feat: add Permissions map

Contributes to NEX-2265.

Adds `Permissions()` function that returns the most granular permissions list
required for an OperationID.

"Granular" means avoiding "composite" roles like operator or developer where possible.
While these roles include most permissions,
they undermine the goal of having precise control over resources.

Author: byashimov

generator/permissions.go

@@ -3,6 +3,8 @@
 package main
 
 import (
+	"bytes"
+	"fmt"
 	"os"
 
 	"gopkg.in/yaml.v3"
@@ -11,15 +13,61 @@ import (
 // readPermissions reads PermissionsFile
 // Returns map[OperationID][]Permission
 func readPermissions(cfg *envConfig) (map[string][]string, error) {
-	b, err := os.ReadFile(cfg.PermissionsFile)
+	var config map[string][]string
+	err := readYamlFile(cfg.ConfigFile, &config)
 	if err != nil {
 		return nil, err
 	}
 
 	var permissions map[string][]string
-	err = yaml.Unmarshal(b, &permissions)
+	err = readYamlFile(cfg.PermissionsFile, &permissions)
 	if err != nil {
 		return nil, err
 	}
+
+	operationIDs := make(map[string]bool)
+	for _, list := range config {
+		for _, k := range list {
+			operationIDs[k] = true
+		}
+	}
+
+	for k, v := range permissions {
+		if !operationIDs[k] {
+			delete(permissions, k)
+			continue
+		}
+
+		permissions[k] = v
+		if len(v) == 0 {
+			delete(permissions, k)
+		}
+	}
+
+	// Write permissions back to file
+	var buffer bytes.Buffer
+	encoder := yaml.NewEncoder(&buffer)
+	encoder.SetIndent(yamlTabSize)
+	err = encoder.Encode(&permissions)
+	if err != nil {
+		return nil, err
+	}
+	err = os.WriteFile(cfg.PermissionsFile, buffer.Bytes(), writeMode)
+	if err != nil {
+		return nil, err
+	}
+
 	return permissions, nil
 }
+
+func readYamlFile(path string, out any) error {
+	b, err := os.ReadFile(path)
+	if err != nil {
+		return err
+	}
+	err = yaml.Unmarshal(b, out)
+	if err != nil {
+		return fmt.Errorf("error parsing yaml file %q: %v", path, err)
+	}
+	return nil
+}

go.mod

@@ -22,6 +22,8 @@ require (
 	github.com/mattn/go-colorable v0.1.13 // indirect
 	github.com/mattn/go-isatty v0.0.20 // indirect
 	github.com/pmezard/go-difflib v1.0.0 // indirect
+	github.com/samber/lo v1.52.0 // indirect
 	github.com/stretchr/objx v0.5.2 // indirect
 	golang.org/x/sys v0.21.0 // indirect
+	golang.org/x/text v0.22.0 // indirect
 )

go.sum

@@ -35,6 +35,8 @@ github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZN
 github.com/rs/xid v1.6.0/go.mod h1:7XoLgs4eV+QndskICGsho+ADou8ySMSjJKDIan90Nz0=
 github.com/rs/zerolog v1.34.0 h1:k43nTLIwcTVQAncfCw4KZ2VY6ukYoZaBPNOE8txlOeY=
 github.com/rs/zerolog v1.34.0/go.mod h1:bJsvje4Z08ROH4Nhs5iH600c3IkWhwp44iRc54W6wYQ=
+github.com/samber/lo v1.52.0 h1:Rvi+3BFHES3A8meP33VPAxiBZX/Aws5RxrschYGjomw=
+github.com/samber/lo v1.52.0/go.mod h1:4+MXEGsJzbKGaUEQFKBq2xtfuznW9oz/WrgyzMzRoM0=
 github.com/stretchr/objx v0.5.2 h1:xuMeJ0Sdp5ZMRXx/aWO6RZxdr3beISkG5/G/aIRr3pY=
 github.com/stretchr/objx v0.5.2/go.mod h1:FRsXN1f5AsAjCGJKqEizvkpNtU+EGNCLh3NxZ/8L+MA=
 github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
@@ -46,6 +48,8 @@ golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.12.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.21.0 h1:rF+pYz3DAGSQAxAu1CbC7catZg4ebC4UIeIhKxBZvws=
 golang.org/x/sys v0.21.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/text v0.22.0 h1:bofq7m3/HAFvbF51jz3Q9wLg3jkvSPuiZu/pD1XwgtM=
+golang.org/x/text v0.22.0/go.mod h1:YRoo4H8PVmsu+E3Ou7cqLVH8oXWIHVoX0jqUWALQhfY=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405 h1:yhCVgyC4o1eVCa2tZl7eS0r+SDo693bJlVdllGtEeKM=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=