garage/src/model/key_table.rs

use serde::{Deserialize, Serialize};

use garage_table::crdt::*;
use garage_table::*;
use garage_util::data::*;

use crate::permission::BucketKeyPerm;

use garage_model_050::key_table as old;

/// An api key
#[derive(PartialEq, Clone, Debug, Serialize, Deserialize)]
pub struct Key {
	/// The id of the key (immutable), used as partition key
	pub key_id: String,

	/// Internal state of the key
	pub state: crdt::Deletable<KeyParams>,
}

/// Configuration for a key
#[derive(PartialEq, Clone, Debug, Serialize, Deserialize)]
pub struct KeyParams {
	/// The secret_key associated (immutable)
	pub secret_key: String,

	/// Name for the key
	pub name: crdt::Lww<String>,

	/// Flag to allow users having this key to create buckets
	pub allow_create_bucket: crdt::Lww<bool>,

	/// If the key is present: it gives some permissions,
	/// a map of bucket IDs (uuids) to permissions.
	/// Otherwise no permissions are granted to key
	pub authorized_buckets: crdt::Map<Uuid, BucketKeyPerm>,

	/// A key can have a local view of buckets names it is
	/// the only one to see, this is the namespace for these aliases
	pub local_aliases: crdt::LwwMap<String, Option<Uuid>>,
}

impl KeyParams {
	fn new(secret_key: &str, name: &str) -> Self {
		KeyParams {
			secret_key: secret_key.to_string(),
			name: crdt::Lww::new(name.to_string()),
			allow_create_bucket: crdt::Lww::new(false),
			authorized_buckets: crdt::Map::new(),
			local_aliases: crdt::LwwMap::new(),
		}
	}
}

impl Crdt for KeyParams {
	fn merge(&mut self, o: &Self) {
		self.name.merge(&o.name);
		self.allow_create_bucket.merge(&o.allow_create_bucket);
		self.authorized_buckets.merge(&o.authorized_buckets);
		self.local_aliases.merge(&o.local_aliases);
	}
}

impl Key {
	/// Initialize a new Key, generating a random identifier and associated secret key
	pub fn new(name: &str) -> Self {
		let key_id = format!("GK{}", hex::encode(&rand::random::<[u8; 12]>()[..]));
		let secret_key = hex::encode(&rand::random::<[u8; 32]>()[..]);
		Self {
			key_id,
			state: crdt::Deletable::present(KeyParams::new(&secret_key, name)),
		}
	}

	/// Import a key from it's parts
	pub fn import(key_id: &str, secret_key: &str, name: &str) -> Self {
		Self {
			key_id: key_id.to_string(),
			state: crdt::Deletable::present(KeyParams::new(secret_key, name)),
		}
	}

	/// Create a new Key which can me merged to mark an existing key deleted
	pub fn delete(key_id: String) -> Self {
		Self {
			key_id,
			state: crdt::Deletable::Deleted,
		}
	}

	/// Returns true if this represents a deleted bucket
	pub fn is_deleted(&self) -> bool {
		self.state.is_deleted()
	}

	/// Returns an option representing the params (None if in deleted state)
	pub fn params(&self) -> Option<&KeyParams> {
		self.state.as_option()
	}

	/// Mutable version of `.state()`
	pub fn params_mut(&mut self) -> Option<&mut KeyParams> {
		self.state.as_option_mut()
	}

	/// Get permissions for a bucket
	pub fn bucket_permissions(&self, bucket: &Uuid) -> BucketKeyPerm {
		self.params()
			.and_then(|params| params.authorized_buckets.get(bucket))
			.cloned()
			.unwrap_or(BucketKeyPerm::NO_PERMISSIONS)
	}

	/// Check if `Key` is allowed to read in bucket
	pub fn allow_read(&self, bucket: &Uuid) -> bool {
		self.bucket_permissions(bucket).allow_read
	}

	/// Check if `Key` is allowed to write in bucket
	pub fn allow_write(&self, bucket: &Uuid) -> bool {
		self.bucket_permissions(bucket).allow_write
	}

	/// Check if `Key` is owner of bucket
	pub fn allow_owner(&self, bucket: &Uuid) -> bool {
		self.bucket_permissions(bucket).allow_owner
	}
}

impl Entry<EmptyKey, String> for Key {
	fn partition_key(&self) -> &EmptyKey {
		&EmptyKey
	}
	fn sort_key(&self) -> &String {
		&self.key_id
	}
}

impl Crdt for Key {
	fn merge(&mut self, other: &Self) {
		self.state.merge(&other.state);
	}
}

pub struct KeyTable;

#[derive(Clone, Debug, Serialize, Deserialize)]
pub enum KeyFilter {
	Deleted(DeletedFilter),
	MatchesAndNotDeleted(String),
}

impl TableSchema for KeyTable {
	const TABLE_NAME: &'static str = "key";

	type P = EmptyKey;
	type S = String;
	type E = Key;
	type Filter = KeyFilter;

	fn matches_filter(entry: &Self::E, filter: &Self::Filter) -> bool {
		match filter {
			KeyFilter::Deleted(df) => df.apply(entry.state.is_deleted()),
			KeyFilter::MatchesAndNotDeleted(pat) => {
				let pat = pat.to_lowercase();
				entry
					.params()
					.map(|p| {
						entry.key_id.to_lowercase().starts_with(&pat)
							|| p.name.get().to_lowercase() == pat
					})
					.unwrap_or(false)
			}
		}
	}

	fn try_migrate(bytes: &[u8]) -> Option<Self::E> {
		let old_k = rmp_serde::decode::from_read_ref::<_, old::Key>(bytes).ok()?;
		let name = crdt::Lww::raw(old_k.name.timestamp(), old_k.name.get().clone());

		let state = if old_k.deleted.get() {
			crdt::Deletable::Deleted
		} else {
			// Authorized buckets is ignored here,
			// migration is performed in specific migration code in
			// garage/migrate.rs
			crdt::Deletable::Present(KeyParams {
				secret_key: old_k.secret_key,
				name,
				allow_create_bucket: crdt::Lww::new(false),
				authorized_buckets: crdt::Map::new(),
				local_aliases: crdt::LwwMap::new(),
			})
		};
		Some(Key {
			key_id: old_k.key_id,
			state,
		})
	}
}