versitygw/iamapi/storage/storer.go

// Copyright 2026 Versity Software
// This file is licensed under the Apache License, Version 2.0
// (the "License"); you may not use this file except in compliance
// with the License.  You may obtain a copy of the License at
//
//   http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing,
// software distributed under the License is distributed on an
// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
// KIND, either express or implied.  See the License for the
// specific language governing permissions and limitations
// under the License.

package storage

import (
	"context"
	"errors"
	"fmt"
	"strings"
	"time"

	"github.com/versity/versitygw/iamapi/iamerr"
	"github.com/versity/versitygw/iamapi/types"
)

// MaxAccessKeysPerUser is the maximum number of access keys a single IAM
// user may hold at once, matching the AWS IAM quota.
const MaxAccessKeysPerUser = 2

// MaxInlinePolicyBytesPerUser is the maximum aggregate size, in bytes, of
// all of a single IAM user's inline policy documents combined
const MaxInlinePolicyBytesPerUser = 2048

// MaxInlinePolicyBytesPerRole is the maximum aggregate size, in bytes, of
// all of a single IAM role's inline policy documents combined
const MaxInlinePolicyBytesPerRole = 10240

// MaxClientIDsPerOIDCProvider is the maximum number of client IDs a single
// OIDC provider may hold at once
const MaxClientIDsPerOIDCProvider = 100

// MaxOIDCProvidersPerAccount is the maximum number of OIDC providers a
// single account may hold
const MaxOIDCProvidersPerAccount = 100

// MaxActiveSessionsPerRole bounds how many currently-unexpired
// AssumeRoleWithWebIdentity sessions a single role may have at once.
// AWS manages and rate-limits STS as a hosted service with no
// customer-visible equivalent quota to match for fidelity; this exists
// purely as local resource protection, since without it a single valid
// federated token can be replayed indefinitely to grow the session
// store — every InternalStore rewrite, or Vault KV path/metadata entry —
// without bound. Chosen generously enough to not constrain any legitimate
// workload's concurrent session count.
//
// A var, not a const, so tests can temporarily lower it rather than paying
// the cost of actually creating 1000 sessions to exercise the cap.
var MaxActiveSessionsPerRole = 1000

var (
	ErrUserIDAlreadyExists      = errors.New("iamapi: user id already exists")
	ErrAccessKeyIDAlreadyExists = errors.New("iamapi: access key id already exists")
	ErrRoleIDAlreadyExists      = errors.New("iamapi: role id already exists")
	// ErrSessionNotFound is returned by GetSession when accessKeyID names no
	// session, or names one whose Expiration has already passed.
	ErrSessionNotFound = errors.New("iamapi: session not found")
)

type ListUsersInput struct {
	PathPrefix string
	Marker     string
	MaxItems   int32
}

type ListUsersOutput struct {
	Users       []types.User
	IsTruncated bool
	Marker      string
}

type UpdateUserInput struct {
	UserName    string
	NewPath     string
	NewUserName string
	NewArn      string
}

type CreateAccessKeyInput struct {
	UserName        string
	AccessKeyID     string
	SecretAccessKey string
	Status          string
	CreateDate      time.Time
}

type UpdateAccessKeyInput struct {
	UserName    string
	AccessKeyID string
	Status      string
}

type ListAccessKeysInput struct {
	UserName string
	Marker   string
	MaxItems int32
}

type ListAccessKeysOutput struct {
	AccessKeys  []types.AccessKeyMetadata
	IsTruncated bool
	Marker      string
}

type GetAccessKeyLastUsedOutput struct {
	UserName     string
	LastUsedDate time.Time
	ServiceName  string
	Region       string
}

type PutUserPolicyInput struct {
	UserName       string
	PolicyName     string
	PolicyDocument string
}

type ListUserPoliciesInput struct {
	UserName string
	Marker   string
	MaxItems int32
}

type ListUserPoliciesOutput struct {
	PolicyNames []string
	IsTruncated bool
	Marker      string
}

type ListRolesInput struct {
	PathPrefix string
	Marker     string
	MaxItems   int32
}

type ListRolesOutput struct {
	Roles       []types.Role
	IsTruncated bool
	Marker      string
}

type UpdateAssumeRolePolicyInput struct {
	RoleName       string
	PolicyDocument string
}

type PutRolePolicyInput struct {
	RoleName       string
	PolicyName     string
	PolicyDocument string
}

type ListRolePoliciesInput struct {
	RoleName string
	Marker   string
	MaxItems int32
}

type ListRolePoliciesOutput struct {
	PolicyNames []string
	IsTruncated bool
	Marker      string
}

type ListOIDCProvidersOutput struct {
	Providers []types.OpenIDConnectProviderListEntry
}

// Storer is the IAM API storage backend contract.
type Storer interface {
	CreateUser(ctx context.Context, user types.User) (*types.User, error)
	DeleteUser(ctx context.Context, username string) error
	GetUser(ctx context.Context, username string) (*types.User, error)
	GetUserByAccessKeyID(ctx context.Context, accessKeyID string) (*types.User, error)
	ListUsers(ctx context.Context, input ListUsersInput) (*ListUsersOutput, error)
	UpdateUser(ctx context.Context, input UpdateUserInput) (*types.User, error)

	CreateAccessKey(ctx context.Context, input CreateAccessKeyInput) (*types.AccessKey, error)
	UpdateAccessKey(ctx context.Context, input UpdateAccessKeyInput) error
	DeleteAccessKey(ctx context.Context, username, accessKeyID string) error
	GetAccessKeyLastUsed(ctx context.Context, accessKeyID string) (*GetAccessKeyLastUsedOutput, error)
	ListAccessKeys(ctx context.Context, input ListAccessKeysInput) (*ListAccessKeysOutput, error)
	// RecordAccessKeyUsage updates accessKeyID's GetAccessKeyLastUsed
	// metadata (service, region, and timestamp) to reflect a successful
	// authentication at when. Called best-effort/asynchronously by the auth
	// middleware, so implementations should treat a lost update under
	// concurrent use as acceptable rather than something worth retrying hard.
	RecordAccessKeyUsage(ctx context.Context, accessKeyID, service, region string, when time.Time) error

	PutUserPolicy(ctx context.Context, input PutUserPolicyInput) error
	GetUserPolicy(ctx context.Context, userName, policyName string) (*types.PolicyEntry, error)
	DeleteUserPolicy(ctx context.Context, userName, policyName string) error
	ListUserPolicies(ctx context.Context, input ListUserPoliciesInput) (*ListUserPoliciesOutput, error)

	CreateRole(ctx context.Context, role types.Role) (*types.Role, error)
	GetRole(ctx context.Context, roleName string) (*types.Role, error)
	ListRoles(ctx context.Context, input ListRolesInput) (*ListRolesOutput, error)
	DeleteRole(ctx context.Context, roleName string) error
	UpdateAssumeRolePolicy(ctx context.Context, input UpdateAssumeRolePolicyInput) (*types.Role, error)

	PutRolePolicy(ctx context.Context, input PutRolePolicyInput) error
	GetRolePolicy(ctx context.Context, roleName, policyName string) (*types.PolicyEntry, error)
	DeleteRolePolicy(ctx context.Context, roleName, policyName string) error
	ListRolePolicies(ctx context.Context, input ListRolePoliciesInput) (*ListRolePoliciesOutput, error)

	// OIDC Provider CRUD
	CreateOIDCProvider(ctx context.Context, provider types.OIDCProvider) (*types.OIDCProvider, error)
	GetOIDCProvider(ctx context.Context, arn string) (*types.OIDCProvider, error)
	ListOIDCProviders(ctx context.Context) (*ListOIDCProvidersOutput, error)
	DeleteOIDCProvider(ctx context.Context, arn string) error
	AddClientIDToOIDCProvider(ctx context.Context, arn, clientID string) error
	RemoveClientIDFromOIDCProvider(ctx context.Context, arn, clientID string) error
	UpdateOIDCProviderThumbprint(ctx context.Context, arn string, thumbprints []string) error

	CreateSession(ctx context.Context, session types.Session) (*types.Session, error)
	GetSession(ctx context.Context, accessKeyID string) (*types.Session, error)
}

func unwrapAPIError(err error) error {
	var apiErr iamerr.APIError
	if errors.As(err, &apiErr) {
		return apiErr
	}

	return err
}

type Config struct {
	Dir   string
	Vault VaultConfig
}

func New(cfg Config) (Storer, error) {
	dir := strings.TrimSpace(cfg.Dir)
	vaultEndpoint := strings.TrimSpace(cfg.Vault.EndpointURL)

	selected := make([]string, 0, 2)
	if dir != "" {
		selected = append(selected, "dir")
	}
	if vaultEndpoint != "" {
		selected = append(selected, "vault")
	}

	switch len(selected) {
	case 0:
		return nil, fmt.Errorf("no IAM storer config specified")
	case 1:
	default:
		return nil, fmt.Errorf("multiple IAM storer configs specified: %s", strings.Join(selected, ", "))
	}

	switch {
	case dir != "":
		store, err := NewInternal(dir)
		if err != nil {
			return nil, fmt.Errorf("init internal IAM storer: %w", err)
		}
		return store, nil
	case vaultEndpoint != "":
		store, err := NewVault(cfg.Vault)
		if err != nil {
			return nil, fmt.Errorf("init vault IAM storer: %w", err)
		}
		return store, nil
	default:
		return nil, fmt.Errorf("no IAM storer config specified")
	}
}