115 lines
3.1 KiB
Go
115 lines
3.1 KiB
Go
// Package model defines the data types persisted as the tool's state:
|
|
// hosts grouped into access groups, and users assigned to those groups.
|
|
package model
|
|
|
|
import "time"
|
|
|
|
// Host is one jump-target reachable via port forwarding through the bastion.
|
|
type Host struct {
|
|
Name string `yaml:"name"` // short identifier, e.g. "db-prod-1"
|
|
Address string `yaml:"address"` // hostname or IP as seen from the jump host
|
|
Port int `yaml:"port"` // TCP port allowed for forwarding
|
|
Description string `yaml:"description,omitempty"`
|
|
}
|
|
|
|
// Group bundles hosts that share the same access policy (e.g. "team-billing").
|
|
// Users are assigned to one or more groups; their effective allowed hosts are
|
|
// the union of all hosts in their groups.
|
|
type Group struct {
|
|
Name string `yaml:"name"`
|
|
Hosts []Host `yaml:"hosts"`
|
|
}
|
|
|
|
// UserStatus is the lifecycle state of a managed account.
|
|
type UserStatus string
|
|
|
|
const (
|
|
StatusActive UserStatus = "active"
|
|
StatusLocked UserStatus = "locked"
|
|
)
|
|
|
|
// User is one managed Linux/SSH account on the jump host.
|
|
type User struct {
|
|
Username string `yaml:"username"`
|
|
Groups []string `yaml:"groups"`
|
|
Status UserStatus `yaml:"status"`
|
|
Fingerprint string `yaml:"fingerprint"` // SHA256 fingerprint of the current authorized public key
|
|
PublicKey string `yaml:"public_key,omitempty"` // full "ssh-ed25519 AAAA... comment" line; safe to store/back up (public), lets us rewrite authorized_keys (e.g. after a group's host list changes) without re-issuing the keypair
|
|
Comment string `yaml:"comment,omitempty"`
|
|
CreatedAt time.Time `yaml:"created_at"`
|
|
LockedAt *time.Time `yaml:"locked_at,omitempty"`
|
|
}
|
|
|
|
// State is the full persisted configuration of the tool.
|
|
type State struct {
|
|
Groups []Group `yaml:"groups"`
|
|
Users []User `yaml:"users"`
|
|
}
|
|
|
|
// FindGroup returns a pointer to the group with the given name, or nil.
|
|
func (s *State) FindGroup(name string) *Group {
|
|
for i := range s.Groups {
|
|
if s.Groups[i].Name == name {
|
|
return &s.Groups[i]
|
|
}
|
|
}
|
|
return nil
|
|
}
|
|
|
|
// FindUser returns a pointer to the user with the given username, or nil.
|
|
func (s *State) FindUser(username string) *User {
|
|
for i := range s.Users {
|
|
if s.Users[i].Username == username {
|
|
return &s.Users[i]
|
|
}
|
|
}
|
|
return nil
|
|
}
|
|
|
|
// AllowedHosts returns the de-duplicated union of hosts across all groups
|
|
// the user belongs to, sorted by "name" for stable authorized_keys output.
|
|
func (s *State) AllowedHosts(u *User) []Host {
|
|
seen := map[string]Host{}
|
|
order := []string{}
|
|
for _, gname := range u.Groups {
|
|
g := s.FindGroup(gname)
|
|
if g == nil {
|
|
continue
|
|
}
|
|
for _, h := range g.Hosts {
|
|
key := h.Address + ":" + itoa(h.Port)
|
|
if _, ok := seen[key]; !ok {
|
|
order = append(order, key)
|
|
}
|
|
seen[key] = h
|
|
}
|
|
}
|
|
out := make([]Host, 0, len(order))
|
|
for _, k := range order {
|
|
out = append(out, seen[k])
|
|
}
|
|
return out
|
|
}
|
|
|
|
func itoa(n int) string {
|
|
if n == 0 {
|
|
return "0"
|
|
}
|
|
neg := n < 0
|
|
if neg {
|
|
n = -n
|
|
}
|
|
var buf [20]byte
|
|
i := len(buf)
|
|
for n > 0 {
|
|
i--
|
|
buf[i] = byte('0' + n%10)
|
|
n /= 10
|
|
}
|
|
if neg {
|
|
i--
|
|
buf[i] = '-'
|
|
}
|
|
return string(buf[i:])
|
|
}
|