Skip to content

Commit 486964e

Browse files
jhrvjhrv
committed
refactor: fjern elevation-konseptet fra CLI
- Rename elevation.go til secret.go - Fjern deprecated CreateElevation og EnsureSecretAccess funksjoner - Bruk GetSecretValues direkte - Elevation er nå internt i API
1 parent 0747c3b commit 486964e

9 files changed

Lines changed: 74 additions & 160 deletions

File tree

‎internal/naisapi/elevation.go‎

Lines changed: 0 additions & 125 deletions
This file was deleted.

‎internal/naisapi/secret.go‎

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
package naisapi
2+
3+
import (
4+
"context"
5+
"fmt"
6+
7+
"github.com/nais/cli/internal/naisapi/gql"
8+
)
9+
10+
// SecretValue represents a key-value pair from a secret
11+
type SecretValue struct {
12+
Name string
13+
Value string
14+
}
15+
16+
// ViewSecretValues retrieves the values of a secret. This requires team membership
17+
// and a reason for access. The access is logged for auditing purposes.
18+
func ViewSecretValues(ctx context.Context, team, environmentName, secretName, reason string) ([]SecretValue, error) {
19+
_ = `# @genqlient
20+
mutation ViewSecretValues($input: ViewSecretValuesInput!) {
21+
viewSecretValues(input: $input) {
22+
values {
23+
name
24+
value
25+
}
26+
}
27+
}
28+
`
29+
30+
client, err := GraphqlClient(ctx)
31+
if err != nil {
32+
return nil, fmt.Errorf("creating GraphQL client: %w", err)
33+
}
34+
35+
resp, err := gql.ViewSecretValues(ctx, client, gql.ViewSecretValuesInput{
36+
Name: secretName,
37+
Environment: environmentName,
38+
Team: team,
39+
Reason: reason,
40+
})
41+
if err != nil {
42+
return nil, fmt.Errorf("viewing secret values: %w", err)
43+
}
44+
45+
values := make([]SecretValue, len(resp.ViewSecretValues.Values))
46+
for i, v := range resp.ViewSecretValues.Values {
47+
values[i] = SecretValue{
48+
Name: v.Name,
49+
Value: v.Value,
50+
}
51+
}
52+
53+
return values, nil
54+
}

‎internal/postgres/access.go‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -35,8 +35,8 @@ var (
3535
)
3636

3737
func PrepareAccess(ctx context.Context, appName string, namespace flag.Namespace, cluster flag.Context, schema string, allPrivs bool, out *naistrix.OutputWriter) error {
38-
// Ensure we have elevated access to read the database secret (hardcoded reason for administrative operation)
39-
if err := EnsureSecretAccess(ctx, appName, namespace, cluster, ReasonPrepareAccess, out); err != nil {
38+
// Get secret values (access is logged for audit purposes)
39+
if _, err := GetSecretValues(ctx, appName, namespace, cluster, ReasonPrepareAccess, out); err != nil {
4040
return err
4141
}
4242

@@ -55,8 +55,8 @@ func PrepareAccess(ctx context.Context, appName string, namespace flag.Namespace
5555
}
5656

5757
func RevokeAccess(ctx context.Context, appName string, namespace flag.Namespace, cluster flag.Context, schema string, out *naistrix.OutputWriter) error {
58-
// Ensure we have elevated access to read the database secret (hardcoded reason for administrative operation)
59-
if err := EnsureSecretAccess(ctx, appName, namespace, cluster, ReasonRevokeAccess, out); err != nil {
58+
// Get secret values (access is logged for audit purposes)
59+
if _, err := GetSecretValues(ctx, appName, namespace, cluster, ReasonRevokeAccess, out); err != nil {
6060
return err
6161
}
6262

‎internal/postgres/audit.go‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -13,16 +13,16 @@ import (
1313
)
1414

1515
func EnableAuditLogging(ctx context.Context, appName string, cluster flag.Context, namespace flag.Namespace, out *naistrix.OutputWriter) error {
16-
// Ensure we have elevated access to read the database secret (hardcoded reason for administrative operation)
17-
if err := EnsureSecretAccess(ctx, appName, namespace, cluster, ReasonEnableAudit, out); err != nil {
16+
// Get secret values (access is logged for audit purposes)
17+
if _, err := GetSecretValues(ctx, appName, namespace, cluster, ReasonEnableAudit, out); err != nil {
1818
return err
1919
}
2020
return enableAuditAsAppUser(ctx, appName, namespace, cluster, out)
2121
}
2222

2323
func VerifyAuditLogging(ctx context.Context, appName string, cluster flag.Context, namespace flag.Namespace, out *naistrix.OutputWriter) error {
24-
// Ensure we have elevated access to read the database secret (hardcoded reason for administrative operation)
25-
if err := EnsureSecretAccess(ctx, appName, namespace, cluster, ReasonVerifyAudit, out); err != nil {
24+
// Get secret values (access is logged for audit purposes)
25+
if _, err := GetSecretValues(ctx, appName, namespace, cluster, ReasonVerifyAudit, out); err != nil {
2626
return err
2727
}
2828
_, err := verifyAuditAsAppUser(ctx, appName, namespace, cluster, out)

‎internal/postgres/iam.go‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -212,8 +212,8 @@ func formatCondition(expr, title string) string {
212212
}
213213

214214
func ListUsers(ctx context.Context, appName string, cluster flag.Context, namespace flag.Namespace, out *naistrix.OutputWriter) error {
215-
// Ensure we have elevated access to read the database secret (hardcoded reason for administrative operation)
216-
if err := EnsureSecretAccess(ctx, appName, namespace, cluster, ReasonListUsers, out); err != nil {
215+
// Get secret values (access is logged for audit purposes)
216+
if _, err := GetSecretValues(ctx, appName, namespace, cluster, ReasonListUsers, out); err != nil {
217217
return err
218218
}
219219

@@ -261,8 +261,8 @@ func AddUser(ctx context.Context, appName, username, password string, cluster fl
261261
return err
262262
}
263263

264-
// Ensure we have elevated access to read the database secret (hardcoded reason for administrative operation)
265-
if err := EnsureSecretAccess(ctx, appName, namespace, cluster, ReasonAddUser, out); err != nil {
264+
// Get secret values (access is logged for audit purposes)
265+
if _, err := GetSecretValues(ctx, appName, namespace, cluster, ReasonAddUser, out); err != nil {
266266
return err
267267
}
268268

@@ -301,8 +301,8 @@ func AddUser(ctx context.Context, appName, username, password string, cluster fl
301301
}
302302

303303
func DropUser(ctx context.Context, appName string, username string, cluster flag.Context, namespace flag.Namespace, out *naistrix.OutputWriter) error {
304-
// Ensure we have elevated access to read the database secret (hardcoded reason for administrative operation)
305-
if err := EnsureSecretAccess(ctx, appName, namespace, cluster, ReasonDropUser, out); err != nil {
304+
// Get secret values (access is logged for audit purposes)
305+
if _, err := GetSecretValues(ctx, appName, namespace, cluster, ReasonDropUser, out); err != nil {
306306
return err
307307
}
308308

‎internal/postgres/password.go‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -18,8 +18,8 @@ import (
1818
)
1919

2020
func RotatePassword(ctx context.Context, appName string, cluster flag.Context, namespace flag.Namespace, out *naistrix.OutputWriter) error {
21-
// Ensure we have elevated access to read the database secret (hardcoded reason for administrative operation)
22-
if err := EnsureSecretAccess(ctx, appName, namespace, cluster, ReasonPasswordRotate, out); err != nil {
21+
// Get secret values (access is logged for audit purposes)
22+
if _, err := GetSecretValues(ctx, appName, namespace, cluster, ReasonPasswordRotate, out); err != nil {
2323
return err
2424
}
2525

‎internal/postgres/proxy.go‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -12,8 +12,8 @@ import (
1212
)
1313

1414
func RunProxy(ctx context.Context, appName string, cluster flag.Context, namespace flag.Namespace, host string, port uint, verbose bool, reason string, out *naistrix.OutputWriter) error {
15-
// Ensure we have elevated access to read the database secret (user must provide reason)
16-
if err := EnsureSecretAccessWithUserReason(ctx, appName, namespace, cluster, reason, out); err != nil {
15+
// Get secret values with user-provided reason (access is logged for audit purposes)
16+
if _, err := GetSecretValuesWithUserReason(ctx, appName, namespace, cluster, reason, out); err != nil {
1717
return err
1818
}
1919

‎internal/postgres/psql.go‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -12,8 +12,8 @@ import (
1212
)
1313

1414
func RunPSQL(ctx context.Context, appName string, cluster flag.Context, namespace flag.Namespace, reason string, out *naistrix.OutputWriter) error {
15-
// Ensure we have elevated access to read the database secret (user must provide reason)
16-
if err := EnsureSecretAccessWithUserReason(ctx, appName, namespace, cluster, reason, out); err != nil {
15+
// Get secret values with user-provided reason (access is logged for audit purposes)
16+
if _, err := GetSecretValuesWithUserReason(ctx, appName, namespace, cluster, reason, out); err != nil {
1717
return err
1818
}
1919

internal/postgres/elevation.go renamed to internal/postgres/secret.go

Lines changed: 0 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -141,18 +141,3 @@ func GetSecretValuesWithUserReason(ctx context.Context, appName string, namespac
141141

142142
return GetSecretValues(ctx, appName, namespace, cluster, reason, out)
143143
}
144-
145-
// EnsureSecretAccess is deprecated. Use GetSecretValues instead.
146-
// This function is kept for backward compatibility and now calls ViewSecretValues internally.
147-
// Deprecated: Use GetSecretValues instead which returns the secret values directly.
148-
func EnsureSecretAccess(ctx context.Context, appName string, namespace flag.Namespace, cluster flag.Context, reason string, out *naistrix.OutputWriter) error {
149-
_, err := GetSecretValues(ctx, appName, namespace, cluster, reason, out)
150-
return err
151-
}
152-
153-
// EnsureSecretAccessWithUserReason is deprecated. Use GetSecretValuesWithUserReason instead.
154-
// Deprecated: Use GetSecretValuesWithUserReason instead which returns the secret values directly.
155-
func EnsureSecretAccessWithUserReason(ctx context.Context, appName string, namespace flag.Namespace, cluster flag.Context, reason string, out *naistrix.OutputWriter) error {
156-
_, err := GetSecretValuesWithUserReason(ctx, appName, namespace, cluster, reason, out)
157-
return err
158-
}

0 commit comments

Comments
 (0)