rbac

type PolicyRuleNormalizationOptions struct {
	// IncludeCustomVerbsInExpansion indicates whether custom verbs (like
	// "promote" for Stages) should be included in the expansion of the "*"
	// wildcard verb. This is optional because when normalizing PolicyRules with
	// the intent to create or update a Role, this is how we would like "*" to be
	// interpreted. However, when normalizing PolicyRules with the intent to
	// display them to the user, we will not want to expand "*" to include custom
	// verbs because Kubernetes own interpretation of "*" does not include custom
	// verbs.
	IncludeCustomVerbsInExpansion bool
}

type Resources struct {
	ServiceAccount *corev1.ServiceAccount
	Roles          []rbacv1.Role
	ClusterRoles   []rbacv1.ClusterRole
	RoleBindings   []rbacv1.RoleBinding
}

type RolesDatabase interface {
	// Create creates the ServiceAccount, Role, and RoleBinding underlying a new
	// Kargo Role. It will return an error if any of those resources already
	// exist.
	Create(context.Context, *rbacapi.Role) (*rbacapi.Role, error)
	// Delete deletes a Kargo Role's underlying ServiceAccount, Role, and
	// RoleBinding. It will return an error if no underlying resources exist or if
	// any underlying resources are not Kargo-manageable.
	Delete(ctx context.Context, project, name string) error
	// Get returns a Kargo Role representation of an underlying ServiceAccount
	// and any Roles it is associated with. It will return an error if no
	// underlying ServiceAccount exists.
	Get(
		ctx context.Context,
		systemLevel bool,
		project string,
		name string,
	) (*rbacapi.Role, error)
	// GetAsResources returns the ServiceAccount and any Roles and RoleBindings
	// underlying a Kargo Role. It will return an error if no underlying
	// ServiceAccount exists. It is valid for the Roles and/or RoleBindings to be
	// missing, in which case they will be returned as nil.
	GetAsResources(
		ctx context.Context,
		systemLevel bool,
		project string,
		name string,
	) (Resources, error)
	// GrantPermissionsToRole amends the Role underlying a Kargo Role with new
	// rules. It will return an error if no underlying ServiceAccount exists or
	// any underlying resources are not Kargo-manageable. It will create
	// underlying Role and RoleBinding resources if they do not exist.
	GrantPermissionsToRole(
		ctx context.Context,
		project string,
		name string,
		resourceDetails *rbacapi.ResourceDetails,
	) (*rbacapi.Role, error)
	// GrantRoleToUsers amends claim annotations of the ServiceAccount underlying
	// a Kargo Role. It will return an error if no underlying ServiceAccount
	// exists or any underlying resources are not Kargo-manageable.
	GrantRoleToUsers(
		ctx context.Context,
		project string,
		name string,
		claims []rbacapi.Claim,
	) (*rbacapi.Role, error)
	// List returns Kargo Role representations of underlying ServiceAccounts and
	// andy Roles and RoleBindings associated with them.
	List(
		ctx context.Context,
		systemLevel bool,
		project string,
	) ([]*rbacapi.Role, error)
	// ListNames returns names of Kargo Roles..
	ListNames(
		ctx context.Context,
		systemLevel bool,
		project string,
	) ([]string, error)
	// RevokePermissionFromRole removes select rules from the Role underlying a
	// Kargo Role. It will return an error if no underlying ServiceAccount exists
	// or any underlying resources are not Kargo-manageable.
	RevokePermissionsFromRole(
		ctx context.Context,
		project string,
		name string,
		resourceDetails *rbacapi.ResourceDetails,
	) (*rbacapi.Role, error)
	// RevokeRoleFromUsers removes select claims from claim annotations of the
	// ServiceAccount underlying a Kargo Role. It will return an error if no
	// underlying ServiceAccount exists or any underlying resources are not
	// Kargo-manageable.
	RevokeRoleFromUsers(
		ctx context.Context,
		project string,
		name string,
		claims []rbacapi.Claim,
	) (*rbacapi.Role, error)
	// Update updates the underlying ServiceAccount and Role resources underlying
	// a Kargo Role. It will return an error if no underlying ServiceAccount
	// exists or any underlying resources are not Kargo-manageable. It will create
	// underlying Role and RoleBinding resources if they do not exist.
	Update(context.Context, *rbacapi.Role) (*rbacapi.Role, error)
	// CreateAPIToken generates and returns a new bearer token associated with a
	// Kargo Role in the form of a Kubernetes Secret.
	CreateAPIToken(
		ctx context.Context,
		systemLevel bool,
		project string,
		roleName string,
		tokenName string,
	) (*corev1.Secret, error)
	// DeleteAPIToken deletes a bearer token associated with a Kargo Role.
	DeleteAPIToken(
		ctx context.Context,
		systemLevel bool,
		project string,
		name string,
	) error
	// GetAPIToken returns a bearer token associated with a Kargo Role.
	GetAPIToken(
		ctx context.Context,
		systemLevel bool,
		project string,
		name string,
	) (*corev1.Secret, error)
	// ListAPITokens lists all bearer tokens associated with a specified Kargo
	// Role.
	ListAPITokens(
		ctx context.Context,
		systemLevel bool,
		project string,
		roleName string,
	) ([]corev1.Secret, error)
}

type RolesDatabaseConfig struct {
	KargoNamespace string `envconfig:"KARGO_NAMESPACE" default:"kargo"`
}