OrchestrAD/backend/internal/rules/engine/reconcile.go

// Package engine - dynamic-group membership reconciliation.
//
// SyncGroupMembership is a set-level action: unlike per-object actions it runs
// once per target group with the entire matched set, diffs it against the
// group's current membership, and issues the adds/removes needed to make the
// group reflect the rule. This is the behaviour that turns a rule into an
// Adaxes/Active-Roles style dynamic group.
package engine

import (
	"fmt"
	"strings"

	"github.com/Grace-Solutions/OrchestrAD/internal/directory/ldap"
	"github.com/Grace-Solutions/OrchestrAD/internal/models"
	"github.com/Grace-Solutions/OrchestrAD/internal/types"
)

// membershipClient is the slice of the LDAP client that reconciliation needs.
// Declaring it as an interface keeps the reconciler unit-testable with a fake.
type membershipClient interface {
	Exists(dn string) (bool, error)
	GetGroupMembers(groupDN string) ([]string, error)
	AddGroupMember(groupDN, memberDN string) error
	RemoveGroupMember(groupDN, memberDN string) error
	CreateGroup(groupDN, groupType, groupScope string) error
	EnsureOUPath(ouDN string) error
}

// ManagedMemberStore records which memberships this rule added, so ManagedAdd
// mode can remove only what it added. Implementations are backed by the DB; a
// nil store disables managed-removal (it degrades to add-only removal).
type ManagedMemberStore interface {
	List(ruleID, groupDN string) ([]string, error)
	Add(ruleID, groupDN, memberDN string) error
	Remove(ruleID, groupDN, memberDN string) error
}

// membershipPlan is the computed diff for one target group.
type membershipPlan struct {
	GroupDN      string
	GroupCreated bool
	ToAdd        []string // original-cased member DNs to add
	ToRemove     []string // original-cased member DNs to remove
	Unchanged    int
	Err          error
}

// normDN returns the case/space-normalised key used to compare DNs. AD returns
// member DNs and search DNs in a consistent form, but comparing case-folded is
// safe and avoids spurious add/remove churn.
func normDN(dn string) string {
	return strings.ToLower(strings.TrimSpace(dn))
}

// planMembership resolves the target group and computes the add/remove diff
// against the matched DN set without mutating anything. It is shared by preview
// (counts only) and execution (which then applies the plan).
func planMembership(action *models.RuleAction, rule *models.Rule, matchedDNs []string,
	client membershipClient, store ManagedMemberStore, allowCreate bool) membershipPlan {

	cfg, err := parseActionConfig(action.ConfigurationJSON)
	if err != nil {
		return membershipPlan{Err: fmt.Errorf("invalid action configuration: %w", err)}
	}

	groupDN := ldap.NormalizeGroupTarget(cfg.TargetGroupDN)
	if groupDN == "" {
		return membershipPlan{Err: fmt.Errorf("targetGroupDn is required for SyncGroupMembership")}
	}
	plan := membershipPlan{GroupDN: groupDN}

	exists, err := client.Exists(groupDN)
	if err != nil {
		plan.Err = fmt.Errorf("checking group existence: %w", err)
		return plan
	}
	if !exists {
		if !cfg.CreateIfMissing {
			plan.Err = fmt.Errorf("target group does not exist: %s", groupDN)
			return plan
		}
		// Group would be created; its current membership is empty.
		plan.GroupCreated = true
		if allowCreate {
			if err := client.EnsureOUPath(parentDN(groupDN)); err != nil {
				plan.Err = fmt.Errorf("ensuring group OU path: %w", err)
				return plan
			}
			if err := client.CreateGroup(groupDN, cfg.GroupType, cfg.GroupScope); err != nil {
				plan.Err = fmt.Errorf("creating group: %w", err)
				return plan
			}
		}
	}

	// Current members (empty when the group was, or would be, freshly created).
	var current []string
	if !plan.GroupCreated {
		current, err = client.GetGroupMembers(groupDN)
		if err != nil {
			plan.Err = fmt.Errorf("reading group members: %w", err)
			return plan
		}
	}

	matchedByKey := make(map[string]string, len(matchedDNs))
	for _, dn := range matchedDNs {
		matchedByKey[normDN(dn)] = dn
	}
	currentByKey := make(map[string]string, len(current))
	for _, dn := range current {
		currentByKey[normDN(dn)] = dn
	}

	// Additions: matched objects not currently in the group.
	for key, dn := range matchedByKey {
		if _, ok := currentByKey[key]; ok {
			plan.Unchanged++
		} else {
			plan.ToAdd = append(plan.ToAdd, dn)
		}
	}

	// Removals depend on the sync mode.
	mode := types.SyncMode(cfg.SyncMode)
	if mode == "" {
		mode = types.SyncModeFull
	}
	switch mode {
	case types.SyncModeFull:
		for key, dn := range currentByKey {
			if _, ok := matchedByKey[key]; !ok {
				plan.ToRemove = append(plan.ToRemove, dn)
			}
		}
	case types.SyncModeManaged:
		if store != nil {
			managed, err := store.List(rule.ID, groupDN)
			if err != nil {
				plan.Err = fmt.Errorf("reading managed members: %w", err)
				return plan
			}
			managedKeys := make(map[string]bool, len(managed))
			for _, dn := range managed {
				managedKeys[normDN(dn)] = true
			}
			for key, dn := range currentByKey {
				if managedKeys[key] {
					if _, ok := matchedByKey[key]; !ok {
						plan.ToRemove = append(plan.ToRemove, dn)
					}
				}
			}
		}
	case types.SyncModeAddOnly:
		// never remove
	}

	return plan
}

// reconcileMembership applies a SyncGroupMembership action and returns one
// ActionResult per membership change (plus a group-created result when
// relevant). Adds are reported as AddToGroup and removes as
// RemoveFromGroupIfNoLongerMatched so the activity feed categorises them as
// syncs and removals.
func (e *Engine) reconcileMembership(action *models.RuleAction, rule *models.Rule,
	matchedDNs []string, client membershipClient, store ManagedMemberStore) []ActionResult {

	plan := planMembership(action, rule, matchedDNs, client, store, true)
	if plan.Err != nil {
		return []ActionResult{{
			ActionID:   action.ID,
			ActionType: string(types.ActionSyncGroupMembership),
			ObjectDN:   plan.GroupDN,
			Success:    false,
			Error:      plan.Err.Error(),
			Details:    map[string]any{"targetGroupDn": plan.GroupDN},
		}}
	}

	var results []ActionResult
	if plan.GroupCreated {
		results = append(results, ActionResult{
			ActionID:   action.ID,
			ActionType: string(types.ActionEnsureGroupExists),
			ObjectDN:   plan.GroupDN,
			Success:    true,
			Details:    map[string]any{"groupDn": plan.GroupDN, "groupCreated": true},
		})
	}

	for _, memberDN := range plan.ToAdd {
		res := ActionResult{
			ActionID:   action.ID,
			ActionType: string(types.ActionAddToGroup),
			ObjectDN:   memberDN,
			Details:    map[string]any{"groupDn": plan.GroupDN, "memberDn": memberDN, "reason": "matched"},
		}
		if err := client.AddGroupMember(plan.GroupDN, memberDN); err != nil {
			res.Success = false
			res.Error = err.Error()
		} else {
			res.Success = true
			if store != nil {
				_ = store.Add(rule.ID, plan.GroupDN, memberDN)
			}
		}
		results = append(results, res)
	}

	for _, memberDN := range plan.ToRemove {
		res := ActionResult{
			ActionID:   action.ID,
			ActionType: string(types.ActionRemoveFromGroupIfNoMatch),
			ObjectDN:   memberDN,
			Details:    map[string]any{"groupDn": plan.GroupDN, "memberDn": memberDN, "reason": "noLongerMatched"},
		}
		if err := client.RemoveGroupMember(plan.GroupDN, memberDN); err != nil {
			res.Success = false
			res.Error = err.Error()
		} else {
			res.Success = true
			if store != nil {
				_ = store.Remove(rule.ID, plan.GroupDN, memberDN)
			}
		}
		results = append(results, res)
	}

	return results
}