resource.go

package roleassignments

import (
	"context"
	"errors"
	"fmt"
	"net/http"
	"strings"
	"time"

	"github.com/hashicorp/terraform-plugin-framework/path"
	"github.com/hashicorp/terraform-plugin-framework/resource"
	"github.com/hashicorp/terraform-plugin-framework/resource/schema"
	"github.com/hashicorp/terraform-plugin-framework/resource/schema/planmodifier"
	"github.com/hashicorp/terraform-plugin-framework/resource/schema/stringplanmodifier"
	"github.com/hashicorp/terraform-plugin-framework/schema/validator"
	"github.com/hashicorp/terraform-plugin-framework/types"
	"github.com/hashicorp/terraform-plugin-log/tflog"
	"github.com/stackitcloud/stackit-sdk-go/core/oapierror"
	"github.com/stackitcloud/stackit-sdk-go/services/authorization"
	"github.com/stackitcloud/terraform-provider-stackit/stackit/internal/conversion"
	"github.com/stackitcloud/terraform-provider-stackit/stackit/internal/core"
	"github.com/stackitcloud/terraform-provider-stackit/stackit/internal/features"
	authorizationUtils "github.com/stackitcloud/terraform-provider-stackit/stackit/internal/services/authorization/utils"
	"github.com/stackitcloud/terraform-provider-stackit/stackit/internal/utils"
	"github.com/stackitcloud/terraform-provider-stackit/stackit/internal/validate"
)

// List of permission assignments targets in form [TF resource name]:[api name]
var roleTargets = []string{
	"project",
	"organization",
	"folder",
	"service-account",
}

// Ensure the implementation satisfies the expected interfaces.
var (
	_ resource.Resource                = &roleAssignmentResource{}
	_ resource.ResourceWithConfigure   = &roleAssignmentResource{}
	_ resource.ResourceWithImportState = &roleAssignmentResource{}

	errRoleAssignmentNotFound       = errors.New("response members did not contain expected role assignment")
	errRoleAssignmentDuplicateFound = errors.New("found a duplicate role assignment")
)

type Model struct {
	Id         types.String `tfsdk:"id"` // needed by TF
	ResourceId types.String `tfsdk:"resource_id"`
	Role       types.String `tfsdk:"role"`
	Subject    types.String `tfsdk:"subject"`
}

// NewRoleAssignmentResources is a helper function to simplify the provider implementation.
func NewRoleAssignmentResources() []func() resource.Resource {
	resources := make([]func() resource.Resource, 0)
	for _, v := range roleTargets {
		resources = append(resources, func() resource.Resource {
			return &roleAssignmentResource{
				apiName: v,
			}
		})
	}
	return resources
}

// roleAssignmentResource is the resource implementation.
type roleAssignmentResource struct {
	authorizationClient *authorization.APIClient
	apiName             string
}

// Metadata returns the resource type name.
func (r *roleAssignmentResource) Metadata(_ context.Context, req resource.MetadataRequest, resp *resource.MetadataResponse) {
	resp.TypeName = fmt.Sprintf("%s_authorization_%s_role_assignment", req.ProviderTypeName, strings.ReplaceAll(r.apiName, "-", "_"))
}

// Configure adds the provider configured client to the resource.
func (r *roleAssignmentResource) Configure(ctx context.Context, req resource.ConfigureRequest, resp *resource.ConfigureResponse) {
	providerData, ok := conversion.ParseProviderData(ctx, req.ProviderData, &resp.Diagnostics)
	if !ok {
		return
	}

	features.CheckExperimentEnabled(ctx, &providerData, features.IamExperiment, fmt.Sprintf("stackit_authorization_%s_role_assignment", r.apiName), core.Resource, &resp.Diagnostics)
	if resp.Diagnostics.HasError() {
		return
	}

	apiClient := authorizationUtils.ConfigureClient(ctx, &providerData, &resp.Diagnostics)
	if resp.Diagnostics.HasError() {
		return
	}
	r.authorizationClient = apiClient
	tflog.Info(ctx, fmt.Sprintf("Resource Manager %s Role Assignment client configured", r.apiName))
}

// Schema defines the schema for the resource.
func (r *roleAssignmentResource) Schema(_ context.Context, _ resource.SchemaRequest, resp *resource.SchemaResponse) {
	// Capitalize the first letter for display (e.g. "Project", "Service-account")
	resourceTitle := fmt.Sprintf("%s%s", strings.ToUpper(r.apiName[:1]), strings.ToLower(r.apiName[1:]))

	descriptionText := fmt.Sprintf("%s Role Assignment resource schema.", resourceTitle)

	// Append specific use case note for service-account
	if r.apiName == "service-account" {
		descriptionText = fmt.Sprintf(
			"%s\n\n~> **Important:** Use this resource to grant 'Act-As' permissions. "+
				"This allows a service-account (the `subject`) to impersonate the target Service Account. "+
				"A common example is authorizing the SKE Service Account to act as a project-specific Service Account to access APIs.",
			descriptionText,
		)
	}

	descriptions := map[string]string{
		"main":        features.AddExperimentDescription(descriptionText, features.IamExperiment, core.Resource),
		"id":          "Terraform's internal resource identifier. It is structured as \"`resource_id`,`role`,`subject`\".",
		"resource_id": fmt.Sprintf("%s Resource to assign the role to.", resourceTitle),
		"role":        "Role to be assigned. Available roles can be queried using stackit-cli: `stackit curl https://authorization.api.stackit.cloud/v2/permissions`",
		"subject":     "Identifier of user, service account or client. Usually email address or name in case of clients. All letters must be lowercased.",
	}

	resp.Schema = schema.Schema{
		Description: descriptions["main"],
		Attributes: map[string]schema.Attribute{
			"id": schema.StringAttribute{
				Description: descriptions["id"],
				Computed:    true,
				PlanModifiers: []planmodifier.String{
					stringplanmodifier.UseStateForUnknown(),
				},
			},
			"resource_id": schema.StringAttribute{
				Description: descriptions["resource_id"],
				Required:    true,
				PlanModifiers: []planmodifier.String{
					stringplanmodifier.RequiresReplace(),
				},
				Validators: []validator.String{
					validate.UUID(),
					validate.NoSeparator(),
				},
			},
			"role": schema.StringAttribute{
				Description: descriptions["role"],
				Required:    true,
				PlanModifiers: []planmodifier.String{
					stringplanmodifier.RequiresReplace(),
				},
			},
			"subject": schema.StringAttribute{
				Description: descriptions["subject"],
				Required:    true,
				Validators: []validator.String{
					validate.IsLowercased(),
				},
				PlanModifiers: []planmodifier.String{
					stringplanmodifier.RequiresReplace(),
				},
			},
		},
	}
}

// Create creates the resource and sets the initial Terraform state.
func (r *roleAssignmentResource) Create(ctx context.Context, req resource.CreateRequest, resp *resource.CreateResponse) { // nolint:gocritic // function signature required by Terraform
	var model Model
	diags := req.Plan.Get(ctx, &model)
	resp.Diagnostics.Append(diags...)
	if resp.Diagnostics.HasError() {
		return
	}

	ctx = core.InitProviderContext(ctx)
	ctx = tflog.SetField(ctx, "subject", model.Subject.ValueString())
	ctx = tflog.SetField(ctx, "role", model.Role.ValueString())
	ctx = tflog.SetField(ctx, "resource_type", r.apiName)

	lockKey := fmt.Sprintf("%s,%s,%s",
		model.ResourceId.ValueString(),
		model.Role.ValueString(),
		model.Subject.ValueString(),
	)

	// Terraform executes resources in parallel. If two resources define the same
	// role assignment, they create a "Check-Then-Act" race condition:
	// 1. Thread A creates -> Success
	// 2. Thread B creates -> Duplicate Error
	// This lock forces Thread B to wait until Thread A completes, allowing
	// the subsequent duplicate check to correctly find the existing assignment.
	unlock := authorizationUtils.LockAssignment(lockKey)
	defer unlock()

	listMemberResp, err := r.authorizationClient.ListMembers(ctx, r.apiName, model.ResourceId.ValueString()).Subject(model.Subject.ValueString()).Execute()
	if err != nil {
		core.LogAndAddError(ctx, &resp.Diagnostics, "Error listing current resource members", fmt.Sprintf("Calling API: %v", err))
		return
	}

	if err := checkDuplicate(model, listMemberResp); err != nil {
		core.LogAndAddError(ctx, &resp.Diagnostics, "Error while checking for duplicate role assignments", err.Error())
		return
	}

	// Create new project role assignment
	payload, err := toCreatePayload(&model, &r.apiName)
	if err != nil {
		core.LogAndAddError(ctx, &resp.Diagnostics, "Error creating credential", fmt.Sprintf("Creating API payload: %v", err))
		return
	}

	createResp, err := r.authorizationClient.AddMembers(ctx, model.ResourceId.ValueString()).AddMembersPayload(*payload).Execute()
	if err != nil {
		core.LogAndAddError(ctx, &resp.Diagnostics, fmt.Sprintf("Error creating %s role assignment", r.apiName), fmt.Sprintf("Calling API: %v", err))
		return
	}

	listMembersResponse, err := authorizationUtils.TypeConverter[authorization.ListMembersResponse](createResp)
	if err != nil {
		core.LogAndAddError(ctx, &resp.Diagnostics, fmt.Sprintf("Error creating %s role assignment", r.apiName), fmt.Sprintf("Processing API payload: %v", err))
		return
	}

	ctx = core.LogResponse(ctx)

	err = mapListMembersResponse(listMembersResponse, &model)
	if err != nil {
		core.LogAndAddError(ctx, &resp.Diagnostics, fmt.Sprintf("Error creating %s role assignment", r.apiName), fmt.Sprintf("Processing API payload: %v", err))
		return
	}

	diags = resp.State.Set(ctx, model)
	resp.Diagnostics.Append(diags...)
	if resp.Diagnostics.HasError() {
		return
	}

	// safety sleep due to api cache
	time.Sleep(1 * time.Second)

	tflog.Info(ctx, fmt.Sprintf("%s role assignment created", r.apiName))
}

// Read refreshes the Terraform state with the latest data.
func (r *roleAssignmentResource) Read(ctx context.Context, req resource.ReadRequest, resp *resource.ReadResponse) { // nolint:gocritic // function signature required by Terraform
	var model Model
	diags := req.State.Get(ctx, &model)
	resp.Diagnostics.Append(diags...)
	if resp.Diagnostics.HasError() {
		return
	}

	ctx = core.InitProviderContext(ctx)
	ctx = tflog.SetField(ctx, "subject", model.Subject.ValueString())
	ctx = tflog.SetField(ctx, "role", model.Role.ValueString())
	ctx = tflog.SetField(ctx, "resource_type", r.apiName)
	ctx = tflog.SetField(ctx, "resource_id", model.ResourceId.ValueString())

	listResp, err := r.authorizationClient.ListMembers(ctx, r.apiName, model.ResourceId.ValueString()).Subject(model.Subject.ValueString()).Execute()
	if err != nil {
		core.LogAndAddError(ctx, &resp.Diagnostics, "Error reading authorizations", fmt.Sprintf("Calling API: %v", err))
		return
	}

	ctx = core.LogResponse(ctx)

	// Map response body to schema
	err = mapListMembersResponse(listResp, &model)
	if err != nil {
		if errors.Is(err, errRoleAssignmentNotFound) {
			resp.State.RemoveResource(ctx)
			return
		}
		core.LogAndAddError(ctx, &resp.Diagnostics, "Error reading authorization", fmt.Sprintf("Processing API payload: %v", err))
		return
	}

	// Set refreshed state
	diags = resp.State.Set(ctx, model)
	resp.Diagnostics.Append(diags...)
	if resp.Diagnostics.HasError() {
		return
	}
	tflog.Info(ctx, fmt.Sprintf("%s role assignment read successful", r.apiName))
}

// Update updates the resource and sets the updated Terraform state on success.
func (r *roleAssignmentResource) Update(_ context.Context, _ resource.UpdateRequest, _ *resource.UpdateResponse) { // nolint:gocritic // function signature required by Terraform
	// does nothing since resource updates should always trigger resource replacement
}

// Delete deletes the resource and removes the Terraform state on success.
func (r *roleAssignmentResource) Delete(ctx context.Context, req resource.DeleteRequest, resp *resource.DeleteResponse) { // nolint:gocritic // function signature required by Terraform
	var model Model
	diags := req.State.Get(ctx, &model)
	resp.Diagnostics.Append(diags...)
	if resp.Diagnostics.HasError() {
		return
	}

	ctx = core.InitProviderContext(ctx)
	ctx = tflog.SetField(ctx, "subject", model.Subject.ValueString())
	ctx = tflog.SetField(ctx, "role", model.Role.ValueString())
	ctx = tflog.SetField(ctx, "resource_type", r.apiName)
	ctx = tflog.SetField(ctx, "resource_id", model.ResourceId.ValueString())

	payload := authorization.RemoveMembersPayload{
		ResourceType: &r.apiName,
		Members: &[]authorization.Member{
			{
				Role:    model.Role.ValueStringPointer(),
				Subject: model.Subject.ValueStringPointer(),
			},
		},
	}

	// Delete existing project role assignment
	_, err := r.authorizationClient.RemoveMembers(ctx, model.ResourceId.ValueString()).RemoveMembersPayload(payload).Execute()
	if err != nil {
		var oapiErr *oapierror.GenericOpenAPIError
		if errors.As(err, &oapiErr) && oapiErr.StatusCode == http.StatusNotFound {
			resp.State.RemoveResource(ctx)
			return
		}
		core.LogAndAddError(ctx, &resp.Diagnostics, fmt.Sprintf("Error deleting %s role assignment", r.apiName), fmt.Sprintf("Calling API: %v", err))
	}

	ctx = core.LogResponse(ctx)
	tflog.Info(ctx, fmt.Sprintf("%s role assignment deleted", r.apiName))
}

// ImportState imports a resource into the Terraform state on success.
// The expected format of the project role assignment resource import identifier is: resource_id,role,subject
func (r *roleAssignmentResource) ImportState(ctx context.Context, req resource.ImportStateRequest, resp *resource.ImportStateResponse) {
	idParts := strings.Split(req.ID, core.Separator)
	if len(idParts) != 3 || idParts[0] == "" || idParts[1] == "" || idParts[2] == "" {
		core.LogAndAddError(ctx, &resp.Diagnostics,
			fmt.Sprintf("Error importing %s role assignment", r.apiName),
			fmt.Sprintf("Expected import identifier with format [resource_id],[role],[subject], got %q", req.ID),
		)
		return
	}

	resp.Diagnostics.Append(resp.State.SetAttribute(ctx, path.Root("resource_id"), idParts[0])...)
	resp.Diagnostics.Append(resp.State.SetAttribute(ctx, path.Root("role"), idParts[1])...)
	resp.Diagnostics.Append(resp.State.SetAttribute(ctx, path.Root("subject"), idParts[2])...)
	tflog.Info(ctx, fmt.Sprintf("%s role assignment state imported", r.apiName))
}

// toCreatePayload builds the payload to add a member to a resource
func toCreatePayload(model *Model, apiName *string) (*authorization.AddMembersPayload, error) {
	if model == nil {
		return nil, fmt.Errorf("nil model")
	}

	if utils.IsUndefined(model.Role) || model.Role.ValueString() == "" {
		return nil, fmt.Errorf("invalid model role")
	}

	if utils.IsUndefined(model.Subject) || model.Subject.ValueString() == "" {
		return nil, fmt.Errorf("invalid model subject")
	}

	return &authorization.AddMembersPayload{
		ResourceType: apiName,
		Members: &[]authorization.Member{
			{
				Role:    model.Role.ValueStringPointer(),
				Subject: model.Subject.ValueStringPointer(),
			},
		},
	}, nil
}

// mapListMembersResponse maps project role assignment fields from the API response to the provider's internal model
func mapListMembersResponse(resp *authorization.ListMembersResponse, model *Model) error {
	if resp == nil {
		return fmt.Errorf("response input is nil")
	}
	if resp.Members == nil {
		return fmt.Errorf("response members are nil")
	}
	if resp.ResourceId == nil {
		return fmt.Errorf("response resource_id is nil")
	}
	if model == nil {
		return fmt.Errorf("model input is nil")
	}

	model.ResourceId = types.StringPointerValue(resp.ResourceId)
	model.Id = utils.BuildInternalTerraformId(model.ResourceId.ValueString(), model.Role.ValueString(), model.Subject.ValueString())

	for _, m := range *resp.Members {
		if *m.Role == model.Role.ValueString() && *m.Subject == model.Subject.ValueString() {
			model.Role = types.StringPointerValue(m.Role)
			model.Subject = types.StringPointerValue(m.Subject)
			return nil
		}
	}

	return errRoleAssignmentNotFound
}

// Prevent creating duplicate <resource_id, role, subject> assignments.
// Duplicates lead to inconsistent state (Terraform then fails).
func checkDuplicate(model Model, listMemberResp *authorization.ListMembersResponse) error { //nolint:gocritic // A read only copy is required since an api response is parsed into the model and this check should not affect the model parameter
	err := mapListMembersResponse(listMemberResp, &model)

	if err != nil {
		if errors.Is(err, errRoleAssignmentNotFound) {
			return nil
		}
		return err
	}

	return errRoleAssignmentDuplicateFound
}