path: root/crates/iam/src/api.rs

use crate::ISSUE_TRACKER_LOC;
use clap::{Parser, Subcommand, ValueEnum};
use colored::*;
use serde::{Deserialize, Serialize};
use thiserror;
use uuid::Uuid;

#[derive(Debug, thiserror::Error)]
pub enum CliError {
    #[error("{}", "iam failed to read a valid configuration profile. Initialize an iam store with `iam admin init`".red())]
    InvalidProfile,
    #[error("{} {}", "Failed to initialize secd: ".red(), .0.yellow())]
    SecdInitializationFailure(String),
    #[error("{} {}", "Fail to initialize an iam store.".red(), format!("An invariant was likely broken and should be reported as a bug here: {}", ISSUE_TRACKER_LOC))]
    AdminInitializationError,
    #[error("{} {}", "The provided validation id and code is invalid or has expired.".red(), "You may recieve at most one session with a valid code, after which a new validation is required.")]
    InvalidCode,
    #[error("{} {}", "An unknown error occurred.".red(), format!("An invariant was likely broken and should be reported as a bug here: {}", ISSUE_TRACKER_LOC))]
    Unknown,
}

#[derive(Parser)]
#[command(
    name = "iam",
    author = "benabel",
    version = "0.0.1",
    long_about = "SecD IAM\nIdentity and access management secured by secd and user controlled. Get started with `iam init`"
)]
pub struct Args {
    #[command(subcommand)]
    pub command: Command,
    /// IAM backend profile as defined in the iam config or as a connection string to an auth store.
    #[arg(long, short)]
    pub profile: Option<String>,
    /// The store type for the associated connection string
    #[arg(long, short)]
    pub store_type: Option<StoreType>,
    /// Connection string for the IAM store
    #[arg(long, short)]
    pub connection_string: Option<String>,
}

#[derive(Clone, ValueEnum)]
pub enum StoreType {
    Dynamo,
    Memory,
    Mysql,
    Postgres,
    Redis,
    Sqlite,
}

#[derive(Subcommand)]
pub enum Command {
    #[command(
        about = "Administrative actions for this IAM instance",
        long_about = "Admin\n\nAdministrative actions for this IAM instance. Each IAM instance is defined by the specified backend in the iam config or manually as an optional argument"
    )]
    Admin {
        #[command(subcommand)]
        action: AdminAction,
    },
    #[command(
        about = "Create a new IAM object which may be used to enforce authorization schemes.",
        long_about = "Create\n\nEntities which define the structure of an IAM instance. These entities may be rendered as an IAM graph, or within a web view, to more easily visualize and manipulate the IAM instance."
    )]
    Create {
        #[command(subcommand)]
        object: CreateObject,
    },
    #[command(
        about = "Get details for a specific IAM object",
        long_about = "Get\n\nGet details for a specific IAM object"
    )]
    Get {
        #[command(subcommand)]
        object: GetObject,
    },
    #[command(
        about = "Initialize an IAM store (alias for `iam admin init`)",
        long_about = "Init\n\nInitalize a new IAM admin store and save the store's configuration profile. This command is an alias for, and thus equiavlent to, `iam admin init`."
    )]
    Init {
        /// If true, interactively initialize an IAM store. Otherwise output a template config.
        #[arg(long, short, action)]
        interactive: bool,
    },
    #[command(
        about = "Link multiple IAM objects together",
        long_about = "Link\n\nCleave different IAM entities to create an IAM system."
    )]
    Link {
        #[command(subcommand)]
        object: LinkObject,
        /// Unlink the provided entities rather than link them.
        #[arg(long, short, action)]
        unlink: bool,
    },
    #[command(
        about = "List and filter IAM objects",
        long_about = "List\n\nPage through collections of IAM objects with optional filtering"
    )]
    Ls {
        #[command(subcommand)]
        object: ListObject,
        /// Regex filter for entity names
        #[arg(long, short)]
        name: Option<String>,
        /// Only fetch entities created after this time
        #[arg(long, short)]
        after: Option<i64>,
        /// Only fetch entities created before this time
        #[arg(long, short)]
        before: Option<i64>,
    },
    /// Start the iam repl to more easily interact with iam and its primitives
    Repl,
}

#[derive(Subcommand)]
pub enum AdminAction {
    /// Aliased as `iam init`
    Init {
        /// If true, interactively initialize an IAM store. Otherwise output a template config.
        #[arg(long, short, action)]
        interactive: bool,
    },
    /// Configure, describe, or rotate the default IAM store.
    Backend {
        #[command(subcommand)]
        action: AdminBackendAction,
    },
    /// Create a new administrative entity for an IAM store.
    Create {
        #[command(subcommand)]
        object: AdminObject,
    },
    /// Seal the configured IAM store to prevent administrative changes
    Seal,
    /// Unseal the configured IAM store to make administrative changes
    Unseal {
        /// The secret key used to seal this store
        secret_key: String,
    },
}

#[derive(Subcommand)]
pub enum AdminBackendAction {
    Configure {
        name: String,
        store: StoreType,
        connection: String,
    },
    Switch {
        name: String,
    },
}

#[derive(Subcommand)]
pub enum AdminObject {
    /// An email template used for IAM procedures, including identity validation
    EmailTemplate {
        template_type: EmailTemplateType,
        template: String,
    },
    /// A selected provider capable of sending email messages
    EmailProvider {
        provider: EmailProvider,
        secret_key: String,
        public_key: Option<String>,
    },
    /// A selected Oauth2.0 provider capable of authenticating identities
    OauthProvider {
        provider: OauthProvider,
        client_id: String,
        secret: String,
        redirect_uri: String,
    },
    /// A selected provider capable of sending SMS
    SmsProvider {
        provider: SmsProvider,
        secret_key: String,
        public_key: Option<String>,
    },
    /// A new secret which may be used to unseal the IAM store
    StoreSecret,
    /// A selected provider capable of sending automated voice messages
    VoiceProvider {
        provider: VoiceProvider,
        secret_key: String,
        public_key: Option<String>,
    },
}

#[derive(Clone, ValueEnum)]
pub enum EmailTemplateType {
    Login,
    SignUp,
}

#[derive(Clone, ValueEnum)]
pub enum EmailProvider {
    Custom,
    Mailgun,
    Sendgrid,
    Ses,
}

#[derive(Clone, ValueEnum)]
pub enum SmsProvider {
    AwsSns,
    Custom,
    Twilio,
}

#[derive(Clone, ValueEnum)]
pub enum VoiceProvider {
    Custom,
    Twilio,
}

#[derive(Subcommand)]
pub enum CreateObject {
    #[command(
        about = "A set of long-lived tokens which authorize an identity",
        long_about = "Api Keys\n\nApi keys are long lived identifiers which authenticate and authorize a identity. Keys have a public and private part,\nwhich may be shared and must be kept private, respectively. Unlike sessions, api keys may be long-lived (infinite) or\nset to expire within certain timeframes."
    )]
    ApiKey {
        /// Identity against which this api key will be linked
        identity: Uuid,
        /// Time this api key expires (epoch time)
        expires_at: Option<i64>,
    },
    #[command(
        about = "A collection of identities",
        long_about = "Group\n\nA group may be created to operate simultaneously against a collection of identities. An identity may be part of mutliple groups, but it may not be part of the same group more than once."
    )]
    Group {
        /// The unique name for this group
        name: String,
        /// An optional set of identities to link against this group
        identities: Vec<Uuid>,
    },
    #[command(
        about = "A collection of services and service actions",
        long_about = "Permission\n\nA permission may be created to operate simultaneously against a collection of services and service actions. A service or service action may be part of mutliple permissions, but it may not be part of the same permission more than once. A permission may be used when many services and service actions are linked and unlinked against a role."
    )]
    Permission {
        /// An optional set of services to link against this permission
        #[arg(long, short)]
        services: Vec<Uuid>,
        /// An optional set of service actions to link against this permission
        #[arg(long, short)]
        actions: Vec<Uuid>,
    },
    #[command(
        about = "A collection of permissions",
        long_about = "Role\n\nA role may be created to operate simultaneously against a collection of permissions. A permission may be part of mutliple roles, but it may not be part of the same role more than once. A role may be used when many entities (such as groups or identities) are linked and unlinked against many permissions."
    )]
    Role {
        /// The unique name for this role
        name: String,
        /// An optional set of permissions to link against this role
        permissions: Vec<Uuid>,
    },
    #[command(
        about = "An entity for which an action may be authorized",
        long_about = "Service\n\nA service is an atomic entity which requires authorization. While a service's authorization may be subdivided by service actions, a service represents a logical element of authorization separation."
    )]
    Service {
        /// The unique name for this service
        name: String,
        /// URI for this service which may be used to resolve authorization
        #[arg(long, short)]
        uri: Option<String>,
    },
    #[command(
        about = "A specific authorization action by a service",
        long_about = "Service Action\n\nA service action is a domain specific action which defines what an identity authorization within that service. A service action may be a simple boolean value or a more complex express which is evaluated at runtime. For example, a boolean action may be something like `can_read_salary_table`, and a more complex action may be `readable_table_rows(datetime)` which executes at runtime and returns a value (or list of values) the service may use to determine authorization. Service actions are used as an inversion of control pattern to ensure that services do not need to worry about specific authorization actions for identities. A service action is unnecessary if the service has no specific authorization logic."
    )]
    ServiceAction {
        /// The unique name for this service action
        name: String,
        /// Program executed for this service action
        #[arg(long, short)]
        program: Option<String>,
    },
    #[command(
        about = "A timebound token which authorizes an identity",
        long_about = "Session\n\nA session is an opaque timebound token which allows an identity to authorize against IAM services. The session may be created by providing a validation request id and secret challenge code"
    )]
    Session {
        /// The validation id associated with a non-expired valid validation
        #[arg(long, short)]
        validation_id: Uuid,
        /// The secret code associated with this validation.
        #[arg(long, short)]
        secret_code: String,
    },
    #[command(
        about = "An action which initiates an identity validation",
        long_about = "Validation\n\nA validation requires that the identity authenticate in some way, either by providing IAM managed credentials, an external gated mechanism (e.g. email, phone, or hardware key), or through a secondary authentication provider (oauth, saml, ldap, kerberos)."
    )]
    Validation {
        /// Method by which the validation will occur
        #[command(subcommand)]
        method: ValidationMethod,
        /// The identity against which to associate this validation. A new identity will be created if no identity is provided.
        #[arg(long, short)]
        identity: Option<Uuid>,
    },
}

#[derive(Subcommand)]
pub enum ValidationMethod {
    /// An email address to which the validation will be sent
    Email {
        /// Email address which will receive the validation
        address: String,
    },
    /// A hardware security key to associate with an identity
    HardwareKey,
    /// A kerberos ticket to associated with an identity
    Kerberos,
    /// An oauth2 provider to authenticate (and authorize) an identity
    Oauth2 {
        provider: OauthProvider,
        /// An optional scope to use for authorization
        scope: Option<String>,
    },
    /// A phone which an identity may authenticate via SMS or voice
    Phone {
        /// Whether to use a voice code. Otherwise, uses SMS
        #[arg(long, short, action)]
        use_voice: bool,
    },
    /// A saml provider to authenticate an identity
    Saml,
}

#[derive(Clone, ValueEnum)]
pub enum OauthProvider {
    Amazon,
    Apple,
    Dropbox,
    Facebook,
    Github,
    Gitlab,
    Google,
    Instagram,
    LinkedIn,
    Microsoft,
    Paypal,
    Reddit,
    Spotify,
    Strava,
    Stripe,
    Twitch,
    Twitter,
    WeChat,
}

#[derive(Subcommand)]
pub enum GetObject {
    ApiKey {
        /// Public key associated with this api key set
        public_key: String,
    },
    Group {
        /// Unique group name
        name: String,
        /// Unique group id
        #[arg(long, short)]
        id: Option<Uuid>,
    },
    Identity {
        /// Unique identity id
        id: Uuid,
    },
    Permission {
        /// Unique permission name
        name: String,
        /// Unique permission id
        #[arg(long, short)]
        id: Option<Uuid>,
    },
    Role {
        /// Unique role name
        name: String,
        /// Unique role id
        #[arg(long, short)]
        id: Option<Uuid>,
    },
    Session {
        /// The plaintext token which uniquely identifies the session
        secret: String,
    },
    Service {
        /// Unique service name
        name: String,
        /// Unique service id
        #[arg(long, short)]
        id: Option<Uuid>,
    },
    ServiceAction {
        /// Unique service action name
        name: String,
        /// Unique service action id
        #[arg(long, short)]
        id: Option<Uuid>,
    },
    Validation {
        /// Unique validation request id
        id: Uuid,
    },
}

#[derive(Subcommand)]
pub enum LinkObject {
    Group {
        group_name: String,
        #[arg(short, long, alias = "id")]
        group_id: Option<Uuid>,

        identity_ids: Vec<Uuid>,
    },
    Identity {
        identity_id: Uuid,

        group_names: Vec<String>,
        #[arg(long)]
        group_ids: Vec<Uuid>,
    },
    Permission {
        permission_name: String,
        #[arg(short, long, alias = "id")]
        permission_id: Option<Uuid>,

        role_names: Vec<String>,
        #[arg(long)]
        role_ids: Vec<Uuid>,
    },
    Role {
        role_name: String,
        #[arg(short, long, alias = "id")]
        role_id: Option<Uuid>,

        permission_names: Vec<String>,
        #[arg(long)]
        permission_ids: Vec<Uuid>,
    },
    Service {
        service_name: String,
        #[arg(short, long, alias = "id")]
        service_id: Option<Uuid>,

        permission_names: Vec<String>,
        #[arg(long)]
        permission_ids: Vec<Uuid>,
    },
    ServiceAction {
        service_action_name: String,
        #[arg(short, long, alias = "id")]
        service_action_id: Option<Uuid>,

        service_name: Vec<String>,
        #[arg(long)]
        service_ids: Vec<Uuid>,
    },
}

#[derive(Subcommand)]
pub enum ListObject {
    ApiKey,
    Group,
    Identity,
    Permission,
    Role,
    Session,
    Service,
    ServiceAction,
    Validation,
}

#[derive(Serialize, Deserialize)]
pub struct Config {
    pub profile: Vec<ConfigProfile>,
}

#[derive(Serialize, Deserialize)]
pub struct ConfigProfile {
    pub name: String,
    pub store: secd::AuthStore,
    pub store_conn: String,
    pub emailer: secd::AuthEmail,
    pub email_template_login: Option<String>,
    pub email_template_signup: Option<String>,
}