func()

in internal/pkg/api/handleAck.go [439:499]
56 lines of code
9 McCabe index (conditional complexity)

func (ack *AckT) updateAPIKey(ctx context.Context,
	zlog zerolog.Logger,
	agentID string,
	apiKeyID, permissionHash string,
	toRetireAPIKeyIDs []model.ToRetireAPIKeyIdsItems, outputName string) error {
	bulk := ack.bulk
	// use output bulker if exists
	if outputName != "" {
		outputBulk := ack.bulk.GetBulker(outputName)
		if outputBulk != nil {
			zlog.Debug().Str(logger.PolicyOutputName, outputName).Msg("Using output bulker in updateAPIKey")
			bulk = outputBulk
		}
	}
	if apiKeyID != "" {
		res, err := bulk.APIKeyRead(ctx, apiKeyID, true)
		if err != nil {
			if isAgentActive(ctx, zlog, ack.bulk, agentID) {
				zlog.Warn().
					Err(err).
					Str(LogAPIKeyID, apiKeyID).
					Str(logger.PolicyOutputName, outputName).
					Msg("Failed to read API Key roles")
			} else {
				// race when API key was invalidated before acking
				zlog.Info().
					Err(err).
					Str(LogAPIKeyID, apiKeyID).
					Str(logger.PolicyOutputName, outputName).
					Msg("Failed to read invalidated API Key roles")

				// prevents future checks
				return ErrUpdatingInactiveAgent
			}
		} else {
			clean, removedRolesCount, err := cleanRoles(res.RoleDescriptors)
			if err != nil {
				zlog.Error().
					Err(err).
					RawJSON("roles", res.RoleDescriptors).
					Str(LogAPIKeyID, apiKeyID).
					Msg("Failed to cleanup roles")
			} else if removedRolesCount > 0 {
				if err := bulk.APIKeyUpdate(ctx, apiKeyID, permissionHash, clean); err != nil {
					zlog.Error().Err(err).RawJSON("roles", clean).Str(LogAPIKeyID, apiKeyID).Str(logger.PolicyOutputName, outputName).Msg("Failed to update API Key")
				} else {
					zlog.Debug().
						Str("hash.sha256", permissionHash).
						Str(LogAPIKeyID, apiKeyID).
						RawJSON("roles", clean).
						Int("removedRoles", removedRolesCount).
						Str(logger.PolicyOutputName, outputName).
						Msg("Updating agent record to pick up reduced roles.")
				}
			}
		}
		ack.invalidateAPIKeys(ctx, zlog, toRetireAPIKeyIDs, apiKeyID)
	}

	return nil
}