softplayer-backend/internal/controllers/accounts.go

package controllers

import (
	"context"
	"fmt"
	"time"

	"git.badhouseplants.net/softplayer/softplayer-backend/internal/helpers/hash"
	"git.badhouseplants.net/softplayer/softplayer-backend/internal/helpers/kube"
	"github.com/google/uuid"
	corev1 "k8s.io/api/core/v1"
	rbacv1 "k8s.io/api/rbac/v1"
	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"

	"k8s.io/apimachinery/pkg/types"
	ctrl "sigs.k8s.io/controller-runtime"
)

type Account struct {
	Controller ctrl.Manager
	Params     AccountParams
	Data       *AccountData
	Token      string
}

type AccountParams struct {
	HashCost int16
}

type AccountData struct {
	Username string
	Password string
	Email    string
	UUID     string
}

func (acc *Account) Create(ctx context.Context) error {
	client := acc.Controller.GetClient()
	acc.Data.UUID = uuid.New().String()

	passwordHash, err := hash.HashPassword(acc.Data.Password, int(acc.Params.HashCost))
	if err != nil {
		return nil
	}

	namespace := &corev1.Namespace{
		ObjectMeta: metav1.ObjectMeta{
			Name: acc.Data.UUID,
			Labels: map[string]string{
				"username":       acc.Data.Username,
				"email-verified": "false",
				"managed-by":     "softplayer",
			},
		},
	}

	if err := kube.Create(ctx, client, namespace, true); err != nil {
		return err
	}

	if err := client.Get(ctx, types.NamespacedName{
		Name: acc.Data.UUID,
	}, namespace); err != nil {
		if err := client.Delete(ctx, namespace); err != nil {
			return err
		}
		return err
	}

	// Create a secret with the account data
	secret := &corev1.Secret{
		ObjectMeta: metav1.ObjectMeta{
			Name:      acc.Data.Username,
			Namespace: "softplayer-accounts",
		},
		StringData: map[string]string{
			"uuid":     acc.Data.UUID,
			"email":    acc.Data.Email,
			"password": passwordHash,
		},
	}

	if err := client.Create(ctx, kube.SetOwnerRef(ctx, client, secret, namespace)); err != nil {
		if err := client.Delete(ctx, namespace); err != nil {
			return err
		}
		return err
	}

	// Prepare RBAC resources for the account
	role := &rbacv1.Role{
		ObjectMeta: metav1.ObjectMeta{Name: acc.Data.Username, Namespace: acc.Data.UUID},
		Rules:      []rbacv1.PolicyRule{{Verbs: []string{"get", "watch", "list", "create", "patch", "delete"}, APIGroups: []string{""}, Resources: []string{"configmaps", "secrets"}}},
	}

	if err := client.Create(ctx, role); err != nil {
		if err := client.Delete(ctx, namespace); err != nil {
			return err
		}
		return err
	}

	sa := &corev1.ServiceAccount{
		ObjectMeta: metav1.ObjectMeta{
			Name:      acc.Data.UUID,
			Namespace: acc.Data.UUID,
		},
	}

	if err := client.Create(ctx, sa); err != nil {
		if err := client.Delete(ctx, namespace); err != nil {
			return err
		}
		return err
	}

	rb := &rbacv1.RoleBinding{
		ObjectMeta: metav1.ObjectMeta{
			Name:      acc.Data.UUID,
			Namespace: acc.Data.UUID,
		},
		Subjects: []rbacv1.Subject{
			rbacv1.Subject{
				Kind:      "ServiceAccount",
				Name:      acc.Data.UUID,
				Namespace: acc.Data.UUID,
			},
		},
		RoleRef: rbacv1.RoleRef{
			APIGroup: "rbac.authorization.k8s.io",
			Kind:     "Role",
			Name:     acc.Data.Username,
		},
	}

	if err := client.Create(ctx, rb); err != nil {
		if err := client.Delete(ctx, namespace); err != nil {
			return err
		}
		return err
	}

	tokenName := fmt.Sprintf("sa-%s", acc.Data.UUID)
	saSec := &corev1.Secret{
		ObjectMeta: metav1.ObjectMeta{
			Name:      tokenName,
			Namespace: acc.Data.UUID,
			Annotations: map[string]string{
				"kubernetes.io/service-account.name": acc.Data.UUID,
			},
		},
		Type: "kubernetes.io/service-account-token",
	}

	if err := client.Create(ctx, saSec); err != nil {
		if err := client.Delete(ctx, namespace); err != nil {
			return err
		}
		return err
	}
	if err := kube.WaitUntilCreated(ctx, client, saSec, 10, time.Millisecond*50); err != nil {
		return err
	}

	acc.Token, err = acc.getToken(ctx, saSec)
	if err != nil {
		if err := client.Delete(ctx, namespace); err != nil {
			return err
		}
		return err
	}
	return nil
}

func (acc *Account) Login(ctx context.Context) error {
	client := acc.Controller.GetClient()
	sec := &corev1.Secret{}

	if err := client.Get(ctx, types.NamespacedName{
		Namespace: "softplayer-accounts",
		Name:      acc.Data.Username,
	}, sec); err != nil {
		return err
	}

	if err := hash.CheckPasswordHash(acc.Data.Password, string(sec.Data["password"])); err != nil {
		return err
	}

	acc.Data.UUID = string(sec.Data["uuid"])
	tokenName := fmt.Sprintf("sa-%s", acc.Data.UUID)
	saSec := &corev1.Secret{
		ObjectMeta: metav1.ObjectMeta{
			Name:      tokenName,
			Namespace: acc.Data.UUID,
			Annotations: map[string]string{
				"kubernetes.io/service-account.name": acc.Data.UUID,
			},
		},
		Type: "kubernetes.io/service-account-token",
	}
	var err error
	acc.Token, err = acc.getToken(ctx, saSec)
	if err != nil {
		return err
	}
	return nil
}

func (acc *Account) getToken(ctx context.Context, saSec *corev1.Secret) (string, error) {
	client := acc.Controller.GetClient()
	if err := client.Get(ctx, types.NamespacedName{
		Namespace: acc.Data.UUID,
		Name:      saSec.ObjectMeta.Name,
	}, saSec); err != nil {
		return "", err
	}
	return string(saSec.Data["token"]), nil
}