crud operations + assume role

Signed-off-by: Sakshi Munjal <sakshimunjal@Sakshis-MacBook-Pro.local>

Author: Sakshi Munjal

src/cmd/nsfs.js

@@ -265,7 +265,7 @@ async function main(argv = minimist(process.argv.slice(2))) {
                 const sts_bucketspace = nsfs_config_root ?
                     new BucketSpaceFS({ config_root: nsfs_config_root }, endpoint_stats_collector.instance()) :
                     new BucketSpaceSimpleFS({ fs_root });
-                req.sts_sdk = new StsSDK(null, null, sts_bucketspace);
+                req.sts_sdk = new StsSDK(null, null, sts_bucketspace, req.object_sdk.accountspace);
             }
         });
         if (config.ALLOW_HTTP) {

src/endpoint/iam/iam_utils.js

@@ -84,7 +84,8 @@ function parse_role_arn(role_arn) {
 }
 
 /**
- * resolve_iam_role_by_arn resolves IAM role entity from a role ARN
+ * resolve_iam_role_by_arn resolves IAM role entity from a role ARN (containerized / system_store).
+ * NC callers should use accountspace.get_role_by_arn via object_sdk / sts_sdk instead.
  * @param {string} role_arn
  * @returns {Promise<{iam_role?: object, account_id?: string, role_name?: string, error?: string}>}
  */
@@ -1295,14 +1296,17 @@ function _get_assumed_role_session_info(req) {
  * @param {object} account
  * @param {boolean} is_iam_user
  * @param {string} [assumed_role_arn]
+ * @param {object} [object_sdk] - NC uses object_sdk.accountspace.get_role_by_arn
  * @returns {Promise<object[]|null>} policies, or null if assumed role could not be resolved
  */
-async function _get_identity_policies(account, is_iam_user, assumed_role_arn) {
+async function _get_identity_policies(account, is_iam_user, assumed_role_arn, object_sdk) {
     if (is_iam_user) {
         return account.iam_user_policies || [];
     }
-    const resolved_role = await resolve_iam_role_by_arn(assumed_role_arn);
-    if (!resolved_role.iam_role) return null;
+    const resolved_role = object_sdk?.accountspace ?
+        await object_sdk.accountspace.get_role_by_arn({ role_arn: assumed_role_arn }) :
+        await resolve_iam_role_by_arn(assumed_role_arn);
+    if (!resolved_role?.iam_role) return null;
     return resolved_role.iam_role.iam_role_policies || [];
 }
 
@@ -1336,13 +1340,20 @@ async function authorize_request_iam_policy_impl(req, method, bucket_name, servi
         principal_arn: assumed_role_arn,
     };
 
-    const iam_policies = await _get_identity_policies(account, is_iam_user, assumed_role_arn);
+    const iam_policies = await _get_identity_policies(
+        account,
+        is_iam_user,
+        assumed_role_arn,
+        req.object_sdk
+    );
     if (iam_policies === null) {
         dbg.error('authorize_request_iam_policy: failed to resolve IAM role for assumed session token');
         return deny_result;
     }
     if (iam_policies.length === 0) {
-        if (is_iam_user && req.object_sdk.nsfs_config_root) return true; // We do not have IAM policies in NC yet
+        // TODO: remove NC empty-policy allow when PutRolePolicy (Phase 2) is implemented
+        // NC: IAM user / role inline policies are Phase 2; allow until PutRolePolicy exists
+        if (req.object_sdk.nsfs_config_root && (is_iam_user || is_assumed_role_session)) return true;
         dbg.error('authorize_request_iam_policy:', iam_identity, 'has no inline policies configured');
         return deny_result;
     }

src/endpoint/sts/sts_rest.js

@@ -238,6 +238,11 @@ function handle_error(req, res, err) {
  * @returns {Promise<Object>} - Assume role policy document
  */
 async function get_assume_role_policy(req) {
+    if (is_nc_environment()) {
+        // NC: role resolve via injected AccountSpaceFS
+        return req.sts_sdk.get_assume_role_policy(req.body.role_arn);
+    }
+
     // TODO: Get the iam_role from cache
     const resolved_role = await resolve_iam_role_by_arn(req.body.role_arn);
     return resolved_role.iam_role?.assume_role_policy_document;

src/manage_nsfs/nsfs_schema_utils.js

@@ -47,6 +47,7 @@ const validate_logging = ajv.compile(log_schema);
 
 /**
  * validate_account_schema validates an account object against the NC NSFS account schema
+ * Same schema used for role
  * @param {object} account
  */
 function validate_account_schema(account) {

src/sdk/accountspace_fs.js

@@ -8,9 +8,10 @@ const dbg = require('../util/debug_module')(__filename);
 const P = require('../util/promise');
 const { ConfigFS, CONFIG_TYPES } = require('./config_fs');
 const native_fs_utils = require('../util/native_fs_utils');
-const { create_arn_for_user, create_arn_for_root, get_action_message_title, check_iam_path_was_set } = require('../endpoint/iam/iam_utils');
-const { IAM_ACTIONS, MAX_NUMBER_OF_ACCESS_KEYS, IAM_DEFAULT_PATH,
-    ACCESS_KEY_STATUS_ENUM, IDENTITY_ENUM } = require('../endpoint/iam/iam_constants');
+const { create_arn_for_user, create_arn_for_root, create_arn_for_role, get_action_message_title, check_iam_path_was_set,
+    parse_role_arn } = require('../endpoint/iam/iam_utils');
+const { IAM_ACTIONS, MAX_NUMBER_OF_ACCESS_KEYS, MAX_NUMBER_OF_IAM_ROLES, IAM_DEFAULT_PATH,
+    ACCESS_KEY_STATUS_ENUM, IDENTITY_ENUM, DEFAULT_MAX_SESSION_DURATION_SECS } = require('../endpoint/iam/iam_constants');
 const IamError = require('../endpoint/iam/iam_errors').IamError;
 const cloud_utils = require('../util/cloud_utils');
 const SensitiveString = require('../util/sensitive_string');
@@ -589,40 +590,164 @@ class AccountSpaceFS {
     // ROLE   //
     ////////////
 
+    // 1 - check requesting account is root
+    // 2 - verify role_name is unique under the account
+    // 3 - enforce per-account role limit
+    // 4 - write role identity.json + symlink
     async create_role(params, account_sdk) {
         const action = IAM_ACTIONS.CREATE_ROLE;
         dbg.log1(`AccountSpaceFS.${action}`, params);
-        const { code, http_code, type } = IamError.NotImplemented;
-        throw new IamError({ code, message: 'NotImplemented', http_code, type });
+        try {
+            const requesting_account = account_sdk.requesting_account;
+            this._check_if_requesting_account_is_root_account(action, requesting_account, {});
+            const owner_account_id = requesting_account._id;
+            const role_exists = await this.config_fs.is_role_exists_by_name(params.role_name, owner_account_id);
+            if (role_exists) {
+                const { code, http_code, type } = IamError.EntityAlreadyExists;
+                throw new IamError({ code, message: `Role with name ${params.role_name} already exists.`, http_code, type });
+            }
+            const existing_roles = await this.config_fs.list_roles_under_account(owner_account_id);
+            if (existing_roles.length >= MAX_NUMBER_OF_IAM_ROLES) {
+                const { code, http_code, type } = IamError.LimitExceeded;
+                throw new IamError({ code, message: `Cannot exceed quota for RolesPerAccount: ${MAX_NUMBER_OF_IAM_ROLES}.`, http_code, type });
+            }
+            const role_data = this._new_role_defaults(requesting_account, params);
+            await this.config_fs.create_role_config_file(role_data);
+            const arn = create_arn_for_role(owner_account_id, role_data.name, role_data.iam_path);
+            return {
+                role_name: role_data.name,
+                role_id: role_data._id,
+                iam_path: role_data.iam_path || IAM_DEFAULT_PATH,
+                arn,
+                create_date: role_data.creation_date,
+                assume_role_policy_document: role_data.assume_role_policy_document,
+                description: role_data.description,
+                max_session_duration: role_data.max_session_duration,
+            };
+        } catch (err) {
+            dbg.error(`AccountSpaceFS.${action} error`, err);
+            throw err;
+        }
     }
 
+    // 1 - check requesting account is root
+    // 2 - read role from filesystem
     async get_role(params, account_sdk) {
         const action = IAM_ACTIONS.GET_ROLE;
         dbg.log1(`AccountSpaceFS.${action}`, params);
-        const { code, http_code, type } = IamError.NotImplemented;
-        throw new IamError({ code, message: 'NotImplemented', http_code, type });
+        try {
+            const requesting_account = account_sdk.requesting_account;
+            this._check_if_requesting_account_is_root_account(action, requesting_account, {});
+            const owner_account_id = requesting_account._id;
+            const role_data = await this.config_fs.get_role_by_name(params.role_name, owner_account_id);
+            if (!role_data) {
+                const { code, http_code, type } = IamError.NoSuchEntity;
+                throw new IamError({ code, message: `The role with name ${params.role_name} cannot be found.`, http_code, type });
+            }
+            const arn = create_arn_for_role(owner_account_id, role_data.name, role_data.iam_path);
+            return {
+                role_name: role_data.name,
+                role_id: role_data._id,
+                iam_path: role_data.iam_path || IAM_DEFAULT_PATH,
+                arn,
+                create_date: role_data.creation_date,
+                assume_role_policy_document: role_data.assume_role_policy_document,
+                description: role_data.description,
+                max_session_duration: role_data.max_session_duration,
+            };
+        } catch (err) {
+            dbg.error(`AccountSpaceFS.${action} error`, err);
+            throw err;
+        }
     }
 
+    // 1 - check requesting account is root
+    // 2 - read role, apply updates (description / max_session_duration), rewrite
     async update_role(params, account_sdk) {
         const action = IAM_ACTIONS.UPDATE_ROLE;
         dbg.log1(`AccountSpaceFS.${action}`, params);
-        const { code, http_code, type } = IamError.NotImplemented;
-        throw new IamError({ code, message: 'NotImplemented', http_code, type });
+        try {
+            const requesting_account = account_sdk.requesting_account;
+            this._check_if_requesting_account_is_root_account(action, requesting_account, {});
+            const owner_account_id = requesting_account._id;
+            const role_data = await this.config_fs.get_role_by_name(params.role_name, owner_account_id);
+            if (!role_data) {
+                const { code, http_code, type } = IamError.NoSuchEntity;
+                throw new IamError({ code, message: `The role with name ${params.role_name} cannot be found.`, http_code, type });
+            }
+            if (params.description !== undefined) role_data.description = params.description;
+            if (params.max_session_duration !== undefined) role_data.max_session_duration = params.max_session_duration;
+            await this.config_fs.update_role_config_file(role_data);
+            return {};
+        } catch (err) {
+            dbg.error(`AccountSpaceFS.${action} error`, err);
+            throw err;
+        }
     }
 
+    // 1 - check requesting account is root
+    // 2 - read role then delete its files and symlink
     async delete_role(params, account_sdk) {
         const action = IAM_ACTIONS.DELETE_ROLE;
         dbg.log1(`AccountSpaceFS.${action}`, params);
-        const { code, http_code, type } = IamError.NotImplemented;
-        throw new IamError({ code, message: 'NotImplemented', http_code, type });
+        try {
+            const requesting_account = account_sdk.requesting_account;
+            this._check_if_requesting_account_is_root_account(action, requesting_account, {});
+            const owner_account_id = requesting_account._id;
+            const role_data = await this.config_fs.get_role_by_name(params.role_name, owner_account_id);
+            if (!role_data) {
+                const { code, http_code, type } = IamError.NoSuchEntity;
+                throw new IamError({ code, message: `The role with name ${params.role_name} cannot be found.`, http_code, type });
+            }
+            await this.config_fs.delete_role_config_file(role_data);
+        } catch (err) {
+            dbg.error(`AccountSpaceFS.${action} error`, err);
+            throw err;
+        }
     }
 
+    // 1 - check requesting account is root
+    // 2 - list roles under the account from filesystem
     async list_roles(params, account_sdk) {
         const action = IAM_ACTIONS.LIST_ROLES;
-        dbg.log1(`AccountSpaceFS.${action} (returns empty list on every request)`, params);
-        const is_truncated = false;
-        const members = [];
-        return { members, is_truncated };
+        dbg.log1(`AccountSpaceFS.${action}`, params);
+        try {
+            const requesting_account = account_sdk.requesting_account;
+            this._check_if_requesting_account_is_root_account(action, requesting_account, {});
+            const owner_account_id = requesting_account._id;
+            const is_truncated = false;
+            const members = await this._list_config_files_for_roles(owner_account_id, params.iam_path_prefix);
+            return { members, is_truncated };
+        } catch (err) {
+            dbg.error(`AccountSpaceFS.${action} error`, err);
+            throw err;
+        }
+    }
+
+    /**
+     * get_role_by_arn resolves a role (and owner access key) from a role ARN via config_fs.
+     * NC-only helper used by STS AssumeRole and S3 assumed-role identity policy checks.
+     * @param {{ role_arn: string }} params
+     * @returns {Promise<{iam_role?: object, account_id?: string, role_name?: string, access_key?: string, error?: string}>}
+     */
+    async get_role_by_arn(params) {
+        const parsed = parse_role_arn(params.role_arn);
+        if (parsed.error) return { error: parsed.error };
+        const { account_id, role_name } = parsed;
+        const iam_role = await this.config_fs.get_role_by_name(role_name, account_id, { silent_if_missing: true });
+        if (!iam_role) return { error: 'NO_SUCH_ROLE', account_id, role_name };
+
+        const owner_account = await this.config_fs.get_identity_by_id(account_id, CONFIG_TYPES.ACCOUNT,
+            { show_secrets: true, decrypt_secret_key: true });
+        if (!owner_account) {
+            return { error: 'NO_SUCH_ACCOUNT', account_id, role_name };
+        }
+        if (!owner_account.access_keys?.length) {
+            return { error: 'ACCESS_DENIED', account_id, role_name };
+        }
+        const raw_access_key = owner_account.access_keys[0].access_key;
+        const access_key = typeof raw_access_key === 'string' ? raw_access_key : raw_access_key.unwrap();
+        return { iam_role, account_id, role_name, access_key };
     }
 
     async put_role_policy(params, account_sdk) {
@@ -654,11 +779,27 @@ class AccountSpaceFS {
         return { members, is_truncated };
     }
 
+    // 1 - check requesting account is root
+    // 2 - read role, replace assume_role_policy_document, rewrite
     async update_assume_role_policy(params, account_sdk) {
         const action = IAM_ACTIONS.UPDATE_ASSUME_ROLE_POLICY;
         dbg.log1(`AccountSpaceFS.${action}`, params);
-        const { code, http_code, type } = IamError.NotImplemented;
-        throw new IamError({ code, message: 'NotImplemented', http_code, type });
+        try {
+            const requesting_account = account_sdk.requesting_account;
+            this._check_if_requesting_account_is_root_account(action, requesting_account, {});
+            const owner_account_id = requesting_account._id;
+            const role_data = await this.config_fs.get_role_by_name(params.role_name, owner_account_id);
+            if (!role_data) {
+                const { code, http_code, type } = IamError.NoSuchEntity;
+                throw new IamError({ code, message: `The role with name ${params.role_name} cannot be found.`, http_code, type });
+            }
+            role_data.assume_role_policy_document = params.policy_document;
+            await this.config_fs.update_role_config_file(role_data);
+            return {};
+        } catch (err) {
+            dbg.error(`AccountSpaceFS.${action} error`, err);
+            throw err;
+        }
     }
 
     ////////////////////////
@@ -701,6 +842,59 @@ class AccountSpaceFS {
         return user_defaults;
     }
 
+    /**
+     * _new_role_defaults builds the initial role data object for a CreateRole call.
+     * @param {object} requesting_account
+     * @param {object} params
+     * @returns {object}
+     */
+    _new_role_defaults(requesting_account, params) {
+        return {
+            _id: generate_id(),
+            name: params.role_name,
+            owner: requesting_account._id,
+            iam_path: params.iam_path || IAM_DEFAULT_PATH,
+            creation_date: new Date().toISOString(),
+            description: params.description || '',
+            max_session_duration: params.max_session_duration || DEFAULT_MAX_SESSION_DURATION_SECS,
+            assume_role_policy_document: params.assume_role_policy_document || {},
+            nsfs_account_config: requesting_account.nsfs_account_config?.distinguished_name ?
+                { distinguished_name: requesting_account.nsfs_account_config.distinguished_name } :
+                { uid: requesting_account.nsfs_account_config?.uid, gid: requesting_account.nsfs_account_config?.gid }
+        };
+    }
+
+    /**
+     * _list_config_files_for_roles reads every role under an owner account and returns member objects.
+     * @param {string} owner_account_id
+     * @param {string} [iam_path_prefix]
+     * @returns {Promise<object[]>}
+     */
+    async _list_config_files_for_roles(owner_account_id, iam_path_prefix) {
+        const role_names = await this.config_fs.list_roles_under_account(owner_account_id);
+        const should_filter_by_prefix = check_iam_path_was_set(iam_path_prefix);
+
+        const members = await P.map_with_concurrency(10, role_names, async role_name => {
+            const role_data = await this.config_fs.get_role_by_name(role_name, owner_account_id);
+            if (!role_data) return undefined;
+            if (should_filter_by_prefix) {
+                if (!role_data.iam_path?.startsWith(iam_path_prefix)) return undefined;
+            }
+            const arn = create_arn_for_role(owner_account_id, role_data.name, role_data.iam_path);
+            return {
+                role_name: role_data.name,
+                role_id: role_data._id,
+                iam_path: role_data.iam_path || IAM_DEFAULT_PATH,
+                arn,
+                create_date: role_data.creation_date,
+                assume_role_policy_document: role_data.assume_role_policy_document,
+                description: role_data.description,
+                max_session_duration: role_data.max_session_duration,
+            };
+        });
+        return members.filter(item => item !== undefined);
+    }
+
     _check_root_account(account) {
         return account.owner === undefined;
     }