Merge pull request #208 from cofide/me/add-resource-uuid

markgoddard · web-flow · commit edbb5a2c3970 · 2025-05-12T15:06:21.000+01:00
Add UUIDs to local resources
diff --git a/internal/pkg/config/schema.cue b/internal/pkg/config/schema.cue
@@ -1,6 +1,7 @@
 #DataSource: string
 
 #TrustZone: {
+	id?: string
 	name!: string
 	trust_domain!: string
 	bundle_endpoint_url?: string
@@ -32,6 +33,7 @@
 }
 
 #Cluster: {
+	id?: string
 	name!: string
 	trust_zone!: string
 	kubernetes_context!: string
@@ -47,12 +49,14 @@
 }
 
 #APBinding: {
+	id?: string
 	trust_zone!: string
 	policy!: string
 	federates_with: [...string]
 }
 
 #AttestationPolicy: {
+	id?: string
 	name!: string
 	#APKubernetes | #APStatic
 }
@@ -89,6 +93,7 @@
 }
 
 #Federation: {
+	id?: string
 	from!: string
 	to!: string
 }
diff --git a/internal/pkg/config/validator_test.go b/internal/pkg/config/validator_test.go
@@ -94,7 +94,7 @@ func TestValidator_ValidateInvalid(t *testing.T) {
 		{
 			name:    "missing attestation policy field",
 			data:    string(readTestConfig(t, "missing_attestation_policy_field.yaml")),
-			wantErr: "attestation_policies.0: incomplete value {name:\"ap1\",kubernetes?:{namespace_selector?:{match_labels?:{},match_expressions?:[]},pod_selector?:{match_labels?:{},match_expressions?:[]}}} | {name:\"ap1\",static?:{spiffe_id!:string,selectors!:[]}}",
+			wantErr: "attestation_policies.0: incomplete value {name:\"ap1\",id?:string,kubernetes?:{namespace_selector?:{match_labels?:{},match_expressions?:[]},pod_selector?:{match_labels?:{},match_expressions?:[]}}} | {name:\"ap1\",id?:string,static?:{spiffe_id!:string,selectors!:[]}}",
 		},
 		{
 			name:    "plugins not a map",
diff --git a/pkg/plugin/local/local.go b/pkg/plugin/local/local.go
@@ -18,8 +18,19 @@ import (
 	"github.com/cofide/cofidectl/internal/pkg/config"
 	"github.com/cofide/cofidectl/internal/pkg/proto"
 	"github.com/cofide/cofidectl/pkg/plugin/datasource"
+
+	"github.com/google/uuid"
 )
 
+func generateId() (*string, error) {
+	uid, err := uuid.NewUUID()
+	if err != nil {
+		return nil, fmt.Errorf("failed to generate UUID: %w", err)
+	}
+	id := uid.String()
+	return &id, nil
+}
+
 var _ datasource.DataSource = (*LocalDataSource)(nil)
 
 type LocalDataSource struct {
@@ -70,10 +81,20 @@ func (lds *LocalDataSource) updateDataFile() error {
 }
 
 func (lds *LocalDataSource) AddTrustZone(trustZone *trust_zone_proto.TrustZone) (*trust_zone_proto.TrustZone, error) {
+	if trustZone.GetId() != "" {
+		return nil, fmt.Errorf("trust zone %s should not have an ID set, this will be auto generated", trustZone.GetId())
+	}
+
+	id, err := generateId()
+	if err != nil {
+		return nil, fmt.Errorf("failed to generate UUID for trust zone: %w", err)
+	}
+	trustZone.Id = id
+
 	if _, ok := lds.config.GetTrustZoneByName(trustZone.Name); ok {
 		return nil, fmt.Errorf("trust zone %s already exists in local config", trustZone.Name)
 	}
-	trustZone, err := proto.CloneTrustZone(trustZone)
+	trustZone, err = proto.CloneTrustZone(trustZone)
 	if err != nil {
 		return nil, err
 	}
@@ -187,6 +208,15 @@ func (lds *LocalDataSource) AddCluster(cluster *clusterpb.Cluster) (*clusterpb.C
 	name := cluster.GetName()
 	trustZone := cluster.GetTrustZone()
 
+	if cluster.GetId() != "" {
+		return nil, fmt.Errorf("cluster %s should not have an ID set, this will be auto generated", cluster.GetId())
+	}
+	id, err := generateId()
+	if err != nil {
+		return nil, fmt.Errorf("failed to generate UUID for cluster: %w", err)
+	}
+	cluster.Id = id
+
 	if _, ok := lds.config.GetClusterByName(name, trustZone); ok {
 		return nil, fmt.Errorf("cluster %s already exists in trust zone %s in local config", name, trustZone)
 	}
@@ -195,7 +225,7 @@ func (lds *LocalDataSource) AddCluster(cluster *clusterpb.Cluster) (*clusterpb.C
 		return nil, fmt.Errorf("trust zone %s already has a cluster", trustZone)
 	}
 
-	cluster, err := proto.CloneCluster(cluster)
+	cluster, err = proto.CloneCluster(cluster)
 	if err != nil {
 		return nil, err
 	}
@@ -306,10 +336,20 @@ func validateTrustProviderUpdate(cluster, tzName string, current, new *trust_pro
 }
 
 func (lds *LocalDataSource) AddAttestationPolicy(policy *attestation_policy_proto.AttestationPolicy) (*attestation_policy_proto.AttestationPolicy, error) {
+	if policy.GetId() != "" {
+		return nil, fmt.Errorf("attestation policy %s should not have an ID set, this will be auto generated", *policy.Id)
+	}
+
+	id, err := generateId()
+	if err != nil {
+		return nil, fmt.Errorf("failed to generate UUID for attestation policy: %w", err)
+	}
+	policy.Id = id
+
 	if _, ok := lds.config.GetAttestationPolicyByName(policy.Name); ok {
 		return nil, fmt.Errorf("attestation policy %s already exists in local config", policy.Name)
 	}
-	policy, err := proto.CloneAttestationPolicy(policy)
+	policy, err = proto.CloneAttestationPolicy(policy)
 	if err != nil {
 		return nil, err
 	}
@@ -364,6 +404,16 @@ func (lds *LocalDataSource) ListAttestationPolicies() ([]*attestation_policy_pro
 }
 
 func (lds *LocalDataSource) AddAPBinding(binding *ap_binding_proto.APBinding) (*ap_binding_proto.APBinding, error) {
+	if binding.GetId() != "" {
+		return nil, fmt.Errorf("attestation policy binding %s should not have an ID set, this will be auto generated", *binding.Id)
+	}
+
+	id, err := generateId()
+	if err != nil {
+		return nil, fmt.Errorf("failed to generate UUID for attestation policy binding: %w", err)
+	}
+	binding.Id = id
+
 	// nolint:staticcheck
 	localTrustZone, ok := lds.config.GetTrustZoneByName(binding.TrustZone)
 	if !ok {
@@ -410,7 +460,7 @@ func (lds *LocalDataSource) AddAPBinding(binding *ap_binding_proto.APBinding) (*
 		}
 	}
 
-	binding, err := proto.CloneAPBinding(binding)
+	binding, err = proto.CloneAPBinding(binding)
 	if err != nil {
 		return nil, err
 	}
@@ -477,6 +527,13 @@ func (lds *LocalDataSource) ListAPBindings(filter *datasourcepb.ListAPBindingsRe
 }
 
 func (lds *LocalDataSource) AddFederation(federationProto *federation_proto.Federation) (*federation_proto.Federation, error) {
+	if federationProto.Id == nil || *federationProto.Id == "" {
+		id, err := generateId()
+		if err != nil {
+			return nil, fmt.Errorf("failed to generate UUID for federation: %w", err)
+		}
+		federationProto.Id = id
+	}
 	// nolint:staticcheck
 	fromTrustZone, ok := lds.config.GetTrustZoneByName(federationProto.From)
 	if !ok {
diff --git a/pkg/plugin/local/local_test.go b/pkg/plugin/local/local_test.go
@@ -132,6 +132,7 @@ func TestLocalDataSource_AddTrustZone(t *testing.T) {
 				gotTrustZone, ok := gotConfig.GetTrustZoneByName(tt.trustZone.Name)
 				assert.True(t, ok)
 				assert.EqualExportedValues(t, tt.trustZone, gotTrustZone)
+				assert.NotNil(t, gotTrustZone.Id)
 			}
 		})
 	}
@@ -447,6 +448,7 @@ func TestLocalDataSource_AddCluster(t *testing.T) {
 				gotCluster, ok := gotConfig.GetClusterByName(tt.cluster.GetName(), tt.cluster.GetTrustZone())
 				assert.True(t, ok)
 				assert.EqualExportedValues(t, tt.cluster, gotCluster)
+				assert.NotNil(t, gotCluster.Id)
 			}
 		})
 	}
@@ -775,6 +777,7 @@ func TestLocalDataSource_AddAttestationPolicy(t *testing.T) {
 				gotPolicy, ok := gotConfig.GetAttestationPolicyByName(tt.policy.Name)
 				assert.True(t, ok)
 				assert.EqualExportedValues(t, tt.policy, gotPolicy)
+				assert.NotNil(t, gotPolicy.Id)
 			}
 		})
 	}
@@ -1025,6 +1028,7 @@ func TestLocalDataSource_AddAPBinding(t *testing.T) {
 				// nolint:staticcheck
 				gotBinding := gotConfig.TrustZones[0].AttestationPolicies[1]
 				assert.EqualExportedValues(t, tt.binding, gotBinding)
+				assert.NotNil(t, gotBinding.Id)
 			}
 		})
 	}
@@ -1268,6 +1272,7 @@ func TestLocalDataSource_AddFederation(t *testing.T) {
 				// nolint:staticcheck
 				gotFederation := gotConfig.TrustZones[0].Federations[1]
 				assert.EqualExportedValues(t, tt.federation, gotFederation)
+				assert.NotNil(t, gotFederation.Id)
 			}
 		})
 	}

Original file line number	Diff line number	Diff line change
`@@ -1,6 +1,7 @@`
`1`	`1`	`#DataSource: string`
`2`	`2`
`3`	`3`	`#TrustZone: {`
	`4`	`+ id?: string`
`4`	`5`	`name!: string`
`5`	`6`	`trust_domain!: string`
`6`	`7`	`bundle_endpoint_url?: string`
`@@ -32,6 +33,7 @@`
`32`	`33`	`}`
`33`	`34`
`34`	`35`	`#Cluster: {`
	`36`	`+ id?: string`
`35`	`37`	`name!: string`
`36`	`38`	`trust_zone!: string`
`37`	`39`	`kubernetes_context!: string`
`@@ -47,12 +49,14 @@`
`47`	`49`	`}`
`48`	`50`
`49`	`51`	`#APBinding: {`
	`52`	`+ id?: string`
`50`	`53`	`trust_zone!: string`
`51`	`54`	`policy!: string`
`52`	`55`	`federates_with: [...string]`
`53`	`56`	`}`
`54`	`57`
`55`	`58`	`#AttestationPolicy: {`
	`59`	`+ id?: string`
`56`	`60`	`name!: string`
`57`	`61`	`#APKubernetes \| #APStatic`
`58`	`62`	`}`
`@@ -89,6 +93,7 @@`
`89`	`93`	`}`
`90`	`94`
`91`	`95`	`#Federation: {`
	`96`	`+ id?: string`
`92`	`97`	`from!: string`
`93`	`98`	`to!: string`
`94`	`99`	`}`
Original file line number	Diff line number	Diff line change
`@@ -94,7 +94,7 @@ func TestValidator_ValidateInvalid(t *testing.T) {`
`94`	`94`	`{`
`95`	`95`	`name: "missing attestation policy field",`
`96`	`96`	`data: string(readTestConfig(t, "missing_attestation_policy_field.yaml")),`
`97`		`- wantErr: "attestation_policies.0: incomplete value {name:\"ap1\",kubernetes?:{namespace_selector?:{match_labels?:{},match_expressions?:[]},pod_selector?:{match_labels?:{},match_expressions?:[]}}} \| {name:\"ap1\",static?:{spiffe_id!:string,selectors!:[]}}",`
	`97`	`+ wantErr: "attestation_policies.0: incomplete value {name:\"ap1\",id?:string,kubernetes?:{namespace_selector?:{match_labels?:{},match_expressions?:[]},pod_selector?:{match_labels?:{},match_expressions?:[]}}} \| {name:\"ap1\",id?:string,static?:{spiffe_id!:string,selectors!:[]}}",`
`98`	`98`	`},`
`99`	`99`	`{`
`100`	`100`	`name: "plugins not a map",`
Original file line number	Diff line number	Diff line change
`@@ -132,6 +132,7 @@ func TestLocalDataSource_AddTrustZone(t *testing.T) {`
`132`	`132`	`gotTrustZone, ok := gotConfig.GetTrustZoneByName(tt.trustZone.Name)`
`133`	`133`	`assert.True(t, ok)`
`134`	`134`	`assert.EqualExportedValues(t, tt.trustZone, gotTrustZone)`
	`135`	`+ assert.NotNil(t, gotTrustZone.Id)`
`135`	`136`	`}`
`136`	`137`	`})`
`137`	`138`	`}`
`@@ -447,6 +448,7 @@ func TestLocalDataSource_AddCluster(t *testing.T) {`
`447`	`448`	`gotCluster, ok := gotConfig.GetClusterByName(tt.cluster.GetName(), tt.cluster.GetTrustZone())`
`448`	`449`	`assert.True(t, ok)`
`449`	`450`	`assert.EqualExportedValues(t, tt.cluster, gotCluster)`
	`451`	`+ assert.NotNil(t, gotCluster.Id)`
`450`	`452`	`}`
`451`	`453`	`})`
`452`	`454`	`}`
`@@ -775,6 +777,7 @@ func TestLocalDataSource_AddAttestationPolicy(t *testing.T) {`
`775`	`777`	`gotPolicy, ok := gotConfig.GetAttestationPolicyByName(tt.policy.Name)`
`776`	`778`	`assert.True(t, ok)`
`777`	`779`	`assert.EqualExportedValues(t, tt.policy, gotPolicy)`
	`780`	`+ assert.NotNil(t, gotPolicy.Id)`
`778`	`781`	`}`
`779`	`782`	`})`
`780`	`783`	`}`
`@@ -1025,6 +1028,7 @@ func TestLocalDataSource_AddAPBinding(t *testing.T) {`
`1025`	`1028`	`// nolint:staticcheck`
`1026`	`1029`	`gotBinding := gotConfig.TrustZones[0].AttestationPolicies[1]`
`1027`	`1030`	`assert.EqualExportedValues(t, tt.binding, gotBinding)`
	`1031`	`+ assert.NotNil(t, gotBinding.Id)`
`1028`	`1032`	`}`
`1029`	`1033`	`})`
`1030`	`1034`	`}`
`@@ -1268,6 +1272,7 @@ func TestLocalDataSource_AddFederation(t *testing.T) {`
`1268`	`1272`	`// nolint:staticcheck`
`1269`	`1273`	`gotFederation := gotConfig.TrustZones[0].Federations[1]`
`1270`	`1274`	`assert.EqualExportedValues(t, tt.federation, gotFederation)`
	`1275`	`+ assert.NotNil(t, gotFederation.Id)`
`1271`	`1276`	`}`
`1272`	`1277`	`})`
`1273`	`1278`	`}`