path: root/crates/iam/src/api.rs

use crate::ISSUE_TRACKER_LOC;
use clap::{Parser, Subcommand, ValueEnum};
use colored::*;
use serde::{Deserialize, Serialize};
use thiserror;
use url::Url;
use uuid::Uuid;

#[derive(Debug, thiserror::Error)]
pub enum CliError {
    #[error("{} {}", "Failed to initialize an iam store.".red(), format!("An invariant was likely broken and should be reported as a bug here: {}", ISSUE_TRACKER_LOC))]
    AdminInitializationError,
    #[error("{} {}", "Failed to recieve incoming request.".red(), .0.white())]
    DevOauthServer(String),
    #[error("{} {} {}", "An unknown error occurred.".red(), format!("An invariant was likely broken and should be reported as a bug here: {}", ISSUE_TRACKER_LOC), .0.yellow())]
    InternalError(String),
    #[error("{} {}", "The provided validation id and code is invalid or has expired.".red(), "You may recieve at most one session with a valid code, after which a new validation is required.")]
    InvalidCode,
    #[error("{}", "iam failed to read a valid configuration profile. Initialize an iam store with `iam admin init`".red())]
    InvalidProfile,
    #[error("{} {}", "Failed to initialize secd: ".red(), .0.yellow())]
    SecdInitializationFailure(String),
}

#[derive(Parser)]
#[command(
    name = "iam",
    author = "benabel",
    version = "0.0.1",
    long_about = "SecD IAM\nIdentity and access management secured by secd and user controlled. Get started with `iam init`"
)]
pub struct Args {
    #[command(subcommand)]
    pub command: Command,
    /// IAM backend profile as defined in the iam config or as a connection string to an auth store.
    #[arg(long, short)]
    pub profile: Option<String>,
    /// The store type for the associated connection string
    #[arg(long, short)]
    pub store_type: Option<StoreType>,
    /// Connection string for the IAM store
    #[arg(long, short)]
    pub connection_string: Option<String>,
}

#[derive(Clone, ValueEnum)]
pub enum StoreType {
    Dynamo,
    Memory,
    Mysql,
    Postgres,
    Redis,
    Sqlite,
}

#[derive(Subcommand)]
pub enum Command {
    #[command(
        about = "Administrative actions for this IAM instance",
        long_about = "Admin\n\nAdministrative actions for this IAM instance. Each IAM instance is defined by the specified backend in the iam config or manually as an optional argument"
    )]
    Admin {
        #[command(subcommand)]
        action: AdminAction,
    },
    #[command(
        about = "Create a new IAM object which may be used to enforce authorization schemes.",
        long_about = "Create\n\nEntities which define the structure of an IAM instance. These entities may be rendered as an IAM graph, or within a web view, to more easily visualize and manipulate the IAM instance."
    )]
    Create {
        #[command(subcommand)]
        object: CreateObject,
    },
    #[command(
        about = "Utility and convenience commands while developing against secd",
        long_about = "Dev\n\nUtility and convenience commands while developing against secd. Easily retrieve local mail, monitor secd logs, and otherwise inspect or interact with the system."
    )]
    Dev {
        #[command(subcommand)]
        object: DevObject,
    },
    #[command(
        about = "List and filter IAM objects",
        long_about = "Get\n\nGet details for a specific IAM object"
    )]
    Get {
        #[command(subcommand)]
        object: GetObject,
    },
    /// Start the iam repl to more easily interact with iam and its primitives
    Repl,
    #[command(
        about = "Update specified IAM object",
        long_about = "Update\n\nUpdate details for the specified IAM object"
    )]
    Update {
        #[command(subcommand)]
        object: UpdateObject,
    },
    #[command(
        about = "Validate an IAM credential, optionally returning a session from the validation",
        long_about = "Validate\n\nCredentials which have been created for identities may be validated and optionally exchanged for sessions."
    )]
    Validate {
        #[command(subcommand)]
        object: ValidateObject,
    },
}

#[derive(Subcommand)]
pub enum AdminAction {
    /// Aliased as `iam init`
    Init {
        /// If true, interactively initialize an IAM store. Otherwise output a template config.
        #[arg(long, short, action)]
        interactive: bool,
    },
    /// Configure, describe, or rotate the default IAM store.
    Backend {
        #[command(subcommand)]
        action: AdminBackendAction,
    },
    /// Create a new administrative entity for an IAM store.
    Create {
        #[command(subcommand)]
        object: AdminObject,
    },
    /// Seal the configured IAM store to prevent administrative changes
    Seal,
    /// Unseal the configured IAM store to make administrative changes
    Unseal {
        /// The secret key used to seal this store
        secret_key: String,
    },
}

#[derive(Subcommand)]
pub enum AdminBackendAction {
    Configure {
        name: String,
        store: StoreType,
        connection: String,
    },
    Switch {
        name: String,
    },
}

#[derive(Subcommand)]
pub enum AdminObject {
    /// An email template used for IAM procedures, including identity validation
    EmailTemplate {
        template_type: EmailTemplateType,
        template: String,
    },
    /// A selected provider capable of sending email messages
    EmailProvider {
        provider: EmailProvider,
        secret_key: String,
        public_key: Option<String>,
    },
    /// A selected Oauth2.0 provider capable of authenticating identities
    Oauth2Provider {
        client_id: String,
        secret: String,
        redirect_url: Url,
    },
    /// A selected provider capable of sending SMS
    SmsProvider {
        provider: SmsProvider,
        secret_key: String,
        public_key: Option<String>,
    },
    /// A new secret which may be used to unseal the IAM store
    StoreSecret,
    /// A selected provider capable of sending automated voice messages
    VoiceProvider {
        provider: VoiceProvider,
        secret_key: String,
        public_key: Option<String>,
    },
}

#[derive(Clone, ValueEnum)]
pub enum EmailTemplateType {
    Login,
    SignUp,
}

#[derive(Clone, ValueEnum)]
pub enum EmailProvider {
    Custom,
    Mailgun,
    Sendgrid,
    Ses,
}

#[derive(Clone, ValueEnum)]
pub enum SmsProvider {
    AwsSns,
    Custom,
    Twilio,
}

#[derive(Clone, ValueEnum)]
pub enum VoiceProvider {
    Custom,
    Twilio,
}

#[derive(Subcommand)]
pub enum CreateObject {
    Credential {
        #[command(subcommand)]
        method: CredentialMethod,
        /// The identity against which to associate this credential. A new identity will be created if no identity is provided.
        #[arg(long, short)]
        identity_id: Option<Uuid>,
    },
    Impersonator {
        /// The identity which will be the source impersonator.
        impersonator_id: Uuid,
        /// The identity id which will be the target for impersonation, and for whom a credential will be created.
        target_id: Uuid,
    },
    Validation {
        /// Method by which the validation will occur
        #[command(subcommand)]
        method: ValidationMethod,
        /// The identity against which to associate this validation. A new identity will be created if no identity is provided.
        #[arg(long, short)]
        identity_id: Option<Uuid>,
    },
    #[command(
        about = "An action which completes an address validation",
        long_about = "Validation Completion\n\nA validation completion depends on an existing address validation, which is validated based on the provided validation id and secret token or secret code"
    )]
    ValidationCompletion {
        /// The validation id against which to complete the validation.
        validation_id: Uuid,
        /// The secret token for the validation. A token or code must be provided.
        #[arg(long, short)]
        token: Option<String>,
        /// The secret code for the validation. A code or token must be provided.
        #[arg(long, short)]
        code: Option<String>,
    },
}

#[derive(Subcommand)]
pub enum DevObject {
    #[command(
        about = "Create a temporary server to easily receive oauth validation during development.",
        long_about = "Oauth2\n\nCreate a temporary server to easily receive oauth validation during development."
    )]
    Oauth2Server {
        /// The port on which the server should listen. You must specify this exact port with your oauth provider. Defaults to 1337
        #[arg(long, short)]
        port: Option<u16>,
    },
}

#[derive(Subcommand)]
pub enum CredentialMethod {
    ApiToken {
        #[arg(long)]
        expires_at: Option<i64>,
    },
    /// Unique username and passphrase credential. Each username may have at most one Passprhase credential.
    Passphrase {
        /// The username associated with this credential
        username: String,
        /// The secret passphrase for this credential
        passphrase: String,
    },
}

#[derive(Subcommand)]
pub enum ValidationMethod {
    /// An email address to which the validation will be sent
    Email {
        /// Email address which will receive the validation
        address: String,
    },
    /// A phone which an identity may authenticate via SMS or Voice
    Phone {
        /// Whether to use a voice code. Otherwise, uses SMS
        #[arg(long, short, action)]
        use_voice: bool,
    },
}

#[derive(Subcommand)]
pub enum GetObject {
    Identity {
        /// The unique id corresponding to this identity.
        #[arg(long, short)]
        identity_id: Option<Uuid>,
        /// The credential corresponding to this identity.
        #[command(subcommand)]
        credential: Option<ValidateObject>,
    },
}

#[derive(Subcommand)]
pub enum UpdateObject {
    Identity {
        /// Unique identifier for this identity.
        id: Uuid,
        /// Metadata for this identity. Note, structured metadata must be configured to be enforced.
        #[arg(long, short)]
        metadata: Option<String>,
    },
    Credential {
        /// Unique identifier for this credential.
        /// Note: You can validate the credential to find it's id.
        id: Uuid,
        /// Whether to revoke this credential. Once revoked, the credential may no longer be used
        /// and may not be un-revoked.
        #[arg(long, short, action)]
        revoke: bool,
    },
}

#[derive(Subcommand)]
pub enum ValidateObject {
    ApiToken {
        /// Api token to validate
        token: String,
    },
    Passphrase {
        /// The username associated with this credential
        username: String,
        /// The secret passphrase for this credential
        passphrase: String,
    },
    Session {
        /// The secret token associated with this session.
        token: String,
    },
}

#[derive(Serialize, Deserialize)]
pub struct Config {
    pub profile: Vec<ConfigProfile>,
}

#[derive(Serialize, Deserialize)]
pub struct ConfigProfile {
    pub name: String,
    pub store: secd::AuthStore,
    pub store_conn: String,
    pub emailer: secd::AuthEmailMessenger,
    pub email_template_login: Option<String>,
    pub email_template_signup: Option<String>,
}

#[derive(Serialize, Deserialize)]
pub struct Validation {
    pub validation_id: Uuid,
    #[serde(skip_serializing_if = "Option::is_none")]
    pub oauth_auth_url: Option<String>,
    #[serde(skip_serializing_if = "Option::is_none")]
    pub note: Option<String>,
}

pub type ValidationSecretCode = String;