Draft: add native space-owned service-account commands

actor/v7action/cloud_controller_client.go

@@ -14,6 +14,11 @@ import (
 
 // CloudControllerClient is the interface to the cloud controller V3 API.
 type CloudControllerClient interface {
+	GetServiceAccount(guid string) (resources.ServiceAccount, ccv3.Warnings, error)
+	DeleteServiceAccount(guid string) (ccv3.JobURL, ccv3.Warnings, error)
+	UpdateServiceAccountEnabled(guid string, enabled bool) (ccv3.JobURL, ccv3.Warnings, error)
+	UpdateApplicationServiceAccount(appGUID string, relationship resources.Relationship) (ccv3.JobURL, ccv3.Warnings, error)
+	GetServiceAccounts(query ...ccv3.Query) ([]resources.ServiceAccount, ccv3.Warnings, error)
 	ApplyOrganizationQuota(quotaGUID string, orgGUID string) (resources.RelationshipList, ccv3.Warnings, error)
 	ApplySpaceQuota(quotaGUID string, spaceGUID string) (resources.RelationshipList, ccv3.Warnings, error)
 	CheckRoute(domainGUID string, hostname string, path string, port int) (bool, ccv3.Warnings, error)
@@ -40,6 +45,7 @@ type CloudControllerClient interface {
 	CreateServiceCredentialBinding(binding resources.ServiceCredentialBinding) (ccv3.JobURL, ccv3.Warnings, error)
 	CreateServiceInstance(serviceInstance resources.ServiceInstance) (ccv3.JobURL, ccv3.Warnings, error)
 	CreateSecurityGroup(securityGroup resources.SecurityGroup) (resources.SecurityGroup, ccv3.Warnings, error)
+	CreateServiceAccount(account resources.ServiceAccount) (resources.ServiceAccount, ccv3.Warnings, error)
 	CreateSpace(space resources.Space) (resources.Space, ccv3.Warnings, error)
 	CreateSpaceQuota(spaceQuota resources.SpaceQuota) (resources.SpaceQuota, ccv3.Warnings, error)
 	CreateUser(userGUID string) (resources.User, ccv3.Warnings, error)

actor/v7action/service_account.go

@@ -0,0 +1,93 @@
+package v7action
+
+import (
+	"fmt"
+
+	"code.cloudfoundry.org/cli/v9/api/cloudcontroller/ccv3"
+	"code.cloudfoundry.org/cli/v9/api/cloudcontroller/ccv3/constant"
+	"code.cloudfoundry.org/cli/v9/resources"
+)
+
+func (actor Actor) GetServiceAccountByNameAndSpace(name, spaceGUID string) (resources.ServiceAccount, Warnings, error) {
+	accounts, warnings, err := actor.CloudControllerClient.GetServiceAccounts(
+		ccv3.Query{Key: ccv3.NameFilter, Values: []string{name}},
+		ccv3.Query{Key: ccv3.SpaceGUIDFilter, Values: []string{spaceGUID}},
+	)
+	allWarnings := Warnings(warnings)
+	if err != nil {
+		return resources.ServiceAccount{}, allWarnings, err
+	}
+	if len(accounts) == 0 {
+		return resources.ServiceAccount{}, allWarnings, fmt.Errorf("Service account '%s' not found in the targeted space.", name)
+	}
+	if len(accounts) != 1 {
+		return resources.ServiceAccount{}, allWarnings, fmt.Errorf("Service account '%s' resolved to multiple accounts.", name)
+	}
+	account, warnings, err := actor.CloudControllerClient.GetServiceAccount(accounts[0].GUID)
+	return account, append(allWarnings, warnings...), err
+}
+
+func (actor Actor) DeleteServiceAccountByNameAndSpace(name, spaceGUID string) (Warnings, error) {
+	account, warnings, err := actor.GetServiceAccountByNameAndSpace(name, spaceGUID)
+	if err != nil {
+		return warnings, err
+	}
+	job, mutationWarnings, err := actor.CloudControllerClient.DeleteServiceAccount(account.GUID)
+	return actor.completeServiceAccountOperation(job, append(warnings, mutationWarnings...), err)
+}
+
+func (actor Actor) SetServiceAccountEnabledByNameAndSpace(name, spaceGUID string, enabled bool) (Warnings, error) {
+	account, warnings, err := actor.GetServiceAccountByNameAndSpace(name, spaceGUID)
+	if err != nil {
+		return warnings, err
+	}
+	job, mutationWarnings, err := actor.CloudControllerClient.UpdateServiceAccountEnabled(account.GUID, enabled)
+	return actor.completeServiceAccountOperation(job, append(warnings, mutationWarnings...), err)
+}
+
+func (actor Actor) BindServiceAccountByNameAndSpace(appName, accountName, spaceGUID string) (Warnings, error) {
+	app, warnings, err := actor.GetApplicationByNameAndSpace(appName, spaceGUID)
+	if err != nil {
+		return warnings, err
+	}
+	account, accountWarnings, err := actor.GetServiceAccountByNameAndSpace(accountName, spaceGUID)
+	warnings = append(warnings, accountWarnings...)
+	if err != nil {
+		return warnings, err
+	}
+	job, mutationWarnings, err := actor.CloudControllerClient.UpdateApplicationServiceAccount(app.GUID, resources.Relationship{GUID: account.GUID})
+	return actor.completeServiceAccountOperation(job, append(warnings, mutationWarnings...), err)
+}
+
+func (actor Actor) UnbindServiceAccountByAppNameAndSpace(appName, spaceGUID string) (Warnings, error) {
+	app, warnings, err := actor.GetApplicationByNameAndSpace(appName, spaceGUID)
+	if err != nil {
+		return warnings, err
+	}
+	job, mutationWarnings, err := actor.CloudControllerClient.UpdateApplicationServiceAccount(app.GUID, resources.Relationship{})
+	return actor.completeServiceAccountOperation(job, append(warnings, mutationWarnings...), err)
+}
+
+func (actor Actor) completeServiceAccountOperation(job ccv3.JobURL, warnings Warnings, err error) (Warnings, error) {
+	if err != nil || job == "" {
+		return warnings, err
+	}
+	pollWarnings, err := actor.CloudControllerClient.PollJob(job)
+	return append(warnings, pollWarnings...), err
+}
+
+func (actor Actor) GetServiceAccountsInSpace(spaceGUID string) ([]resources.ServiceAccount, Warnings, error) {
+	accounts, warnings, err := actor.CloudControllerClient.GetServiceAccounts(ccv3.Query{
+		Key: ccv3.SpaceGUIDFilter, Values: []string{spaceGUID},
+	})
+	return accounts, Warnings(warnings), err
+}
+
+func (actor Actor) CreateServiceAccountInSpace(name, description, spaceGUID string) (resources.ServiceAccount, Warnings, error) {
+	account, warnings, err := actor.CloudControllerClient.CreateServiceAccount(resources.ServiceAccount{
+		Name:          name,
+		Description:   description,
+		Relationships: resources.Relationships{constant.RelationshipTypeSpace: {GUID: spaceGUID}},
+	})
+	return account, Warnings(warnings), err
+}

actor/v7action/service_account_lifecycle_test.go

@@ -0,0 +1,122 @@
+package v7action_test
+
+import (
+	"errors"
+
+	. "code.cloudfoundry.org/cli/v9/actor/v7action"
+	"code.cloudfoundry.org/cli/v9/actor/v7action/v7actionfakes"
+	"code.cloudfoundry.org/cli/v9/api/cloudcontroller/ccv3"
+	"code.cloudfoundry.org/cli/v9/resources"
+	. "github.com/onsi/ginkgo/v2"
+	. "github.com/onsi/gomega"
+)
+
+var _ = Describe("Service Account Lifecycle Actions", func() {
+	var actor *Actor
+	var client *v7actionfakes.FakeCloudControllerClient
+	BeforeEach(func() {
+		client = new(v7actionfakes.FakeCloudControllerClient)
+		actor = NewActor(client, nil, nil, nil, nil, nil)
+		client.GetServiceAccountsReturns([]resources.ServiceAccount{{GUID: "account-guid", Name: "workers"}}, ccv3.Warnings{"lookup warning"}, nil)
+		client.GetServiceAccountReturns(resources.ServiceAccount{GUID: "account-guid", Name: "workers", Status: "ready"}, ccv3.Warnings{"detail warning"}, nil)
+		client.GetApplicationsReturns([]resources.Application{{GUID: "app-guid", Name: "app"}}, ccv3.Warnings{"app warning"}, nil)
+		client.DeleteServiceAccountReturns("job-url", ccv3.Warnings{"mutation warning"}, nil)
+		client.UpdateServiceAccountEnabledReturns("job-url", ccv3.Warnings{"mutation warning"}, nil)
+		client.UpdateApplicationServiceAccountReturns("job-url", ccv3.Warnings{"mutation warning"}, nil)
+		client.PollJobReturns(ccv3.Warnings{"poll warning"}, nil)
+	})
+	It("resolves by name AND owning space, then fetches current detail", func() {
+		account, warnings, err := actor.GetServiceAccountByNameAndSpace("workers", "space-guid")
+		Expect(err).NotTo(HaveOccurred())
+		Expect(account.Status).To(Equal("ready"))
+		Expect(warnings).To(Equal(Warnings{"lookup warning", "detail warning"}))
+		Expect(client.GetServiceAccountsArgsForCall(0)).To(Equal([]ccv3.Query{{Key: ccv3.NameFilter, Values: []string{"workers"}}, {Key: ccv3.SpaceGUIDFilter, Values: []string{"space-guid"}}}))
+		Expect(client.GetServiceAccountArgsForCall(0)).To(Equal("account-guid"))
+	})
+	It("returns a helpful missing-account error without fetching or mutating another space", func() {
+		client.GetServiceAccountsReturns(nil, ccv3.Warnings{"lookup warning"}, nil)
+		_, warnings, err := actor.GetServiceAccountByNameAndSpace("workers", "space-guid")
+		Expect(err).To(MatchError("Service account 'workers' not found in the targeted space."))
+		Expect(warnings).To(ConsistOf("lookup warning"))
+		Expect(client.GetServiceAccountCallCount()).To(BeZero())
+	})
+	DescribeTable("waits for lifecycle completion and preserves every warning", func(operation string) {
+		var warnings Warnings
+		var err error
+		switch operation {
+		case "delete":
+			warnings, err = actor.DeleteServiceAccountByNameAndSpace("workers", "space-guid")
+		case "enable":
+			warnings, err = actor.SetServiceAccountEnabledByNameAndSpace("workers", "space-guid", true)
+		case "disable":
+			warnings, err = actor.SetServiceAccountEnabledByNameAndSpace("workers", "space-guid", false)
+		case "bind":
+			warnings, err = actor.BindServiceAccountByNameAndSpace("app", "workers", "space-guid")
+		case "unbind":
+			warnings, err = actor.UnbindServiceAccountByAppNameAndSpace("app", "space-guid")
+		}
+		Expect(err).NotTo(HaveOccurred())
+		Expect(client.PollJobCallCount()).To(Equal(1))
+		Expect(client.PollJobArgsForCall(0)).To(Equal(ccv3.JobURL("job-url")))
+		Expect(warnings).To(ContainElements("mutation warning", "poll warning"))
+		if operation == "bind" || operation == "unbind" {
+			Expect(client.GetApplicationsArgsForCall(0)).To(ContainElements(ccv3.Query{Key: ccv3.NameFilter, Values: []string{"app"}}, ccv3.Query{Key: ccv3.SpaceGUIDFilter, Values: []string{"space-guid"}}))
+			guid, relationship := client.UpdateApplicationServiceAccountArgsForCall(0)
+			Expect(guid).To(Equal("app-guid"))
+			if operation == "bind" {
+				Expect(relationship.GUID).To(Equal("account-guid"))
+			} else {
+				Expect(relationship.GUID).To(BeEmpty())
+				Expect(client.GetServiceAccountsCallCount()).To(BeZero())
+			}
+		} else if operation == "delete" {
+			Expect(client.DeleteServiceAccountArgsForCall(0)).To(Equal("account-guid"))
+		} else {
+			guid, enabled := client.UpdateServiceAccountEnabledArgsForCall(0)
+			Expect(guid).To(Equal("account-guid"))
+			Expect(enabled).To(Equal(operation == "enable"))
+		}
+	}, Entry("delete", "delete"), Entry("enable", "enable"), Entry("disable", "disable"), Entry("bind", "bind"), Entry("unbind", "unbind"))
+
+	It("does not poll synchronous unbinding", func() {
+		client.UpdateApplicationServiceAccountReturns("", ccv3.Warnings{"restart warning"}, nil)
+		warnings, err := actor.UnbindServiceAccountByAppNameAndSpace("app", "space-guid")
+		Expect(err).NotTo(HaveOccurred())
+		Expect(warnings).To(ContainElement("restart warning"))
+		Expect(client.PollJobCallCount()).To(BeZero())
+	})
+	It("stops binding when account lookup fails", func() {
+		client.GetServiceAccountsReturns(nil, ccv3.Warnings{"lookup warning"}, errors.New("lookup denied"))
+		warnings, err := actor.BindServiceAccountByNameAndSpace("app", "workers", "space-guid")
+		Expect(err).To(MatchError("lookup denied"))
+		Expect(warnings).To(ContainElement("lookup warning"))
+		Expect(client.UpdateApplicationServiceAccountCallCount()).To(BeZero())
+	})
+	It("stops unbinding when app lookup fails", func() {
+		client.GetApplicationsReturns(nil, ccv3.Warnings{"app warning"}, errors.New("app denied"))
+		warnings, err := actor.UnbindServiceAccountByAppNameAndSpace("app", "space-guid")
+		Expect(err).To(MatchError("app denied"))
+		Expect(warnings).To(ContainElement("app warning"))
+		Expect(client.UpdateApplicationServiceAccountCallCount()).To(BeZero())
+	})
+	It("stops deletion on detail failure", func() {
+		client.GetServiceAccountReturns(resources.ServiceAccount{}, ccv3.Warnings{"detail warning"}, errors.New("detail denied"))
+		warnings, err := actor.DeleteServiceAccountByNameAndSpace("workers", "space-guid")
+		Expect(err).To(MatchError("detail denied"))
+		Expect(warnings).To(ContainElement("detail warning"))
+		Expect(client.DeleteServiceAccountCallCount()).To(BeZero())
+	})
+	It("does not poll a rejected disable operation", func() {
+		client.UpdateServiceAccountEnabledReturns("", ccv3.Warnings{"mutation warning"}, errors.New("operation in progress"))
+		warnings, err := actor.SetServiceAccountEnabledByNameAndSpace("workers", "space-guid", false)
+		Expect(err).To(MatchError("operation in progress"))
+		Expect(warnings).To(ContainElement("mutation warning"))
+		Expect(client.PollJobCallCount()).To(BeZero())
+	})
+	It("reports job failure with poll warnings", func() {
+		client.PollJobReturns(ccv3.Warnings{"poll warning"}, errors.New("provisioning failed"))
+		warnings, err := actor.BindServiceAccountByNameAndSpace("app", "workers", "space-guid")
+		Expect(err).To(MatchError("provisioning failed"))
+		Expect(warnings).To(ContainElements("app warning", "lookup warning", "detail warning", "mutation warning", "poll warning"))
+	})
+})

actor/v7action/service_account_test.go

@@ -0,0 +1,58 @@
+package v7action_test
+
+import (
+	"errors"
+
+	. "code.cloudfoundry.org/cli/v9/actor/v7action"
+	"code.cloudfoundry.org/cli/v9/actor/v7action/v7actionfakes"
+	"code.cloudfoundry.org/cli/v9/api/cloudcontroller/ccv3"
+	"code.cloudfoundry.org/cli/v9/api/cloudcontroller/ccv3/constant"
+	"code.cloudfoundry.org/cli/v9/resources"
+	. "github.com/onsi/ginkgo/v2"
+	. "github.com/onsi/gomega"
+)
+
+var _ = Describe("Service Account Actions", func() {
+	var actor *Actor
+	var client *v7actionfakes.FakeCloudControllerClient
+	BeforeEach(func() {
+		client = new(v7actionfakes.FakeCloudControllerClient)
+		actor = NewActor(client, nil, nil, nil, nil, nil)
+	})
+	It("lists only the specified owning space and preserves results and warnings", func() {
+		accounts := []resources.ServiceAccount{{Name: "shared-worker", Status: "ready"}}
+		client.GetServiceAccountsReturns(accounts, ccv3.Warnings{"warning"}, nil)
+		result, warnings, err := actor.GetServiceAccountsInSpace("space-guid")
+		Expect(err).NotTo(HaveOccurred())
+		Expect(result).To(Equal(accounts))
+		Expect(warnings).To(ConsistOf("warning"))
+		Expect(client.GetServiceAccountsCallCount()).To(Equal(1))
+		Expect(client.GetServiceAccountsArgsForCall(0)).To(Equal([]ccv3.Query{{Key: ccv3.SpaceGUIDFilter, Values: []string{"space-guid"}}}))
+	})
+	It("propagates listing errors and warnings", func() {
+		denied := errors.New("denied")
+		client.GetServiceAccountsReturns(nil, ccv3.Warnings{"warning"}, denied)
+		_, warnings, err := actor.GetServiceAccountsInSpace("space-guid")
+		Expect(err).To(MatchError(denied))
+		Expect(warnings).To(ConsistOf("warning"))
+	})
+	It("creates in the specified space and preserves platform state and warnings", func() {
+		created := resources.ServiceAccount{GUID: "account-guid", Status: "unprovisioned"}
+		client.CreateServiceAccountReturns(created, ccv3.Warnings{"warning"}, nil)
+		account, warnings, err := actor.CreateServiceAccountInSpace("shared-worker", "Workers", "space-guid")
+		Expect(err).NotTo(HaveOccurred())
+		Expect(account).To(Equal(created))
+		Expect(warnings).To(ConsistOf("warning"))
+		Expect(client.CreateServiceAccountCallCount()).To(Equal(1))
+		Expect(client.CreateServiceAccountArgsForCall(0)).To(Equal(resources.ServiceAccount{
+			Name: "shared-worker", Description: "Workers", Relationships: resources.Relationships{constant.RelationshipTypeSpace: {GUID: "space-guid"}},
+		}))
+	})
+	It("propagates errors and warnings without adopting an existing account", func() {
+		denied := errors.New("name permanently reserved")
+		client.CreateServiceAccountReturns(resources.ServiceAccount{}, ccv3.Warnings{"warning"}, denied)
+		_, warnings, err := actor.CreateServiceAccountInSpace("shared-worker", "", "space-guid")
+		Expect(err).To(MatchError(denied))
+		Expect(warnings).To(ConsistOf("warning"))
+	})
+})