tryaudex_core/

roles.rs

use std::collections::HashMap;

use serde::{Deserialize, Serialize};

use crate::error::{AvError, Result};

/// Role mapping configuration in `[roles]` config section.
/// Maps developer identities (email, team, username) to IAM roles.
#[derive(Debug, Clone, Serialize, Deserialize, Default)]
pub struct RoleMappingConfig {
    /// Default role ARN used when no mapping matches
    pub default_role: Option<String>,
    /// Map of identity patterns to role ARNs.
    /// Keys can be emails, team names, or glob patterns.
    /// Example: { "backend-team" = "arn:aws:iam::123:role/BackendAgentRole" }
    #[serde(default)]
    pub mappings: HashMap<String, RoleMapping>,
}

/// A single role mapping entry.
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct RoleMapping {
    /// IAM role ARN (AWS), service account email (GCP), or role name (Azure)
    pub role: String,
    /// Optional list of allowed profiles for this role
    #[serde(default)]
    pub allowed_profiles: Vec<String>,
    /// Optional max TTL override (e.g. "30m")
    pub max_ttl: Option<String>,
    /// Optional description
    pub description: Option<String>,
}

/// Resolved role for a given identity.
#[derive(Debug, Clone)]
pub struct ResolvedRole {
    pub role: String,
    pub allowed_profiles: Vec<String>,
    pub max_ttl: Option<String>,
    pub matched_by: String,
}

/// Resolve the IAM role for a given identity.
/// Checks in order: exact email match, team/group match, glob patterns, default.
pub fn resolve(config: &RoleMappingConfig, identity: &str) -> Result<ResolvedRole> {
    // 1. Exact match
    if let Some(mapping) = config.mappings.get(identity) {
        return Ok(ResolvedRole {
            role: mapping.role.clone(),
            allowed_profiles: mapping.allowed_profiles.clone(),
            max_ttl: mapping.max_ttl.clone(),
            matched_by: format!("exact: {}", identity),
        });
    }

    // 2. Glob pattern match (e.g. "*@backend.team.com", "deploy-*")
    // Sort patterns for deterministic matching when multiple patterns could match.
    let mut patterns: Vec<_> = config.mappings.iter().collect();
    patterns.sort_by_key(|(k, _)| (*k).clone());
    for (pattern, mapping) in patterns {
        if matches_glob(pattern, identity) {
            return Ok(ResolvedRole {
                role: mapping.role.clone(),
                allowed_profiles: mapping.allowed_profiles.clone(),
                max_ttl: mapping.max_ttl.clone(),
                matched_by: format!("pattern: {}", pattern),
            });
        }
    }

    // 3. Default role
    if let Some(ref default) = config.default_role {
        return Ok(ResolvedRole {
            role: default.clone(),
            allowed_profiles: Vec::new(),
            max_ttl: None,
            matched_by: "default".to_string(),
        });
    }

    Err(AvError::InvalidPolicy(format!(
        "No role mapping found for '{}' and no default_role configured",
        identity
    )))
}

/// Simple glob matching supporting * and ? wildcards.
fn matches_glob(pattern: &str, text: &str) -> bool {
    if !pattern.contains('*') && !pattern.contains('?') {
        return false; // Not a glob pattern, skip (exact match handled separately)
    }

    let pattern_chars: Vec<char> = pattern.chars().collect();
    let text_chars: Vec<char> = text.chars().collect();

    matches_glob_inner(&pattern_chars, &text_chars, 0, 0)
}

/// Iterative glob matching using a two-pointer approach. The previous
/// recursive implementation was O(n^k) on patterns with multiple `*`
/// wildcards (e.g. `*a*a*a*b`), causing ReDoS on pathological input.
fn matches_glob_inner(pattern: &[char], text: &[char], mut pi: usize, mut ti: usize) -> bool {
    let mut star_pi: Option<usize> = None;
    let mut star_ti: usize = 0;

    while ti < text.len() {
        if pi < pattern.len() && (pattern[pi] == '?' || pattern[pi] == text[ti]) {
            pi += 1;
            ti += 1;
        } else if pi < pattern.len() && pattern[pi] == '*' {
            star_pi = Some(pi);
            star_ti = ti;
            pi += 1; // try matching * with zero chars first
        } else if let Some(sp) = star_pi {
            // backtrack: let the last * consume one more char
            pi = sp + 1;
            star_ti += 1;
            ti = star_ti;
        } else {
            return false;
        }
    }

    // Consume trailing *s in the pattern
    while pi < pattern.len() && pattern[pi] == '*' {
        pi += 1;
    }

    pi == pattern.len()
}

/// Detect the current user identity from environment.
/// Checks: AUDEX_IDENTITY, USER, LOGNAME, git config user.email.
pub fn detect_identity() -> Option<String> {
    // Explicit override
    if let Ok(id) = std::env::var("AUDEX_IDENTITY") {
        if !id.is_empty() {
            return Some(id);
        }
    }

    // Git user email
    if let Ok(output) = std::process::Command::new("git")
        .args(["config", "user.email"])
        .output()
    {
        if output.status.success() {
            let email = String::from_utf8_lossy(&output.stdout).trim().to_string();
            if !email.is_empty() {
                return Some(email);
            }
        }
    }

    // System username
    std::env::var("USER")
        .or_else(|_| std::env::var("LOGNAME"))
        .ok()
}

#[cfg(test)]
mod tests {
    use super::*;

    fn test_config() -> RoleMappingConfig {
        let mut mappings = HashMap::new();
        mappings.insert(
            "alice@example.com".to_string(),
            RoleMapping {
                role: "arn:aws:iam::123:role/AliceRole".to_string(),
                allowed_profiles: vec!["s3-readonly".to_string()],
                max_ttl: Some("30m".to_string()),
                description: Some("Alice's role".to_string()),
            },
        );
        mappings.insert(
            "*@backend.example.com".to_string(),
            RoleMapping {
                role: "arn:aws:iam::123:role/BackendRole".to_string(),
                allowed_profiles: vec![],
                max_ttl: None,
                description: None,
            },
        );
        mappings.insert(
            "deploy-*".to_string(),
            RoleMapping {
                role: "arn:aws:iam::123:role/DeployRole".to_string(),
                allowed_profiles: vec!["lambda-deploy".to_string(), "ecr-push".to_string()],
                max_ttl: Some("1h".to_string()),
                description: None,
            },
        );
        RoleMappingConfig {
            default_role: Some("arn:aws:iam::123:role/DefaultRole".to_string()),
            mappings,
        }
    }

    #[test]
    fn test_exact_match() {
        let config = test_config();
        let resolved = resolve(&config, "alice@example.com").unwrap();
        assert_eq!(resolved.role, "arn:aws:iam::123:role/AliceRole");
        assert!(resolved.matched_by.starts_with("exact:"));
        assert_eq!(resolved.allowed_profiles, vec!["s3-readonly"]);
        assert_eq!(resolved.max_ttl, Some("30m".to_string()));
    }

    #[test]
    fn test_glob_email_domain() {
        let config = test_config();
        let resolved = resolve(&config, "bob@backend.example.com").unwrap();
        assert_eq!(resolved.role, "arn:aws:iam::123:role/BackendRole");
        assert!(resolved.matched_by.starts_with("pattern:"));
    }

    #[test]
    fn test_glob_prefix() {
        let config = test_config();
        let resolved = resolve(&config, "deploy-staging").unwrap();
        assert_eq!(resolved.role, "arn:aws:iam::123:role/DeployRole");
        assert_eq!(resolved.allowed_profiles.len(), 2);
    }

    #[test]
    fn test_default_fallback() {
        let config = test_config();
        let resolved = resolve(&config, "unknown-user").unwrap();
        assert_eq!(resolved.role, "arn:aws:iam::123:role/DefaultRole");
        assert_eq!(resolved.matched_by, "default");
    }

    #[test]
    fn test_no_match_no_default() {
        let config = RoleMappingConfig {
            default_role: None,
            mappings: HashMap::new(),
        };
        assert!(resolve(&config, "anyone").is_err());
    }

    #[test]
    fn test_config_deserialize() {
        let toml_str = r#"
default_role = "arn:aws:iam::123:role/DefaultRole"

[mappings.backend-team]
role = "arn:aws:iam::123:role/BackendRole"
allowed_profiles = ["s3-readwrite", "dynamodb-query"]
max_ttl = "1h"
description = "Backend team role"

[mappings."*@frontend.example.com"]
role = "arn:aws:iam::123:role/FrontendRole"
"#;
        let config: RoleMappingConfig = toml::from_str(toml_str).unwrap();
        assert_eq!(
            config.default_role.unwrap(),
            "arn:aws:iam::123:role/DefaultRole"
        );
        assert_eq!(config.mappings.len(), 2);
        let backend = config.mappings.get("backend-team").unwrap();
        assert_eq!(backend.allowed_profiles.len(), 2);
    }

    #[test]
    fn test_glob_question_mark() {
        assert!(matches_glob("user?", "user1"));
        assert!(matches_glob("user?", "userA"));
        assert!(!matches_glob("user?", "user"));
        assert!(!matches_glob("user?", "user12"));
    }

    #[test]
    fn test_glob_star() {
        assert!(matches_glob("*@example.com", "alice@example.com"));
        assert!(matches_glob("deploy-*", "deploy-staging"));
        assert!(matches_glob("deploy-*", "deploy-"));
        assert!(!matches_glob("deploy-*", "deploystaging"));
    }
}