ensureServiceUser

#! /usr/bin/env node

// TODO
// - deduplicate with Vault's seed script at https://github.com/scality/Vault/pull/1627
// - add permission boundaries to user when https://scality.atlassian.net/browse/VAULT-4 is implemented
const fs = require('fs');

const { errors, errorUtils } = require('arsenal');
const { program } = require('commander');
const werelogs = require('werelogs');
const version = require('../package.json').version;
const async = require('async');
const { IAMClient, GetUserCommand, CreateUserCommand, ListPoliciesCommand, CreatePolicyCommand,
        ListAttachedUserPoliciesCommand, AttachUserPolicyCommand, GetRoleCommand, CreateRoleCommand,
        ListAttachedRolePoliciesCommand, AttachRolePolicyCommand, ListAccessKeysCommand, CreateAccessKeyCommand,
        NoSuchEntityException,
} = require('@aws-sdk/client-iam');
const { STSClient, GetCallerIdentityCommand } = require('@aws-sdk/client-sts');

const systemPrefix = '/scality-internal/';

function generateUserAssumeRolePolicyDocument(roleName, targetAccount) {
    return {
        Version: '2012-10-17',
        Statement: {
            Effect: 'Allow',
            Action: 'sts:AssumeRole',
            Resource: `arn:aws:iam::${targetAccount}:role${systemPrefix}${roleName}`,
        }
    };
}

function generateRoleTrustPolicyDocument(userArn) {
    return {
        Version: '2012-10-17',
        Statement: [
          {
            Effect: 'Allow',
            Principal: {
              AWS: userArn,
            },
            Action: 'sts:AssumeRole',
            Condition: {}
          }
        ]
     };
}

function createIAMClient(opts) {
    return new IAMClient({
        endpoint: opts.iamEndpoint,
        region: opts.region,
    });
}

function createSTSClient(opts) {
    return new STSClient({
        endpoint: opts.stsEndpoint,
        region: opts.region,
    });
}

function needsCreation(v) {
    if (Array.isArray(v)) {
        return !v.length;
    }

    return !v;
}

class BaseHandler {
    constructor(serviceName, iamClient, log, options) {
        this.serviceName = serviceName;
        this.iamClient = iamClient;
        this.log = log;
        this.options = options || {};
        this.name = this.options.name;
        this.resourceTypeSuffix = this.name ? `_${this.name}` : '';
        this.resourceNameSuffix = this.name ? `-${this.name}` : '';
        this.resourceName = `${this.serviceName}${this.resourceNameSuffix}`;
        this.stsClient = this.options.stsClient;
    }

    get fqResourceType() {
        return `${this.resourceType}${this.resourceTypeSuffix}`;
    }

    applyWaterfall(values, done) {
        this.log.debug('applyWaterfall', { values, type: this.fqResourceType });

        const v = values[this.fqResourceType];

        if (needsCreation(v)) {
            this.log.debug('creating', { v, type: this.fqResourceType });
            return this.create(values)
                .then(res =>
                    done(null, Object.assign(values, {
                        [this.fqResourceType]: res,
                    })))
                .catch(done);
        }

        this.log.debug('conflicts check', { v, type: this.fqResourceType });
        if (this.conflicts(v)) {
            return done(errors.EntityAlreadyExists.customizeDescription(
                `${this.fqResourceType} ${this.serviceName} already exists and conflicts with the expected value.`));
        }

        this.log.debug('nothing to do', { v, type: this.fqResourceType });
        return done(null, values);
    }
}

class UserHandler extends BaseHandler {
    get resourceType() {
        return 'user';
    }

    async collect() {
        const command = new GetUserCommand({
            UserName: this.resourceName,
        });
        const res = await this.iamClient.send(command);
        return res.User;
    }

    async create(allResources) {
        const command = new CreateUserCommand({
            UserName: this.resourceName,
            Path: systemPrefix,
        });
        const res = await this.iamClient.send(command);
        return res.User;
    }

    conflicts(u) {
        return u.Path !== systemPrefix;
    }
}

class PolicyHandler extends BaseHandler {
    get resourceType() {
        return 'policy';
    }

    async collect() {
        const command = new ListPoliciesCommand({
            MaxItems: 100,
            OnlyAttached: false,
            Scope: 'All',
        });
        const res = await this.iamClient.send(command);
        return res.Policies.find(p => p.PolicyName === this.resourceName);
    }

    async create(allResources) {
        let accountId;
        
        if (!this.options.constrainToThisAccount) {
            accountId = '*';
        } else {
            try {
                const command = new GetCallerIdentityCommand({});
                const res = await this.stsClient.send(command);
                accountId = res.Account;
            } catch (err) {
                this.log.error('failed to get caller identity', {
                    error: errorUtils.reshapeExceptionError(err),
                });
                throw err;
            }
        }

        const policyDocument = this.options.policy || 
            generateUserAssumeRolePolicyDocument(this.serviceName, accountId);
        
        const command = new CreatePolicyCommand({
            PolicyName: this.resourceName,
            PolicyDocument: JSON.stringify(policyDocument),
            Path: systemPrefix,
        });
        
        const res = await this.iamClient.send(command);
        return res.Policy;
    }

    conflicts(p) {
        return p.Path !== systemPrefix;
    }
}

class RoleHandler extends BaseHandler {
    get resourceType() {
        return 'role';
    }

    async collect() {
        const command = new GetRoleCommand({
            RoleName: this.resourceName,
        });
        const res = await this.iamClient.send(command);
        return res.Role;
    }

    async create(allResources) {
        const trustPolicy = generateRoleTrustPolicyDocument(allResources.user.Arn);

        const command = new CreateRoleCommand({
            RoleName: this.resourceName,
            Path: systemPrefix,
            AssumeRolePolicyDocument: JSON.stringify(trustPolicy),
        });
        
        const res = await this.iamClient.send(command);
        return res.Role;
    }

    conflicts(p) {
        return p.Path !== systemPrefix;
    }
}

class PolicyUserAttachmentHandler extends BaseHandler {
    get resourceType() {
        return 'policyAttachment';
    }

    async collect() {
        const command = new ListAttachedUserPoliciesCommand({
            UserName: this.resourceName,
            MaxItems: 100,
        });
        const res = await this.iamClient.send(command);
        return res.AttachedPolicies;
    }

    async create(allResources) {
        const command = new AttachUserPolicyCommand({
            PolicyArn: allResources.policy_user.Arn,
            UserName: this.resourceName,
        });
        await this.iamClient.send(command);
    }

    conflicts(p) {
        return false;
    }
}

class PolicyRoleAttachmentHandler extends BaseHandler {
    get resourceType() {
        return 'policyRoleAttachment';
    }

    async collect() {
        const command = new ListAttachedRolePoliciesCommand({
            RoleName: this.resourceName,
            MaxItems: 100,
        });
        const res = await this.iamClient.send(command);
        return res.AttachedPolicies;
    }

    async create(allResources) {
        const command = new AttachRolePolicyCommand({
            PolicyArn: allResources.policy_role.Arn,
            RoleName: this.resourceName,
        });
        await this.iamClient.send(command);
    }

    conflicts(p) {
        return false;
    }
}

class AccessKeyHandler extends BaseHandler {
    get resourceType() {
        return 'accessKey';
    }

    async collect() {
        const command = new ListAccessKeysCommand({
            UserName: this.resourceName,
            MaxItems: 100,
        });
        const res = await this.iamClient.send(command);
        return res.AccessKeyMetadata;
    }

    async create(allResources) {
        const command = new CreateAccessKeyCommand({
            UserName: this.resourceName,
        });
        const res = await this.iamClient.send(command);
        return res.AccessKey;
    }

    conflicts(a) {
        return false;
    }
}

function collectResource(v, done) {
    v.collect()
        .then(res => done(null, res))
        .catch(err => {
            if (err instanceof NoSuchEntityException) {
                return done(null, null);
            }
            done(err);
        });
}

function collectResourcesFromHandlers(handlers, cb) {
    const tasks = handlers.reduce((acc, v) => ({
        [v.fqResourceType]: done => collectResource(v, done),
        ...acc,
    }), {});
    async.parallel(tasks, cb);
}

function buildServiceUserForCrossAccountAssumeRoleHandlers(serviceName, client, log) {
    return [
        new UserHandler(serviceName, client, log),
        new PolicyHandler(serviceName, client, log, {
            name: 'user',
            policy: generateUserAssumeRolePolicyDocument(serviceName, '*'),
        }),
        new PolicyUserAttachmentHandler(serviceName, client, log),
        new AccessKeyHandler(serviceName, client, log),
    ];
}

function buildServiceUserForInAccountAssumeRoleHandlers(serviceName, policy, iamClient, stsClient, log) {
    return [
        // try permission policy first so that the waterfall
        // fails early if it contains forbidden actions
        new PolicyHandler(serviceName, iamClient, log, {
            policy,
            name: 'role',
        }),
        new UserHandler(serviceName, iamClient, log),
        new PolicyHandler(serviceName, iamClient, log, {
            stsClient,
            name: 'user',
            constrainToThisAccount: true,
        }),
        new PolicyUserAttachmentHandler(serviceName, iamClient, log),
        new RoleHandler(serviceName, iamClient, log),
        new PolicyRoleAttachmentHandler(serviceName, iamClient, log),
        new AccessKeyHandler(serviceName, iamClient, log),
    ];
}

function apply(iamClient, stsClient, serviceName, policyFile, log, cb) {
    let handlers;

    if (policyFile) {
        const policyStr = fs.readFileSync(policyFile);
        const policy = JSON.parse(policyStr);
        handlers = buildServiceUserForInAccountAssumeRoleHandlers(serviceName, policy, iamClient, stsClient, log);
    } else {
        handlers = buildServiceUserForCrossAccountAssumeRoleHandlers(serviceName, iamClient, log);
    }

    async.waterfall([
        done => collectResourcesFromHandlers(handlers, done),
        ...handlers.map(h => h.applyWaterfall.bind(h)),
        (values, done) => done(null, values.accessKey),
    ], cb);
}

function wrapAction(actionFunc, serviceName, _, cmd) {
    const options = cmd.optsWithGlobals();

    werelogs.configure({
        level: options.logLevel,
        dump: options.logDumpLevel,
    });

    const log = new werelogs.Logger(process.argv[1]).newRequestLogger();
    const iamClient = createIAMClient(options);
    const stsClient = createSTSClient(options);

    actionFunc(iamClient, stsClient, serviceName, options.policy, log, (err, data) => {
        if (err) {
            log.error('failed', {
                data,
                error: errorUtils.reshapeExceptionError(err),
            });
            if (err.EntityAlreadyExists) {
                log.error(`run "${process.argv[1]} purge ${serviceName}" to fix.`);
            }
            process.exit(1);
        }
        log.info('success', { data });
        process.exit();
    });
}

program.version(version);

program
    .option('--iam-endpoint <url>', 'IAM endpoint', 'http://localhost:8600')
    .option('--sts-endpoint <url>', 'STS endpoint', 'http://localhost:8800')
    .option('--region <region>', 'AWS region', 'us-east-1')
    .option('--log-level <level>', 'log level', 'info')
    .option('--log-dump-level <level>', 'log level that triggers a dump of the debug buffer', 'error');

program
    .command('apply <service-name>')
    .option('-p, --policy <policy-file.json>', 'Create a policy using the provided document' +
        ' and attach it to a role that the service user is allowed to assume, instead' +
        ' of only allowing the user to assume one (seeded) role named <service-name> in all accounts.')
    .action(wrapAction.bind(null, apply));

const validCommands = program.commands.map(n => n._name);

// Is the command given invalid or are there too few arguments passed
if (!validCommands.includes(process.argv[2])) {
    program.outputHelp();
    process.stdout.write('\n');
    process.exit(1);
} else {
    program.parse(process.argv);
}