zrok/controller/unaccess.go

package controller

import (
	"fmt"

	"github.com/go-openapi/runtime/middleware"
	"github.com/michaelquigley/df/dl"
	"github.com/openziti/zrok/v2/controller/automation"
	"github.com/openziti/zrok/v2/controller/store"
	"github.com/openziti/zrok/v2/rest_model_zrok"
	"github.com/openziti/zrok/v2/rest_server_zrok/operations/share"
)

type unaccessHandler struct{}

func newUnaccessHandler() *unaccessHandler {
	return &unaccessHandler{}
}

func (h *unaccessHandler) Handle(params share.UnaccessParams, principal *rest_model_zrok.Principal) middleware.Responder {
	feToken := params.Body.FrontendToken
	shrToken := params.Body.ShareToken
	envZId := params.Body.EnvZID
	dl.Infof("processing unaccess request for frontend '%v' (share '%v', environment '%v')", feToken, shrToken, envZId)

	trx, err := str.Begin()
	if err != nil {
		dl.Errorf("error starting transaction: %v", err)
		return share.NewUnaccessInternalServerError()
	}
	defer func() { _ = trx.Rollback() }()

	var senv *store.Environment
	if envs, err := str.FindEnvironmentsForAccount(int(principal.ID), trx); err == nil {
		for _, env := range envs {
			if env.ZId == envZId {
				senv = env
				break
			}
		}
		if senv == nil {
			dl.Errorf("environment with id '%v' not found for '%v", envZId, principal.Email)
			return share.NewUnaccessUnauthorized()
		}
	} else {
		dl.Errorf("error finding environments for account '%v': %v", principal.Email, err)
		return share.NewUnaccessUnauthorized()
	}

	sfe, err := str.FindFrontendWithTokenAndEnvironment(feToken, senv.Id, trx)
	if err != nil {
		dl.Errorf("frontend named '%v' not found or not owned by environment '%v': %v", feToken, envZId, err)
		return share.NewUnaccessNotFound()
	}

	if err := str.DeleteFrontend(sfe.Id, trx); err != nil {
		dl.Errorf("error deleting frontend named '%v': %v", feToken, err)
		return share.NewUnaccessNotFound()
	}

	ziti, err := automation.NewZitiAutomation(cfg.Ziti)
	if err != nil {
		dl.Error(err)
		return share.NewUnaccessInternalServerError()
	}

	filter := fmt.Sprintf("tags.zrokShareToken=\"%v\" and tags.zrokFrontendToken=\"%v\" and type=1", shrToken, feToken)
	if err := ziti.ServicePolicies.DeleteWithFilter(filter); err != nil {
		dl.Errorf("error removing access to '%v' for '%v': %v", shrToken, envZId, err)
		return share.NewUnaccessInternalServerError()
	}

	if err := trx.Commit(); err != nil {
		dl.Errorf("error committing frontend '%v' delete: %v", feToken, err)
		return share.NewUnaccessInternalServerError()
	}

	return share.NewUnaccessOK()
}