Feature/expose app credential

crates/api-types/src/error_conv.rs

@@ -218,19 +218,33 @@ impl From<CatalogProviderError> for KeystoneApiError {
 }
 
 impl From<ApplicationCredentialProviderError> for KeystoneApiError {
-    fn from(source: ApplicationCredentialProviderError) -> Self {
-        match source {
+    fn from(value: ApplicationCredentialProviderError) -> Self {
+        match value {
             ApplicationCredentialProviderError::ApplicationCredentialNotFound(x) => {
                 Self::NotFound {
                     resource: "application_credential".into(),
                     identifier: x,
                 }
             }
+            ApplicationCredentialProviderError::AccessRuleNotFound(x) => Self::NotFound {
+                resource: "access_rule".into(),
+                identifier: x,
+            },
+            ApplicationCredentialProviderError::RoleNotFound(x) => Self::NotFound {
+                resource: "role".into(),
+                identifier: x,
+            },
             ref err @ ApplicationCredentialProviderError::Conflict(..) => {
                 Self::Conflict(err.to_string())
             }
-            err @ ApplicationCredentialProviderError::ApplicationCredentialExpired => {
-                Self::unauthorized(err, None::<String>)
+            ref err @ ApplicationCredentialProviderError::Validation { .. } => {
+                Self::BadRequest(err.to_string())
+            }
+            ApplicationCredentialProviderError::ApplicationCredentialExpired => {
+                Self::BadRequest("application credential has expired".into())
+            }
+            ApplicationCredentialProviderError::AccessRuleInUse(x) => {
+                Self::BadRequest(format!("access rule {x} is still in use"))
             }
             other => Self::InternalError(other.to_string()),
         }

crates/api-types/src/v3.rs

@@ -12,6 +12,7 @@
 //
 // SPDX-License-Identifier: Apache-2.0
 //! # V3 API types
+pub mod application_credential;
 pub mod auth;
 pub mod credential;
 pub mod domain;
@@ -23,6 +24,8 @@ pub mod role;
 pub mod role_assignment;
 pub mod user;
 
+#[cfg(feature = "conv")]
+mod application_credential_conv;
 #[cfg(feature = "conv")]
 mod auth_conv;
 #[cfg(feature = "conv")]

crates/api-types/src/v3/application_credential.rs

@@ -0,0 +1,16 @@
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+// SPDX-License-Identifier: Apache-2.0
+
+pub mod access_rule;
+pub mod application_credential;

crates/api-types/src/v3/application_credential/access_rule.rs

@@ -0,0 +1,84 @@
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+// SPDX-License-Identifier: Apache-2.0
+
+use serde::{Deserialize, Serialize};
+/// Short access rule representation.
+#[derive(Clone, Debug, Deserialize, PartialEq, Serialize)]
+#[cfg_attr(
+    feature = "builder",
+    derive(derive_builder::Builder),
+    builder(
+        build_fn(error = "crate::error::BuilderError"),
+        setter(strip_option, into)
+    )
+)]
+#[cfg_attr(feature = "openapi", derive(utoipa::ToSchema))]
+#[cfg_attr(feature = "validate", derive(validator::Validate))]
+pub struct AccessRule {
+    /// The ID of the access rule.
+    #[cfg_attr(feature = "validate", validate(length(min = 1, max = 64)))]
+    pub id: String,
+
+    /// The HTTP method permitted.
+    #[cfg_attr(feature = "builder", builder(default))]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    #[cfg_attr(feature = "validate", validate(length(min = 1, max = 16)))]
+    pub method: Option<String>,
+
+    /// The API path permitted.
+    #[cfg_attr(feature = "builder", builder(default))]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    #[cfg_attr(feature = "validate", validate(length(min = 1, max = 128)))]
+    pub path: Option<String>,
+
+    /// The service type permitted.
+    #[cfg_attr(feature = "builder", builder(default))]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    #[cfg_attr(feature = "validate", validate(length(min = 1, max = 64)))]
+    pub service: Option<String>,
+}
+
+/// Access rule for creation (id is optional).
+#[derive(Clone, Debug, Deserialize, PartialEq, Serialize)]
+#[cfg_attr(
+    feature = "builder",
+    derive(derive_builder::Builder),
+    builder(
+        build_fn(error = "crate::error::BuilderError"),
+        setter(strip_option, into)
+    )
+)]
+#[cfg_attr(feature = "openapi", derive(utoipa::ToSchema))]
+#[cfg_attr(feature = "validate", derive(validator::Validate))]
+pub struct AccessRuleCreate {
+    #[cfg_attr(feature = "builder", builder(default))]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    #[cfg_attr(feature = "validate", validate(length(min = 1, max = 64)))]
+    pub id: Option<String>,
+
+    #[cfg_attr(feature = "builder", builder(default))]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    #[cfg_attr(feature = "validate", validate(length(min = 1, max = 16)))]
+    pub method: Option<String>,
+
+    #[cfg_attr(feature = "builder", builder(default))]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    #[cfg_attr(feature = "validate", validate(length(min = 1, max = 128)))]
+    pub path: Option<String>,
+
+    #[cfg_attr(feature = "builder", builder(default))]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    #[cfg_attr(feature = "validate", validate(length(min = 1, max = 64)))]
+    pub service: Option<String>,
+}

crates/api-types/src/v3/application_credential/application_credential.rs

@@ -0,0 +1,179 @@
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+// SPDX-License-Identifier: Apache-2.0
+//! # Application credential API types
+
+use chrono::{DateTime, Utc};
+use serde::{Deserialize, Serialize};
+#[cfg(feature = "validate")]
+use validator::Validate;
+
+use crate::v3::application_credential::access_rule::{AccessRule, AccessRuleCreate};
+use crate::v3::role::RoleRef;
+
+/// Full application credential representation.
+#[derive(Clone, Debug, Deserialize, PartialEq, Serialize)]
+#[cfg_attr(
+    feature = "builder",
+    derive(derive_builder::Builder),
+    builder(
+        build_fn(error = "crate::error::BuilderError"),
+        setter(strip_option, into)
+    )
+)]
+#[cfg_attr(feature = "openapi", derive(utoipa::ToSchema))]
+#[cfg_attr(feature = "validate", derive(validator::Validate))]
+pub struct ApplicationCredential {
+    #[cfg_attr(feature = "builder", builder(default))]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    #[cfg_attr(feature = "validate", validate(nested))]
+    pub access_rules: Option<Vec<AccessRule>>,
+
+    #[cfg_attr(feature = "builder", builder(default))]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    #[cfg_attr(feature = "validate", validate(length(min = 1, max = 255)))]
+    pub description: Option<String>,
+
+    #[cfg_attr(feature = "builder", builder(default))]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub expires_at: Option<DateTime<Utc>>,
+
+    #[cfg_attr(feature = "validate", validate(length(min = 1, max = 64)))]
+    pub id: String,
+
+    #[cfg_attr(feature = "validate", validate(length(min = 1, max = 255)))]
+    pub name: String,
+
+    #[cfg_attr(feature = "validate", validate(length(min = 1, max = 64)))]
+    pub project_id: String,
+
+    #[cfg_attr(feature = "validate", validate(nested))]
+    pub roles: Vec<RoleRef>,
+
+    pub unrestricted: bool,
+
+    #[cfg_attr(feature = "validate", validate(length(min = 1, max = 64)))]
+    pub user_id: String,
+}
+
+/// Data for creating an application credential.
+#[derive(Clone, Debug, Deserialize, PartialEq, Serialize)]
+#[cfg_attr(
+    feature = "builder",
+    derive(derive_builder::Builder),
+    builder(
+        build_fn(error = "crate::error::BuilderError"),
+        setter(strip_option, into)
+    )
+)]
+#[cfg_attr(feature = "openapi", derive(utoipa::ToSchema))]
+#[cfg_attr(feature = "validate", derive(validator::Validate))]
+pub struct ApplicationCredentialCreate {
+    #[cfg_attr(feature = "builder", builder(default))]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    #[cfg_attr(feature = "validate", validate(nested))]
+    pub access_rules: Option<Vec<AccessRuleCreate>>,
+
+    #[cfg_attr(feature = "builder", builder(default))]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub description: Option<String>,
+
+    #[cfg_attr(feature = "builder", builder(default))]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub expires_at: Option<DateTime<Utc>>,
+
+    #[cfg_attr(feature = "builder", builder(default))]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    #[cfg_attr(feature = "validate", validate(length(min = 1, max = 64)))]
+    pub id: Option<String>,
+
+    #[cfg_attr(feature = "validate", validate(length(min = 1, max = 255)))]
+    pub name: String,
+
+    #[cfg_attr(feature = "builder", builder(default))]
+    pub roles: Vec<RoleRef>,
+
+    #[cfg_attr(feature = "builder", builder(default))]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub unrestricted: Option<bool>,
+}
+
+/// Wrapper for a single application credential response.
+#[derive(Clone, Debug, Deserialize, PartialEq, Serialize)]
+#[cfg_attr(feature = "openapi", derive(utoipa::ToSchema))]
+#[cfg_attr(feature = "validate", derive(validator::Validate))]
+pub struct ApplicationCredentialResponse {
+    #[cfg_attr(feature = "validate", validate(nested))]
+    pub application_credential: ApplicationCredential,
+}
+
+/// Wrapper for a create request body.
+#[derive(Clone, Debug, Deserialize, PartialEq, Serialize)]
+#[cfg_attr(feature = "openapi", derive(utoipa::ToSchema))]
+#[cfg_attr(feature = "validate", derive(validator::Validate))]
+pub struct ApplicationCredentialCreateRequest {
+    #[cfg_attr(feature = "validate", validate(nested))]
+    pub application_credential: ApplicationCredentialCreate,
+}
+
+/// Application credential as returned by create — includes secret (shown once only).
+#[derive(Clone, Debug, Deserialize, PartialEq, Serialize)]
+#[cfg_attr(feature = "openapi", derive(utoipa::ToSchema))]
+#[cfg_attr(feature = "validate", derive(validator::Validate))]
+pub struct ApplicationCredentialCreated {
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub access_rules: Option<Vec<AccessRule>>,
+
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub description: Option<String>,
+
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub expires_at: Option<DateTime<Utc>>,
+
+    pub id: String,
+    pub name: String,
+    pub project_id: String,
+    pub roles: Vec<RoleRef>,
+
+    /// Only present in create response. Never returned again.
+    pub secret: String,
+
+    pub unrestricted: bool,
+    pub user_id: String,
+}
+
+/// Wrapper for create response body.
+#[derive(Clone, Debug, Deserialize, PartialEq, Serialize)]
+#[cfg_attr(feature = "openapi", derive(utoipa::ToSchema))]
+#[cfg_attr(feature = "validate", derive(validator::Validate))]
+pub struct ApplicationCredentialCreateResponse {
+    pub application_credential: ApplicationCredentialCreated,
+}
+
+/// List of application credentials.
+#[derive(Clone, Debug, Deserialize, PartialEq, Serialize)]
+#[cfg_attr(feature = "openapi", derive(utoipa::ToSchema))]
+#[cfg_attr(feature = "validate", derive(validator::Validate))]
+pub struct ApplicationCredentialList {
+    #[cfg_attr(feature = "validate", validate(nested))]
+    pub application_credentials: Vec<ApplicationCredential>,
+}
+
+/// List parameters for filtering application credentials.
+#[derive(Clone, Debug, Default, Deserialize, PartialEq, Serialize)]
+#[cfg_attr(feature = "openapi", derive(utoipa::IntoParams))]
+#[cfg_attr(feature = "validate", derive(validator::Validate))]
+pub struct ApplicationCredentialListParameters {
+    #[cfg_attr(feature = "validate", validate(length(max = 255)))]
+    pub name: Option<String>,
+}