zitadel/internal/api/grpc/action/v2/query.go

package action

import (
	"context"
	"strings"

	"connectrpc.com/connect"
	"google.golang.org/protobuf/types/known/durationpb"
	"google.golang.org/protobuf/types/known/timestamppb"

	"github.com/zitadel/zitadel/internal/api/grpc/filter/v2"
	"github.com/zitadel/zitadel/internal/command"
	"github.com/zitadel/zitadel/internal/domain"
	target_domain "github.com/zitadel/zitadel/internal/execution/target"
	"github.com/zitadel/zitadel/internal/query"
	"github.com/zitadel/zitadel/internal/zerrors"
	"github.com/zitadel/zitadel/pkg/grpc/action/v2"
	filter_pb "github.com/zitadel/zitadel/pkg/grpc/filter/v2"
)

const (
	conditionIDAllSegmentCount                    = 0
	conditionIDRequestResponseServiceSegmentCount = 1
	conditionIDRequestResponseMethodSegmentCount  = 2
	conditionIDEventGroupSegmentCount             = 1
)

func (s *Server) GetTarget(ctx context.Context, req *connect.Request[action.GetTargetRequest]) (*connect.Response[action.GetTargetResponse], error) {
	resp, err := s.query.GetTargetByID(ctx, req.Msg.GetId())
	if err != nil {
		return nil, err
	}
	return connect.NewResponse(&action.GetTargetResponse{
		Target: targetToPb(resp),
	}), nil
}

type InstanceContext interface {
	GetInstanceId() string
	GetInstanceDomain() string
}

type Context interface {
	GetOwner() InstanceContext
}

func (s *Server) ListTargets(ctx context.Context, req *connect.Request[action.ListTargetsRequest]) (*connect.Response[action.ListTargetsResponse], error) {
	queries, err := s.ListTargetsRequestToModel(req.Msg)
	if err != nil {
		return nil, err
	}
	resp, err := s.query.SearchTargets(ctx, queries)
	if err != nil {
		return nil, err
	}
	return connect.NewResponse(&action.ListTargetsResponse{
		Targets:    targetsToPb(resp.Targets),
		Pagination: filter.QueryToPaginationPb(queries.SearchRequest, resp.SearchResponse),
	}), nil
}

func (s *Server) ListPublicKeys(ctx context.Context, req *connect.Request[action.ListPublicKeysRequest]) (*connect.Response[action.ListPublicKeysResponse], error) {
	queries, err := s.listPublicKeysRequestToQuery(req.Msg)
	if err != nil {
		return nil, err
	}
	res, err := s.query.SearchAuthNKeys(ctx, queries, query.JoinFilterTarget, nil)
	if err != nil {
		return nil, err
	}
	return connect.NewResponse(&action.ListPublicKeysResponse{
		Pagination: filter.QueryToPaginationPb(queries.SearchRequest, res.SearchResponse),
		PublicKeys: publicKeysToPb(res.AuthNKeys),
	}), nil
}

func (s *Server) ListExecutions(ctx context.Context, req *connect.Request[action.ListExecutionsRequest]) (*connect.Response[action.ListExecutionsResponse], error) {
	queries, err := s.ListExecutionsRequestToModel(req.Msg)
	if err != nil {
		return nil, err
	}
	resp, err := s.query.SearchExecutions(ctx, queries)
	if err != nil {
		return nil, err
	}
	return connect.NewResponse(&action.ListExecutionsResponse{
		Executions: executionsToPb(resp.Executions),
		Pagination: filter.QueryToPaginationPb(queries.SearchRequest, resp.SearchResponse),
	}), nil
}

func targetsToPb(targets []*query.Target) []*action.Target {
	t := make([]*action.Target, len(targets))
	for i, target := range targets {
		t[i] = targetToPb(target)
	}
	return t
}

func targetToPb(t *query.Target) *action.Target {
	target := &action.Target{
		Id:          t.ID,
		Name:        t.Name,
		Timeout:     durationpb.New(t.Timeout),
		Endpoint:    t.Endpoint,
		SigningKey:  t.SigningKey,
		PayloadType: payloadTypeToPb(t.PayloadType),
	}
	switch t.TargetType {
	case target_domain.TargetTypeWebhook:
		target.TargetType = &action.Target_RestWebhook{RestWebhook: &action.RESTWebhook{InterruptOnError: t.InterruptOnError}}
	case target_domain.TargetTypeCall:
		target.TargetType = &action.Target_RestCall{RestCall: &action.RESTCall{InterruptOnError: t.InterruptOnError}}
	case target_domain.TargetTypeAsync:
		target.TargetType = &action.Target_RestAsync{RestAsync: &action.RESTAsync{}}
	default:
		target.TargetType = nil
	}

	if !t.EventDate.IsZero() {
		target.ChangeDate = timestamppb.New(t.EventDate)
	}
	if !t.CreationDate.IsZero() {
		target.CreationDate = timestamppb.New(t.CreationDate)
	}
	return target
}

func payloadTypeToPb(payloadType target_domain.PayloadType) action.PayloadType {
	switch payloadType {
	case target_domain.PayloadTypeUnspecified:
		return action.PayloadType_PAYLOAD_TYPE_UNSPECIFIED
	case target_domain.PayloadTypeJSON:
		return action.PayloadType_PAYLOAD_TYPE_JSON
	case target_domain.PayloadTypeJWT:
		return action.PayloadType_PAYLOAD_TYPE_JWT
	case target_domain.PayloadTypeJWE:
		return action.PayloadType_PAYLOAD_TYPE_JWE
	default:
		return action.PayloadType_PAYLOAD_TYPE_UNSPECIFIED
	}
}

func (s *Server) ListTargetsRequestToModel(req *action.ListTargetsRequest) (*query.TargetSearchQueries, error) {
	offset, limit, asc, err := filter.PaginationPbToQuery(s.systemDefaults, req.Pagination)
	if err != nil {
		return nil, err
	}
	queries, err := targetQueriesToQuery(req.Filters)
	if err != nil {
		return nil, err
	}
	return &query.TargetSearchQueries{
		SearchRequest: query.SearchRequest{
			Offset:        offset,
			Limit:         limit,
			Asc:           asc,
			SortingColumn: targetFieldNameToSortingColumn(req.SortingColumn),
		},
		Queries: queries,
	}, nil
}

func targetQueriesToQuery(queries []*action.TargetSearchFilter) (_ []query.SearchQuery, err error) {
	q := make([]query.SearchQuery, len(queries))
	for i, qry := range queries {
		q[i], err = targetQueryToQuery(qry)
		if err != nil {
			return nil, err
		}
	}
	return q, nil
}

func targetQueryToQuery(filter *action.TargetSearchFilter) (query.SearchQuery, error) {
	switch q := filter.Filter.(type) {
	case *action.TargetSearchFilter_TargetNameFilter:
		return targetNameQueryToQuery(q.TargetNameFilter)
	case *action.TargetSearchFilter_InTargetIdsFilter:
		return targetInTargetIdsQueryToQuery(q.InTargetIdsFilter)
	default:
		return nil, zerrors.ThrowInvalidArgument(nil, "GRPC-vR9nC", "List.Query.Invalid")
	}
}

func targetNameQueryToQuery(q *action.TargetNameFilter) (query.SearchQuery, error) {
	return query.NewTargetNameSearchQuery(filter.TextMethodPbToQuery(q.Method), q.GetTargetName())
}

func targetInTargetIdsQueryToQuery(q *action.InTargetIDsFilter) (query.SearchQuery, error) {
	return query.NewTargetInIDsSearchQuery(q.GetTargetIds())
}

// targetFieldNameToSortingColumn defaults to the creation date because this ensures deterministic pagination
func targetFieldNameToSortingColumn(field *action.TargetFieldName) query.Column {
	if field == nil {
		return query.TargetColumnCreationDate
	}
	switch *field {
	case action.TargetFieldName_TARGET_FIELD_NAME_UNSPECIFIED:
		return query.TargetColumnCreationDate
	case action.TargetFieldName_TARGET_FIELD_NAME_ID:
		return query.TargetColumnID
	case action.TargetFieldName_TARGET_FIELD_NAME_CREATED_DATE:
		return query.TargetColumnCreationDate
	case action.TargetFieldName_TARGET_FIELD_NAME_CHANGED_DATE:
		return query.TargetColumnChangeDate
	case action.TargetFieldName_TARGET_FIELD_NAME_NAME:
		return query.TargetColumnName
	case action.TargetFieldName_TARGET_FIELD_NAME_TARGET_TYPE:
		return query.TargetColumnTargetType
	case action.TargetFieldName_TARGET_FIELD_NAME_URL:
		return query.TargetColumnURL
	case action.TargetFieldName_TARGET_FIELD_NAME_TIMEOUT:
		return query.TargetColumnTimeout
	case action.TargetFieldName_TARGET_FIELD_NAME_INTERRUPT_ON_ERROR:
		return query.TargetColumnInterruptOnError
	default:
		return query.TargetColumnCreationDate
	}
}

// executionFieldNameToSortingColumn defaults to the creation date because this ensures deterministic pagination
func executionFieldNameToSortingColumn(field *action.ExecutionFieldName) query.Column {
	if field == nil {
		return query.ExecutionColumnCreationDate
	}
	switch *field {
	case action.ExecutionFieldName_EXECUTION_FIELD_NAME_UNSPECIFIED:
		return query.ExecutionColumnCreationDate
	case action.ExecutionFieldName_EXECUTION_FIELD_NAME_ID:
		return query.ExecutionColumnID
	case action.ExecutionFieldName_EXECUTION_FIELD_NAME_CREATED_DATE:
		return query.ExecutionColumnCreationDate
	case action.ExecutionFieldName_EXECUTION_FIELD_NAME_CHANGED_DATE:
		return query.ExecutionColumnChangeDate
	default:
		return query.ExecutionColumnCreationDate
	}
}

func (s *Server) ListExecutionsRequestToModel(req *action.ListExecutionsRequest) (*query.ExecutionSearchQueries, error) {
	offset, limit, asc, err := filter.PaginationPbToQuery(s.systemDefaults, req.Pagination)
	if err != nil {
		return nil, err
	}
	queries, err := executionQueriesToQuery(req.Filters)
	if err != nil {
		return nil, err
	}
	return &query.ExecutionSearchQueries{
		SearchRequest: query.SearchRequest{
			Offset:        offset,
			Limit:         limit,
			Asc:           asc,
			SortingColumn: executionFieldNameToSortingColumn(req.SortingColumn),
		},
		Queries: queries,
	}, nil
}

func executionQueriesToQuery(queries []*action.ExecutionSearchFilter) (_ []query.SearchQuery, err error) {
	q := make([]query.SearchQuery, len(queries))
	for i, query := range queries {
		q[i], err = executionQueryToQuery(query)
		if err != nil {
			return nil, err
		}
	}
	return q, nil
}

func executionQueryToQuery(searchQuery *action.ExecutionSearchFilter) (query.SearchQuery, error) {
	switch q := searchQuery.Filter.(type) {
	case *action.ExecutionSearchFilter_InConditionsFilter:
		return inConditionsQueryToQuery(q.InConditionsFilter)
	case *action.ExecutionSearchFilter_ExecutionTypeFilter:
		return executionTypeToQuery(q.ExecutionTypeFilter)
	case *action.ExecutionSearchFilter_TargetFilter:
		return query.NewTargetSearchQuery(q.TargetFilter.GetTargetId())
	default:
		return nil, zerrors.ThrowInvalidArgument(nil, "GRPC-vR9nC", "List.Query.Invalid")
	}
}

func executionTypeToQuery(q *action.ExecutionTypeFilter) (query.SearchQuery, error) {
	switch q.ExecutionType {
	case action.ExecutionType_EXECUTION_TYPE_UNSPECIFIED:
		return query.NewExecutionTypeSearchQuery(domain.ExecutionTypeUnspecified)
	case action.ExecutionType_EXECUTION_TYPE_REQUEST:
		return query.NewExecutionTypeSearchQuery(domain.ExecutionTypeRequest)
	case action.ExecutionType_EXECUTION_TYPE_RESPONSE:
		return query.NewExecutionTypeSearchQuery(domain.ExecutionTypeResponse)
	case action.ExecutionType_EXECUTION_TYPE_EVENT:
		return query.NewExecutionTypeSearchQuery(domain.ExecutionTypeEvent)
	case action.ExecutionType_EXECUTION_TYPE_FUNCTION:
		return query.NewExecutionTypeSearchQuery(domain.ExecutionTypeFunction)
	default:
		return query.NewExecutionTypeSearchQuery(domain.ExecutionTypeUnspecified)
	}
}

func inConditionsQueryToQuery(q *action.InConditionsFilter) (query.SearchQuery, error) {
	values := make([]string, len(q.GetConditions()))
	for i, condition := range q.GetConditions() {
		id, err := conditionToID(condition)
		if err != nil {
			return nil, err
		}
		values[i] = id
	}
	return query.NewExecutionInIDsSearchQuery(values)
}

func conditionToID(q *action.Condition) (string, error) {
	switch t := q.GetConditionType().(type) {
	case *action.Condition_Request:
		cond := &command.ExecutionAPICondition{
			Method:  t.Request.GetMethod(),
			Service: t.Request.GetService(),
			All:     t.Request.GetAll(),
		}
		return cond.ID(domain.ExecutionTypeRequest), nil
	case *action.Condition_Response:
		cond := &command.ExecutionAPICondition{
			Method:  t.Response.GetMethod(),
			Service: t.Response.GetService(),
			All:     t.Response.GetAll(),
		}
		return cond.ID(domain.ExecutionTypeResponse), nil
	case *action.Condition_Event:
		cond := &command.ExecutionEventCondition{
			Event: t.Event.GetEvent(),
			Group: t.Event.GetGroup(),
			All:   t.Event.GetAll(),
		}
		return cond.ID(), nil
	case *action.Condition_Function:
		return command.ExecutionFunctionCondition(t.Function.GetName()).ID(), nil
	default:
		return "", zerrors.ThrowInvalidArgument(nil, "GRPC-vR9nC", "List.Query.Invalid")
	}
}

func executionsToPb(executions []*query.Execution) []*action.Execution {
	e := make([]*action.Execution, len(executions))
	for i, execution := range executions {
		e[i] = executionToPb(execution)
	}
	return e
}

func executionToPb(e *query.Execution) *action.Execution {
	targets := make([]string, len(e.Targets))
	for i := range e.Targets {
		switch e.Targets[i].Type {
		case domain.ExecutionTargetTypeTarget:
			targets[i] = e.Targets[i].Target
		case domain.ExecutionTargetTypeInclude, domain.ExecutionTargetTypeUnspecified:
			continue
		default:
			continue
		}
	}

	exec := &action.Execution{
		Condition: executionIDToCondition(e.ID),
		Targets:   targets,
	}
	if !e.EventDate.IsZero() {
		exec.ChangeDate = timestamppb.New(e.EventDate)
	}
	if !e.CreationDate.IsZero() {
		exec.CreationDate = timestamppb.New(e.CreationDate)
	}
	return exec
}

func executionIDToCondition(include string) *action.Condition {
	if strings.HasPrefix(include, domain.ExecutionTypeRequest.String()) {
		return includeRequestToCondition(strings.TrimPrefix(include, domain.ExecutionTypeRequest.String()))
	}
	if strings.HasPrefix(include, domain.ExecutionTypeResponse.String()) {
		return includeResponseToCondition(strings.TrimPrefix(include, domain.ExecutionTypeResponse.String()))
	}
	if strings.HasPrefix(include, domain.ExecutionTypeEvent.String()) {
		return includeEventToCondition(strings.TrimPrefix(include, domain.ExecutionTypeEvent.String()))
	}
	if strings.HasPrefix(include, domain.ExecutionTypeFunction.String()) {
		return includeFunctionToCondition(strings.TrimPrefix(include, domain.ExecutionTypeFunction.String()))
	}
	return nil
}

func includeRequestToCondition(id string) *action.Condition {
	switch strings.Count(id, "/") {
	case conditionIDRequestResponseMethodSegmentCount:
		return &action.Condition{ConditionType: &action.Condition_Request{Request: &action.RequestExecution{Condition: &action.RequestExecution_Method{Method: id}}}}
	case conditionIDRequestResponseServiceSegmentCount:
		return &action.Condition{ConditionType: &action.Condition_Request{Request: &action.RequestExecution{Condition: &action.RequestExecution_Service{Service: strings.TrimPrefix(id, "/")}}}}
	case conditionIDAllSegmentCount:
		return &action.Condition{ConditionType: &action.Condition_Request{Request: &action.RequestExecution{Condition: &action.RequestExecution_All{All: true}}}}
	default:
		return nil
	}
}
func includeResponseToCondition(id string) *action.Condition {
	switch strings.Count(id, "/") {
	case conditionIDRequestResponseMethodSegmentCount:
		return &action.Condition{ConditionType: &action.Condition_Response{Response: &action.ResponseExecution{Condition: &action.ResponseExecution_Method{Method: id}}}}
	case conditionIDRequestResponseServiceSegmentCount:
		return &action.Condition{ConditionType: &action.Condition_Response{Response: &action.ResponseExecution{Condition: &action.ResponseExecution_Service{Service: strings.TrimPrefix(id, "/")}}}}
	case conditionIDAllSegmentCount:
		return &action.Condition{ConditionType: &action.Condition_Response{Response: &action.ResponseExecution{Condition: &action.ResponseExecution_All{All: true}}}}
	default:
		return nil
	}
}

func includeEventToCondition(id string) *action.Condition {
	switch strings.Count(id, "/") {
	case conditionIDEventGroupSegmentCount:
		if strings.HasSuffix(id, command.EventGroupSuffix) {
			return &action.Condition{ConditionType: &action.Condition_Event{Event: &action.EventExecution{Condition: &action.EventExecution_Group{Group: strings.TrimSuffix(strings.TrimPrefix(id, "/"), command.EventGroupSuffix)}}}}
		} else {
			return &action.Condition{ConditionType: &action.Condition_Event{Event: &action.EventExecution{Condition: &action.EventExecution_Event{Event: strings.TrimPrefix(id, "/")}}}}
		}
	case conditionIDAllSegmentCount:
		return &action.Condition{ConditionType: &action.Condition_Event{Event: &action.EventExecution{Condition: &action.EventExecution_All{All: true}}}}
	default:
		return nil
	}
}

func includeFunctionToCondition(id string) *action.Condition {
	return &action.Condition{ConditionType: &action.Condition_Function{Function: &action.FunctionExecution{Name: strings.TrimPrefix(id, "/")}}}
}

func (s *Server) listPublicKeysRequestToQuery(req *action.ListPublicKeysRequest) (*query.AuthNKeySearchQueries, error) {
	offset, limit, asc, err := filter.PaginationPbToQuery(s.systemDefaults, req.Pagination)
	if err != nil {
		return nil, err
	}
	queries, err := publicKeyFiltersToQuery(req.Filters, req.GetTargetId())
	if err != nil {
		return nil, err
	}
	return &query.AuthNKeySearchQueries{
		SearchRequest: query.SearchRequest{
			Offset:        offset,
			Limit:         limit,
			Asc:           asc,
			SortingColumn: publicKeyFieldNameToSortingColumn(req.GetSortingColumn()),
		},
		Queries: queries,
	}, nil
}

func publicKeyFiltersToQuery(filters []*action.PublicKeySearchFilter, targetID string) (_ []query.SearchQuery, err error) {
	f := make([]query.SearchQuery, len(filters)+1)
	for i, filter := range filters {
		f[i], err = publicKeyFilterToQuery(filter)
		if err != nil {
			return nil, err
		}
	}
	f[len(filters)], err = query.NewAuthNKeyIdentifyerQuery(targetID)
	if err != nil {
		return nil, err
	}
	return f, nil
}

func publicKeyFilterToQuery(filter *action.PublicKeySearchFilter) (query.SearchQuery, error) {
	switch q := filter.Filter.(type) {
	case *action.PublicKeySearchFilter_KeyIdsFilter:
		return publicKeyKeyIDsFilterToQuery(q.KeyIdsFilter)
	case *action.PublicKeySearchFilter_ActiveFilter:
		return publicKeyActiveFilterToQuery(q.ActiveFilter)
	case *action.PublicKeySearchFilter_ExpirationDateFilter:
		return publicKeyExpirationFilterToQuery(q.ExpirationDateFilter)
	default:
		return nil, zerrors.ThrowInvalidArgument(nil, "GRPC-vR9nC", "List.Query.Invalid")
	}
}

func publicKeyKeyIDsFilterToQuery(idsFilter *filter_pb.InIDsFilter) (query.SearchQuery, error) {
	return query.NewAuthNKeyInIDsSearchQuery(idsFilter.GetIds())
}

func publicKeyActiveFilterToQuery(activeFilter bool) (query.SearchQuery, error) {
	return query.NewAuthNKeyEnabledSearchQuery(activeFilter)
}

func publicKeyExpirationFilterToQuery(f *filter_pb.TimestampFilter) (query.SearchQuery, error) {
	return query.NewAuthNKeyExpirationDateQuery(f.GetTimestamp().AsTime(), filter.TimestampMethodPbToQuery(f.Method))
}

func publicKeyFieldNameToSortingColumn(column action.PublicKeyFieldName) query.Column {
	switch column {
	case action.PublicKeyFieldName_PUBLIC_KEY_FIELD_NAME_UNSPECIFIED:
		return query.AuthNKeyColumnCreationDate
	case action.PublicKeyFieldName_PUBLIC_KEY_FIELD_NAME_CREATION_DATE:
		return query.AuthNKeyColumnCreationDate
	case action.PublicKeyFieldName_PUBLIC_KEY_FIELD_NAME_CHANGE_DATE:
		return query.AuthNKeyColumnChangeDate
	case action.PublicKeyFieldName_PUBLIC_KEY_FIELD_NAME_EXPIRATION_DATE:
		return query.AuthNKeyColumnExpiration
	default:
		return query.AuthNKeyColumnCreationDate
	}
}

func publicKeysToPb(keys []*query.AuthNKey) []*action.PublicKey {
	pks := make([]*action.PublicKey, len(keys))
	for i, key := range keys {
		var expiration *timestamppb.Timestamp
		if !key.Expiration.IsZero() {
			expiration = timestamppb.New(key.Expiration)
		}
		pks[i] = &action.PublicKey{
			KeyId:          key.ID,
			Active:         key.Enabled,
			PublicKey:      key.PublicKey,
			Fingerprint:    key.Fingerprint,
			ExpirationDate: expiration,
			CreationDate:   timestamppb.New(key.CreationDate),
			ChangeDate:     timestamppb.New(key.ChangeDate),
		}
	}
	return pks
}