Go refactoring 2

services/accessanalyzer/access_previews.go

@@ -0,0 +1,136 @@
+package accessanalyzer
+
+import (
+	"sort"
+	"time"
+
+	"github.com/google/uuid"
+)
+
+// CreateAccessPreview creates a new access preview.
+func (b *InMemoryBackend) CreateAccessPreview(analyzerArn string) (*AccessPreview, error) {
+	b.mu.Lock("CreateAccessPreview")
+	defer b.mu.Unlock()
+
+	var found bool
+
+	for _, a := range b.analyzers.All() {
+		if a.Arn == analyzerArn {
+			found = true
+
+			break
+		}
+	}
+
+	if !found {
+		return nil, ErrAnalyzerNotFound
+	}
+
+	now := time.Now().UTC()
+	ap := &AccessPreview{
+		ID:          uuid.NewString(),
+		AnalyzerArn: analyzerArn,
+		Status:      AccessPreviewStatusCompleted,
+		CreatedAt:   now,
+	}
+
+	b.accessPreviews.Put(ap)
+
+	return copyAccessPreview(ap), nil
+}
+
+// GetAccessPreview returns an access preview by ID.
+func (b *InMemoryBackend) GetAccessPreview(accessPreviewID string) (*AccessPreview, error) {
+	b.mu.RLock("GetAccessPreview")
+	defer b.mu.RUnlock()
+
+	ap, ok := b.accessPreviews.Get(accessPreviewID)
+	if !ok {
+		return nil, ErrAccessPreviewNotFound
+	}
+
+	return copyAccessPreview(ap), nil
+}
+
+// ListAccessPreviews returns all access previews for a given analyzerArn.
+func (b *InMemoryBackend) ListAccessPreviews(analyzerArn string) ([]*AccessPreview, error) {
+	b.mu.RLock("ListAccessPreviews")
+	defer b.mu.RUnlock()
+
+	result := make([]*AccessPreview, 0)
+
+	for _, ap := range b.accessPreviews.All() {
+		if analyzerArn != "" && ap.AnalyzerArn != analyzerArn {
+			continue
+		}
+
+		result = append(result, copyAccessPreview(ap))
+	}
+
+	sort.Slice(result, func(i, j int) bool {
+		return result[i].ID < result[j].ID
+	})
+
+	return result, nil
+}
+
+// ListAccessPreviewFindings returns findings from the analyzer associated with the preview.
+func (b *InMemoryBackend) ListAccessPreviewFindings(
+	accessPreviewID string,
+	maxResults int,
+	nextToken string,
+) ([]*Finding, string, error) {
+	b.mu.RLock("ListAccessPreviewFindings")
+	defer b.mu.RUnlock()
+
+	ap, ok := b.accessPreviews.Get(accessPreviewID)
+	if !ok {
+		return nil, "", ErrAccessPreviewNotFound
+	}
+
+	// Find the analyzer by ARN.
+	var analyzerName string
+
+	for _, a := range b.analyzers.All() {
+		if a.Arn == ap.AnalyzerArn {
+			analyzerName = a.Name
+
+			break
+		}
+	}
+
+	if analyzerName == "" {
+		return []*Finding{}, "", nil
+	}
+
+	group := b.findingsByAnalyzer.Get(analyzerName)
+	findings := make([]*Finding, 0, len(group))
+
+	for _, f := range group {
+		findings = append(findings, copyFinding(f))
+	}
+
+	sort.Slice(findings, func(i, j int) bool {
+		return findings[i].ID < findings[j].ID
+	})
+
+	start := 0
+
+	if nextToken != "" {
+		for i, f := range findings {
+			if f.ID == nextToken {
+				start = i
+
+				break
+			}
+		}
+	}
+
+	findings = findings[start:]
+
+	if maxResults > 0 && len(findings) > maxResults {
+		return findings[:maxResults], findings[maxResults].ID, nil
+	}
+
+	return findings, "", nil
+}

services/accessanalyzer/analyzed_resources.go

@@ -0,0 +1,111 @@
+package accessanalyzer
+
+import (
+	"sort"
+	"time"
+)
+
+// StartResourceScan records that a scan was initiated for a resource (no-op in simulation).
+func (b *InMemoryBackend) StartResourceScan(analyzerARN string, _ string) error {
+	b.mu.RLock("StartResourceScan")
+	defer b.mu.RUnlock()
+
+	// Verify the analyzer exists by ARN.
+	for _, a := range b.analyzers.All() {
+		if a.Arn == analyzerARN {
+			return nil
+		}
+	}
+
+	return ErrAnalyzerNotFound
+}
+
+// GetAnalyzedResource returns an analyzed resource for an analyzer by resource ARN.
+func (b *InMemoryBackend) GetAnalyzedResource(analyzerArn, resourceArn string) (*AnalyzedResource, error) {
+	b.mu.RLock("GetAnalyzedResource")
+	defer b.mu.RUnlock()
+
+	ar, ok := b.analyzedResources.Get(analyzedResourceKey(analyzerArn, resourceArn))
+	if !ok {
+		return nil, ErrAnalyzedResourceNotFound
+	}
+
+	cp := *ar
+
+	return &cp, nil
+}
+
+// ListAnalyzedResources returns analyzed resources for an analyzer, optionally filtered by type.
+func (b *InMemoryBackend) ListAnalyzedResources(
+	analyzerArn, resourceType string,
+	maxResults int,
+	nextToken string,
+) ([]*AnalyzedResource, string, error) {
+	b.mu.RLock("ListAnalyzedResources")
+	defer b.mu.RUnlock()
+
+	result := make([]*AnalyzedResource, 0)
+
+	for _, ar := range b.analyzedResources.All() {
+		if ar.AnalyzerArn != analyzerArn {
+			continue
+		}
+
+		if resourceType != "" && ar.ResourceType != resourceType {
+			continue
+		}
+
+		cp := *ar
+		result = append(result, &cp)
+	}
+
+	sort.Slice(result, func(i, j int) bool {
+		return result[i].ResourceArn < result[j].ResourceArn
+	})
+
+	start := 0
+
+	if nextToken != "" {
+		for i, ar := range result {
+			if ar.ResourceArn == nextToken {
+				start = i
+
+				break
+			}
+		}
+	}
+
+	result = result[start:]
+
+	if maxResults > 0 && len(result) > maxResults {
+		return result[:maxResults], result[maxResults].ResourceArn, nil
+	}
+
+	return result, "", nil
+}
+
+// AddAnalyzedResource adds a synthetic analyzed resource (for testing).
+func (b *InMemoryBackend) AddAnalyzedResource(
+	analyzerArn, resourceArn, resourceType string,
+	isPublic bool,
+) (*AnalyzedResource, error) {
+	b.mu.Lock("AddAnalyzedResource")
+	defer b.mu.Unlock()
+
+	now := time.Now().UTC()
+	ar := &AnalyzedResource{
+		ResourceArn:  resourceArn,
+		ResourceType: resourceType,
+		AnalyzerArn:  analyzerArn,
+		IsPublic:     isPublic,
+		CreatedAt:    now,
+		AnalyzedAt:   now,
+		UpdatedAt:    now,
+	}
+
+	b.analyzedResources.Put(ar)
+
+	cp := *ar
+
+	return &cp, nil
+}

services/accessanalyzer/analyzers.go

@@ -0,0 +1,119 @@
+package accessanalyzer
+
+import (
+	"slices"
+	"sort"
+	"time"
+
+	"github.com/google/uuid"
+)
+
+// CreateAnalyzer creates a new analyzer.
+func (b *InMemoryBackend) CreateAnalyzer(
+	name string,
+	analyzerType AnalyzerType,
+	tags map[string]string,
+) (*Analyzer, error) {
+	if name == "" {
+		return nil, ErrValidation
+	}
+
+	b.mu.Lock("CreateAnalyzer")
+	defer b.mu.Unlock()
+
+	if b.analyzers.Has(name) {
+		return nil, ErrAnalyzerAlreadyExists
+	}
+
+	now := time.Now().UTC()
+	a := &Analyzer{
+		Arn:       b.analyzerARN(name),
+		Name:      name,
+		Type:      analyzerType,
+		Status:    AnalyzerStatusActive,
+		CreatedAt: now,
+		Tags:      cloneTags(tags),
+	}
+
+	b.analyzers.Put(a)
+
+	return copyAnalyzer(a), nil
+}
+
+// GetAnalyzer returns the named analyzer.
+func (b *InMemoryBackend) GetAnalyzer(name string) (*Analyzer, error) {
+	b.mu.RLock("GetAnalyzer")
+	defer b.mu.RUnlock()
+
+	a, exists := b.analyzers.Get(name)
+	if !exists {
+		return nil, ErrAnalyzerNotFound
+	}
+
+	return copyAnalyzer(a), nil
+}
+
+// ListAnalyzers returns all analyzers, optionally filtered by type.
+func (b *InMemoryBackend) ListAnalyzers(analyzerType string) ([]*Analyzer, error) {
+	b.mu.RLock("ListAnalyzers")
+	defer b.mu.RUnlock()
+
+	all := b.analyzers.All()
+	result := make([]*Analyzer, 0, len(all))
+
+	for _, a := range all {
+		if analyzerType != "" && string(a.Type) != analyzerType {
+			continue
+		}
+
+		result = append(result, copyAnalyzer(a))
+	}
+
+	sort.Slice(result, func(i, j int) bool {
+		return result[i].Name < result[j].Name
+	})
+
+	return result, nil
+}
+
+// DeleteAnalyzer removes an analyzer and all its findings and archive rules.
+func (b *InMemoryBackend) DeleteAnalyzer(name string) error {
+	b.mu.Lock("DeleteAnalyzer")
+	defer b.mu.Unlock()
+
+	if !b.analyzers.Has(name) {
+		return ErrAnalyzerNotFound
+	}
+
+	b.analyzers.Delete(name)
+
+	for _, r := range slices.Clone(b.archiveRulesByAnalyzer.Get(name)) {
+		b.archiveRules.Delete(archiveRuleKey(r.AnalyzerName, r.RuleName))
+	}
+
+	for _, f := range slices.Clone(b.findingsByAnalyzer.Get(name)) {
+		b.findings.Delete(f.ID)
+	}
+
+	return nil
+}
+
+// CreateServiceLinkedAnalyzer creates an analyzer with a generated service-linked name.
+func (b *InMemoryBackend) CreateServiceLinkedAnalyzer(analyzerType AnalyzerType) (*Analyzer, error) {
+	name := "_AccessAnalyzerForInternalUse-" + uuid.NewString()[:8]
+
+	return b.CreateAnalyzer(name, analyzerType, nil)
+}
+
+// UpdateAnalyzer updates an analyzer (currently a no-op — configuration not stored).
+func (b *InMemoryBackend) UpdateAnalyzer(name string) (*Analyzer, error) {
+	b.mu.RLock("UpdateAnalyzer")
+	defer b.mu.RUnlock()
+
+	a, ok := b.analyzers.Get(name)
+	if !ok {
+		return nil, ErrAnalyzerNotFound
+	}
+
+	return copyAnalyzer(a), nil
+}