improve IAM module

Signed-off-by: hongming <talonwan@yunify.com>

pkg/models/resources/v1alpha3/workspacerole/workspaceroles.go

@@ -18,9 +18,13 @@
 package workspacerole
 
 import (
+	"encoding/json"
+	"k8s.io/apimachinery/pkg/api/errors"
 	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/klog"
 	"kubesphere.io/kubesphere/pkg/api"
 	iamv1alpha2 "kubesphere.io/kubesphere/pkg/apis/iam/v1alpha2"
+	tenantv1alpha1 "kubesphere.io/kubesphere/pkg/apis/tenant/v1alpha1"
 	"kubesphere.io/kubesphere/pkg/apiserver/query"
 	informers "kubesphere.io/kubesphere/pkg/client/informers/externalversions"
 	"kubesphere.io/kubesphere/pkg/models/resources/v1alpha3"
@@ -38,19 +42,28 @@ func (d *workspacerolesGetter) Get(_, name string) (runtime.Object, error) {
 	return d.sharedInformers.Iam().V1alpha2().WorkspaceRoles().Lister().Get(name)
 }
 
-func (d *workspacerolesGetter) List(_ string, query *query.Query) (*api.ListResult, error) {
+func (d *workspacerolesGetter) List(_ string, queryParam *query.Query) (*api.ListResult, error) {
+
+	var roles []*iamv1alpha2.WorkspaceRole
+	var err error
+
+	if aggregateTo := queryParam.Filters[iamv1alpha2.AggregateTo]; aggregateTo != "" {
+		roles, err = d.fetchAggregationRoles(string(aggregateTo))
+		delete(queryParam.Filters, iamv1alpha2.AggregateTo)
+	} else {
+		roles, err = d.sharedInformers.Iam().V1alpha2().WorkspaceRoles().Lister().List(queryParam.Selector())
+	}
 
-	all, err := d.sharedInformers.Iam().V1alpha2().WorkspaceRoles().Lister().List(query.Selector())
 	if err != nil {
 		return nil, err
 	}
 
 	var result []runtime.Object
-	for _, deploy := range all {
-		result = append(result, deploy)
+	for _, role := range roles {
+		result = append(result, role)
 	}
 
-	return v1alpha3.DefaultList(result, query, d.compare, d.filter), nil
+	return v1alpha3.DefaultList(result, queryParam, d.compare, d.filter), nil
 }
 
 func (d *workspacerolesGetter) compare(left runtime.Object, right runtime.Object, field query.Field) bool {
@@ -75,5 +88,46 @@ func (d *workspacerolesGetter) filter(object runtime.Object, filter query.Filter
 		return false
 	}
 
-	return v1alpha3.DefaultObjectMetaFilter(role.ObjectMeta, filter)
+	switch filter.Field {
+	case iamv1alpha2.ScopeWorkspace:
+		return role.Labels[tenantv1alpha1.WorkspaceLabel] == string(filter.Value)
+	default:
+		return v1alpha3.DefaultObjectMetaFilter(role.ObjectMeta, filter)
+	}
+
+}
+
+func (d *workspacerolesGetter) fetchAggregationRoles(name string) ([]*iamv1alpha2.WorkspaceRole, error) {
+	roles := make([]*iamv1alpha2.WorkspaceRole, 0)
+
+	obj, err := d.Get("", name)
+
+	if err != nil {
+		if errors.IsNotFound(err) {
+			return roles, nil
+		}
+		return nil, err
+	}
+
+	if annotation := obj.(*iamv1alpha2.WorkspaceRole).Annotations[iamv1alpha2.AggregationRolesAnnotation]; annotation != "" {
+		var roleNames []string
+		if err = json.Unmarshal([]byte(annotation), &roleNames); err == nil {
+
+			for _, roleName := range roleNames {
+				role, err := d.Get("", roleName)
+
+				if err != nil {
+					if errors.IsNotFound(err) {
+						klog.Warningf("invalid aggregation role found: %s, %s", name, roleName)
+						continue
+					}
+					return nil, err
+				}
+
+				roles = append(roles, role.(*iamv1alpha2.WorkspaceRole))
+			}
+		}
+	}
+
+	return roles, nil
 }