bmc/auth.h

#ifndef PRODUCTION_BORG_MGMT_NODE_PROXY_SAFEPOWER_SAFEPOWER_AGENT_BMC_AUTH_H_
#define PRODUCTION_BORG_MGMT_NODE_PROXY_SAFEPOWER_SAFEPOWER_AGENT_BMC_AUTH_H_

#include <filesystem>  // NOLINT(build/c++17)
#include <memory>
#include <string>
#include <utility>

#include "bmc/auth_file_helper.h"
#include "absl/status/status.h"
#include "absl/status/statusor.h"
#include "absl/strings/string_view.h"
#include "absl/time/time.h"
#include "grpcpp/security/authorization_policy_provider.h"
#include "grpcpp/security/server_credentials.h"
#include "grpcpp/security/tls_certificate_provider.h"

namespace auth {

constexpr absl::string_view kGpowerDCertAuthZPolicy =
    "/var/google/authz_policies/gpowerd_authz_policy.json";
constexpr absl::string_view kTrustBundleFilePath =
    "/var/google/trust_bundle/trust_bundle.pem";

constexpr absl::string_view kSelfSignedCertPath = "/run/gpowerd/server.pem";
constexpr absl::string_view kSymlinkPath = "/run/gpowerd/server.pem.link";
constexpr absl::string_view kLoas3CertPath = "/var/volatile/prodid/server.pem";
constexpr absl::string_view kGmiFilePath =
    "/var/google/googlemachineidentity/live/machine_identity.pb";
constexpr absl::Duration kScanInterval = absl::Seconds(30);

class AuthManager {
 public:
  // TODO: b/454436186 - every file path should be in the configs
  // args only for testing, production uses defaults
  explicit AuthManager(std::filesystem::path
                           symlink_path = std::string(kSymlinkPath),
              std::filesystem::path loas3_cert_path =
                  std::string(kLoas3CertPath),
              std::filesystem::path self_signed_cert_path =
                  std::string(kSelfSignedCertPath),
              std::filesystem::path gmi_file_path =
                  std::string(kGmiFilePath),
              std::filesystem::path trust_bundle_file_path =
                  std::string(kTrustBundleFilePath),
              absl::Duration scan_interval = kScanInterval,
              std::string policy_file_path =
                  std::string(kGpowerDCertAuthZPolicy)
              )
      : symlink_path_(std::move(symlink_path)),
        loas3_cert_path_(std::move(loas3_cert_path)),
        self_signed_cert_path_(std::move(self_signed_cert_path)),
        gmi_file_path_(std::move(gmi_file_path)),
        trust_bundle_file_path_(std::move(trust_bundle_file_path)),
        scan_interval_(std::move(scan_interval)),
        policy_file_path_(std::move(policy_file_path)),
        auth_file_helper_(std::make_unique<AuthFileHelper>(
            gmi_file_path_, self_signed_cert_path_)) {}

  absl::StatusOr<std::shared_ptr<grpc::ServerCredentials>>
                  GetCredsInfo();
  absl::StatusOr<
    std::shared_ptr<::grpc::experimental::AuthorizationPolicyProviderInterface>>
  GetAuthPolicy();

  absl::StatusOr<
    std::shared_ptr<::grpc::experimental::FileWatcherCertificateProvider>>
  GetProvider();

  // public for testing
  absl::Status CreateCertsSymlinkUpdate();

 private:
  // file paths need to persist for the duration watchers.
  std::filesystem::path symlink_path_;
  std::filesystem::path loas3_cert_path_;
  std::filesystem::path self_signed_cert_path_;
  std::filesystem::path gmi_file_path_;
  std::filesystem::path trust_bundle_file_path_;
  absl::Duration scan_interval_;
  std::string policy_file_path_;
  std::unique_ptr<AuthFileHelper> auth_file_helper_;

  std::shared_ptr<::grpc::experimental::FileWatcherCertificateProvider>
  certificate_provider_;

  void UpdateCertSymlink();

  absl::Status GetCertificateProvider();

  absl::StatusOr<std::shared_ptr<grpc::ServerCredentials>>
      getTLSServerCredentials();
};

}  // namespace auth

#endif  // PRODUCTION_BORG_MGMT_NODE_PROXY_SAFEPOWER_SAFEPOWER_AGENT_BMC_AUTH_H_