add endpoint to discover the resource a role is assigned to

internal/api/roles.go

@@ -138,3 +138,31 @@ func (r *Router) roleDelete(c echo.Context) error {
 
 	return c.JSON(http.StatusOK, resp)
 }
+
+func (r *Router) roleGetResource(c echo.Context) error {
+	roleIDStr := c.Param("role_id")
+
+	ctx, span := tracer.Start(c.Request().Context(), "api.roleGetResource", trace.WithAttributes(attribute.String("id", roleIDStr)))
+	defer span.End()
+
+	roleResourceID, err := gidx.Parse(roleIDStr)
+	if err != nil {
+		return echo.NewHTTPError(http.StatusBadRequest, "error getting resource").SetInternal(err)
+	}
+
+	roleResource, err := r.engine.NewResourceFromID(roleResourceID)
+	if err != nil {
+		return echo.NewHTTPError(http.StatusBadRequest, "error getting resource").SetInternal(err)
+	}
+
+	resource, err := r.engine.GetRoleResource(ctx, roleResource, "")
+	if err != nil {
+		return echo.NewHTTPError(http.StatusInternalServerError, "error getting resource").SetInternal(err)
+	}
+
+	resp := resourceResponse{
+		ID: resource.ID,
+	}
+
+	return c.JSON(http.StatusOK, resp)
+}

internal/api/router.go

@@ -51,6 +51,7 @@ func (r *Router) Routes(rg *echo.Group) {
 		v1.GET("/relationships/to/:id", r.relationshipListTo)
 		v1.GET("/roles/:role_id", r.roleGet)
 		v1.DELETE("/roles/:id", r.roleDelete)
+		v1.GET("/roles/:role_id/resource", r.roleGetResource)
 		v1.POST("/roles/:role_id/assignments", r.assignmentCreate)
 		v1.DELETE("/roles/:role_id/assignments", r.assignmentDelete)
 		v1.GET("/roles/:role_id/assignments", r.assignmentsList)

internal/api/types.go

@@ -13,6 +13,10 @@ type roleResponse struct {
 	Actions []string        `json:"actions"`
 }
 
+type resourceResponse struct {
+	ID gidx.PrefixedID `json:"id"`
+}
+
 type deleteRoleResponse struct {
 	Success bool `json:"success"`
 }

internal/query/mock/mock.go

@@ -62,6 +62,11 @@ func (e *Engine) GetRole(ctx context.Context, roleResource types.Resource, query
 	return types.Role{}, nil
 }
 
+// GetRoleResource returns nothing but satisfies the Engine interface.
+func (e *Engine) GetRoleResource(ctx context.Context, roleResource types.Resource, queryToken string) (types.Resource, error) {
+	return types.Resource{}, nil
+}
+
 // ListAssignments returns nothing but satisfies the Engine interface.
 func (e *Engine) ListAssignments(ctx context.Context, role types.Role, queryToken string) ([]types.Resource, error) {
 	return nil, nil

internal/query/relations.go

@@ -610,6 +610,37 @@ func (e *engine) GetRole(ctx context.Context, roleResource types.Resource, query
 	return types.Role{}, ErrRoleNotFound
 }
 
+// GetRoleResource gets the role's assigned resource.
+func (e *engine) GetRoleResource(ctx context.Context, roleResource types.Resource, queryToken string) (types.Resource, error) {
+	var (
+		resActions map[types.Resource][]string
+		err        error
+	)
+
+	for _, resType := range e.schemaRoleables {
+		resActions, err = e.listRoleResourceActions(ctx, roleResource, resType.Name, queryToken)
+		if err != nil {
+			return types.Resource{}, err
+		}
+
+		// roles are only ever created for a single resource, so we can break after the first one is found.
+		if len(resActions) != 0 {
+			break
+		}
+	}
+
+	if len(resActions) > 1 {
+		e.logger.Warnw("role is assigned to more than one resource", "role.id", roleResource.ID.String())
+	}
+
+	// returns the first resources actions.
+	for resource := range resActions {
+		return resource, nil
+	}
+
+	return types.Resource{}, ErrRoleNotFound
+}
+
 // DeleteRole removes all role actions from the assigned resource.
 func (e *engine) DeleteRole(ctx context.Context, roleResource types.Resource, queryToken string) (string, error) {
 	var (

internal/query/service.go

@@ -18,6 +18,7 @@ type Engine interface {
 	CreateRelationships(ctx context.Context, rels []types.Relationship) (string, error)
 	CreateRole(ctx context.Context, res types.Resource, actions []string) (types.Role, string, error)
 	GetRole(ctx context.Context, roleResource types.Resource, queryToken string) (types.Role, error)
+	GetRoleResource(ctx context.Context, roleResource types.Resource, queryToken string) (types.Resource, error)
 	ListAssignments(ctx context.Context, role types.Role, queryToken string) ([]types.Resource, error)
 	ListRelationshipsFrom(ctx context.Context, resource types.Resource, queryToken string) ([]types.Relationship, error)
 	ListRelationshipsTo(ctx context.Context, resource types.Resource, queryToken string) ([]types.Relationship, error)