feat(auth): use Wayne native role APIs

server/internal/service/wayne_role_binding.go

@@ -3,6 +3,7 @@ package service
 import (
 	"bytes"
 	"context"
+	"encoding/base64"
 	"encoding/json"
 	"errors"
 	"fmt"
@@ -15,14 +16,19 @@ import (
 	"time"
 
 	"github.com/1024XEngineer/xinfra/server/internal/config"
-	"github.com/1024XEngineer/xinfra/server/internal/wayne"
+	"github.com/1024XEngineer/xinfra/server/internal/model"
+
+	"gorm.io/gorm"
+	"gorm.io/gorm/clause"
 )
 
 var (
-	ErrWayneRoleBindingNotConfigured = errors.New("wayne internal role binding api is not configured")
-	ErrWayneRoleBindingRequestFailed = errors.New("wayne internal role binding request failed")
+	ErrWayneRoleBindingNotConfigured = errors.New("wayne native api is not configured")
+	ErrWayneRoleBindingRequestFailed = errors.New("wayne native role binding request failed")
 )
 
+const wayneAdminTokenAccount = "admin"
+
 type WayneRoleBindingRequest struct {
 	Username       string   `json:"username,omitempty"`
 	GroupIDs       []uint64 `json:"groupIds,omitempty"`
@@ -70,14 +76,18 @@ func (e *WayneRoleBindingHTTPError) Error() string {
 }
 
 type WayneRoleBindingService struct {
-	cfg    config.Config
-	client *http.Client
-	now    func() time.Time
+	cfg         config.Config
+	db          *gorm.DB
+	client      *http.Client
+	now         func() time.Time
+	cachedToken string
+	cachedExp   time.Time
 }
 
-func NewWayneRoleBindingService(cfg config.Config) *WayneRoleBindingService {
+func NewWayneRoleBindingService(cfg config.Config, db *gorm.DB) *WayneRoleBindingService {
 	return &WayneRoleBindingService{
 		cfg: cfg,
+		db:  db,
 		client: &http.Client{
 			Timeout: 10 * time.Second,
 		},
@@ -86,33 +96,33 @@ func NewWayneRoleBindingService(cfg config.Config) *WayneRoleBindingService {
 }
 
 func (s *WayneRoleBindingService) BindNamespace(ctx context.Context, namespaceID uint64, username string, operatorEmail string, req WayneRoleBindingRequest) (*WayneRoleBindingResult, error) {
-	return s.call(ctx, http.MethodPut, fmt.Sprintf("/api/v1/internal/namespaces/%d/users/%s/roles", namespaceID, url.PathEscape(username)), operatorEmail, req)
+	return s.bindUserRoles(ctx, "namespace", namespaceID, username, req)
 }
 
 func (s *WayneRoleBindingService) UnbindNamespace(ctx context.Context, namespaceID uint64, username string, operatorEmail string, req WayneRoleBindingRequest) (*WayneRoleBindingResult, error) {
-	return s.call(ctx, http.MethodDelete, fmt.Sprintf("/api/v1/internal/namespaces/%d/users/%s/roles", namespaceID, url.PathEscape(username)), operatorEmail, req)
+	return s.unbindUserRoles(ctx, "namespace", namespaceID, username, req)
 }
 
 func (s *WayneRoleBindingService) BindApp(ctx context.Context, appID uint64, username string, operatorEmail string, req WayneRoleBindingRequest) (*WayneRoleBindingResult, error) {
-	return s.call(ctx, http.MethodPut, fmt.Sprintf("/api/v1/internal/apps/%d/users/%s/roles", appID, url.PathEscape(username)), operatorEmail, req)
+	return s.bindUserRoles(ctx, "app", appID, username, req)
 }
 
 func (s *WayneRoleBindingService) UnbindApp(ctx context.Context, appID uint64, username string, operatorEmail string, req WayneRoleBindingRequest) (*WayneRoleBindingResult, error) {
-	return s.call(ctx, http.MethodDelete, fmt.Sprintf("/api/v1/internal/apps/%d/users/%s/roles", appID, url.PathEscape(username)), operatorEmail, req)
+	return s.unbindUserRoles(ctx, "app", appID, username, req)
 }
 
 func (s *WayneRoleBindingService) ListNamespaces(ctx context.Context) (*WayneRoleBindingResult, error) {
-	return s.callRaw(ctx, http.MethodGet, "/api/v1/internal/namespaces", nil)
+	return s.callRaw(ctx, http.MethodGet, "/api/v1/namespaces", nil)
 }
 
 func (s *WayneRoleBindingService) ListGroups(ctx context.Context, groupType *int) (*WayneRoleBindingResult, error) {
-	internalPath := "/api/v1/internal/groups"
+	path := "/api/v1/groups"
 	if groupType != nil {
 		values := url.Values{}
 		values.Set("type", strconv.Itoa(*groupType))
-		internalPath += "?" + values.Encode()
+		path += "?" + values.Encode()
 	}
-	return s.callRaw(ctx, http.MethodGet, internalPath, nil)
+	return s.callRaw(ctx, http.MethodGet, path, nil)
 }
 
 func (s *WayneRoleBindingService) ListNamespaceRoleGroups(ctx context.Context) ([]WayneRoleGroup, error) {
@@ -146,11 +156,44 @@ func (s *WayneRoleBindingService) GetUserRoles(ctx context.Context, username str
 	if username == "" {
 		return nil, ErrWayenEmailMissing
 	}
-	return s.callRaw(ctx, http.MethodGet, fmt.Sprintf("/api/v1/internal/users/%s/roles", url.PathEscape(username)), nil)
+	user, err := s.findUser(ctx, username)
+	if err != nil {
+		return nil, err
+	}
+
+	namespaces, err := s.listResourceIDs(ctx, "/api/v1/namespaces")
+	if err != nil {
+		return nil, err
+	}
+	results := make([]json.RawMessage, 0, len(namespaces))
+	values := url.Values{}
+	values.Set("userId", strconv.FormatUint(user.ID, 10))
+	for _, namespaceID := range namespaces {
+		result, err := s.callRaw(ctx, http.MethodGet, roleBindingBasePath("namespace", namespaceID)+"?"+values.Encode(), nil)
+		if err != nil {
+			return result, err
+		}
+		results = append(results, rawWayneData(result.Body))
+	}
+	body, err := json.Marshal(map[string]json.RawMessage{
+		"namespaceRoles": mustMarshalRaw(results),
+	})
+	if err != nil {
+		return nil, err
+	}
+	return &WayneRoleBindingResult{StatusCode: http.StatusOK, ContentType: "application/json", Body: body}, nil
+}
+
+func (s *WayneRoleBindingService) listResourceIDs(ctx context.Context, path string) ([]uint64, error) {
+	result, err := s.callRaw(ctx, http.MethodGet, path, nil)
+	if err != nil {
+		return nil, err
+	}
+	return parseWayneResourceIDs(result.Body)
 }
 
 func (s *WayneRoleBindingService) NamespaceOperatorPermissions(ctx context.Context, namespaceID uint64, operatorEmail string) (*WayneRoleBindingResult, error) {
-	return s.operatorPermissions(ctx, fmt.Sprintf("/api/v1/internal/namespaces/%d/operator-permissions", namespaceID), operatorEmail)
+	return s.permissions(ctx, "namespace", namespaceID)
 }
 
 func (s *WayneRoleBindingService) NamespaceOperatorPermissionsParsed(ctx context.Context, namespaceID uint64, operatorEmail string) (*WayneOperatorPermissions, error) {
@@ -162,59 +205,122 @@ func (s *WayneRoleBindingService) NamespaceOperatorPermissionsParsed(ctx context
 }
 
 func (s *WayneRoleBindingService) AppOperatorPermissions(ctx context.Context, appID uint64, operatorEmail string) (*WayneRoleBindingResult, error) {
-	return s.operatorPermissions(ctx, fmt.Sprintf("/api/v1/internal/apps/%d/operator-permissions", appID), operatorEmail)
+	return s.permissions(ctx, "app", appID)
 }
 
-func (s *WayneRoleBindingService) call(ctx context.Context, method, internalPath, operatorEmail string, req WayneRoleBindingRequest) (*WayneRoleBindingResult, error) {
-	if err := s.validateConfig(); err != nil {
-		return nil, err
-	}
-	operatorEmail = strings.TrimSpace(operatorEmail)
-	if operatorEmail == "" {
+func (s *WayneRoleBindingService) bindUserRoles(ctx context.Context, scope string, resourceID uint64, username string, req WayneRoleBindingRequest) (*WayneRoleBindingResult, error) {
+	if strings.TrimSpace(username) == "" {
 		return nil, ErrWayenEmailMissing
 	}
-
-	req.OperatorUserID = nil
-	req.OperatorName = operatorEmail
-	req.Username = ""
-
-	body, err := json.Marshal(req)
+	user, err := s.findUser(ctx, username)
 	if err != nil {
 		return nil, err
 	}
-	return s.callRaw(ctx, method, internalPath, body)
-}
-
-func (s *WayneRoleBindingService) operatorPermissions(ctx context.Context, internalPath, operatorEmail string) (*WayneRoleBindingResult, error) {
-	operatorEmail = strings.TrimSpace(operatorEmail)
-	if operatorEmail == "" {
-		return nil, ErrWayenEmailMissing
-	}
-	values := url.Values{}
-	values.Set("operatorName", operatorEmail)
-	return s.callRaw(ctx, http.MethodGet, internalPath+"?"+values.Encode(), nil)
-}
-
-func (s *WayneRoleBindingService) callRaw(ctx context.Context, method, internalPath string, body []byte) (*WayneRoleBindingResult, error) {
-	if err := s.validateConfig(); err != nil {
+	bindings, err := s.listUserBindings(ctx, scope, resourceID, user.ID)
+	if err != nil {
 		return nil, err
 	}
+
+	body := nativeRoleBindingBody(scope, resourceID, user.ID, req.GroupIDs)
+	if len(bindings) == 0 {
+		return s.callRaw(ctx, http.MethodPost, roleBindingBasePath(scope, resourceID), body)
+	}
+	bodyWithID, err := nativeRoleBindingBodyWithID(body, bindings[0].ID)
+	if err != nil {
+		return nil, err
+	}
+	return s.callRaw(ctx, http.MethodPut, fmt.Sprintf("%s/%d", roleBindingBasePath(scope, resourceID), bindings[0].ID), bodyWithID)
+}
+
+func (s *WayneRoleBindingService) unbindUserRoles(ctx context.Context, scope string, resourceID uint64, username string, req WayneRoleBindingRequest) (*WayneRoleBindingResult, error) {
+	if strings.TrimSpace(username) == "" {
+		return nil, ErrWayenEmailMissing
+	}
+	user, err := s.findUser(ctx, username)
+	if err != nil {
+		return nil, err
+	}
+	bindings, err := s.listUserBindings(ctx, scope, resourceID, user.ID)
+	if err != nil {
+		return nil, err
+	}
+	if len(bindings) == 0 {
+		return &WayneRoleBindingResult{StatusCode: http.StatusOK, ContentType: "application/json", Body: []byte(`{"data":null}`)}, nil
+	}
+	return s.callRaw(ctx, http.MethodDelete, fmt.Sprintf("%s/%d", roleBindingBasePath(scope, resourceID), bindings[0].ID), nil)
+}
+
+func (s *WayneRoleBindingService) permissions(ctx context.Context, scope string, resourceID uint64) (*WayneRoleBindingResult, error) {
+	path := fmt.Sprintf("%s/permissions/%d", roleBindingBasePath(scope, resourceID), resourceID)
+	result, err := s.callRaw(ctx, http.MethodGet, path, nil)
+	if err != nil {
+		return result, err
+	}
+	permissions, err := parseNativePermissions(result.Body, scope)
+	if err != nil {
+		return nil, err
+	}
+	body, err := json.Marshal(map[string]WayneOperatorPermissions{"permissions": permissions})
+	if err != nil {
+		return nil, err
+	}
+	return &WayneRoleBindingResult{StatusCode: result.StatusCode, ContentType: "application/json", Body: body}, nil
+}
+
+func (s *WayneRoleBindingService) findUser(ctx context.Context, username string) (*wayneNativeUser, error) {
+	values := url.Values{}
+	values.Set("name", strings.TrimSpace(username))
+	result, err := s.callRaw(ctx, http.MethodGet, "/api/v1/users?"+values.Encode(), nil)
+	if err != nil {
+		return nil, err
+	}
+	users, err := parseWayneUsers(result.Body)
+	if err != nil {
+		return nil, err
+	}
+	for _, user := range users {
+		if sameWayneUser(user, username) {
+			return &user, nil
+		}
+	}
+	return nil, fmt.Errorf("wayne user %q not found", username)
+}
+
+func (s *WayneRoleBindingService) listUserBindings(ctx context.Context, scope string, resourceID uint64, userID uint64) ([]wayneRoleBinding, error) {
+	values := url.Values{}
+	values.Set("userId", strconv.FormatUint(userID, 10))
+	result, err := s.callRaw(ctx, http.MethodGet, roleBindingBasePath(scope, resourceID)+"?"+values.Encode(), nil)
+	if err != nil {
+		return nil, err
+	}
+	return parseWayneRoleBindings(result.Body)
+}
+
+func (s *WayneRoleBindingService) callRaw(ctx context.Context, method, nativePath string, body []byte) (*WayneRoleBindingResult, error) {
+	token, err := s.adminToken(ctx, false)
+	if err != nil {
+		return nil, err
+	}
+	result, err := s.callRawWithToken(ctx, method, nativePath, body, token)
+	if result != nil && result.StatusCode == http.StatusUnauthorized {
+		token, refreshErr := s.adminToken(ctx, true)
+		if refreshErr != nil {
+			return result, refreshErr
+		}
+		return s.callRawWithToken(ctx, method, nativePath, body, token)
+	}
+	return result, err
+}
+
+func (s *WayneRoleBindingService) callRawWithToken(ctx context.Context, method, nativePath string, body []byte, token string) (*WayneRoleBindingResult, error) {
 	if body == nil {
 		body = []byte{}
 	}
-	target, signingURI, err := s.requestURL(internalPath)
+	target, err := s.requestURL(nativePath)
 	if err != nil {
 		return nil, err
 	}
-	log.Printf(
-		"wayne role binding request: method=%s target=%s signing_uri=%s body_bytes=%d service_name=%s secret_configured=%t",
-		method,
-		target,
-		signingURI,
-		len(body),
-		s.cfg.WayneServiceName,
-		strings.TrimSpace(s.cfg.WayneServiceAPISecretKey) != "",
-	)
+	log.Printf("wayne native request: method=%s target=%s body_bytes=%d", method, target, len(body))
 	httpReq, err := http.NewRequestWithContext(ctx, method, target, bytes.NewReader(body))
 	if err != nil {
 		return nil, err
@@ -223,16 +329,11 @@ func (s *WayneRoleBindingService) callRaw(ctx context.Context, method, internalP
 		httpReq.Header.Set("Content-Type", "application/json")
 	}
 	httpReq.Header.Set("Accept", "application/json")
-
-	headers, err := wayne.BuildSignedHeaders(s.cfg.WayneServiceName, s.cfg.WayneServiceAPISecretKey, method, signingURI, body, s.now())
-	if err != nil {
-		return nil, err
-	}
-	headers.Apply(httpReq)
+	httpReq.Header.Set("Authorization", "Bearer "+token)
 
 	resp, err := s.client.Do(httpReq)
 	if err != nil {
-		log.Printf("wayne role binding request failed: method=%s target=%s error=%v", method, target, err)
+		log.Printf("wayne native request failed: method=%s target=%s error=%v", method, target, err)
 		return nil, err
 	}
 	defer resp.Body.Close()
@@ -246,48 +347,154 @@ func (s *WayneRoleBindingService) callRaw(ctx context.Context, method, internalP
 		ContentType: resp.Header.Get("Content-Type"),
 		Body:        respBody,
 	}
-	log.Printf(
-		"wayne role binding response: method=%s target=%s status=%d content_type=%q body=%q",
-		method,
-		target,
-		resp.StatusCode,
-		result.ContentType,
-		truncateForDebugLog(string(respBody), 512),
-	)
+	log.Printf("wayne native response: method=%s target=%s status=%d content_type=%q body=%q", method, target, resp.StatusCode, result.ContentType, truncateForDebugLog(string(respBody), 512))
 	if resp.StatusCode < http.StatusOK || resp.StatusCode >= http.StatusBadRequest {
 		return result, &WayneRoleBindingHTTPError{StatusCode: resp.StatusCode, Body: respBody}
 	}
 	return result, nil
 }
 
+func (s *WayneRoleBindingService) adminToken(ctx context.Context, forceRefresh bool) (string, error) {
+	if err := s.validateConfig(); err != nil {
+		return "", err
+	}
+	now := s.now()
+	if !forceRefresh && strings.TrimSpace(s.cachedToken) != "" && s.cachedExp.After(now.Add(time.Minute)) {
+		return s.cachedToken, nil
+	}
+	if !forceRefresh && s.db != nil {
+		var saved model.WayneToken
+		err := s.db.WithContext(ctx).Where("account = ?", wayneAdminTokenAccount).First(&saved).Error
+		if err == nil && strings.TrimSpace(saved.Token) != "" && saved.ExpiresAt.After(now.Add(time.Minute)) {
+			s.cachedToken = saved.Token
+			s.cachedExp = saved.ExpiresAt
+			return saved.Token, nil
+		}
+		if err != nil && !errors.Is(err, gorm.ErrRecordNotFound) {
+			return "", err
+		}
+	}
+	token, expiresAt, err := s.loginAdmin(ctx)
+	if err != nil {
+		return "", err
+	}
+	s.cachedToken = token
+	s.cachedExp = expiresAt
+	if s.db != nil {
+		err = s.db.WithContext(ctx).Clauses(clause.OnConflict{
+			Columns:   []clause.Column{{Name: "account"}},
+			DoUpdates: clause.AssignmentColumns([]string{"token", "expires_at", "updated_at"}),
+		}).Create(&model.WayneToken{
+			Account:   wayneAdminTokenAccount,
+			Token:     token,
+			ExpiresAt: expiresAt,
+		}).Error
+	}
+	return token, err
+}
+
+func (s *WayneRoleBindingService) loginAdmin(ctx context.Context) (string, time.Time, error) {
+	body, err := json.Marshal(map[string]string{
+		"username": s.cfg.WayneAdminUsername,
+		"password": s.cfg.WayneAdminPassword,
+	})
+	if err != nil {
+		return "", time.Time{}, err
+	}
+	target, err := s.requestURL("/login/db")
+	if err != nil {
+		return "", time.Time{}, err
+	}
+	req, err := http.NewRequestWithContext(ctx, http.MethodPost, target, bytes.NewReader(body))
+	if err != nil {
+		return "", time.Time{}, err
+	}
+	req.Header.Set("Content-Type", "application/json")
+	req.Header.Set("Accept", "application/json")
+	resp, err := s.client.Do(req)
+	if err != nil {
+		return "", time.Time{}, err
+	}
+	defer resp.Body.Close()
+	respBody, err := io.ReadAll(io.LimitReader(resp.Body, 4<<20))
+	if err != nil {
+		return "", time.Time{}, err
+	}
+	if resp.StatusCode < http.StatusOK || resp.StatusCode >= http.StatusBadRequest {
+		return "", time.Time{}, &WayneRoleBindingHTTPError{StatusCode: resp.StatusCode, Body: respBody}
+	}
+	token, err := parseWayneLoginToken(respBody)
+	if err != nil {
+		return "", time.Time{}, err
+	}
+	expiresAt := wayneTokenExpiresAt(token, s.now().Add(time.Duration(s.cfg.WayneTokenTTLMinutes)*time.Minute))
+	return token, expiresAt, nil
+}
+
 func (s *WayneRoleBindingService) validateConfig() error {
-	baseConfigured := strings.TrimSpace(s.cfg.WayneInternalAPIBaseURL) != ""
-	serviceConfigured := strings.TrimSpace(s.cfg.WayneServiceName) != ""
-	secretConfigured := strings.TrimSpace(s.cfg.WayneServiceAPISecretKey) != ""
-	if !baseConfigured || !serviceConfigured || !secretConfigured {
+	baseConfigured := strings.TrimSpace(s.cfg.WayneAPIBaseURL) != ""
+	usernameConfigured := strings.TrimSpace(s.cfg.WayneAdminUsername) != ""
+	passwordConfigured := strings.TrimSpace(s.cfg.WayneAdminPassword) != ""
+	if !baseConfigured || !usernameConfigured || !passwordConfigured {
 		log.Printf(
-			"wayne role binding config invalid: base_url_configured=%t service_name_configured=%t secret_configured=%t",
+			"wayne native config invalid: base_url_configured=%t admin_username_configured=%t admin_password_configured=%t",
 			baseConfigured,
-			serviceConfigured,
-			secretConfigured,
+			usernameConfigured,
+			passwordConfigured,
 		)
 		return ErrWayneRoleBindingNotConfigured
 	}
 	return nil
 }
 
-func (s *WayneRoleBindingService) requestURL(internalPath string) (string, string, error) {
-	base, err := url.Parse(strings.TrimRight(strings.TrimSpace(s.cfg.WayneInternalAPIBaseURL), "/"))
+func (s *WayneRoleBindingService) requestURL(nativePath string) (string, error) {
+	base, err := url.Parse(strings.TrimRight(strings.TrimSpace(s.cfg.WayneAPIBaseURL), "/"))
 	if err != nil {
-		return "", "", err
+		return "", err
 	}
 	if base.Scheme == "" || base.Host == "" {
-		return "", "", fmt.Errorf("invalid wayne internal api base url: %s", s.cfg.WayneInternalAPIBaseURL)
+		return "", fmt.Errorf("invalid wayne api base url: %s", s.cfg.WayneAPIBaseURL)
 	}
-	path, rawQuery, _ := strings.Cut(internalPath, "?")
+	path, rawQuery, _ := strings.Cut(nativePath, "?")
 	base.Path = strings.TrimRight(base.Path, "/") + path
 	base.RawQuery = rawQuery
-	return base.String(), base.RequestURI(), nil
+	return base.String(), nil
+}
+
+func roleBindingBasePath(scope string, resourceID uint64) string {
+	switch scope {
+	case "app":
+		return fmt.Sprintf("/api/v1/apps/%d/users", resourceID)
+	default:
+		return fmt.Sprintf("/api/v1/namespaces/%d/users", resourceID)
+	}
+}
+
+func nativeRoleBindingBody(scope string, resourceID, userID uint64, groupIDs []uint64) []byte {
+	groups := make([]map[string]uint64, 0, len(groupIDs))
+	for _, groupID := range groupIDs {
+		groups = append(groups, map[string]uint64{"id": groupID})
+	}
+	body := map[string]any{
+		"user":   map[string]uint64{"id": userID},
+		"groups": groups,
+	}
+	if scope == "app" {
+		body["app"] = map[string]uint64{"id": resourceID}
+	} else {
+		body["namespace"] = map[string]uint64{"id": resourceID}
+	}
+	raw, _ := json.Marshal(body)
+	return raw
+}
+
+func nativeRoleBindingBodyWithID(body []byte, id uint64) ([]byte, error) {
+	var payload map[string]any
+	if err := json.Unmarshal(body, &payload); err != nil {
+		return nil, err
+	}
+	payload["id"] = id
+	return json.Marshal(payload)
 }
 
 func truncateForDebugLog(value string, limit int) string {
@@ -298,42 +505,169 @@ func truncateForDebugLog(value string, limit int) string {
 	return value[:limit] + "...(truncated)"
 }
 
+func parseWayneLoginToken(body []byte) (string, error) {
+	var wrapped struct {
+		Data struct {
+			Token string `json:"token"`
+		} `json:"data"`
+		Token string `json:"token"`
+	}
+	if err := json.Unmarshal(body, &wrapped); err != nil {
+		return "", err
+	}
+	token := strings.TrimSpace(wrapped.Data.Token)
+	if token == "" {
+		token = strings.TrimSpace(wrapped.Token)
+	}
+	if token == "" {
+		return "", fmt.Errorf("wayne login response token is empty")
+	}
+	return token, nil
+}
+
+func wayneTokenExpiresAt(token string, fallback time.Time) time.Time {
+	parts := strings.Split(token, ".")
+	if len(parts) < 2 {
+		return fallback
+	}
+	payload, err := base64.RawURLEncoding.DecodeString(parts[1])
+	if err != nil {
+		return fallback
+	}
+	var claims struct {
+		ExpiresAt int64 `json:"exp"`
+	}
+	if err := json.Unmarshal(payload, &claims); err != nil || claims.ExpiresAt <= 0 {
+		return fallback
+	}
+	return time.Unix(claims.ExpiresAt, 0)
+}
+
 func parseWayneRoleGroups(body []byte) ([]WayneRoleGroup, error) {
 	var wrapped struct {
-		Data  []WayneRoleGroup `json:"data"`
-		Items []WayneRoleGroup `json:"items"`
+		Data struct {
+			List []WayneRoleGroup `json:"list"`
+		} `json:"data"`
 	}
-	if err := json.Unmarshal(body, &wrapped); err == nil {
-		if wrapped.Data != nil {
-			return wrapped.Data, nil
-		}
-		if wrapped.Items != nil {
-			return wrapped.Items, nil
-		}
-	}
-	var direct []WayneRoleGroup
-	if err := json.Unmarshal(body, &direct); err != nil {
+	if err := json.Unmarshal(body, &wrapped); err != nil {
 		return nil, err
 	}
-	return direct, nil
+	return wrapped.Data.List, nil
 }
 
 func parseWayneOperatorPermissions(body []byte) (*WayneOperatorPermissions, error) {
 	var wrapped struct {
-		Data struct {
-			Permissions WayneOperatorPermissions `json:"permissions"`
-		} `json:"data"`
 		Permissions WayneOperatorPermissions `json:"permissions"`
 	}
 	if err := json.Unmarshal(body, &wrapped); err != nil {
 		return nil, err
 	}
-	if wrapped.Data.Permissions != (WayneOperatorPermissions{}) {
-		return &wrapped.Data.Permissions, nil
-	}
 	return &wrapped.Permissions, nil
 }
 
+func parseNativePermissions(body []byte, scope string) (WayneOperatorPermissions, error) {
+	var wrapped struct {
+		Data map[string]map[string]bool `json:"data"`
+	}
+	if err := json.Unmarshal(body, &wrapped); err != nil {
+		return WayneOperatorPermissions{}, err
+	}
+	key := "namespaceUser"
+	if scope == "app" {
+		key = "appUser"
+	}
+	return WayneOperatorPermissions{
+		Create: wrapped.Data[key]["create"],
+		Update: wrapped.Data[key]["update"],
+		Delete: wrapped.Data[key]["delete"],
+	}, nil
+}
+
+func rawWayneData(body []byte) json.RawMessage {
+	var wrapped struct {
+		Data json.RawMessage `json:"data"`
+	}
+	if err := json.Unmarshal(body, &wrapped); err == nil && len(wrapped.Data) > 0 {
+		return wrapped.Data
+	}
+	return json.RawMessage(body)
+}
+
+func mustMarshalRaw(value any) json.RawMessage {
+	raw, err := json.Marshal(value)
+	if err != nil {
+		return json.RawMessage(`null`)
+	}
+	return raw
+}
+
+func parseWayneResourceIDs(body []byte) ([]uint64, error) {
+	var wrapped struct {
+		Data struct {
+			List []struct {
+				ID uint64 `json:"id"`
+			} `json:"list"`
+		} `json:"data"`
+	}
+	if err := json.Unmarshal(body, &wrapped); err != nil {
+		return nil, err
+	}
+	return resourceIDsFromItems(wrapped.Data.List), nil
+}
+
+func resourceIDsFromItems(items []struct {
+	ID uint64 `json:"id"`
+}) []uint64 {
+	ids := make([]uint64, 0, len(items))
+	for _, item := range items {
+		if item.ID != 0 {
+			ids = append(ids, item.ID)
+		}
+	}
+	return ids
+}
+
+type wayneNativeUser struct {
+	ID      uint64 `json:"id"`
+	Name    string `json:"name"`
+	Email   string `json:"email"`
+	Display string `json:"display"`
+}
+
+func parseWayneUsers(body []byte) ([]wayneNativeUser, error) {
+	var wrapped struct {
+		Data struct {
+			List []wayneNativeUser `json:"list"`
+		} `json:"data"`
+	}
+	if err := json.Unmarshal(body, &wrapped); err != nil {
+		return nil, err
+	}
+	return wrapped.Data.List, nil
+}
+
+func sameWayneUser(user wayneNativeUser, username string) bool {
+	username = strings.TrimSpace(strings.ToLower(username))
+	return strings.ToLower(strings.TrimSpace(user.Name)) == username ||
+		strings.ToLower(strings.TrimSpace(user.Email)) == username
+}
+
+type wayneRoleBinding struct {
+	ID uint64 `json:"id"`
+}
+
+func parseWayneRoleBindings(body []byte) ([]wayneRoleBinding, error) {
+	var wrapped struct {
+		Data struct {
+			List []wayneRoleBinding `json:"list"`
+		} `json:"data"`
+	}
+	if err := json.Unmarshal(body, &wrapped); err != nil {
+		return nil, err
+	}
+	return wrapped.Data.List, nil
+}
+
 func isWayneVisitorRoleName(name string) bool {
 	normalized := strings.ToLower(strings.TrimSpace(name))
 	return normalized == "访客" || normalized == "visitor" || strings.Contains(normalized, "visitor")