/*
Copyright 2020 The KubeSphere Authors.

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

    http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/
package am

import (
	"encoding/json"
	"fmt"

	rbacv1 "k8s.io/api/rbac/v1"
	"k8s.io/apimachinery/pkg/api/errors"
	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
	"k8s.io/apimachinery/pkg/labels"
	"k8s.io/apimachinery/pkg/types"
	"k8s.io/client-go/kubernetes"
	listersv1 "k8s.io/client-go/listers/core/v1"
	"k8s.io/klog"
	"kubesphere.io/kubesphere/pkg/api"
	iamv1alpha2 "kubesphere.io/kubesphere/pkg/apis/iam/v1alpha2"
	tenantv1alpha1 "kubesphere.io/kubesphere/pkg/apis/tenant/v1alpha1"
	"kubesphere.io/kubesphere/pkg/apiserver/query"
	kubesphere "kubesphere.io/kubesphere/pkg/client/clientset/versioned"
	devopslisters "kubesphere.io/kubesphere/pkg/client/listers/devops/v1alpha3"
	"kubesphere.io/kubesphere/pkg/informers"
	resourcev1alpha3 "kubesphere.io/kubesphere/pkg/models/resources/v1alpha3"
	"kubesphere.io/kubesphere/pkg/models/resources/v1alpha3/clusterrole"
	"kubesphere.io/kubesphere/pkg/models/resources/v1alpha3/clusterrolebinding"
	"kubesphere.io/kubesphere/pkg/models/resources/v1alpha3/globalrole"
	"kubesphere.io/kubesphere/pkg/models/resources/v1alpha3/globalrolebinding"
	"kubesphere.io/kubesphere/pkg/models/resources/v1alpha3/role"
	"kubesphere.io/kubesphere/pkg/models/resources/v1alpha3/rolebinding"
	"kubesphere.io/kubesphere/pkg/models/resources/v1alpha3/workspacerole"
	"kubesphere.io/kubesphere/pkg/models/resources/v1alpha3/workspacerolebinding"
	"kubesphere.io/kubesphere/pkg/utils/sliceutil"
)

type AccessManagementInterface interface {
	GetGlobalRoleOfUser(username string) (*iamv1alpha2.GlobalRole, error)
	GetWorkspaceRoleOfUser(username string, groups []string, workspace string) ([]*iamv1alpha2.WorkspaceRole, error)
	GetClusterRoleOfUser(username string) (*rbacv1.ClusterRole, error)
	GetNamespaceRoleOfUser(username string, groups []string, namespace string) ([]*rbacv1.Role, error)
	ListRoles(namespace string, query *query.Query) (*api.ListResult, error)
	ListClusterRoles(query *query.Query) (*api.ListResult, error)
	ListWorkspaceRoles(query *query.Query) (*api.ListResult, error)
	ListGlobalRoles(query *query.Query) (*api.ListResult, error)
	ListGlobalRoleBindings(username string) ([]*iamv1alpha2.GlobalRoleBinding, error)
	ListClusterRoleBindings(username string) ([]*rbacv1.ClusterRoleBinding, error)
	ListWorkspaceRoleBindings(username string, groups []string, workspace string) ([]*iamv1alpha2.WorkspaceRoleBinding, error)
	ListRoleBindings(username string, groups []string, namespace string) ([]*rbacv1.RoleBinding, error)
	GetRoleReferenceRules(roleRef rbacv1.RoleRef, namespace string) (string, []rbacv1.PolicyRule, error)
	GetGlobalRole(globalRole string) (*iamv1alpha2.GlobalRole, error)
	GetWorkspaceRole(workspace string, name string) (*iamv1alpha2.WorkspaceRole, error)
	CreateGlobalRoleBinding(username string, globalRole string) error
	CreateOrUpdateWorkspaceRole(workspace string, workspaceRole *iamv1alpha2.WorkspaceRole) (*iamv1alpha2.WorkspaceRole, error)
	PatchWorkspaceRole(workspace string, workspaceRole *iamv1alpha2.WorkspaceRole) (*iamv1alpha2.WorkspaceRole, error)
	CreateOrUpdateGlobalRole(globalRole *iamv1alpha2.GlobalRole) (*iamv1alpha2.GlobalRole, error)
	PatchGlobalRole(globalRole *iamv1alpha2.GlobalRole) (*iamv1alpha2.GlobalRole, error)
	DeleteWorkspaceRole(workspace string, name string) error
	DeleteGlobalRole(name string) error
	CreateOrUpdateClusterRole(clusterRole *rbacv1.ClusterRole) (*rbacv1.ClusterRole, error)
	DeleteClusterRole(name string) error
	GetClusterRole(name string) (*rbacv1.ClusterRole, error)
	GetNamespaceRole(namespace string, name string) (*rbacv1.Role, error)
	CreateOrUpdateNamespaceRole(namespace string, role *rbacv1.Role) (*rbacv1.Role, error)
	DeleteNamespaceRole(namespace string, name string) error
	CreateUserWorkspaceRoleBinding(username string, workspace string, role string) error
	RemoveUserFromWorkspace(username string, workspace string) error
	CreateNamespaceRoleBinding(username string, namespace string, role string) error
	RemoveUserFromNamespace(username string, namespace string) error
	CreateClusterRoleBinding(username string, role string) error
	RemoveUserFromCluster(username string) error
	GetDevOpsRelatedNamespace(devops string) (string, error)
	GetNamespaceControlledWorkspace(namespace string) (string, error)
	GetDevOpsControlledWorkspace(devops string) (string, error)
	PatchNamespaceRole(namespace string, role *rbacv1.Role) (*rbacv1.Role, error)
	PatchClusterRole(clusterRole *rbacv1.ClusterRole) (*rbacv1.ClusterRole, error)
	ListGroupRoleBindings(workspace string, query *query.Query) ([]*rbacv1.RoleBinding, error)
	CreateRoleBinding(namespace string, roleBinding *rbacv1.RoleBinding) (*rbacv1.RoleBinding, error)
	DeleteRoleBinding(namespace, name string) error
	ListGroupWorkspaceRoleBindings(workspace string, query *query.Query) (*api.ListResult, error)
	CreateWorkspaceRoleBinding(workspace string, roleBinding *iamv1alpha2.WorkspaceRoleBinding) (*iamv1alpha2.WorkspaceRoleBinding, error)
	DeleteWorkspaceRoleBinding(workspaceName, name string) error
}

type amOperator struct {
	globalRoleBindingGetter    resourcev1alpha3.Interface
	workspaceRoleBindingGetter resourcev1alpha3.Interface
	clusterRoleBindingGetter   resourcev1alpha3.Interface
	roleBindingGetter          resourcev1alpha3.Interface
	globalRoleGetter           resourcev1alpha3.Interface
	workspaceRoleGetter        resourcev1alpha3.Interface
	clusterRoleGetter          resourcev1alpha3.Interface
	roleGetter                 resourcev1alpha3.Interface
	devopsProjectLister        devopslisters.DevOpsProjectLister
	namespaceLister            listersv1.NamespaceLister
	ksclient                   kubesphere.Interface
	k8sclient                  kubernetes.Interface
}

func NewReadOnlyOperator(factory informers.InformerFactory) AccessManagementInterface {
	return &amOperator{
		globalRoleBindingGetter:    globalrolebinding.New(factory.KubeSphereSharedInformerFactory()),
		workspaceRoleBindingGetter: workspacerolebinding.New(factory.KubeSphereSharedInformerFactory()),
		clusterRoleBindingGetter:   clusterrolebinding.New(factory.KubernetesSharedInformerFactory()),
		roleBindingGetter:          rolebinding.New(factory.KubernetesSharedInformerFactory()),
		globalRoleGetter:           globalrole.New(factory.KubeSphereSharedInformerFactory()),
		workspaceRoleGetter:        workspacerole.New(factory.KubeSphereSharedInformerFactory()),
		clusterRoleGetter:          clusterrole.New(factory.KubernetesSharedInformerFactory()),
		roleGetter:                 role.New(factory.KubernetesSharedInformerFactory()),
		devopsProjectLister:        factory.KubeSphereSharedInformerFactory().Devops().V1alpha3().DevOpsProjects().Lister(),
		namespaceLister:            factory.KubernetesSharedInformerFactory().Core().V1().Namespaces().Lister(),
	}
}

func NewOperator(ksClient kubesphere.Interface, k8sClient kubernetes.Interface, factory informers.InformerFactory) AccessManagementInterface {
	amOperator := NewReadOnlyOperator(factory).(*amOperator)
	amOperator.ksclient = ksClient
	amOperator.k8sclient = k8sClient
	return amOperator
}

func (am *amOperator) GetGlobalRoleOfUser(username string) (*iamv1alpha2.GlobalRole, error) {
	globalRoleBindings, err := am.ListGlobalRoleBindings(username)
	if len(globalRoleBindings) > 0 {
		// Usually, only one globalRoleBinding will be found which is created from ks-console.
		if len(globalRoleBindings) > 1 {
			klog.Warningf("conflict global role binding, username: %s", username)
		}
		globalRole, err := am.GetGlobalRole(globalRoleBindings[0].RoleRef.Name)
		if err != nil {
			klog.Error(err)
			return nil, err
		}
		return globalRole, nil
	}

	err = errors.NewNotFound(iamv1alpha2.Resource(iamv1alpha2.ResourcesSingularGlobalRoleBinding), username)
	klog.V(4).Info(err)
	return nil, err
}

func (am *amOperator) GetWorkspaceRoleOfUser(username string, groups []string, workspace string) ([]*iamv1alpha2.WorkspaceRole, error) {

	userRoleBindings, err := am.ListWorkspaceRoleBindings(username, groups, workspace)

	if err != nil {
		klog.Error(err)
		return nil, err
	}

	if len(userRoleBindings) > 0 {
		roles := make([]*iamv1alpha2.WorkspaceRole, len(userRoleBindings))
		for i, roleBinding := range userRoleBindings {
			role, err := am.GetWorkspaceRole(workspace, roleBinding.RoleRef.Name)

			if err != nil {
				klog.Error(err)
				return nil, err
			}

			out := role.DeepCopy()
			if out.Annotations == nil {
				out.Annotations = make(map[string]string, 0)
			}
			out.Annotations[iamv1alpha2.WorkspaceRoleAnnotation] = role.Name

			roles[i] = out
		}

		if len(userRoleBindings) > 1 {
			klog.Infof("conflict workspace role binding, username: %s", username)
		}

		return roles, nil
	}

	err = errors.NewNotFound(iamv1alpha2.Resource(iamv1alpha2.ResourcesSingularWorkspaceRoleBinding), username)
	klog.V(4).Info(err)
	return nil, err
}

func (am *amOperator) GetNamespaceRoleOfUser(username string, groups []string, namespace string) ([]*rbacv1.Role, error) {

	userRoleBindings, err := am.ListRoleBindings(username, groups, namespace)

	if err != nil {
		klog.Error(err)
		return nil, err
	}

	if len(userRoleBindings) > 0 {
		roles := make([]*rbacv1.Role, len(userRoleBindings))
		for i, roleBinding := range userRoleBindings {
			role, err := am.GetNamespaceRole(namespace, roleBinding.RoleRef.Name)
			if err != nil {
				klog.Error(err)
				return nil, err
			}

			out := role.DeepCopy()
			if out.Annotations == nil {
				out.Annotations = make(map[string]string, 0)
			}
			out.Annotations[iamv1alpha2.RoleAnnotation] = role.Name

			roles[i] = out
		}

		if len(userRoleBindings) > 1 {
			klog.Infof("conflict role binding, username: %s", username)
		}
		return roles, nil
	}

	err = errors.NewNotFound(iamv1alpha2.Resource(iamv1alpha2.ResourcesSingularRoleBinding), username)
	klog.V(4).Info(err)
	return nil, err
}

func (am *amOperator) GetClusterRoleOfUser(username string) (*rbacv1.ClusterRole, error) {
	userRoleBindings, err := am.ListClusterRoleBindings(username)

	if err != nil {
		klog.Error(err)
		return nil, err
	}

	if len(userRoleBindings) > 0 {
		role, err := am.GetClusterRole(userRoleBindings[0].RoleRef.Name)
		if err != nil {
			klog.Error(err)
			return nil, err
		}

		if len(userRoleBindings) > 1 {
			klog.Warningf("conflict cluster role binding, username: %s", username)
		}

		out := role.DeepCopy()
		if out.Annotations == nil {
			out.Annotations = make(map[string]string, 0)
		}
		out.Annotations[iamv1alpha2.ClusterRoleAnnotation] = role.Name
		return out, nil
	}

	err = errors.NewNotFound(iamv1alpha2.Resource(iamv1alpha2.ResourcesSingularClusterRoleBinding), username)
	klog.V(4).Info(err)
	return nil, err
}

func (am *amOperator) ListWorkspaceRoleBindings(username string, groups []string, workspace string) ([]*iamv1alpha2.WorkspaceRoleBinding, error) {
	roleBindings, err := am.workspaceRoleBindingGetter.List("", query.New())

	if err != nil {
		return nil, err
	}

	result := make([]*iamv1alpha2.WorkspaceRoleBinding, 0)

	for _, obj := range roleBindings.Items {
		roleBinding := obj.(*iamv1alpha2.WorkspaceRoleBinding)
		inSpecifiedWorkspace := workspace == "" || roleBinding.Labels[tenantv1alpha1.WorkspaceLabel] == workspace
		if contains(roleBinding.Subjects, username, groups) && inSpecifiedWorkspace {
			result = append(result, roleBinding)
		}
	}

	return result, nil
}

func (am *amOperator) ListClusterRoleBindings(username string) ([]*rbacv1.ClusterRoleBinding, error) {

	roleBindings, err := am.clusterRoleBindingGetter.List("", query.New())
	if err != nil {
		return nil, err
	}

	result := make([]*rbacv1.ClusterRoleBinding, 0)
	for _, obj := range roleBindings.Items {
		roleBinding := obj.(*rbacv1.ClusterRoleBinding)
		if contains(roleBinding.Subjects, username, nil) {
			result = append(result, roleBinding)
		}
	}

	return result, nil
}

func (am *amOperator) ListGlobalRoleBindings(username string) ([]*iamv1alpha2.GlobalRoleBinding, error) {
	roleBindings, err := am.globalRoleBindingGetter.List("", query.New())
	if err != nil {
		return nil, err
	}

	result := make([]*iamv1alpha2.GlobalRoleBinding, 0)
	for _, obj := range roleBindings.Items {
		roleBinding := obj.(*iamv1alpha2.GlobalRoleBinding)
		if contains(roleBinding.Subjects, username, nil) {
			result = append(result, roleBinding)
		}
	}

	return result, nil
}

func (am *amOperator) ListRoleBindings(username string, groups []string, namespace string) ([]*rbacv1.RoleBinding, error) {
	roleBindings, err := am.roleBindingGetter.List(namespace, query.New())
	if err != nil {
		klog.Error(err)
		return nil, err
	}

	result := make([]*rbacv1.RoleBinding, 0)
	for _, obj := range roleBindings.Items {
		roleBinding := obj.(*rbacv1.RoleBinding)
		if contains(roleBinding.Subjects, username, groups) {
			result = append(result, roleBinding)
		}
	}
	return result, nil
}

func contains(subjects []rbacv1.Subject, username string, groups []string) bool {
	// if username is nil means list all role bindings
	if username == "" {
		return true
	}
	for _, subject := range subjects {
		if subject.Kind == rbacv1.UserKind && subject.Name == username {
			return true
		}
		if subject.Kind == rbacv1.GroupKind && sliceutil.HasString(groups, subject.Name) {
			return true
		}
	}
	return false
}

func (am *amOperator) ListRoles(namespace string, query *query.Query) (*api.ListResult, error) {
	return am.roleGetter.List(namespace, query)
}

func (am *amOperator) ListClusterRoles(query *query.Query) (*api.ListResult, error) {
	return am.clusterRoleGetter.List("", query)
}

func (am *amOperator) ListWorkspaceRoles(queryParam *query.Query) (*api.ListResult, error) {
	return am.workspaceRoleGetter.List("", queryParam)
}

func (am *amOperator) ListGlobalRoles(query *query.Query) (*api.ListResult, error) {
	return am.globalRoleGetter.List("", query)
}

func (am *amOperator) GetGlobalRole(globalRole string) (*iamv1alpha2.GlobalRole, error) {
	obj, err := am.globalRoleGetter.Get("", globalRole)
	if err != nil {
		klog.Error(err)
		return nil, err
	}
	return obj.(*iamv1alpha2.GlobalRole), nil
}

func (am *amOperator) CreateGlobalRoleBinding(username string, role string) error {
	_, err := am.GetGlobalRole(role)
	if err != nil {
		klog.Error(err)
		return err
	}

	roleBindings, err := am.ListGlobalRoleBindings(username)
	if err != nil {
		klog.Error(err)
		return err
	}

	for _, roleBinding := range roleBindings {
		if role == roleBinding.RoleRef.Name {
			return nil
		}
		err := am.ksclient.IamV1alpha2().GlobalRoleBindings().Delete(roleBinding.Name, metav1.NewDeleteOptions(0))
		if err != nil {
			if errors.IsNotFound(err) {
				continue
			}
			klog.Error(err)
			return err
		}
	}

	globalRoleBinding := iamv1alpha2.GlobalRoleBinding{
		ObjectMeta: metav1.ObjectMeta{
			Name:   fmt.Sprintf("%s-%s", username, role),
			Labels: map[string]string{iamv1alpha2.UserReferenceLabel: username},
		},
		Subjects: []rbacv1.Subject{
			{
				Kind:     rbacv1.UserKind,
				APIGroup: rbacv1.SchemeGroupVersion.Group,
				Name:     username,
			},
		},
		RoleRef: rbacv1.RoleRef{
			APIGroup: iamv1alpha2.SchemeGroupVersion.Group,
			Kind:     iamv1alpha2.ResourceKindGlobalRole,
			Name:     role,
		},
	}

	if _, err := am.ksclient.IamV1alpha2().GlobalRoleBindings().Create(&globalRoleBinding); err != nil {
		return err
	}

	return nil
}

func (am *amOperator) CreateOrUpdateWorkspaceRole(workspace string, workspaceRole *iamv1alpha2.WorkspaceRole) (*iamv1alpha2.WorkspaceRole, error) {
	if workspaceRole.Labels == nil {
		workspaceRole.Labels = make(map[string]string, 0)
	}
	workspaceRole.Labels[tenantv1alpha1.WorkspaceLabel] = workspace
	workspaceRole.Rules = make([]rbacv1.PolicyRule, 0)
	if aggregateRoles := am.getAggregateRoles(workspaceRole.ObjectMeta); aggregateRoles != nil {
		for _, roleName := range aggregateRoles {
			aggregationRole, err := am.GetWorkspaceRole("", roleName)
			if err != nil {
				klog.Error(err)
				return nil, err
			}
			workspaceRole.Rules = append(workspaceRole.Rules, aggregationRole.Rules...)
		}
	}
	var created *iamv1alpha2.WorkspaceRole
	var err error
	if workspaceRole.ResourceVersion != "" {
		created, err = am.ksclient.IamV1alpha2().WorkspaceRoles().Update(workspaceRole)
	} else {
		created, err = am.ksclient.IamV1alpha2().WorkspaceRoles().Create(workspaceRole)
	}

	return created, err
}

func (am *amOperator) PatchGlobalRole(globalRole *iamv1alpha2.GlobalRole) (*iamv1alpha2.GlobalRole, error) {
	old, err := am.GetGlobalRole(globalRole.Name)
	if err != nil {
		klog.Error(err)
		return nil, err
	}

	// rules cannot be override
	globalRole.Rules = old.Rules
	// aggregate roles if annotation has change
	if aggregateRoles := am.getAggregateRoles(globalRole.ObjectMeta); aggregateRoles != nil {
		globalRole.Rules = make([]rbacv1.PolicyRule, 0)
		for _, roleName := range aggregateRoles {
			aggregationRole, err := am.GetGlobalRole(roleName)
			if err != nil {
				klog.Error(err)
				return nil, err
			}
			globalRole.Rules = append(globalRole.Rules, aggregationRole.Rules...)
		}
	}

	data, err := json.Marshal(globalRole)
	if err != nil {
		return nil, err
	}

	return am.ksclient.IamV1alpha2().GlobalRoles().Patch(globalRole.Name, types.MergePatchType, data)
}

func (am *amOperator) getAggregateRoles(obj metav1.ObjectMeta) []string {
	if aggregateRolesAnnotation := obj.Annotations[iamv1alpha2.AggregationRolesAnnotation]; aggregateRolesAnnotation != "" {
		var aggregateRoles []string
		if err := json.Unmarshal([]byte(aggregateRolesAnnotation), &aggregateRoles); err != nil {
			klog.Warningf("invalid aggregation role annotation found %+v", obj)
		}
		return aggregateRoles
	}
	return nil
}

func (am *amOperator) PatchWorkspaceRole(workspace string, workspaceRole *iamv1alpha2.WorkspaceRole) (*iamv1alpha2.WorkspaceRole, error) {
	old, err := am.GetWorkspaceRole(workspace, workspaceRole.Name)
	if err != nil {
		klog.Error(err)
		return nil, err
	}

	// workspace label cannot be override
	if workspaceRole.Labels[tenantv1alpha1.WorkspaceLabel] != "" {
		workspaceRole.Labels[tenantv1alpha1.WorkspaceLabel] = workspace
	}

	// rules cannot be override
	workspaceRole.Rules = old.Rules
	// aggregate roles if annotation has change
	if aggregateRoles := am.getAggregateRoles(workspaceRole.ObjectMeta); aggregateRoles != nil {
		workspaceRole.Rules = make([]rbacv1.PolicyRule, 0)
		for _, roleName := range aggregateRoles {
			aggregationRole, err := am.GetWorkspaceRole("", roleName)
			if err != nil {
				klog.Error(err)
				return nil, err
			}
			workspaceRole.Rules = append(workspaceRole.Rules, aggregationRole.Rules...)
		}
	}

	data, err := json.Marshal(workspaceRole)
	if err != nil {
		return nil, err
	}

	return am.ksclient.IamV1alpha2().WorkspaceRoles().Patch(workspaceRole.Name, types.MergePatchType, data)
}

func (am *amOperator) PatchNamespaceRole(namespace string, role *rbacv1.Role) (*rbacv1.Role, error) {
	old, err := am.GetNamespaceRole(namespace, role.Name)
	if err != nil {
		klog.Error(err)
		return nil, err
	}

	// rules cannot be override
	role.Rules = old.Rules
	// aggregate roles if annotation has change
	if aggregateRoles := am.getAggregateRoles(role.ObjectMeta); aggregateRoles != nil {
		role.Rules = make([]rbacv1.PolicyRule, 0)
		for _, roleName := range aggregateRoles {
			aggregationRole, err := am.GetNamespaceRole(namespace, roleName)
			if err != nil {
				klog.Error(err)
				return nil, err
			}
			role.Rules = append(role.Rules, aggregationRole.Rules...)
		}
	}

	data, err := json.Marshal(role)
	if err != nil {
		return nil, err
	}

	return am.k8sclient.RbacV1().Roles(namespace).Patch(role.Name, types.MergePatchType, data)
}

func (am *amOperator) PatchClusterRole(clusterRole *rbacv1.ClusterRole) (*rbacv1.ClusterRole, error) {
	old, err := am.GetClusterRole(clusterRole.Name)
	if err != nil {
		klog.Error(err)
		return nil, err
	}

	// rules cannot be override
	clusterRole.Rules = old.Rules
	// aggregate roles if annotation has change
	if aggregateRoles := am.getAggregateRoles(clusterRole.ObjectMeta); aggregateRoles != nil {
		clusterRole.Rules = make([]rbacv1.PolicyRule, 0)
		for _, roleName := range aggregateRoles {
			aggregationRole, err := am.GetClusterRole(roleName)
			if err != nil {
				klog.Error(err)
				return nil, err
			}
			clusterRole.Rules = append(clusterRole.Rules, aggregationRole.Rules...)
		}
	}

	data, err := json.Marshal(clusterRole)
	if err != nil {
		return nil, err
	}

	return am.k8sclient.RbacV1().ClusterRoles().Patch(clusterRole.Name, types.MergePatchType, data)
}

func (am *amOperator) CreateUserWorkspaceRoleBinding(username string, workspace string, role string) error {
	_, err := am.GetWorkspaceRole(workspace, role)
	if err != nil {
		klog.Error(err)
		return err
	}

	roleBindings, err := am.ListWorkspaceRoleBindings(username, nil, workspace)
	if err != nil {
		klog.Error(err)
		return err
	}

	for _, roleBinding := range roleBindings {
		if role == roleBinding.RoleRef.Name {
			return nil
		}
		err := am.ksclient.IamV1alpha2().WorkspaceRoleBindings().Delete(roleBinding.Name, metav1.NewDeleteOptions(0))
		if err != nil {
			if errors.IsNotFound(err) {
				continue
			}
			klog.Error(err)
			return err
		}
	}

	roleBinding := iamv1alpha2.WorkspaceRoleBinding{
		ObjectMeta: metav1.ObjectMeta{
			Name: fmt.Sprintf("%s-%s", username, role),
			Labels: map[string]string{iamv1alpha2.UserReferenceLabel: username,
				tenantv1alpha1.WorkspaceLabel: workspace},
		},
		Subjects: []rbacv1.Subject{
			{
				Kind:     rbacv1.UserKind,
				APIGroup: rbacv1.SchemeGroupVersion.Group,
				Name:     username,
			},
		},
		RoleRef: rbacv1.RoleRef{
			APIGroup: iamv1alpha2.SchemeGroupVersion.Group,
			Kind:     iamv1alpha2.ResourceKindWorkspaceRole,
			Name:     role,
		},
	}

	if _, err := am.ksclient.IamV1alpha2().WorkspaceRoleBindings().Create(&roleBinding); err != nil {
		return err
	}

	return nil
}

func (am *amOperator) CreateClusterRoleBinding(username string, role string) error {
	_, err := am.GetClusterRole(role)
	if err != nil {
		klog.Error(err)
		return err
	}

	roleBindings, err := am.ListClusterRoleBindings(username)

	if err != nil {
		klog.Error(err)
		return err
	}

	for _, roleBinding := range roleBindings {
		if role == roleBinding.RoleRef.Name {
			return nil
		}
		err := am.k8sclient.RbacV1().ClusterRoleBindings().Delete(roleBinding.Name, metav1.NewDeleteOptions(0))
		if err != nil {
			if errors.IsNotFound(err) {
				continue
			}
			klog.Error(err)
			return err
		}
	}

	roleBinding := rbacv1.ClusterRoleBinding{
		ObjectMeta: metav1.ObjectMeta{
			Name:   fmt.Sprintf("%s-%s", username, role),
			Labels: map[string]string{iamv1alpha2.UserReferenceLabel: username},
		},
		Subjects: []rbacv1.Subject{
			{
				Kind:     rbacv1.UserKind,
				APIGroup: rbacv1.SchemeGroupVersion.Group,
				Name:     username,
			},
		},
		RoleRef: rbacv1.RoleRef{
			APIGroup: rbacv1.SchemeGroupVersion.Group,
			Kind:     iamv1alpha2.ResourceKindClusterRole,
			Name:     role,
		},
	}

	if _, err := am.k8sclient.RbacV1().ClusterRoleBindings().Create(&roleBinding); err != nil {
		return err
	}

	return nil
}

func (am *amOperator) CreateNamespaceRoleBinding(username string, namespace string, role string) error {

	_, err := am.GetNamespaceRole(namespace, role)
	if err != nil {
		klog.Error(err)
		return err
	}

	// Don't pass user's groups.
	roleBindings, err := am.ListRoleBindings(username, nil, namespace)
	if err != nil {
		klog.Error(err)
		return err
	}

	for _, roleBinding := range roleBindings {
		if role == roleBinding.RoleRef.Name {
			return nil
		}
		err := am.k8sclient.RbacV1().RoleBindings(namespace).Delete(roleBinding.Name, metav1.NewDeleteOptions(0))
		if err != nil {
			if errors.IsNotFound(err) {
				continue
			}
			klog.Error(err)
			return err
		}
	}

	roleBinding := rbacv1.RoleBinding{
		ObjectMeta: metav1.ObjectMeta{
			Name:   fmt.Sprintf("%s-%s", username, role),
			Labels: map[string]string{iamv1alpha2.UserReferenceLabel: username},
		},
		Subjects: []rbacv1.Subject{
			{
				Kind:     rbacv1.UserKind,
				APIGroup: rbacv1.SchemeGroupVersion.Group,
				Name:     username,
			},
		},
		RoleRef: rbacv1.RoleRef{
			APIGroup: rbacv1.SchemeGroupVersion.Group,
			Kind:     iamv1alpha2.ResourceKindRole,
			Name:     role,
		},
	}

	if _, err := am.k8sclient.RbacV1().RoleBindings(namespace).Create(&roleBinding); err != nil {
		return err
	}

	return nil
}

func (am *amOperator) RemoveUserFromWorkspace(username string, workspace string) error {

	roleBindings, err := am.ListWorkspaceRoleBindings(username, nil, workspace)
	if err != nil {
		klog.Error(err)
		return err
	}

	for _, roleBinding := range roleBindings {
		err := am.ksclient.IamV1alpha2().WorkspaceRoleBindings().Delete(roleBinding.Name, metav1.NewDeleteOptions(0))
		if err != nil {
			if errors.IsNotFound(err) {
				continue
			}
			klog.Error(err)
			return err
		}
	}

	return nil
}

func (am *amOperator) RemoveUserFromNamespace(username string, namespace string) error {

	roleBindings, err := am.ListRoleBindings(username, nil, namespace)
	if err != nil {
		klog.Error(err)
		return err
	}

	for _, roleBinding := range roleBindings {
		err := am.k8sclient.RbacV1().RoleBindings(namespace).Delete(roleBinding.Name, metav1.NewDeleteOptions(0))
		if err != nil {
			if errors.IsNotFound(err) {
				continue
			}
			klog.Error(err)
			return err
		}
	}

	return nil
}

func (am *amOperator) RemoveUserFromCluster(username string) error {
	roleBindings, err := am.ListClusterRoleBindings(username)
	if err != nil {
		klog.Error(err)
		return err
	}

	for _, roleBinding := range roleBindings {
		err := am.k8sclient.RbacV1().ClusterRoleBindings().Delete(roleBinding.Name, metav1.NewDeleteOptions(0))
		if err != nil {
			if errors.IsNotFound(err) {
				continue
			}
			klog.Error(err)
			return err
		}
	}

	return nil
}

func (am *amOperator) CreateOrUpdateGlobalRole(globalRole *iamv1alpha2.GlobalRole) (*iamv1alpha2.GlobalRole, error) {
	globalRole.Rules = make([]rbacv1.PolicyRule, 0)
	if aggregateRoles := am.getAggregateRoles(globalRole.ObjectMeta); aggregateRoles != nil {
		for _, roleName := range aggregateRoles {
			aggregationRole, err := am.GetGlobalRole(roleName)
			if err != nil {
				klog.Error(err)
				return nil, err
			}
			globalRole.Rules = append(globalRole.Rules, aggregationRole.Rules...)
		}
	}
	var created *iamv1alpha2.GlobalRole
	var err error
	if globalRole.ResourceVersion != "" {
		created, err = am.ksclient.IamV1alpha2().GlobalRoles().Update(globalRole)
	} else {
		created, err = am.ksclient.IamV1alpha2().GlobalRoles().Create(globalRole)
	}
	return created, err
}

func (am *amOperator) CreateOrUpdateClusterRole(clusterRole *rbacv1.ClusterRole) (*rbacv1.ClusterRole, error) {
	clusterRole.Rules = make([]rbacv1.PolicyRule, 0)
	if aggregateRoles := am.getAggregateRoles(clusterRole.ObjectMeta); aggregateRoles != nil {
		for _, roleName := range aggregateRoles {
			aggregationRole, err := am.GetClusterRole(roleName)
			if err != nil {
				klog.Error(err)
				return nil, err
			}
			clusterRole.Rules = append(clusterRole.Rules, aggregationRole.Rules...)
		}
	}
	var created *rbacv1.ClusterRole
	var err error
	if clusterRole.ResourceVersion != "" {
		created, err = am.k8sclient.RbacV1().ClusterRoles().Update(clusterRole)
	} else {
		created, err = am.k8sclient.RbacV1().ClusterRoles().Create(clusterRole)
	}
	return created, err
}

func (am *amOperator) CreateOrUpdateNamespaceRole(namespace string, role *rbacv1.Role) (*rbacv1.Role, error) {
	role.Rules = make([]rbacv1.PolicyRule, 0)
	role.Namespace = namespace
	if aggregateRoles := am.getAggregateRoles(role.ObjectMeta); aggregateRoles != nil {
		for _, roleName := range aggregateRoles {
			aggregationRole, err := am.GetNamespaceRole(namespace, roleName)
			if err != nil {
				klog.Error(err)
				return nil, err
			}
			role.Rules = append(role.Rules, aggregationRole.Rules...)
		}
	}
	var created *rbacv1.Role
	var err error
	if role.ResourceVersion != "" {
		created, err = am.k8sclient.RbacV1().Roles(namespace).Update(role)
	} else {
		created, err = am.k8sclient.RbacV1().Roles(namespace).Create(role)
	}

	return created, err
}

func (am *amOperator) DeleteWorkspaceRole(workspace string, name string) error {
	workspaceRole, err := am.GetWorkspaceRole(workspace, name)
	if err != nil {
		return err
	}
	return am.ksclient.IamV1alpha2().WorkspaceRoles().Delete(workspaceRole.Name, metav1.NewDeleteOptions(0))
}

func (am *amOperator) DeleteGlobalRole(name string) error {
	return am.ksclient.IamV1alpha2().GlobalRoles().Delete(name, metav1.NewDeleteOptions(0))
}

func (am *amOperator) DeleteClusterRole(name string) error {
	return am.k8sclient.RbacV1().ClusterRoles().Delete(name, metav1.NewDeleteOptions(0))
}
func (am *amOperator) DeleteNamespaceRole(namespace string, name string) error {
	return am.k8sclient.RbacV1().Roles(namespace).Delete(name, metav1.NewDeleteOptions(0))
}

// GetRoleReferenceRules attempts to resolve the RoleBinding or ClusterRoleBinding.
func (am *amOperator) GetRoleReferenceRules(roleRef rbacv1.RoleRef, namespace string) (regoPolicy string, rules []rbacv1.PolicyRule, err error) {

	empty := make([]rbacv1.PolicyRule, 0)

	switch roleRef.Kind {
	case iamv1alpha2.ResourceKindRole:
		role, err := am.GetNamespaceRole(namespace, roleRef.Name)
		if err != nil {
			if errors.IsNotFound(err) {
				return "", empty, nil
			}
			return "", nil, err
		}
		return role.Annotations[iamv1alpha2.RegoOverrideAnnotation], role.Rules, nil
	case iamv1alpha2.ResourceKindClusterRole:
		clusterRole, err := am.GetClusterRole(roleRef.Name)
		if err != nil {
			if errors.IsNotFound(err) {
				return "", empty, nil
			}
			return "", nil, err
		}
		return clusterRole.Annotations[iamv1alpha2.RegoOverrideAnnotation], clusterRole.Rules, nil
	case iamv1alpha2.ResourceKindGlobalRole:
		globalRole, err := am.GetGlobalRole(roleRef.Name)
		if err != nil {
			if errors.IsNotFound(err) {
				return "", empty, nil
			}
			return "", nil, err
		}
		return globalRole.Annotations[iamv1alpha2.RegoOverrideAnnotation], globalRole.Rules, nil
	case iamv1alpha2.ResourceKindWorkspaceRole:
		workspaceRole, err := am.GetWorkspaceRole("", roleRef.Name)
		if err != nil {
			if errors.IsNotFound(err) {
				return "", empty, nil
			}
			return "", nil, err
		}
		return workspaceRole.Annotations[iamv1alpha2.RegoOverrideAnnotation], workspaceRole.Rules, nil
	default:
		return "", nil, fmt.Errorf("unsupported role reference kind: %q", roleRef.Kind)
	}
}

func (am *amOperator) GetWorkspaceRole(workspace string, name string) (*iamv1alpha2.WorkspaceRole, error) {
	obj, err := am.workspaceRoleGetter.Get("", name)
	if err != nil {
		klog.Error(err)
		return nil, err
	}

	workspaceRole := obj.(*iamv1alpha2.WorkspaceRole)

	if workspace != "" && workspaceRole.Labels[tenantv1alpha1.WorkspaceLabel] != workspace {
		err := errors.NewNotFound(iamv1alpha2.Resource(iamv1alpha2.ResourcesSingularWorkspaceRole), name)
		klog.Error(err)
		return nil, err
	}

	return workspaceRole, nil
}

func (am *amOperator) GetNamespaceRole(namespace string, name string) (*rbacv1.Role, error) {
	obj, err := am.roleGetter.Get(namespace, name)
	if err != nil {
		klog.Error(err)
		return nil, err
	}
	return obj.(*rbacv1.Role), nil
}

func (am *amOperator) GetClusterRole(name string) (*rbacv1.ClusterRole, error) {
	obj, err := am.clusterRoleGetter.Get("", name)
	if err != nil {
		klog.Error(err)
		return nil, err
	}
	return obj.(*rbacv1.ClusterRole), nil
}
func (am *amOperator) GetDevOpsRelatedNamespace(devops string) (string, error) {
	devopsProject, err := am.devopsProjectLister.Get(devops)
	if err != nil {
		klog.Error(err)
		return "", err
	}
	return devopsProject.Status.AdminNamespace, nil
}

func (am *amOperator) GetDevOpsControlledWorkspace(devops string) (string, error) {
	devopsProject, err := am.devopsProjectLister.Get(devops)
	if err != nil {
		klog.Error(err)
		return "", err
	}
	return devopsProject.Labels[tenantv1alpha1.WorkspaceLabel], nil
}

func (am *amOperator) GetNamespaceControlledWorkspace(namespace string) (string, error) {
	ns, err := am.namespaceLister.Get(namespace)
	if err != nil {
		if errors.IsNotFound(err) {
			return "", nil
		}
		klog.Error(err)
		return "", err
	}
	return ns.Labels[tenantv1alpha1.WorkspaceLabel], nil
}

func (am *amOperator) ListGroupWorkspaceRoleBindings(workspace string, query *query.Query) (*api.ListResult, error) {

	lableSelector, err := labels.ConvertSelectorToLabelsMap(query.LabelSelector)
	if err != nil {
		klog.Error(err)
		return nil, err
	}
	// workspace resources must be filtered by workspace
	wsSelector := labels.Set{tenantv1alpha1.WorkspaceLabel: workspace}
	query.LabelSelector = labels.Merge(lableSelector, wsSelector).String()
	return am.workspaceRoleBindingGetter.List("", query)
}

func (am *amOperator) CreateWorkspaceRoleBinding(workspace string, roleBinding *iamv1alpha2.WorkspaceRoleBinding) (*iamv1alpha2.WorkspaceRoleBinding, error) {

	_, err := am.GetWorkspaceRole(workspace, roleBinding.RoleRef.Name)
	if err != nil {
		klog.Error(err)
		return nil, err
	}

	if len(roleBinding.Subjects) == 0 {
		err := errors.NewNotFound(iamv1alpha2.Resource(iamv1alpha2.ResourcesPluralUser), "")
		return nil, err
	}

	roleBinding.GenerateName = fmt.Sprintf("%s-%s-", roleBinding.Subjects[0].Name, roleBinding.RoleRef.Name)

	if roleBinding.Labels == nil {
		roleBinding.Labels = map[string]string{}
	}

	if roleBinding.Subjects[0].Kind == rbacv1.GroupKind {
		roleBinding.Labels[iamv1alpha2.GroupReferenceLabel] = roleBinding.RoleRef.Name
	} else if roleBinding.Subjects[0].Kind == rbacv1.UserKind {
		roleBinding.Labels[iamv1alpha2.UserReferenceLabel] = roleBinding.RoleRef.Name
	}

	roleBinding.Labels[tenantv1alpha1.WorkspaceLabel] = workspace

	return am.ksclient.IamV1alpha2().WorkspaceRoleBindings().Create(roleBinding)

}
func (am *amOperator) DeleteWorkspaceRoleBinding(workspaceName, name string) error {
	return am.ksclient.IamV1alpha2().WorkspaceRoleBindings().Delete(name, metav1.NewDeleteOptions(0))
}

func (am *amOperator) ListGroupRoleBindings(workspace string, query *query.Query) ([]*rbacv1.RoleBinding, error) {
	namespaces, err := am.namespaceLister.List(labels.SelectorFromSet(labels.Set{tenantv1alpha1.WorkspaceLabel: workspace}))
	if err != nil {
		return nil, err
	}
	result := make([]*rbacv1.RoleBinding, 0)
	for _, namespace := range namespaces {
		roleBindings, err := am.roleBindingGetter.List(namespace.Name, query)
		if err != nil {
			klog.Error(err)
			return nil, err
		}

		for _, obj := range roleBindings.Items {
			roleBinding := obj.(*rbacv1.RoleBinding)
			result = append(result, roleBinding)
		}
	}
	devOpsProjects, err := am.devopsProjectLister.List(labels.SelectorFromSet(labels.Set{tenantv1alpha1.WorkspaceLabel: workspace}))
	if err != nil {
		return nil, err
	}
	for _, devOpsProject := range devOpsProjects {
		roleBindings, err := am.roleBindingGetter.List(devOpsProject.Name, query)
		if err != nil {
			klog.Error(err)
			return nil, err
		}
		for _, obj := range roleBindings.Items {
			roleBinding := obj.(*rbacv1.RoleBinding)
			result = append(result, roleBinding)
		}
	}
	return result, nil
}

func (am *amOperator) CreateRoleBinding(namespace string, roleBinding *rbacv1.RoleBinding) (*rbacv1.RoleBinding, error) {

	_, err := am.GetNamespaceRole(namespace, roleBinding.RoleRef.Name)
	if err != nil {
		klog.Error(err)
		return nil, err
	}

	if len(roleBinding.Subjects) == 0 {
		err := errors.NewNotFound(iamv1alpha2.Resource(iamv1alpha2.ResourcesPluralUser), "")
		return nil, err
	}

	roleBinding.GenerateName = fmt.Sprintf("%s-%s-", roleBinding.Subjects[0].Name, roleBinding.RoleRef.Name)

	if roleBinding.Labels == nil {
		roleBinding.Labels = map[string]string{}
	}

	if roleBinding.Subjects[0].Kind == rbacv1.GroupKind {
		roleBinding.Labels[iamv1alpha2.GroupReferenceLabel] = roleBinding.Subjects[0].Name
	} else if roleBinding.Subjects[0].Kind == rbacv1.UserKind {
		roleBinding.Labels[iamv1alpha2.UserReferenceLabel] = roleBinding.Subjects[0].Name
	}

	return am.k8sclient.RbacV1().RoleBindings(namespace).Create(roleBinding)
}

func (am *amOperator) DeleteRoleBinding(namespace, name string) error {
	return am.k8sclient.RbacV1().RoleBindings(namespace).Delete(name, metav1.NewDeleteOptions(0))
}