
}
if entity == nil {
return logical . ErrorResponse ( "entity not found from id" ) , nil
}
2018-01-08 21:31:38 +03:00
}
2017-10-11 20:21:20 +03:00
2018-07-25 05:01:58 +03:00
// Get the name
entityName := d . Get ( "name" ) . ( string )
if entityName != "" {
2018-09-18 06:03:00 +03:00
entityByName , err := i . MemDBEntityByName ( ctx , entityName , false )
2018-07-25 05:01:58 +03:00
if err != nil {
return nil , err
}
switch {
case entityByName == nil :
// Not found, safe to use this name with an existing or new entity
2018-09-18 06:03:00 +03:00
case entity . ID == "" :
2018-09-25 22:28:28 +03:00
// Entity by ID was not found, but and entity for the supplied
// name was found. Continue updating the entity.
entity = entityByName
2018-07-25 05:01:58 +03:00
case entity . ID == entityByName . ID :
// Same exact entity, carry on (this is basically a noop then)
default :
return logical . ErrorResponse ( "entity name is already in use" ) , nil
}
2018-01-08 21:31:38 +03:00
}
2018-07-25 05:01:58 +03:00
if entityName != "" {
entity . Name = entityName
2018-01-08 21:31:38 +03:00
}
2017-10-11 20:21:20 +03:00
2018-07-25 05:01:58 +03:00
// Update the policies if supplied
entityPoliciesRaw , ok := d . GetOk ( "policies" )
if ok {
2021-10-23 02:28:31 +03:00
entity . Policies = strutil . RemoveDuplicates ( entityPoliciesRaw . ( [ ] string ) , false )
2018-07-25 05:01:58 +03:00
}
2017-10-11 20:21:20 +03:00
2018-08-21 23:12:23 +03:00
if strutil . StrListContains ( entity . Policies , "root" ) {
return logical . ErrorResponse ( "policies cannot contain root" ) , nil
}
2018-07-25 05:01:58 +03:00
disabledRaw , ok := d . GetOk ( "disabled" )
if ok {
entity . Disabled = disabledRaw . ( bool )
}
2018-04-14 04:49:40 +03:00
2018-07-25 05:01:58 +03:00
// Get entity metadata
metadata , ok , err := d . GetOkErr ( "metadata" )
2017-10-11 20:21:20 +03:00
if err != nil {
2018-07-25 05:01:58 +03:00
return logical . ErrorResponse ( fmt . Sprintf ( "failed to parse metadata: %v" , err ) ) , nil
2017-10-11 20:21:20 +03:00
}
2018-07-25 05:01:58 +03:00
if ok {
entity . Metadata = metadata . ( map [ string ] string )
}
2018-09-25 22:28:28 +03:00
// At this point, if entity.ID is empty, it indicates that a new entity
// is being created. Using this to respond data in the response.
newEntity := entity . ID == ""
2018-07-25 05:01:58 +03:00
// ID creation and some validations
2018-09-18 06:03:00 +03:00
err = i . sanitizeEntity ( ctx , entity )
2018-07-25 05:01:58 +03:00
if err != nil {
return nil , err
2017-10-11 20:21:20 +03:00
}
2018-09-25 22:28:28 +03:00
if err := i . upsertEntity ( ctx , entity , nil , true ) ; err != nil {
return nil , err
}
// If this operation was an update to an existing entity, return 204
if ! newEntity {
return nil , nil
}
2018-07-25 05:01:58 +03:00
// Prepare the response
respData := map [ string ] interface { } {
2019-05-01 20:47:41 +03:00
"id" : entity . ID ,
"name" : entity . Name ,
2018-07-25 05:01:58 +03:00
}
2017-10-11 20:21:20 +03:00
2018-07-25 05:01:58 +03:00
var aliasIDs [ ] string
for _ , alias := range entity . Aliases {
aliasIDs = append ( aliasIDs , alias . ID )
}
2017-10-11 20:21:20 +03:00
2018-07-25 05:01:58 +03:00
respData [ "aliases" ] = aliasIDs
2017-10-11 20:21:20 +03:00
2018-07-25 05:01:58 +03:00
// Return ID of the entity that was either created or updated along with
// its aliases
return & logical . Response {
Data : respData ,
} , nil
2017-10-11 20:21:20 +03:00
}
}
2018-09-25 22:28:28 +03:00
// pathEntityNameRead returns the properties of an entity for a given entity ID
func ( i * IdentityStore ) pathEntityNameRead ( ) framework . OperationFunc {
return func ( ctx context . Context , req * logical . Request , d * framework . FieldData ) ( * logical . Response , error ) {
entityName := d . Get ( "name" ) . ( string )
if entityName == "" {
return logical . ErrorResponse ( "missing entity name" ) , nil
}
entity , err := i . MemDBEntityByName ( ctx , entityName , false )
if err != nil {
return nil , err
}
if entity == nil {
return nil , nil
}
return i . handleEntityReadCommon ( ctx , entity )
}
}
2017-10-11 20:21:20 +03:00
// pathEntityIDRead returns the properties of an entity for a given entity ID
2018-01-08 21:31:38 +03:00
func ( i * IdentityStore ) pathEntityIDRead ( ) framework . OperationFunc {
return func ( ctx context . Context , req * logical . Request , d * framework . FieldData ) ( * logical . Response , error ) {
entityID := d . Get ( "id" ) . ( string )
if entityID == "" {
return logical . ErrorResponse ( "missing entity id" ) , nil
}
2017-10-11 20:21:20 +03:00
2018-01-08 21:31:38 +03:00
entity , err := i . MemDBEntityByID ( entityID , false )
if err != nil {
return nil , err
}
if entity == nil {
return nil , nil
}
2017-10-11 20:21:20 +03:00
2018-09-18 06:03:00 +03:00
return i . handleEntityReadCommon ( ctx , entity )
2018-01-08 21:31:38 +03:00
}
2017-11-02 23:38:15 +03:00
}
2018-09-18 06:03:00 +03:00
func ( i * IdentityStore ) handleEntityReadCommon ( ctx context . Context , entity * identity . Entity ) ( * logical . Response , error ) {
ns , err := namespace . FromContext ( ctx )
if err != nil {
return nil , err
}
if ns . ID != entity . NamespaceID {
return nil , nil
}
2017-10-11 20:21:20 +03:00
respData := map [ string ] interface { } { }
respData [ "id" ] = entity . ID
respData [ "name" ] = entity . Name
respData [ "metadata" ] = entity . Metadata
respData [ "merged_entity_ids" ] = entity . MergedEntityIDs
2021-10-23 02:28:31 +03:00
respData [ "policies" ] = strutil . RemoveDuplicates ( entity . Policies , false )
2018-04-14 04:49:40 +03:00
respData [ "disabled" ] = entity . Disabled
2019-06-14 19:53:00 +03:00
respData [ "namespace_id" ] = entity . NamespaceID
2017-10-11 20:21:20 +03:00
// Convert protobuf timestamp into RFC3339 format
respData [ "creation_time" ] = ptypes . TimestampString ( entity . CreationTime )
respData [ "last_update_time" ] = ptypes . TimestampString ( entity . LastUpdateTime )
// Convert each alias into a map and replace the time format in each
aliasesToReturn := make ( [ ] interface { } , len ( entity . Aliases ) )
for aliasIdx , alias := range entity . Aliases {
aliasMap := map [ string ] interface { } { }
aliasMap [ "id" ] = alias . ID
2017-11-02 23:05:48 +03:00
aliasMap [ "canonical_id" ] = alias . CanonicalID
2017-10-11 20:21:20 +03:00
aliasMap [ "mount_accessor" ] = alias . MountAccessor
aliasMap [ "metadata" ] = alias . Metadata
aliasMap [ "name" ] = alias . Name
2017-11-02 23:05:48 +03:00
aliasMap [ "merged_from_canonical_ids" ] = alias . MergedFromCanonicalIDs
2017-10-11 20:21:20 +03:00
aliasMap [ "creation_time" ] = ptypes . TimestampString ( alias . CreationTime )
aliasMap [ "last_update_time" ] = ptypes . TimestampString ( alias . LastUpdateTime )
2021-10-15 22:20:00 +03:00
aliasMap [ "local" ] = alias . Local
aliasMap [ "custom_metadata" ] = alias . CustomMetadata
2018-05-25 21:34:24 +03:00
2021-08-30 22:31:11 +03:00
if mountValidationResp := i . router . ValidateMountByAccessor ( alias . MountAccessor ) ; mountValidationResp != nil {
2018-05-25 21:34:24 +03:00
aliasMap [ "mount_type" ] = mountValidationResp . MountType
aliasMap [ "mount_path" ] = mountValidationResp . MountPath
}
2017-10-11 20:21:20 +03:00
aliasesToReturn [ aliasIdx ] = aliasMap
}
// Add the aliases information to the response which has the correct time
// formats
respData [ "aliases" ] = aliasesToReturn
2018-09-18 06:03:00 +03:00
addExtraEntityDataToResponse ( entity , respData )
2017-11-06 21:01:48 +03:00
// Fetch the groups this entity belongs to and return their identifiers
groups , inheritedGroups , err := i . groupsByEntityID ( entity . ID )
if err != nil {
return nil , err
}
groupIDs := make ( [ ] string , len ( groups ) )
for i , group := range groups {
groupIDs [ i ] = group . ID
}
respData [ "direct_group_ids" ] = groupIDs
inheritedGroupIDs := make ( [ ] string , len ( inheritedGroups ) )
for i , group := range inheritedGroups {
inheritedGroupIDs [ i ] = group . ID
}
respData [ "inherited_group_ids" ] = inheritedGroupIDs
respData [ "group_ids" ] = append ( groupIDs , inheritedGroupIDs ... )
2017-11-02 23:38:15 +03:00
return & logical . Response {
2017-10-11 20:21:20 +03:00
Data : respData ,
2017-11-02 23:38:15 +03:00
} , nil
2017-10-11 20:21:20 +03:00
}
// pathEntityIDDelete deletes the entity for a given entity ID
2018-01-08 21:31:38 +03:00
func ( i * IdentityStore ) pathEntityIDDelete ( ) framework . OperationFunc {
return func ( ctx context . Context , req * logical . Request , d * framework . FieldData ) ( * logical . Response , error ) {
entityID := d . Get ( "id" ) . ( string )
if entityID == "" {
return logical . ErrorResponse ( "missing entity id" ) , nil
}
2017-10-11 20:21:20 +03:00
2018-07-25 05:01:58 +03:00
i . lock . Lock ( )
defer i . lock . Unlock ( )
2018-06-24 14:45:53 +03:00
// Create a MemDB transaction to delete entity
txn := i . db . Txn ( true )
defer txn . Abort ( )
// Fetch the entity using its ID
entity , err := i . MemDBEntityByIDInTxn ( txn , entityID , true )
if err != nil {
return nil , err
}
if entity == nil {
return nil , nil
}
2020-04-24 01:25:13 +03:00
err = i . handleEntityDeleteCommon ( ctx , txn , entity , true )
2018-06-24 14:45:53 +03:00
if err != nil {
return nil , err
}
txn . Commit ( )
return nil , nil
2018-01-08 21:31:38 +03:00
}
2017-10-11 20:21:20 +03:00
}
2018-09-25 22:28:28 +03:00
// pathEntityNameDelete deletes the entity for a given entity ID
func ( i * IdentityStore ) pathEntityNameDelete ( ) framework . OperationFunc {
2018-01-08 21:31:38 +03:00
return func ( ctx context . Context , req * logical . Request , d * framework . FieldData ) ( * logical . Response , error ) {
2018-09-25 22:28:28 +03:00
entityName := d . Get ( "name" ) . ( string )
if entityName == "" {
return logical . ErrorResponse ( "missing entity name" ) , nil
}
i . lock . Lock ( )
defer i . lock . Unlock ( )
// Create a MemDB transaction to delete entity
txn := i . db . Txn ( true )
defer txn . Abort ( )
// Fetch the entity using its name
2018-10-19 22:47:26 +03:00
entity , err := i . MemDBEntityByNameInTxn ( ctx , txn , entityName , true )
2018-09-25 22:28:28 +03:00
if err != nil {
return nil , err
}
// If there is no entity for the ID, do nothing
if entity == nil {
return nil , nil
}
2018-09-18 06:03:00 +03:00
ns , err := namespace . FromContext ( ctx )
if err != nil {
return nil , err
}
2018-09-25 22:28:28 +03:00
if entity . NamespaceID != ns . ID {
return nil , nil
}
2018-09-18 06:03:00 +03:00
2020-04-24 01:25:13 +03:00
err = i . handleEntityDeleteCommon ( ctx , txn , entity , true )
2018-09-25 22:28:28 +03:00
if err != nil {
return nil , err
}
2018-06-24 14:45:53 +03:00
2018-11-16 04:07:45 +03:00
txn . Commit ( )
return nil , nil
}
}
2020-04-24 01:25:13 +03:00
// pathEntityIDDelete deletes the entity for a given entity ID
func ( i * IdentityStore ) handleEntityBatchDelete ( ) framework . OperationFunc {
return func ( ctx context . Context , req * logical . Request , d * framework . FieldData ) ( * logical . Response , error ) {
entityIDs := d . Get ( "entity_ids" ) . ( [ ] string )
if len ( entityIDs ) == 0 {
return logical . ErrorResponse ( "missing entity ids to delete" ) , nil
}
// Sort the ids by the bucket they will be deleted from
byBucket := make ( map [ string ] map [ string ] struct { } )
for _ , id := range entityIDs {
bucketKey := i . entityPacker . BucketKey ( id )
bucket , ok := byBucket [ bucketKey ]
if ! ok {
bucket = make ( map [ string ] struct { } )
byBucket [ bucketKey ] = bucket
}
bucket [ id ] = struct { } { }
}
deleteIdsForBucket := func ( entityIDs [ ] string ) error {
i . lock . Lock ( )
defer i . lock . Unlock ( )
// Create a MemDB transaction to delete entities from the inmem database
2020-05-14 16:19:27 +03:00
// without altering storage. Batch deletion on storage bucket items is
2020-04-24 01:25:13 +03:00
// performed directly through entityPacker.
txn := i . db . Txn ( true )
defer txn . Abort ( )
for _ , entityID := range entityIDs {
// Fetch the entity using its ID
entity , err := i . MemDBEntityByIDInTxn ( txn , entityID , true )
if err != nil {
return err
}
if entity == nil {
continue
}
err = i . handleEntityDeleteCommon ( ctx , txn , entity , false )
if err != nil {
return err
}
}
// Write all updates for this bucket.
err := i . entityPacker . DeleteMultipleItems ( ctx , i . logger , entityIDs )
if err != nil {
return err
}
txn . Commit ( )
return nil
}
for _ , bucket := range byBucket {
ids := make ( [ ] string , len ( bucket ) )
i := 0
2021-04-08 19:43:39 +03:00
for id := range bucket {
2020-04-24 01:25:13 +03:00
ids [ i ] = id
i ++
}
err := deleteIdsForBucket ( ids )
if err != nil {
return nil , err
}
}
return nil , nil
}
}
2021-02-24 14:58:10 +03:00
// handleEntityDeleteCommon deletes an entity by removing it from groups of
// which it's a member and then, if update is true, deleting the entity itself.
2020-04-24 01:25:13 +03:00
func ( i * IdentityStore ) handleEntityDeleteCommon ( ctx context . Context , txn * memdb . Txn , entity * identity . Entity , update bool ) error {
2018-11-16 04:07:45 +03:00
ns , err := namespace . FromContext ( ctx )
if err != nil {
return err
}
if entity . NamespaceID != ns . ID {
return nil
}
// Remove entity ID as a member from all the groups it belongs, both
// internal and external
groups , err := i . MemDBGroupsByMemberEntityIDInTxn ( txn , entity . ID , true , false )
if err != nil {
2021-10-01 17:22:52 +03:00
return err
2018-11-16 04:07:45 +03:00
}
2018-06-24 14:45:53 +03:00
2018-11-16 04:07:45 +03:00
for _ , group := range groups {
group . MemberEntityIDs = strutil . StrListDelete ( group . MemberEntityIDs , entity . ID )
2019-05-01 20:47:41 +03:00
err = i . UpsertGroupInTxn ( ctx , txn , group , true )
2018-01-08 21:31:38 +03:00
if err != nil {
2018-11-16 04:07:45 +03:00
return err
2018-01-08 21:31:38 +03:00
}
2018-11-16 04:07:45 +03:00
}
2017-10-11 20:21:20 +03:00
2018-11-16 04:07:45 +03:00
// Delete all the aliases in the entity and the respective indexes
err = i . deleteAliasesInEntityInTxn ( txn , entity , entity . Aliases )
if err != nil {
return err
}
2018-06-24 14:45:53 +03:00
2018-11-16 04:07:45 +03:00
// Delete the entity using the same transaction
err = i . MemDBDeleteEntityByIDInTxn ( txn , entity . ID )
if err != nil {
return err
2018-09-25 22:28:28 +03:00
}
2018-11-16 04:07:45 +03:00
2020-04-24 01:25:13 +03:00
if update {
// Delete the entity from storage
err = i . entityPacker . DeleteItem ( ctx , entity . ID )
if err != nil {
return err
}
2018-11-16 04:07:45 +03:00
}
return nil
2018-09-25 22:28:28 +03:00
}
2018-05-25 21:34:24 +03:00
2018-09-25 22:28:28 +03:00
func ( i * IdentityStore ) pathEntityIDList ( ) framework . OperationFunc {
return func ( ctx context . Context , req * logical . Request , d * framework . FieldData ) ( * logical . Response , error ) {
return i . handlePathEntityListCommon ( ctx , req , d , true )
}
}
2018-05-25 21:34:24 +03:00
2018-09-25 22:28:28 +03:00
func ( i * IdentityStore ) pathEntityNameList ( ) framework . OperationFunc {
return func ( ctx context . Context , req * logical . Request , d * framework . FieldData ) ( * logical . Response , error ) {
return i . handlePathEntityListCommon ( ctx , req , d , false )
}
}
2018-05-25 21:34:24 +03:00
2018-09-25 22:28:28 +03:00
// handlePathEntityListCommon lists the IDs or names of all the valid entities
// in the identity store
func ( i * IdentityStore ) handlePathEntityListCommon ( ctx context . Context , req * logical . Request , d * framework . FieldData , byID bool ) ( * logical . Response , error ) {
ns , err := namespace . FromContext ( ctx )
if err != nil {
return nil , err
}
ws := memdb . NewWatchSet ( )
txn := i . db . Txn ( false )
iter , err := txn . Get ( entitiesTable , "namespace_id" , ns . ID )
if err != nil {
2021-05-11 20:12:54 +03:00
return nil , fmt . Errorf ( "failed to fetch iterator for entities in memdb: %w" , err )
2018-09-25 22:28:28 +03:00
}
ws . Add ( iter . WatchCh ( ) )
var keys [ ] string
entityInfo := map [ string ] interface { } { }
type mountInfo struct {
MountType string
MountPath string
}
mountAccessorMap := map [ string ] mountInfo { }
for {
2020-09-11 01:31:32 +03:00
// Check for timeouts
select {
case <- ctx . Done ( ) :
resp := logical . ListResponseWithInfo ( keys , entityInfo )
resp . AddWarning ( "partial response due to timeout" )
return resp , nil
default :
break
}
2018-09-25 22:28:28 +03:00
raw := iter . Next ( )
if raw == nil {
break
}
entity := raw . ( * identity . Entity )
if byID {
keys = append ( keys , entity . ID )
} else {
keys = append ( keys , entity . Name )
}
entityInfoEntry := map [ string ] interface { } {
"name" : entity . Name ,
}
if len ( entity . Aliases ) > 0 {
aliasList := make ( [ ] interface { } , 0 , len ( entity . Aliases ) )
for _ , alias := range entity . Aliases {
entry := map [ string ] interface { } {
"id" : alias . ID ,
"name" : alias . Name ,
"mount_accessor" : alias . MountAccessor ,
}
mi , ok := mountAccessorMap [ alias . MountAccessor ]
if ok {
entry [ "mount_type" ] = mi . MountType
entry [ "mount_path" ] = mi . MountPath
} else {
mi = mountInfo { }
2021-08-30 22:31:11 +03:00
if mountValidationResp := i . router . ValidateMountByAccessor ( alias . MountAccessor ) ; mountValidationResp != nil {
2018-09-25 22:28:28 +03:00
mi . MountType = mountValidationResp . MountType
mi . MountPath = mountValidationResp . MountPath
2018-05-25 21:34:24 +03:00
entry [ "mount_type" ] = mi . MountType
entry [ "mount_path" ] = mi . MountPath
}
2018-09-25 22:28:28 +03:00
mountAccessorMap [ alias . MountAccessor ] = mi
2018-05-25 21:34:24 +03:00
}
2018-09-25 22:28:28 +03:00
aliasList = append ( aliasList , entry )
2018-05-25 21:34:24 +03:00
}
2018-09-25 22:28:28 +03:00
entityInfoEntry [ "aliases" ] = aliasList
2017-10-11 20:21:20 +03:00
}
2018-09-25 22:28:28 +03:00
entityInfo [ entity . ID ] = entityInfoEntry
2018-01-08 21:31:38 +03:00
}
2018-09-25 22:28:28 +03:00
return logical . ListResponseWithInfo ( keys , entityInfo ) , nil
2017-10-11 20:21:20 +03:00
}
2022-08-10 16:10:02 +03:00
func ( i * IdentityStore ) mergeEntityAsPartOfUpsert ( ctx context . Context , txn * memdb . Txn , toEntity * identity . Entity , fromEntityID string , persist bool ) ( error , error ) {
2022-10-17 21:46:25 +03:00
err1 , err2 , _ := i . mergeEntity ( ctx , txn , toEntity , [ ] string { fromEntityID } , [ ] string { } , true , false , true , persist , true )
return err1 , err2
2022-08-10 16:10:02 +03:00
}
2022-10-17 21:46:25 +03:00
// A small type to return useful information to the UI after an entity clash
// Every alias involved in a clash will be returned.
type aliasClashInformation struct {
Alias string ` json:"alias" `
Entity string ` json:"entity" `
EntityId string ` json:"entity_id" `
Mount string ` json:"mount" `
MountPath string ` json:"mount_path" `
}
func ( i * IdentityStore ) mergeEntity ( ctx context . Context , txn * memdb . Txn , toEntity * identity . Entity , fromEntityIDs , conflictingAliasIDsToKeep [ ] string , force , grabLock , mergePolicies , persist , forceMergeAliases bool ) ( error , error , [ ] aliasClashInformation ) {
2018-08-09 23:37:36 +03:00
if grabLock {
i . lock . Lock ( )
defer i . lock . Unlock ( )
}
if toEntity == nil {
2022-10-17 21:46:25 +03:00
return errors . New ( "entity id to merge to is invalid" ) , nil , nil
2018-08-09 23:37:36 +03:00
}
2018-09-18 06:03:00 +03:00
ns , err := namespace . FromContext ( ctx )
if err != nil {
2022-10-17 21:46:25 +03:00
return nil , err , nil
2018-09-18 06:03:00 +03:00
}
if toEntity . NamespaceID != ns . ID {
2022-10-17 21:46:25 +03:00
return errors . New ( "entity id to merge into does not belong to the request's namespace" ) , nil , nil
2018-09-18 06:03:00 +03:00
}
2022-08-10 16:10:02 +03:00
if len ( fromEntityIDs ) > 1 && len ( conflictingAliasIDsToKeep ) > 1 {
2022-10-17 21:46:25 +03:00
return errors . New ( "aliases conflicts cannot be resolved with multiple from entity ids - merge one entity at a time" ) , nil , nil
2022-08-10 16:10:02 +03:00
}
2021-10-12 22:35:19 +03:00
sanitizedFromEntityIDs := strutil . RemoveDuplicates ( fromEntityIDs , false )
2022-08-10 16:10:02 +03:00
// A map to check if there are any clashes between mount accessors for any of the sanitizedFromEntityIDs
fromEntityAccessors := make ( map [ string ] string )
2022-10-17 21:46:25 +03:00
// A list detailing all aliases where a clash has occurred, so that the error
// can be understood by the UI
aliasesInvolvedInClashes := make ( [ ] aliasClashInformation , 0 )
2022-08-10 16:10:02 +03:00
// An error detailing if any alias clashes happen (shared mount accessor)
var aliasClashError error
2021-10-12 22:35:19 +03:00
for _ , fromEntityID := range sanitizedFromEntityIDs {
2018-08-09 23:37:36 +03:00
if fromEntityID == toEntity . ID {
2022-10-17 21:46:25 +03:00
return errors . New ( "to_entity_id should not be present in from_entity_ids" ) , nil , nil
2018-08-09 23:37:36 +03:00
}
fromEntity , err := i . MemDBEntityByID ( fromEntityID , false )
if err != nil {
2022-10-17 21:46:25 +03:00
return nil , err , nil
2018-08-09 23:37:36 +03:00
}
if fromEntity == nil {
2022-10-17 21:46:25 +03:00
return errors . New ( "entity id to merge from is invalid" ) , nil , nil
2018-08-09 23:37:36 +03:00
}
2018-09-18 06:03:00 +03:00
if fromEntity . NamespaceID != toEntity . NamespaceID {
2022-10-17 21:46:25 +03:00
return errors . New ( "entity id to merge from does not belong to this namespace" ) , nil , nil
2018-09-18 06:03:00 +03:00
}
2022-08-10 16:10:02 +03:00
// If we're not resolving a conflict, we check to see if
// any aliases conflict between the toEntity and this fromEntity:
if ! forceMergeAliases && len ( conflictingAliasIDsToKeep ) == 0 {
for _ , toAlias := range toEntity . Aliases {
for _ , fromAlias := range fromEntity . Aliases {
// First, check to see if this alias clashes with an alias from any of the other fromEntities:
id , mountAccessorInAnotherFromEntity := fromEntityAccessors [ fromAlias . MountAccessor ]
if mountAccessorInAnotherFromEntity && ( id != fromEntityID ) {
2022-10-17 21:46:25 +03:00
return fmt . Errorf ( "mount accessor %s found in multiple fromEntities, merge should be done with one fromEntity at a time" , fromAlias . MountAccessor ) , nil , nil
2022-08-10 16:10:02 +03:00
}
fromEntityAccessors [ fromAlias . MountAccessor ] = fromEntityID
// If it doesn't, check if it clashes with the toEntities
if toAlias . MountAccessor == fromAlias . MountAccessor {
if aliasClashError == nil {
aliasClashError = multierror . Append ( aliasClashError , fmt . Errorf ( "toEntity and at least one fromEntity have aliases with the same mount accessor, repeat the merge request specifying exactly one fromEntity, clashes: " ) )
}
aliasClashError = multierror . Append ( aliasClashError ,
fmt . Errorf ( "mountAccessor: %s, toEntity ID: %s, fromEntity ID: %s, conflicting toEntity alias ID: %s, conflicting fromEntity alias ID: %s" ,
toAlias . MountAccessor , toEntity . ID , fromEntityID , toAlias . ID , fromAlias . ID ) )
2022-10-17 21:46:25 +03:00
2022-10-21 23:47:59 +03:00
var toAliasMountType string
var toAliasMountPath string
mountValidationRespToAlias := i . router . ValidateMountByAccessor ( toAlias . MountAccessor )
if mountValidationRespToAlias != nil {
toAliasMountType = mountValidationRespToAlias . MountType
toAliasMountPath = mountValidationRespToAlias . MountPath
}
var fromAliasMountType string
var fromAliasMountPath string
mountValidationRespFromAlias := i . router . ValidateMountByAccessor ( fromAlias . MountAccessor )
if mountValidationRespFromAlias != nil {
fromAliasMountType = mountValidationRespFromAlias . MountType
fromAliasMountPath = mountValidationRespFromAlias . MountPath
}
2022-10-17 21:46:25 +03:00
// Also add both to our summary of all clashes:
aliasesInvolvedInClashes = append ( aliasesInvolvedInClashes , aliasClashInformation {
Entity : toEntity . Name ,
EntityId : toEntity . ID ,
Alias : toAlias . Name ,
2022-10-21 23:47:59 +03:00
Mount : toAliasMountType ,
MountPath : toAliasMountPath ,
2022-10-17 21:46:25 +03:00
} )
aliasesInvolvedInClashes = append ( aliasesInvolvedInClashes , aliasClashInformation {
Entity : fromEntity . Name ,
EntityId : fromEntityID ,
Alias : fromAlias . Name ,
2022-10-21 23:47:59 +03:00
Mount : fromAliasMountType ,
MountPath : fromAliasMountPath ,
2022-10-17 21:46:25 +03:00
} )
2022-08-10 16:10:02 +03:00
}
}
}
}
2018-09-18 06:03:00 +03:00
for configID , configSecret := range fromEntity . MFASecrets {
_ , ok := toEntity . MFASecrets [ configID ]
if ok && ! force {
2022-10-17 21:46:25 +03:00
return nil , fmt . Errorf ( "conflicting MFA config ID %q in entity ID %q" , configID , fromEntity . ID ) , nil
2018-09-18 06:03:00 +03:00
} else {
2019-10-22 16:57:24 +03:00
if toEntity . MFASecrets == nil {
toEntity . MFASecrets = make ( map [ string ] * mfa . Secret )
}
2018-09-18 06:03:00 +03:00
toEntity . MFASecrets [ configID ] = configSecret
}
}
}
2022-08-10 16:10:02 +03:00
// Check alias clashes after validating every fromEntity, so that we have a full list of errors
if aliasClashError != nil {
2022-10-17 21:46:25 +03:00
return aliasClashError , nil , aliasesInvolvedInClashes
2022-08-10 16:10:02 +03:00
}
2021-08-30 22:31:11 +03:00
isPerfSecondaryOrStandby := i . localNode . ReplicationState ( ) . HasState ( consts . ReplicationPerformanceSecondary ) ||
i . localNode . HAState ( ) == consts . PerfStandby
2021-10-01 17:22:52 +03:00
var fromEntityGroups [ ] * identity . Group
2021-10-14 19:52:07 +03:00
2022-08-10 16:10:02 +03:00
toEntityAccessors := make ( map [ string ] [ ] string )
2021-10-14 19:52:07 +03:00
for _ , alias := range toEntity . Aliases {
2022-08-10 16:10:02 +03:00
if accessors , ok := toEntityAccessors [ alias . MountAccessor ] ; ! ok {
// While it is not supported to have multiple aliases with the same mount accessor in one entity
// we do not strictly enforce the invariant. Thus, we account for multiple just to be safe
if accessors == nil {
toEntityAccessors [ alias . MountAccessor ] = [ ] string { alias . ID }
} else {
toEntityAccessors [ alias . MountAccessor ] = append ( accessors , alias . ID )
}
2021-10-14 19:52:07 +03:00
}
}
2021-10-12 22:35:19 +03:00
for _ , fromEntityID := range sanitizedFromEntityIDs {
2018-09-18 06:03:00 +03:00
if fromEntityID == toEntity . ID {
2022-10-17 21:46:25 +03:00
return errors . New ( "to_entity_id should not be present in from_entity_ids" ) , nil , nil
2018-09-18 06:03:00 +03:00
}
2022-04-22 20:04:34 +03:00
fromEntity , err := i . MemDBEntityByID ( fromEntityID , true )
2018-09-18 06:03:00 +03:00
if err != nil {
2022-10-17 21:46:25 +03:00
return nil , err , nil
2018-09-18 06:03:00 +03:00
}
if fromEntity == nil {
2022-10-17 21:46:25 +03:00
return errors . New ( "entity id to merge from is invalid" ) , nil , nil
2018-09-18 06:03:00 +03:00
}
if fromEntity . NamespaceID != toEntity . NamespaceID {
2022-10-17 21:46:25 +03:00
return errors . New ( "entity id to merge from does not belong to this namespace" ) , nil , nil
2018-09-18 06:03:00 +03:00
}
2022-08-10 16:10:02 +03:00
for _ , fromAlias := range fromEntity . Aliases {
// If true, we need to handle conflicts (conflict = both aliases share the same mount accessor)
if toAliasIds , ok := toEntityAccessors [ fromAlias . MountAccessor ] ; ok {
for _ , toAliasId := range toAliasIds {
// When forceMergeAliases is true (as part of the merge-during-upsert case), we make the decision
// for the user, and keep the to_entity alias, merging the from_entity
// This case's code is the same as when the user selects to keep the from_entity alias
// but is kept separate for clarity
if forceMergeAliases {
i . logger . Info ( "Deleting to_entity alias during entity merge" , "to_entity" , toEntity . ID , "deleted_alias" , toAliasId )
err := i . MemDBDeleteAliasByIDInTxn ( txn , toAliasId , false )
if err != nil {
2022-10-17 21:46:25 +03:00
return nil , fmt . Errorf ( "failed to delete orphaned alias during merge: %w" , err ) , nil
2022-08-10 16:10:02 +03:00
}
} else if strutil . StrListContains ( conflictingAliasIDsToKeep , toAliasId ) {
i . logger . Info ( "Deleting from_entity alias during entity merge" , "from_entity" , fromEntityID , "deleted_alias" , fromAlias . ID )
err := i . MemDBDeleteAliasByIDInTxn ( txn , fromAlias . ID , false )
if err != nil {
2022-10-17 21:46:25 +03:00
return nil , fmt . Errorf ( "failed to delete orphaned alias during merge: %w" , err ) , nil
2022-08-10 16:10:02 +03:00
}
// Continue to next alias, as there's no alias to merge left in the from_entity
continue
} else if strutil . StrListContains ( conflictingAliasIDsToKeep , fromAlias . ID ) {
i . logger . Info ( "Deleting to_entity alias during entity merge" , "to_entity" , toEntity . ID , "deleted_alias" , toAliasId )
err := i . MemDBDeleteAliasByIDInTxn ( txn , toAliasId , false )
if err != nil {
2022-10-17 21:46:25 +03:00
return nil , fmt . Errorf ( "failed to delete orphaned alias during merge: %w" , err ) , nil
2022-08-10 16:10:02 +03:00
}
} else {
2022-10-17 21:46:25 +03:00
return fmt . Errorf ( "conflicting mount accessors in following alias IDs and neither were present in conflicting_alias_ids_to_keep: %s, %s" , fromAlias . ID , toAliasId ) , nil , nil
2022-08-10 16:10:02 +03:00
}
}
}
2018-08-09 23:37:36 +03:00
// Set the desired canonical ID
2022-08-10 16:10:02 +03:00
fromAlias . CanonicalID = toEntity . ID
2018-08-09 23:37:36 +03:00
2022-08-10 16:10:02 +03:00
fromAlias . MergedFromCanonicalIDs = append ( fromAlias . MergedFromCanonicalIDs , fromEntity . ID )
2018-08-09 23:37:36 +03:00
2022-08-10 16:10:02 +03:00
err = i . MemDBUpsertAliasInTxn ( txn , fromAlias , false )
2018-08-09 23:37:36 +03:00
if err != nil {
2022-10-17 21:46:25 +03:00
return nil , fmt . Errorf ( "failed to update alias during merge: %w" , err ) , nil
2018-08-09 23:37:36 +03:00
}
// Add the alias to the desired entity
2022-08-10 16:10:02 +03:00
toEntity . Aliases = append ( toEntity . Aliases , fromAlias )
2018-08-09 23:37:36 +03:00
}
// If told to, merge policies
if mergePolicies {
2021-10-23 02:28:31 +03:00
toEntity . Policies = strutil . RemoveDuplicates ( strutil . MergeSlices ( toEntity . Policies , fromEntity . Policies ) , false )
2018-08-09 23:37:36 +03:00
}
// If the entity from which we are merging from was already a merged
// entity, transfer over the Merged set to the entity we are
// merging into.
toEntity . MergedEntityIDs = append ( toEntity . MergedEntityIDs , fromEntity . MergedEntityIDs ... )
// Add the entity from which we are merging from to the list of entities
// the entity we are merging into is composed of.
toEntity . MergedEntityIDs = append ( toEntity . MergedEntityIDs , fromEntity . ID )
2021-10-01 17:22:52 +03:00
// Remove entity ID as a member from all the groups it belongs, both
// internal and external
groups , err := i . MemDBGroupsByMemberEntityIDInTxn ( txn , fromEntity . ID , true , false )
if err != nil {
2022-10-17 21:46:25 +03:00
return nil , err , nil
2021-10-01 17:22:52 +03:00
}
for _ , group := range groups {
group . MemberEntityIDs = strutil . StrListDelete ( group . MemberEntityIDs , fromEntity . ID )
err = i . UpsertGroupInTxn ( ctx , txn , group , persist && ! isPerfSecondaryOrStandby )
if err != nil {
2022-10-17 21:46:25 +03:00
return nil , err , nil
2021-10-01 17:22:52 +03:00
}
fromEntityGroups = append ( fromEntityGroups , group )
}
2018-08-09 23:37:36 +03:00
// Delete the entity which we are merging from in MemDB using the same transaction
err = i . MemDBDeleteEntityByIDInTxn ( txn , fromEntity . ID )
if err != nil {
2022-10-17 21:46:25 +03:00
return nil , err , nil
2018-08-09 23:37:36 +03:00
}
2019-02-09 00:32:06 +03:00
if persist && ! isPerfSecondaryOrStandby {
// Delete the entity which we are merging from in storage
2019-05-01 20:47:41 +03:00
err = i . entityPacker . DeleteItem ( ctx , fromEntity . ID )
2019-02-09 00:32:06 +03:00
if err != nil {
2022-10-17 21:46:25 +03:00
return nil , err , nil
2019-02-09 00:32:06 +03:00
}
2018-08-09 23:37:36 +03:00
}
}
// Update MemDB with changes to the entity we are merging to
2018-09-18 06:03:00 +03:00
err = i . MemDBUpsertEntityInTxn ( txn , toEntity )
2018-08-09 23:37:36 +03:00
if err != nil {
2022-10-17 21:46:25 +03:00
return nil , err , nil
2018-08-09 23:37:36 +03:00
}
2021-10-01 17:22:52 +03:00
for _ , group := range fromEntityGroups {
group . MemberEntityIDs = append ( group . MemberEntityIDs , toEntity . ID )
err = i . UpsertGroupInTxn ( ctx , txn , group , persist && ! isPerfSecondaryOrStandby )
if err != nil {
2022-10-17 21:46:25 +03:00
return nil , err , nil
2021-10-01 17:22:52 +03:00
}
}
2019-02-09 00:32:06 +03:00
if persist && ! isPerfSecondaryOrStandby {
// Persist the entity which we are merging to
toEntityAsAny , err := ptypes . MarshalAny ( toEntity )
if err != nil {
2022-10-17 21:46:25 +03:00
return nil , err , nil
2019-02-09 00:32:06 +03:00
}
item := & storagepacker . Item {
ID : toEntity . ID ,
Message : toEntityAsAny ,
}
2018-08-09 23:37:36 +03:00
2019-05-01 20:47:41 +03:00
err = i . entityPacker . PutItem ( ctx , item )
2019-02-09 00:32:06 +03:00
if err != nil {
2022-10-17 21:46:25 +03:00
return nil , err , nil
2019-02-09 00:32:06 +03:00
}
2018-08-09 23:37:36 +03:00
}
2022-10-17 21:46:25 +03:00
return nil , nil , nil
2018-08-09 23:37:36 +03:00
}
2017-10-11 20:21:20 +03:00
var entityHelp = map [ string ] [ 2 ] string {
"entity" : {
"Create a new entity" ,
"" ,
} ,
"entity-id" : {
"Update, read or delete an entity using entity ID" ,
"" ,
} ,
2018-09-25 22:28:28 +03:00
"entity-name" : {
"Update, read or delete an entity using entity name" ,
"" ,
} ,
2017-10-11 20:21:20 +03:00
"entity-id-list" : {
"List all the entity IDs" ,
"" ,
} ,
2018-09-25 22:28:28 +03:00
"entity-name-list" : {
"List all the entity names" ,
"" ,
} ,
2017-10-11 20:21:20 +03:00
"entity-merge-id" : {
"Merge two or more entities together" ,
"" ,
} ,
2020-04-24 01:25:13 +03:00
"batch-delete" : {
"Delete all of the entities provided" ,
"" ,
} ,
2017-10-11 20:21:20 +03:00
}