mesh-host/internal/apply/identities.go

package apply

import (
	"context"
	"errors"
	"fmt"
	"sort"
	"strconv"
	"strings"
	"time"

	"github.com/novox/mesh-host/internal/declaration"
	"github.com/novox/mesh-host/internal/store"
	"github.com/novox/mesh-host/internal/system"
)

// Every module is given an identity of its own (novox/hq ADR 0325 §3, §11, issue 567).
//
// The controller allocates each module a user and a group number once, from a range of its own, the same on every
// machine, and declares them as `mesh-<module>`. The engine makes the group and the account with exactly those
// numbers — a system account: no login shell, no home, no password — before anything of the declaration is
// applied, so a directory the module owns can be given to it and a container told to run as it.
//
// **Never root** (§11): a number that is 0, or a gid a root group has here (by its number and by its name), is
// refused for the whole declaration before anything is made or started, naming why — for an account and for an
// image alike. **Never another's**: a name that exists with other numbers, or numbers another name holds, is
// refused for that identity alone, naming whose, and its module is not attempted; the rest of the machine is.
//
// **What it made, and only that, goes** when the identity is no longer declared: the record says whether the
// engine made the account, the group or both, and an account or a group that was there before is never removed.

// accountsTool is how the engine reads and changes the machine's accounts: the system's own tools through the
// runner, which is what a test stands in for.
type accountsTool interface {
	CreateSystemAccount(ctx context.Context, run system.Runner, name string, uid, gid int) error
	CreateSystemGroup(ctx context.Context, run system.Runner, name string, gid int) error
	RemoveAccount(ctx context.Context, run system.Runner, name string) error
	RemoveGroup(ctx context.Context, run system.Runner, name string) error
}

// entry is one line the user or group database gives for a key: its name and its numbers.
type entry struct {
	name     string
	id, prim int
}

// lookUp asks the database (passwd or group) for key, a name or a number. Absent is (entry{}, false, nil); a
// database that does not answer is an error, never read as absent (system.LookUpUser's rule).
func lookUp(ctx context.Context, run Runner, database, key string) (entry, bool, error) {
	out, err := run(ctx, "getent", database, key)
	if err != nil {
		if code, ok := system.ExitCode(err); ok && code == 2 {
			return entry{}, false, nil
		}
		return entry{}, false, fmt.Errorf("the %s database did not answer about %s: %w", database, key, err)
	}
	fields := strings.Split(strings.TrimSpace(strings.SplitN(out, "\n", 2)[0]), ":")
	if len(fields) < 3 {
		return entry{}, false, fmt.Errorf("the %s database gave %q for %s", database, strings.TrimSpace(out), key)
	}
	e := entry{name: fields[0], prim: -1}
	if e.id, err = strconv.Atoi(fields[2]); err != nil {
		return entry{}, false, fmt.Errorf("the %s database gave %q for %s", database, strings.TrimSpace(out), key)
	}
	if database == "passwd" && len(fields) >= 4 {
		if e.prim, err = strconv.Atoi(fields[3]); err != nil {
			e.prim = -1
		}
	}
	return e, true, nil
}

// refuseRootIdentities is every identity and every container's run-as that is root's (§11), judged before
// anything of the declaration is applied: one is enough to refuse it whole, so nothing is made or started.
func refuseRootIdentities(d *declaration.Declaration) error {
	var problems []string
	for _, id := range d.Identities {
		if err := rootIdentity(id.UID, id.GID); err != nil {
			problems = append(problems, fmt.Sprintf("the identity %s: %v", id.Name, err))
		}
	}
	for _, r := range d.Resources {
		if c, ok := r.(*declaration.Container); ok && c.RunAs != nil {
			if err := rootIdentity(c.RunAs.UID, c.RunAs.GID); err != nil {
				problems = append(problems, fmt.Sprintf("the container %s is told to run as uid %d, gid %d: %v",
					c.ID, c.RunAs.UID, c.RunAs.GID, err))
			}
		}
	}
	if len(problems) == 0 {
		return nil
	}
	sort.Strings(problems)
	return fmt.Errorf("%s; nothing of this declaration was made or started", strings.Join(problems, "; "))
}

// applyIdentity makes one identity as declared, or refuses it naming whose the name or the numbers are. What it
// made is recorded on known; an identity already right is unchanged.
func applyIdentity(ctx context.Context, tool accountsTool, id declaration.Identity, known *store.State,
	run Runner) (Outcome, error) {
	out := Outcome{ID: "identity " + id.Name, Type: "identity", Target: id.Name, Action: "unchanged"}
	user, hasUser, err := lookUp(ctx, run, "passwd", id.Name)
	if err != nil {
		return out, err
	}
	group, hasGroup, err := lookUp(ctx, run, "group", id.Name)
	if err != nil {
		return out, err
	}
	byUID, uidUsed, err := lookUp(ctx, run, "passwd", strconv.Itoa(id.UID))
	if err != nil {
		return out, err
	}
	byGID, gidUsed, err := lookUp(ctx, run, "group", strconv.Itoa(id.GID))
	if err != nil {
		return out, err
	}
	const never = "; nothing was made, and nothing of the module was attempted (novox/hq ADR 0325 §3)"
	switch {
	case hasUser && (user.id != id.UID || user.prim != id.GID):
		return out, fmt.Errorf("the account %s is here with uid %d and group %d, and the mesh allocated uid %d, "+
			"gid %d%s", id.Name, user.id, user.prim, id.UID, id.GID, never)
	case hasGroup && group.id != id.GID:
		return out, fmt.Errorf("the group %s is here with gid %d, and the mesh allocated gid %d%s", id.Name,
			group.id, id.GID, never)
	case uidUsed && byUID.name != id.Name:
		return out, fmt.Errorf("uid %d is the account %s's here, and the mesh allocated it to %s%s", id.UID,
			byUID.name, id.Name, never)
	case gidUsed && byGID.name != id.Name:
		return out, fmt.Errorf("gid %d is the group %s's here, and the mesh allocated it to %s%s", id.GID,
			byGID.name, id.Name, never)
	}
	rec := madeIdentity(known, id.Name)
	rec.Module, rec.Name, rec.UID, rec.GID = id.Module, id.Name, id.UID, id.GID
	var made []string
	if !hasGroup {
		if err := tool.CreateSystemGroup(ctx, run, id.Name, id.GID); err != nil {
			return out, err
		}
		rec.MadeGroup = true
		made = append(made, fmt.Sprintf("the group (gid %d)", id.GID))
	}
	if !hasUser {
		if err := tool.CreateSystemAccount(ctx, run, id.Name, id.UID, id.GID); err != nil {
			recordIdentity(known, rec)
			return out, err
		}
		rec.MadeUser = true
		made = append(made, fmt.Sprintf("the account (uid %d), with no login, no home and no password", id.UID))
	}
	if rec.At.IsZero() {
		rec.At = time.Now().UTC()
	}
	recordIdentity(known, rec)
	if len(made) > 0 {
		out.Action, out.Detail = "created", "made "+strings.Join(made, " and ")
	} else {
		out.Detail = "here with its numbers"
	}
	return out, nil
}

// madeIdentity is what the engine recorded of name, or an empty record.
func madeIdentity(known *store.State, name string) store.MadeIdentity {
	for _, m := range known.Identities {
		if m.Name == name {
			return m
		}
	}
	return store.MadeIdentity{}
}

// recordIdentity records what was made of one identity, in place of any record before.
func recordIdentity(known *store.State, rec store.MadeIdentity) {
	for i, m := range known.Identities {
		if m.Name == rec.Name {
			known.Identities[i] = rec
			return
		}
	}
	if rec.MadeUser || rec.MadeGroup {
		known.Identities = append(known.Identities, rec)
	}
}

// removeIdentities removes what the engine made of every identity no longer declared — the account, then the
// group — and only while it still has the numbers the engine gave it. Never fatal: what could not be removed
// stays recorded, said, for the next apply.
func removeIdentities(ctx context.Context, tool accountsTool, declared []declaration.Identity, known *store.State,
	run Runner) []Outcome {
	wanted := map[string]bool{}
	for _, id := range declared {
		wanted[id.Name] = true
	}
	var out []Outcome
	var keep []store.MadeIdentity
	for _, m := range known.Identities {
		if wanted[m.Name] {
			keep = append(keep, m)
			continue
		}
		o := Outcome{ID: "identity " + m.Name, Type: "identity", Target: m.Name, Action: "removed"}
		var said []string
		if m.MadeUser {
			if u, has, err := lookUp(ctx, run, "passwd", m.Name); err != nil || (has && u.id != m.UID) {
				said = append(said, "the account was left: it no longer has the uid the mesh gave it, or the "+
					"database did not answer")
				m.MadeUser = false
			} else if has {
				if err := tool.RemoveAccount(ctx, run, m.Name); err != nil {
					said = append(said, "the account could not be removed: "+err.Error())
				} else {
					m.MadeUser = false
					said = append(said, "removed the account")
				}
			} else {
				m.MadeUser = false
			}
		}
		if m.MadeGroup && !m.MadeUser {
			if g, has, err := lookUp(ctx, run, "group", m.Name); err != nil || (has && g.id != m.GID) {
				said = append(said, "the group was left: it no longer has the gid the mesh gave it, or the "+
					"database did not answer")
				m.MadeGroup = false
			} else if has {
				if err := tool.RemoveGroup(ctx, run, m.Name); err != nil {
					said = append(said, "the group could not be removed: "+err.Error())
				} else {
					m.MadeGroup = false
					said = append(said, "removed the group")
				}
			} else {
				m.MadeGroup = false
			}
		}
		if m.MadeUser || m.MadeGroup {
			o.Action = "waiting"
			keep = append(keep, m)
		}
		o.Detail = "no longer declared: " + strings.Join(said, "; ")
		out = append(out, o)
	}
	known.Identities = keep
	return out
}

// toolFor is the accounts tool of a system, or why it has none.
func toolFor(sys system.System) (accountsTool, error) {
	if t, ok := sys.(accountsTool); ok {
		return t, nil
	}
	return nil, errors.New("this system makes no module identity: it has no way to make a system account")
}