feat: manage bounded automation service accounts
This commit is contained in:
@@ -0,0 +1,283 @@
|
||||
from __future__ import annotations
|
||||
|
||||
from collections.abc import Iterable, Mapping
|
||||
|
||||
from sqlalchemy import select
|
||||
from sqlalchemy.exc import IntegrityError
|
||||
from sqlalchemy.orm import Session
|
||||
|
||||
from govoplan_access.backend.db.base import utcnow
|
||||
from govoplan_access.backend.db.models import (
|
||||
Account,
|
||||
ServiceAccount,
|
||||
Tenant,
|
||||
User,
|
||||
new_uuid,
|
||||
)
|
||||
from govoplan_core.auth import ApiPrincipal
|
||||
|
||||
|
||||
class ServiceAccountError(ValueError):
|
||||
pass
|
||||
|
||||
|
||||
class ServiceAccountNotFoundError(ServiceAccountError):
|
||||
pass
|
||||
|
||||
|
||||
class ServiceAccountConflictError(ServiceAccountError):
|
||||
pass
|
||||
|
||||
|
||||
def list_service_accounts(
|
||||
session: Session,
|
||||
*,
|
||||
tenant_id: str,
|
||||
) -> list[ServiceAccount]:
|
||||
return list(
|
||||
session.scalars(
|
||||
select(ServiceAccount)
|
||||
.where(ServiceAccount.tenant_id == tenant_id)
|
||||
.order_by(
|
||||
ServiceAccount.normalized_name,
|
||||
ServiceAccount.id,
|
||||
)
|
||||
)
|
||||
)
|
||||
|
||||
|
||||
def get_service_account(
|
||||
session: Session,
|
||||
*,
|
||||
tenant_id: str,
|
||||
service_account_id: str,
|
||||
lock: bool = False,
|
||||
) -> ServiceAccount:
|
||||
query = select(ServiceAccount).where(
|
||||
ServiceAccount.id == service_account_id,
|
||||
ServiceAccount.tenant_id == tenant_id,
|
||||
)
|
||||
if lock:
|
||||
query = query.with_for_update()
|
||||
item = session.scalar(query)
|
||||
if item is None:
|
||||
raise ServiceAccountNotFoundError(
|
||||
"Service account was not found"
|
||||
)
|
||||
return item
|
||||
|
||||
|
||||
def create_service_account(
|
||||
session: Session,
|
||||
*,
|
||||
tenant: Tenant,
|
||||
principal: ApiPrincipal,
|
||||
name: str,
|
||||
description: str | None,
|
||||
scope_ceiling: Iterable[str],
|
||||
) -> ServiceAccount:
|
||||
clean_name = _service_account_name(name)
|
||||
scopes = _service_account_scopes(
|
||||
principal,
|
||||
scope_ceiling,
|
||||
)
|
||||
service_account_id = new_uuid()
|
||||
internal_email = (
|
||||
f"service-account-{service_account_id}@govoplan.invalid"
|
||||
)
|
||||
account = Account(
|
||||
id=new_uuid(),
|
||||
email=internal_email,
|
||||
normalized_email=internal_email,
|
||||
display_name=clean_name,
|
||||
is_active=True,
|
||||
auth_provider="service_account",
|
||||
password_hash=None,
|
||||
password_reset_required=False,
|
||||
)
|
||||
membership = User(
|
||||
id=new_uuid(),
|
||||
tenant_id=tenant.id,
|
||||
account=account,
|
||||
email=internal_email,
|
||||
display_name=clean_name,
|
||||
is_active=True,
|
||||
is_tenant_admin=False,
|
||||
auth_provider="service_account",
|
||||
password_hash=None,
|
||||
settings={"managed_service_account": service_account_id},
|
||||
)
|
||||
item = ServiceAccount(
|
||||
id=service_account_id,
|
||||
tenant_id=tenant.id,
|
||||
account_id=account.id,
|
||||
membership_id=membership.id,
|
||||
name=clean_name,
|
||||
normalized_name=_normalized_name(clean_name),
|
||||
description=_optional_text(description),
|
||||
scope_ceiling=list(scopes),
|
||||
is_active=True,
|
||||
revision=1,
|
||||
created_by_account_id=principal.account_id,
|
||||
updated_by_account_id=principal.account_id,
|
||||
settings={},
|
||||
)
|
||||
session.add_all((account, membership, item))
|
||||
try:
|
||||
session.flush()
|
||||
except IntegrityError as exc:
|
||||
raise ServiceAccountConflictError(
|
||||
"A service account with this name already exists"
|
||||
) from exc
|
||||
return item
|
||||
|
||||
|
||||
def update_service_account(
|
||||
session: Session,
|
||||
*,
|
||||
tenant_id: str,
|
||||
service_account_id: str,
|
||||
principal: ApiPrincipal,
|
||||
expected_revision: int,
|
||||
changes: Mapping[str, object],
|
||||
) -> ServiceAccount:
|
||||
item = get_service_account(
|
||||
session,
|
||||
tenant_id=tenant_id,
|
||||
service_account_id=service_account_id,
|
||||
lock=True,
|
||||
)
|
||||
if item.revision != expected_revision:
|
||||
raise ServiceAccountConflictError(
|
||||
"Service account changed on the server; reload before saving"
|
||||
)
|
||||
account = session.get(Account, item.account_id)
|
||||
membership = session.get(User, item.membership_id)
|
||||
if account is None or membership is None:
|
||||
raise ServiceAccountConflictError(
|
||||
"Service account backing identity is missing"
|
||||
)
|
||||
if "name" in changes:
|
||||
clean_name = _service_account_name(str(changes["name"]))
|
||||
item.name = clean_name
|
||||
item.normalized_name = _normalized_name(clean_name)
|
||||
account.display_name = clean_name
|
||||
membership.display_name = clean_name
|
||||
if "description" in changes:
|
||||
value = changes["description"]
|
||||
item.description = _optional_text(
|
||||
str(value) if value is not None else None
|
||||
)
|
||||
if "scope_ceiling" in changes:
|
||||
raw_scopes = changes["scope_ceiling"]
|
||||
if not isinstance(raw_scopes, Iterable) or isinstance(
|
||||
raw_scopes,
|
||||
(str, bytes),
|
||||
):
|
||||
raise ServiceAccountError(
|
||||
"Service account scope ceiling is invalid"
|
||||
)
|
||||
item.scope_ceiling = list(
|
||||
_service_account_scopes(
|
||||
principal,
|
||||
(str(scope) for scope in raw_scopes),
|
||||
)
|
||||
)
|
||||
if "is_active" in changes:
|
||||
active = bool(changes["is_active"])
|
||||
item.is_active = active
|
||||
account.is_active = active
|
||||
membership.is_active = active
|
||||
item.retired_at = None if active else utcnow()
|
||||
item.revision += 1
|
||||
item.updated_by_account_id = principal.account_id
|
||||
try:
|
||||
session.flush()
|
||||
except IntegrityError as exc:
|
||||
raise ServiceAccountConflictError(
|
||||
"A service account with this name already exists"
|
||||
) from exc
|
||||
return item
|
||||
|
||||
|
||||
def retire_service_account(
|
||||
session: Session,
|
||||
*,
|
||||
tenant_id: str,
|
||||
service_account_id: str,
|
||||
principal: ApiPrincipal,
|
||||
expected_revision: int,
|
||||
) -> ServiceAccount:
|
||||
return update_service_account(
|
||||
session,
|
||||
tenant_id=tenant_id,
|
||||
service_account_id=service_account_id,
|
||||
principal=principal,
|
||||
expected_revision=expected_revision,
|
||||
changes={"is_active": False},
|
||||
)
|
||||
|
||||
|
||||
def _service_account_name(value: str) -> str:
|
||||
clean = " ".join(value.split())
|
||||
if not 1 <= len(clean) <= 255:
|
||||
raise ServiceAccountError(
|
||||
"Service account name must contain between 1 and 255 characters"
|
||||
)
|
||||
return clean
|
||||
|
||||
|
||||
def _normalized_name(value: str) -> str:
|
||||
return value.casefold()
|
||||
|
||||
|
||||
def _optional_text(value: str | None) -> str | None:
|
||||
if value is None:
|
||||
return None
|
||||
clean = value.strip()
|
||||
if len(clean) > 4000:
|
||||
raise ServiceAccountError(
|
||||
"Service account description is too long"
|
||||
)
|
||||
return clean or None
|
||||
|
||||
|
||||
def _service_account_scopes(
|
||||
principal: ApiPrincipal,
|
||||
values: Iterable[str],
|
||||
) -> tuple[str, ...]:
|
||||
scopes = tuple(
|
||||
sorted(
|
||||
{
|
||||
str(value).strip()
|
||||
for value in values
|
||||
if str(value).strip()
|
||||
}
|
||||
)
|
||||
)
|
||||
if len(scopes) > 200:
|
||||
raise ServiceAccountError(
|
||||
"Service accounts support at most 200 scope grants"
|
||||
)
|
||||
denied = tuple(
|
||||
scope for scope in scopes
|
||||
if not principal.has(scope)
|
||||
)
|
||||
if denied:
|
||||
raise PermissionError(
|
||||
"Cannot grant service-account scopes outside the current "
|
||||
f"administrator authority: {', '.join(denied)}"
|
||||
)
|
||||
return scopes
|
||||
|
||||
|
||||
__all__ = [
|
||||
"ServiceAccountConflictError",
|
||||
"ServiceAccountError",
|
||||
"ServiceAccountNotFoundError",
|
||||
"create_service_account",
|
||||
"get_service_account",
|
||||
"list_service_accounts",
|
||||
"retire_service_account",
|
||||
"update_service_account",
|
||||
]
|
||||
Reference in New Issue
Block a user