1 files changed, 115 insertions, 0 deletions

diff --git a/app/models/account.go b/app/models/account.go
new file mode 100644
index 0000000..0ae1821
--- /dev/null
+++ b/app/models/account.go
@@ -0,0 +1,115 @@
+package models
+
+import (
+        "context"
+        "fmt"
+        "time"
+
+        "code.crute.us/mcrute/golib/db/mongodb"
+)
+
+const accountCol = "accounts"
+
+type AccountStore interface {
+        List(context.Context) ([]*Account, error)
+        ListForUser(context.Context, *User) ([]*Account, error)
+        Get(context.Context, string) (*Account, error)               // Error on not found
+        GetForUser(context.Context, string, *User) (*Account, error) // Error on not found
+        Put(context.Context, *Account) error
+        Delete(context.Context, *Account) error
+}
+
+type Account struct {
+        ShortName              string `bson:"_id"`
+        AccountType            string
+        AccountNumber          int
+        Name                   string
+        ConsoleSessionDuration time.Duration
+        VaultMaterial          string
+        DefaultRegion          string
+        Users                  []string
+}
+
+func (a *Account) ConsoleSessionDurationSecs() int64 {
+        return int64(a.ConsoleSessionDuration.Seconds())
+}
+
+func (a *Account) CanAccess(u *User) bool {
+        if u.IsAdmin {
+                return true
+        }
+        // Linear search should be fine for now, these lists are pretty small
+        for _, n := range a.Users {
+                if n == u.Username {
+                        return true
+                }
+        }
+        return false
+}
+
+type MongoDbAccountStore struct {
+        Db *mongodb.Mongo
+}
+
+// List returns all accounts in the system.
+func (s *MongoDbAccountStore) List(ctx context.Context) ([]*Account, error) {
+        var out []*Account
+        if err := s.Db.FindAll(ctx, accountCol, &out); err != nil {
+                return nil, err
+        }
+        return out, nil
+}
+
+// ListForUser returns all accounts for which the user has access. This is the
+// authorized version of List.
+//
+// Note this does not handle the case where a user is an admin but not
+// explicitly listed in the allowed users list for an account. For that case
+// just use List directly.
+func (s *MongoDbAccountStore) ListForUser(ctx context.Context, u *User) ([]*Account, error) {
+        var out []*Account
+        filter := mongodb.AnyInTopLevelArray("Users", u.Username)
+        if err := s.Db.FindAllByFilter(ctx, accountCol, filter, &out); err != nil {
+                return nil, err
+        }
+        return out, nil
+}
+
+func (s *MongoDbAccountStore) Get(ctx context.Context, id string) (*Account, error) {
+        var a Account
+        if err := s.Db.FindOneById(ctx, accountCol, id, &a); err != nil {
+                return nil, err
+        }
+        return &a, nil
+}
+
+// GetForUser returns an account if the user has access to this account,
+// otherwise it returns an error. This is the authorized version of Get.
+func (s *MongoDbAccountStore) GetForUser(ctx context.Context, id string, u *User) (*Account, error) {
+        a, err := s.Get(ctx, id)
+        if err != nil {
+                return nil, err
+        }
+
+        if !a.CanAccess(u) {
+                return nil, fmt.Errorf("User does not have access to account")
+        }
+
+        return a, nil
+}
+
+func (s *MongoDbAccountStore) Put(ctx context.Context, a *Account) error {
+        if err := s.Db.ReplaceOneById(ctx, accountCol, a.ShortName, a); err != nil {
+                return err
+        }
+        return nil
+}
+
+func (s *MongoDbAccountStore) Delete(ctx context.Context, a *Account) error {
+        if err := s.Db.DeleteOneById(ctx, accountCol, a.ShortName); err != nil {
+                return err
+        }
+        return nil
+}
+
+var _ AccountStore = (*MongoDbAccountStore)(nil)