1 files changed, 82 insertions, 61 deletions

diff --git a/crates/iam/src/main.rs b/crates/iam/src/main.rs
index c679af6..28f4e4c 100644
--- a/crates/iam/src/main.rs
+++ b/crates/iam/src/main.rs
@@ -2,19 +2,19 @@ mod api;
 mod command;
 mod util;
 
+use crate::api::ValidationMethod;
 use anyhow::bail;
-use api::{AdminAction, Args, CliError, Command, CreateObject, DevObject, GetObject, UpdateObject};
+use api::{
+    AdminAction, Args, CliError, Command, CreateObject, DevObject, GetObject, UpdateObject,
+    ValidateObject,
+};
+
 use clap::Parser;
 use command::dev_oauth2_listen;
 use env_logger::Env;
-use secd::{
-    auth::z, Credential, CredentialType, Secd, ENV_AUTH_STORE_CONN_STRING, ENV_SPICE_SECRET,
-    ENV_SPICE_SERVER,
-};
-use util::{error_detail, Result};
-use uuid::Uuid;
-
-use crate::api::ValidationMethod;
+use secd::{CredentialType, Secd};
+use time::OffsetDateTime;
+use util::Result;
 
 const CONFIG_DIR_NAME: &str = "secdiam";
 const CONFIG_PROFILE_FILE: &str = "profiles.toml";
@@ -49,15 +49,7 @@ async fn exec() -> Result<Option<String>> {
 
         rest @ _ => {
             // let cfg = util::read_config(args.profile).map_err(|_| CliError::InvalidProfile)?;
-            std::env::set_var(
-                ENV_AUTH_STORE_CONN_STRING,
-                // "sqlite:///home/benj/.config/secdiam/34wxC.sql?mode=rwc",
-                "postgresql://secduser:p4ssw0rd@localhost:5412/secd",
-            );
-            std::env::set_var(ENV_SPICE_SECRET, "sup3rs3cr3tk3y");
-            std::env::set_var(ENV_SPICE_SERVER, "http://[::1]:50051");
-
-            let secd = Secd::init(None)
+            let secd = Secd::init(None, None)
                 .await
                 .map_err(|e| CliError::SecdInitializationFailure(e.to_string()))?;
 
@@ -70,6 +62,7 @@ async fn exec() -> Result<Option<String>> {
                     unimplemented!()
                 }
                 Command::Update { object } => update(&secd, object).await?,
+                Command::Validate { object } => validate(&secd, object).await?,
             }
         }
     })
@@ -101,18 +94,27 @@ async fn create(secd: &Secd, cmd: CreateObject) -> Result<Option<String>> {
             method,
             identity_id,
         } => {
-            let t = match method {
+            let t = match &method {
                 api::CredentialMethod::Passphrase {
                     username,
                     passphrase,
                 } => CredentialType::Passphrase {
-                    key: username,
-                    value: passphrase,
+                    key: username.clone(),
+                    value: passphrase.clone(),
                 },
+                api::CredentialMethod::ApiToken { .. } => CredentialType::new_api_token()?,
+            };
+
+            let expires_at = match method {
+                api::CredentialMethod::ApiToken { expires_at, .. } => expires_at.map(|t| {
+                    OffsetDateTime::from_unix_timestamp(t)
+                        .expect("The provided value is an invalid unix timestamp")
+                }),
+                api::CredentialMethod::Passphrase { .. } => None,
             };
 
-            let credential = secd.create_credential(t, identity_id).await?;
-            Some(serde_json::ser::to_string(&credential)?.to_string())
+            let credential = secd.create_credential(t, identity_id, expires_at).await?;
+            Some(serde_json::ser::to_string_pretty(&credential)?.to_string())
         }
         CreateObject::Validation {
             method,
@@ -121,7 +123,7 @@ async fn create(secd: &Secd, cmd: CreateObject) -> Result<Option<String>> {
             ValidationMethod::Email { address } => {
                 let validation = secd.validate_email(&address, identity_id).await?;
 
-                Some(serde_json::ser::to_string(&validation)?.to_string())
+                Some(serde_json::ser::to_string_pretty(&validation)?.to_string())
             }
             _ => unimplemented!(),
         },
@@ -136,7 +138,7 @@ async fn create(secd: &Secd, cmd: CreateObject) -> Result<Option<String>> {
             let session = secd
                 .complete_address_validation(&validation_id, token, code)
                 .await?;
-            Some(serde_json::ser::to_string(&session)?.to_string())
+            Some(serde_json::ser::to_string_pretty(&session)?.to_string())
         }
     })
 }
@@ -149,44 +151,31 @@ async fn dev(cmd: DevObject) -> Result<Option<String>> {
 
 async fn get(secd: &Secd, cmd: GetObject) -> Result<Option<String>> {
     Ok(match cmd {
-        GetObject::ApiKey { public_key } => {
-            println!("get object api key");
-            None
-        }
-        GetObject::Group { name, id } => {
-            println!("get object group");
-            None
-        }
         GetObject::Identity {
             identity_id,
-            session_token,
-        } => Some(
-            serde_json::ser::to_string(&secd.get_identity(identity_id, session_token).await?)?
-                .to_string(),
-        ),
-
-        GetObject::Permission { name, id } => {
-            println!("get object permission");
-            None
-        }
-        GetObject::Role { name, id } => {
-            println!("get object role");
-            None
-        }
-        GetObject::Service { name, id } => {
-            println!("get object service");
-            None
-        }
-        GetObject::ServiceAction { name, id } => {
-            println!("get object service action");
-            None
-        }
-        GetObject::Session { secret } => {
-            Some(serde_json::ser::to_string(&secd.get_session(&secret).await?)?.to_string())
-        }
-        GetObject::Validation { id } => {
-            println!("get object validation");
-            None
+
+            credential,
+        } => {
+            let t = credential.map(|cred| match cred {
+                ValidateObject::ApiToken { token } => {
+                    CredentialType::api_token_from_str(&token).expect("failed to build api token")
+                }
+                ValidateObject::Passphrase {
+                    username,
+                    passphrase,
+                } => CredentialType::Passphrase {
+                    key: username,
+                    value: passphrase,
+                },
+                ValidateObject::Session { token } => {
+                    CredentialType::session_from_str(&token).expect("failed to build session")
+                }
+            });
+
+            Some(
+                serde_json::ser::to_string_pretty(&secd.get_identity(identity_id, t).await?)?
+                    .to_string(),
+            )
         }
     })
 }
@@ -202,5 +191,37 @@ async fn update(secd: &Secd, cmd: UpdateObject) -> Result<Option<String>> {
 
             Some(serde_json::to_string(&identity)?.to_string())
         }
+        UpdateObject::Credential { id, revoke } => {
+            if revoke {
+                secd.revoke_credential(id).await?;
+            }
+
+            Some("Ok".to_string())
+        }
     })
 }
+
+async fn validate(secd: &Secd, cmd: ValidateObject) -> Result<Option<String>> {
+    let credential = match cmd {
+        ValidateObject::ApiToken { token } => {
+            secd.validate_credential(CredentialType::api_token_from_str(&token)?)
+                .await?
+        }
+        ValidateObject::Passphrase {
+            username,
+            passphrase,
+        } => {
+            secd.validate_credential(CredentialType::Passphrase {
+                key: username,
+                value: passphrase,
+            })
+            .await?
+        }
+        ValidateObject::Session { token } => {
+            secd.validate_credential(CredentialType::session_from_str(&token)?)
+                .await?
+        }
+    };
+
+    Ok(Some(serde_json::to_string_pretty(&credential)?.to_string()))
+}