WIP #600 - Control authorized entities before create or update usage plan

Author: quentinovega

daikoku/app/controllers/ApiController.scala

@@ -4730,6 +4730,7 @@ class ApiController(
         }
 
         (for {
+          _ <- newPlan.checkAuthorizedEntities(team)
           api <- EitherT.fromOptionF[Future, AppError, Api](
             env.dataStore.apiRepo
               .forTenant(ctx.tenant)
@@ -5059,6 +5060,7 @@ class ApiController(
         }
 
         val value: EitherT[Future, AppError, Result] = for {
+          _ <- updatedPlan.checkAuthorizedEntities(team)
           api <- EitherT.fromOptionF(
             env.dataStore.apiRepo
               .forTenant(ctx.tenant)

daikoku/app/domain/apiEntities.scala

@@ -296,6 +296,24 @@ sealed trait UsagePlan {
       case (_, TenantDisplay.Default) => EitherT.pure[Future, AppError](())
     }
   }
+
+  def checkAuthorizedEntities(team: Team)(implicit ec: ExecutionContext): EitherT[Future, AppError, Unit] = {
+    otoroshiTarget match {
+      case Some(otoroshiTarget) if team.authorizedOtoroshiEntities.isDefined =>
+        val teamAuthorizedEntities = team.authorizedOtoroshiEntities.get.find(_.otoroshiSettingsId == otoroshiTarget.otoroshiSettings)
+
+        teamAuthorizedEntities match {
+          case Some(authorizedEntities) =>
+            for {
+              _ <- EitherT.cond[Future](authorizedEntities.authorizedEntities.groups.diff(otoroshiTarget.authorizedEntities.map(_.groups).getOrElse(Set.empty)).isEmpty, (), AppError.Unauthorized)
+              _ <- EitherT.cond[Future](authorizedEntities.authorizedEntities.services.diff(otoroshiTarget.authorizedEntities.map(_.services).getOrElse(Set.empty)).isEmpty, (), AppError.Unauthorized)
+              _ <- EitherT.cond[Future](authorizedEntities.authorizedEntities.routes.diff(otoroshiTarget.authorizedEntities.map(_.routes).getOrElse(Set.empty)).isEmpty, (), AppError.Unauthorized)
+            } yield ()
+          case None => EitherT.leftT[Future, Unit](AppError.Unauthorized)
+        }
+      case _ => EitherT.pure[Future, AppError](())
+    }
+  }
 }
 
 case object UsagePlan {