project.go

// Copyright 2022 MongoDB Inc
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//      http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

package project

import (
	"fmt"
	"strings"

	"github.com/mongodb/mongodb-atlas-cli/atlascli/internal/kubernetes/operator/features"
	"github.com/mongodb/mongodb-atlas-cli/atlascli/internal/kubernetes/operator/resources"
	"github.com/mongodb/mongodb-atlas-cli/atlascli/internal/kubernetes/operator/secrets"
	"github.com/mongodb/mongodb-atlas-cli/atlascli/internal/pointer"
	"github.com/mongodb/mongodb-atlas-cli/atlascli/internal/store"
	akov2 "github.com/mongodb/mongodb-atlas-kubernetes/v2/pkg/api/v1"
	akov2common "github.com/mongodb/mongodb-atlas-kubernetes/v2/pkg/api/v1/common"
	akov2project "github.com/mongodb/mongodb-atlas-kubernetes/v2/pkg/api/v1/project"
	akov2provider "github.com/mongodb/mongodb-atlas-kubernetes/v2/pkg/api/v1/provider"
	akov2status "github.com/mongodb/mongodb-atlas-kubernetes/v2/pkg/api/v1/status"
	atlasv2 "go.mongodb.org/atlas-sdk/v20231115008/admin"
	corev1 "k8s.io/api/core/v1"
	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
	k8snames "k8s.io/apiserver/pkg/storage/names"
)

const (
	credSecretFormat                = "%s-credentials"
	MaxItems                        = 500
	featureAccessLists              = "projectIpAccessList"
	featureMaintenanceWindows       = "maintenanceWindow"
	featureIntegrations             = "integrations"
	featureNetworkPeering           = "networkPeers"
	featurePrivateEndpoints         = "privateEndpoints"
	featureEncryptionAtRest         = "encryptionAtRest"
	featureCloudProviderAccessRoles = "cloudProviderAccessRoles"
	featureProjectSettings          = "settings"
	featureAuditing                 = "auditing"
	featureAlertConfiguration       = "alertConfigurations"
	featureCustomRoles              = "customRoles"
	featureTeams                    = "teams"
	cidrException                   = "/32"
	datadogIntegrationType          = "DATADOG"
	newRelicIntegrationType         = "NEW_RELIC"
	opsGenieIntegrationType         = "OPS_GENIE"
	pagerDutyIntegrationType        = "PAGER_DUTY"
	victorOpsIntegrationType        = "VICTOR_OPS"
	webhookIntegrationType          = "WEBHOOK"
	microsoftTeamsIntegrationType   = "MICROSOFT_TEAMS"
	slackIntegrationType            = "SLACK"
	prometheusIntegrationType       = "PROMETHEUS"
)

type AtlasProjectResult struct {
	Project *akov2.AtlasProject
	Secrets []*corev1.Secret
	Teams   []*akov2.AtlasTeam
}

func BuildAtlasProject(projectStore store.OperatorProjectStore, validator features.FeatureValidator, orgID, projectID, targetNamespace string, includeSecret bool, dictionary map[string]string, version string) (*AtlasProjectResult, error) { //nolint:gocyclo
	project, err := projectStore.Project(projectID)
	if err != nil {
		return nil, err
	}

	projectResult := newAtlasProject(project, dictionary, targetNamespace, version)

	result := &AtlasProjectResult{
		Project: projectResult,
		Secrets: nil,
		Teams:   nil,
	}

	if validator.FeatureExist(features.ResourceAtlasProject, featureAccessLists) {
		ipAccessList, ferr := buildAccessLists(projectStore, projectID)
		if ferr != nil {
			return nil, ferr
		}
		projectResult.Spec.ProjectIPAccessList = ipAccessList
	}

	if validator.FeatureExist(features.ResourceAtlasProject, featureMaintenanceWindows) {
		maintenanceWindows, ferr := buildMaintenanceWindows(projectStore, projectID)
		if ferr != nil {
			return nil, ferr
		}
		projectResult.Spec.MaintenanceWindow = maintenanceWindows
	}

	secretRef := &akov2common.ResourceRefNamespaced{}
	if includeSecret {
		secretRef.Name = resources.NormalizeAtlasName(fmt.Sprintf(credSecretFormat, project.Name), dictionary)
	}
	projectResult.Spec.ConnectionSecret = secretRef

	if validator.FeatureExist(features.ResourceAtlasProject, featureIntegrations) {
		integrations, intSecrets, ferr := buildIntegrations(projectStore, projectID, targetNamespace, true, dictionary)
		if ferr != nil {
			return nil, ferr
		}
		projectResult.Spec.Integrations = integrations
		result.Secrets = intSecrets
	}

	if validator.FeatureExist(features.ResourceAtlasProject, featureNetworkPeering) {
		networkPeering, ferr := buildNetworkPeering(projectStore, projectID)
		if ferr != nil {
			return nil, ferr
		}
		projectResult.Spec.NetworkPeers = networkPeering
	}

	if validator.FeatureExist(features.ResourceAtlasProject, featurePrivateEndpoints) {
		privateEndpoints, ferr := buildPrivateEndpoints(projectStore, projectID)
		if ferr != nil {
			return nil, ferr
		}
		projectResult.Spec.PrivateEndpoints = privateEndpoints
	}

	if validator.FeatureExist(features.ResourceAtlasProject, featureEncryptionAtRest) {
		encryptionAtRest, secrets, ferr := buildEncryptionAtRest(projectStore, projectID, project.Name, targetNamespace, dictionary)
		if ferr != nil {
			return nil, ferr
		}
		projectResult.Spec.EncryptionAtRest = encryptionAtRest
		result.Secrets = append(result.Secrets, secrets...)
	}

	if validator.FeatureExist(features.ResourceAtlasProject, featureCloudProviderAccessRoles) {
		cpa, ferr := buildCloudProviderAccessRoles(projectStore, projectID)
		if ferr != nil {
			return nil, ferr
		}
		projectResult.Spec.CloudProviderAccessRoles = cpa
	}

	if validator.FeatureExist(features.ResourceAtlasProject, featureProjectSettings) {
		projectSettings, ferr := buildProjectSettings(projectStore, projectID)
		if ferr != nil {
			return nil, ferr
		}
		projectResult.Spec.Settings = projectSettings
	}

	if validator.FeatureExist(features.ResourceAtlasProject, featureAuditing) {
		auditing, ferr := buildAuditing(projectStore, projectID)
		if ferr != nil {
			return nil, ferr
		}
		projectResult.Spec.Auditing = auditing
	}

	if validator.FeatureExist(features.ResourceAtlasProject, featureAlertConfiguration) {
		alertConfigurations, secrets, ferr := buildAlertConfigurations(projectStore, projectID, project.Name, targetNamespace, dictionary)
		if ferr != nil {
			return nil, ferr
		}
		projectResult.Spec.AlertConfigurations = alertConfigurations
		result.Secrets = append(result.Secrets, secrets...)
	}

	if validator.FeatureExist(features.ResourceAtlasProject, featureCustomRoles) {
		customRoles, ferr := buildCustomRoles(projectStore, projectID)
		if ferr != nil {
			return nil, ferr
		}
		projectResult.Spec.CustomRoles = customRoles
	}

	if validator.FeatureExist(features.ResourceAtlasProject, featureTeams) {
		teamsRefs, teams, ferr := buildTeams(projectStore, orgID, projectID, project.Name, targetNamespace, version, dictionary)
		if ferr != nil {
			return nil, ferr
		}
		projectResult.Spec.Teams = teamsRefs
		result.Teams = teams
	}

	return result, err
}

func newAtlasProject(project *atlasv2.Group, dictionary map[string]string, targetNamespace string, version string) *akov2.AtlasProject {
	return &akov2.AtlasProject{
		TypeMeta: v1.TypeMeta{
			Kind:       "AtlasProject",
			APIVersion: "atlas.mongodb.com/v1",
		},
		ObjectMeta: v1.ObjectMeta{
			Name:      resources.NormalizeAtlasName(project.Name, dictionary),
			Namespace: targetNamespace,
			Labels: map[string]string{
				features.ResourceVersion: version,
			},
		},
		Spec: akov2.AtlasProjectSpec{
			Name:                          project.Name,
			ConnectionSecret:              nil,
			ProjectIPAccessList:           nil,
			PrivateEndpoints:              nil,
			CloudProviderAccessRoles:      nil,
			AlertConfigurations:           nil,
			AlertConfigurationSyncEnabled: false,
			NetworkPeers:                  nil,
			WithDefaultAlertsSettings:     pointer.GetOrDefault(project.WithDefaultAlertsSettings, false),
			X509CertRef:                   nil, // not available for import
			Integrations:                  nil,
			EncryptionAtRest:              nil,
			Auditing:                      nil,
			Settings:                      nil,
			CustomRoles:                   nil,
			Teams:                         nil,
			RegionUsageRestrictions:       store.StringOrEmpty(project.RegionUsageRestrictions),
		},
		Status: akov2status.AtlasProjectStatus{
			Common: akov2status.Common{
				Conditions: []akov2status.Condition{},
			},
		},
	}
}

func BuildProjectConnectionSecret(credsProvider store.CredentialsGetter, name, namespace, orgID string, includeCreds bool, dictionary map[string]string) *corev1.Secret {
	secret := secrets.NewAtlasSecretBuilder(fmt.Sprintf("%s-credentials", name), namespace, dictionary).
		WithData(map[string][]byte{
			secrets.CredOrgID:         []byte(""),
			secrets.CredPublicAPIKey:  []byte(""),
			secrets.CredPrivateAPIKey: []byte(""),
		}).
		Build()
	if includeCreds {
		secret.Data = map[string][]byte{
			secrets.CredOrgID:         []byte(orgID),
			secrets.CredPublicAPIKey:  []byte(credsProvider.PublicAPIKey()),
			secrets.CredPrivateAPIKey: []byte(credsProvider.PrivateAPIKey()),
		}
	}
	return secret
}

func buildCustomRoles(crProvider store.DatabaseRoleLister, projectID string) ([]akov2.CustomRole, error) {
	dbRoles, err := crProvider.DatabaseRoles(projectID)
	if err != nil {
		return nil, err
	}
	if dbRoles == nil {
		return nil, nil
	}

	result := make([]akov2.CustomRole, 0, len(dbRoles))
	roles := dbRoles
	for rIdx := range roles {
		role := &roles[rIdx]

		inhRoles := make([]akov2.Role, 0, len(role.GetInheritedRoles()))
		for _, rl := range role.GetInheritedRoles() {
			inhRoles = append(inhRoles, akov2.Role{
				Name:     rl.Role,
				Database: rl.Db,
			})
		}

		actions := make([]akov2.Action, 0, len(role.GetActions()))
		for _, action := range role.GetActions() {
			r := make([]akov2.Resource, 0, len(action.GetResources()))
			for _, res := range action.GetResources() {
				r = append(r, akov2.Resource{
					Cluster:    pointer.Get(res.Cluster),
					Database:   pointer.Get(res.Db),
					Collection: pointer.Get(res.Collection),
				})
			}
			actions = append(actions, akov2.Action{
				Name:      action.Action,
				Resources: r,
			})
		}
		result = append(result, akov2.CustomRole{
			Name:           role.RoleName,
			InheritedRoles: inhRoles,
			Actions:        actions,
		})
	}
	return result, nil
}

func buildAccessLists(accessListProvider store.ProjectIPAccessListLister, projectID string) ([]akov2project.IPAccessList, error) {
	// pagination not required, max 200 entries can be configured via API
	accessLists, err := accessListProvider.ProjectIPAccessLists(projectID, &store.ListOptions{ItemsPerPage: MaxItems})
	if err != nil {
		return nil, err
	}

	result := make([]akov2project.IPAccessList, 0, len(accessLists.GetResults()))
	for _, list := range accessLists.GetResults() {
		if strings.HasSuffix(list.GetCidrBlock(), cidrException) && list.GetIpAddress() != "" {
			list.CidrBlock = pointer.Get("")
		}
		deleteAfterDate := ""
		if !list.GetDeleteAfterDate().IsZero() {
			deleteAfterDate = list.GetDeleteAfterDate().String()
		}
		result = append(result, akov2project.IPAccessList{
			AwsSecurityGroup: list.GetAwsSecurityGroup(),
			CIDRBlock:        list.GetCidrBlock(),
			Comment:          list.GetComment(),
			DeleteAfterDate:  deleteAfterDate,
			IPAddress:        list.GetIpAddress(),
		})
	}
	return result, nil
}

func buildMaintenanceWindows(mwProvider store.MaintenanceWindowDescriber, projectID string) (akov2project.MaintenanceWindow, error) {
	mw, err := mwProvider.MaintenanceWindow(projectID)
	if err != nil {
		return akov2project.MaintenanceWindow{}, err
	}

	return akov2project.MaintenanceWindow{
		DayOfWeek: mw.DayOfWeek,
		HourOfDay: mw.GetHourOfDay(),
		AutoDefer: mw.GetAutoDeferOnceEnabled(),
		StartASAP: mw.GetStartASAP(),
		Defer:     false,
	}, nil
}

func buildIntegrations(intProvider store.IntegrationLister, projectID, targetNamespace string, includeSecrets bool, dictionary map[string]string) ([]akov2project.Integration, []*corev1.Secret, error) { //nolint:gocyclo
	integrations, err := intProvider.Integrations(projectID)
	if err != nil {
		return nil, nil, err
	}
	result := make([]akov2project.Integration, 0, len(integrations.GetResults()))
	intSecrets := make([]*corev1.Secret, 0, len(integrations.GetResults()))

	for _, list := range integrations.GetResults() {
		iType := list.GetType()
		secret := secrets.NewAtlasSecretBuilder(
			fmt.Sprintf("%s-integration-%s", projectID, strings.ToLower(iType)),
			targetNamespace,
			dictionary,
		).WithData(map[string][]byte{secrets.PasswordField: []byte("")}).Build()

		integration := akov2project.Integration{
			Type: iType,
		}
		secretRef := akov2common.ResourceRefNamespaced{
			Name:      resources.NormalizeAtlasName(secret.Name, dictionary),
			Namespace: targetNamespace,
		}
		switch iType {
		case pagerDutyIntegrationType:
			integration.ServiceKeyRef = secretRef
			if includeSecrets {
				secret.Data[secrets.PasswordField] = []byte(list.GetServiceKey())
			}
		case slackIntegrationType:
			integration.TeamName = list.GetTeamName()
			integration.APITokenRef = secretRef
			if includeSecrets {
				secret.Data[secrets.PasswordField] = []byte(list.GetApiToken())
			}
		case datadogIntegrationType:
			integration.Region = list.GetRegion()
			integration.APIKeyRef = secretRef
			if includeSecrets {
				secret.Data[secrets.PasswordField] = []byte(list.GetApiKey())
			}
		case opsGenieIntegrationType:
			integration.Region = list.GetRegion()
			integration.APIKeyRef = secretRef
			if includeSecrets {
				secret.Data[secrets.PasswordField] = []byte(list.GetApiKey())
			}
		case webhookIntegrationType:
			integration.URL = list.GetUrl()
			integration.SecretRef = secretRef
			if includeSecrets {
				secret.Data[secrets.PasswordField] = []byte(list.GetSecret())
			}
		case microsoftTeamsIntegrationType:
			integration.MicrosoftTeamsWebhookURL = list.GetMicrosoftTeamsWebhookUrl()
		case prometheusIntegrationType:
			integration.UserName = list.GetUsername()
			integration.PasswordRef = secretRef
			integration.ServiceDiscovery = list.GetServiceDiscovery()
			integration.Enabled = list.GetEnabled()
			if includeSecrets {
				secret.Data[secrets.PasswordField] = []byte(list.GetPassword())
			}
		case victorOpsIntegrationType: // One more secret required
			integration.APIKeyRef = secretRef
			secret.Data[secrets.PasswordField] = []byte(list.GetApiKey())

			var routingKeyData string
			if includeSecrets {
				routingKeyData = list.GetRoutingKey()
			}
			if list.GetRoutingKey() != "" {
				// Secret with routing key
				routingSecret := secrets.NewAtlasSecretBuilder(
					fmt.Sprintf("%s-integration-%s-routing-key", projectID, strings.ToLower(iType)),
					targetNamespace,
					dictionary,
				).WithData(map[string][]byte{secrets.PasswordField: []byte(routingKeyData)}).Build()
				intSecrets = append(intSecrets, routingSecret)
			}
		case newRelicIntegrationType:
			integration.LicenseKeyRef = secretRef
			secret.Data[secrets.PasswordField] = []byte(list.GetLicenseKey())
			// Secrets with write and read tokens
			var writeToken, readToken string
			if includeSecrets {
				writeToken = list.GetWriteToken()
				readToken = list.GetReadToken()
			}
			writeTokenSecret := secrets.NewAtlasSecretBuilder(
				fmt.Sprintf("%s-integration-%s-routing-key", projectID, strings.ToLower(iType)),
				targetNamespace,
				dictionary,
			).WithData(map[string][]byte{secrets.PasswordField: []byte(writeToken)}).Build()
			readTokenSecret := secrets.NewAtlasSecretBuilder(
				fmt.Sprintf("%s-integration-%s-routing-key", projectID, strings.ToLower(iType)),
				targetNamespace,
				dictionary,
			).WithData(map[string][]byte{secrets.PasswordField: []byte(readToken)}).Build()
			intSecrets = append(intSecrets, writeTokenSecret, readTokenSecret)
		}
		result = append(result, integration)
		intSecrets = append(intSecrets, secret)
	}

	return result, intSecrets, nil
}

func buildPrivateEndpoints(peProvider store.PrivateEndpointLister, projectID string) ([]akov2.PrivateEndpoint, error) {
	var result []akov2.PrivateEndpoint
	for _, cloudProvider := range []akov2provider.ProviderName{akov2provider.ProviderAWS, akov2provider.ProviderGCP, akov2provider.ProviderAzure} {
		peList, err := peProvider.PrivateEndpoints(projectID, string(cloudProvider))
		if err != nil {
			return nil, err
		}
		for i := range peList {
			pe := &peList[i]
			result = append(result, akov2.PrivateEndpoint{
				Provider:          cloudProvider,
				Region:            pe.GetRegionName(),
				ID:                firstElementOrZeroValue(pe.GetInterfaceEndpoints()),
				IP:                "",
				GCPProjectID:      "",
				EndpointGroupName: "",
				Endpoints:         akov2.GCPEndpoints{},
			})
		}
	}
	return result, nil
}

func buildNetworkPeering(npProvider store.PeeringConnectionLister, projectID string) ([]akov2.NetworkPeer, error) {
	// pagination not required, max 25 entries per provider can be configured via API
	npListAWS, err := npProvider.PeeringConnections(projectID, &store.ContainersListOptions{
		ListOptions: store.ListOptions{
			ItemsPerPage: MaxItems,
		},
		ProviderName: string(akov2provider.ProviderAWS),
	})
	if err != nil {
		return nil, fmt.Errorf("error getting network peering connections for AWS: %w", err)
	}

	npListGCP, err := npProvider.PeeringConnections(projectID, &store.ContainersListOptions{
		ListOptions: store.ListOptions{
			ItemsPerPage: MaxItems,
		},
		ProviderName: string(akov2provider.ProviderGCP),
	})
	if err != nil {
		return nil, fmt.Errorf("error getting network peering connections for GCP: %w", err)
	}

	npListAzure, err := npProvider.PeeringConnections(projectID, &store.ContainersListOptions{
		ListOptions: store.ListOptions{
			ItemsPerPage: MaxItems,
		},
		ProviderName: string(akov2provider.ProviderAzure),
	})
	if err != nil {
		return nil, fmt.Errorf("error getting network peering connections for Azure: %w", err)
	}

	result := make([]akov2.NetworkPeer, 0, len(npListAWS)+len(npListGCP)+len(npListAzure))

	for i := range npListAWS {
		np := npListAWS[i]
		result = append(result, convertNetworkPeer(np, akov2provider.ProviderAWS))
	}

	for i := range npListGCP {
		np := npListGCP[i]
		result = append(result, convertNetworkPeer(np, akov2provider.ProviderGCP))
	}

	for i := range npListAzure {
		np := npListAzure[i]
		result = append(result, convertNetworkPeer(np, akov2provider.ProviderAzure))
	}

	return result, nil
}

func convertNetworkPeer(np atlasv2.BaseNetworkPeeringConnectionSettings, providerName akov2provider.ProviderName) akov2.NetworkPeer {
	switch np.GetProviderName() {
	case "AWS":
		return convertAWSNetworkPeer(&np, providerName)
	case "GCP":
		return convertGCPNetworkPeer(&np, providerName)
	case "Azure":
		return convertAzureNetworkPeer(&np, providerName)
	default:
		return akov2.NetworkPeer{}
	}
}

func convertAWSNetworkPeer(np *atlasv2.BaseNetworkPeeringConnectionSettings, providerName akov2provider.ProviderName) akov2.NetworkPeer {
	return akov2.NetworkPeer{
		AccepterRegionName:  np.GetAccepterRegionName(),
		AWSAccountID:        np.GetAwsAccountId(),
		ContainerRegion:     "",
		ContainerID:         np.ContainerId,
		ProviderName:        providerName,
		RouteTableCIDRBlock: np.GetRouteTableCidrBlock(),
		VpcID:               np.GetVpcId(),
	}
}

func convertAzureNetworkPeer(np *atlasv2.BaseNetworkPeeringConnectionSettings, providerName akov2provider.ProviderName) akov2.NetworkPeer {
	return akov2.NetworkPeer{
		AzureDirectoryID:    np.GetAzureDirectoryId(),
		AzureSubscriptionID: np.GetAzureSubscriptionId(),
		ContainerRegion:     "",
		ContainerID:         np.GetContainerId(),
		ProviderName:        providerName,
		ResourceGroupName:   np.GetResourceGroupName(),
		VNetName:            np.GetVnetName(),
	}
}

func convertGCPNetworkPeer(np *atlasv2.BaseNetworkPeeringConnectionSettings, providerName akov2provider.ProviderName) akov2.NetworkPeer {
	return akov2.NetworkPeer{
		GCPProjectID:    np.GetGcpProjectId(),
		ContainerRegion: "",
		ContainerID:     np.ContainerId,
		ProviderName:    providerName,
		NetworkName:     np.GetNetworkName(),
	}
}

func buildEncryptionAtRest(encProvider store.EncryptionAtRestDescriber, projectID, projectName, targetNamespace string, dictionary map[string]string) (*akov2.EncryptionAtRest, []*corev1.Secret, error) {
	data, err := encProvider.EncryptionAtRest(projectID)
	if err != nil {
		return nil, nil, err
	}

	ref := &akov2.EncryptionAtRest{
		AwsKms: akov2.AwsKms{
			Enabled: data.AwsKms.Enabled,
			Region:  data.AwsKms.GetRegion(),
			Valid:   data.AwsKms.Valid,
		},
		AzureKeyVault: akov2.AzureKeyVault{
			Enabled:           data.AzureKeyVault.Enabled,
			ClientID:          data.AzureKeyVault.GetClientID(),
			AzureEnvironment:  data.AzureKeyVault.GetAzureEnvironment(),
			ResourceGroupName: data.AzureKeyVault.GetResourceGroupName(),
			TenantID:          data.AzureKeyVault.GetTenantID(),
		},
		GoogleCloudKms: akov2.GoogleCloudKms{
			Enabled: data.GoogleCloudKms.Enabled,
		},
	}

	var ss []*corev1.Secret
	switch {
	case data.AwsKms.Enabled != nil && *data.AwsKms.Enabled:
		ref.AwsKms.SecretRef = akov2common.ResourceRefNamespaced{
			Name:      resources.NormalizeAtlasName(generateName("aws-credentials-"), dictionary),
			Namespace: targetNamespace,
		}

		ss = append(ss, secrets.NewAtlasSecretBuilder(ref.AwsKms.SecretRef.Name, ref.AwsKms.SecretRef.Namespace, dictionary).
			WithData(map[string][]byte{"CustomerMasterKeyID": []byte(""), "RoleID": []byte("")}).
			WithProjectLabels(projectID, projectName).
			Build())

	case data.AzureKeyVault.Enabled != nil && *data.AzureKeyVault.Enabled:
		ref.AzureKeyVault.SecretRef = akov2common.ResourceRefNamespaced{
			Name:      resources.NormalizeAtlasName(generateName("azure-credentials-"), dictionary),
			Namespace: targetNamespace,
		}

		ss = append(ss, secrets.NewAtlasSecretBuilder(ref.AzureKeyVault.SecretRef.Name, ref.AzureKeyVault.SecretRef.Namespace, dictionary).
			WithData(map[string][]byte{"SubscriptionID": []byte(""), "KeyVaultName": []byte(""), "KeyIdentifier": []byte(""), "Secret": []byte("")}).
			WithProjectLabels(projectID, projectName).
			Build())

	case data.GoogleCloudKms.Enabled != nil && *data.GoogleCloudKms.Enabled:
		ref.AzureKeyVault.SecretRef = akov2common.ResourceRefNamespaced{
			Name:      resources.NormalizeAtlasName(generateName("gcp-credentials-"), dictionary),
			Namespace: targetNamespace,
		}

		ss = append(ss, secrets.NewAtlasSecretBuilder(ref.GoogleCloudKms.SecretRef.Name, ref.GoogleCloudKms.SecretRef.Namespace, dictionary).
			WithData(map[string][]byte{"ServiceAccountKey": []byte(""), "KeyVersionResourceID": []byte("")}).
			WithProjectLabels(projectID, projectName).
			Build())
	}

	return ref, ss, nil
}

func buildCloudProviderAccessRoles(cpaProvider store.CloudProviderAccessRoleLister, projectID string) ([]akov2.CloudProviderAccessRole, error) {
	data, err := cpaProvider.CloudProviderAccessRoles(projectID)
	if err != nil {
		return nil, err
	}

	result := make([]akov2.CloudProviderAccessRole, 0, len(data.GetAwsIamRoles()))
	for _, cpa := range data.GetAwsIamRoles() {
		result = append(result, akov2.CloudProviderAccessRole{
			ProviderName:      cpa.ProviderName,
			IamAssumedRoleArn: cpa.GetIamAssumedRoleArn(),
		})
	}

	return result, nil
}

func buildProjectSettings(psProvider store.ProjectSettingsDescriber, projectID string) (*akov2.ProjectSettings, error) {
	data, err := psProvider.ProjectSettings(projectID)
	if err != nil {
		return nil, err
	}

	return &akov2.ProjectSettings{
		IsCollectDatabaseSpecificsStatisticsEnabled: data.IsCollectDatabaseSpecificsStatisticsEnabled,
		IsDataExplorerEnabled:                       data.IsDataExplorerEnabled,
		IsPerformanceAdvisorEnabled:                 data.IsPerformanceAdvisorEnabled,
		IsRealtimePerformancePanelEnabled:           data.IsRealtimePerformancePanelEnabled,
		IsSchemaAdvisorEnabled:                      data.IsSchemaAdvisorEnabled,
	}, nil
}

func buildAuditing(auditingProvider store.AuditingDescriber, projectID string) (*akov2.Auditing, error) {
	data, err := auditingProvider.Auditing(projectID)
	if err != nil {
		return nil, err
	}

	return &akov2.Auditing{
		AuditAuthorizationSuccess: pointer.GetOrZero(data.AuditAuthorizationSuccess),
		AuditFilter:               pointer.GetOrZero(data.AuditFilter),
		Enabled:                   pointer.GetOrZero(data.Enabled),
	}, nil
}

func buildAlertConfigurations(acProvider store.AlertConfigurationLister, projectID, projectName, targetNamespace string, dictionary map[string]string) ([]akov2.AlertConfiguration, []*corev1.Secret, error) {
	data, err := acProvider.AlertConfigurations(&atlasv2.ListAlertConfigurationsApiParams{
		GroupId:      projectID,
		ItemsPerPage: pointer.Get(MaxItems),
	})
	if err != nil {
		return nil, nil, err
	}

	convertMatchers := func(atlasMatcher []map[string]interface{}) []akov2.Matcher {
		var res []akov2.Matcher
		for _, m := range atlasMatcher {
			res = append(res, akov2.Matcher{
				FieldName: (m["FieldName"]).(string),
				Operator:  (m["Operator"]).(string),
				Value:     (m["Value"]).(string),
			})
		}
		return res
	}

	convertMetricThreshold := func(atlasMT *atlasv2.ServerlessMetricThreshold) *akov2.MetricThreshold {
		if atlasMT == nil {
			return &akov2.MetricThreshold{}
		}
		return &akov2.MetricThreshold{
			MetricName: atlasMT.MetricName,
			Operator:   store.StringOrEmpty(atlasMT.Operator),
			Threshold:  fmt.Sprintf("%f", pointer.GetOrDefault(atlasMT.Threshold, 0.0)),
			Units:      store.StringOrEmpty(atlasMT.Units),
			Mode:       store.StringOrEmpty(atlasMT.Mode),
		}
	}

	convertThreshold := func(atlasT *atlasv2.GreaterThanRawThreshold) *akov2.Threshold {
		if atlasT == nil {
			return &akov2.Threshold{}
		}
		return &akov2.Threshold{
			Operator:  store.StringOrEmpty(atlasT.Operator),
			Units:     store.StringOrEmpty(atlasT.Units),
			Threshold: fmt.Sprintf("%d", pointer.GetOrDefault(atlasT.Threshold, 0)),
		}
	}
	convertNotifications := func(atlasNotifications []atlasv2.AlertsNotificationRootForGroup) ([]akov2.Notification, []*corev1.Secret) {
		var (
			akoNotifications []akov2.Notification
			akoSecrets       []*corev1.Secret
		)

		for _, atlasNotification := range atlasNotifications {
			akoNotification := akov2.Notification{
				ChannelName:    store.StringOrEmpty(atlasNotification.ChannelName),
				DatadogRegion:  store.StringOrEmpty(atlasNotification.DatadogRegion),
				DelayMin:       atlasNotification.DelayMin,
				EmailAddress:   store.StringOrEmpty(atlasNotification.EmailAddress),
				EmailEnabled:   atlasNotification.EmailEnabled,
				IntervalMin:    pointer.GetOrDefault(atlasNotification.IntervalMin, 0),
				MobileNumber:   store.StringOrEmpty(atlasNotification.MobileNumber),
				OpsGenieRegion: store.StringOrEmpty(atlasNotification.OpsGenieRegion),
				SMSEnabled:     atlasNotification.SmsEnabled,
				TeamID:         store.StringOrEmpty(atlasNotification.TeamId),
				TeamName:       store.StringOrEmpty(atlasNotification.TeamName),
				TypeName:       store.StringOrEmpty(atlasNotification.TypeName),
				Username:       store.StringOrEmpty(atlasNotification.Username),
				Roles:          atlasNotification.GetRoles(),
			}

			if atlasNotification.TypeName != nil {
				switch *atlasNotification.TypeName {
				case pagerDutyIntegrationType:
					akoNotification.ServiceKeyRef = akov2common.ResourceRefNamespaced{
						Name:      resources.NormalizeAtlasName(generateName("service-key-"), dictionary),
						Namespace: targetNamespace,
					}

					akoSecrets = append(akoSecrets,
						secrets.NewAtlasSecretBuilder(akoNotification.ServiceKeyRef.Name, akoNotification.ServiceKeyRef.Namespace, dictionary).
							WithData(map[string][]byte{"ServiceKey": []byte("")}).
							WithProjectLabels(projectID, projectName).
							WithNotifierLabels(atlasNotification.NotifierId, pagerDutyIntegrationType).
							Build())

				case slackIntegrationType:
					akoNotification.APITokenRef = akov2common.ResourceRefNamespaced{
						Name:      resources.NormalizeAtlasName(generateName("api-token-"), dictionary),
						Namespace: targetNamespace,
					}

					akoSecrets = append(akoSecrets,
						secrets.NewAtlasSecretBuilder(akoNotification.APITokenRef.Name, akoNotification.APITokenRef.Namespace, dictionary).
							WithData(map[string][]byte{"APIToken": []byte("")}).
							WithProjectLabels(projectID, projectName).
							WithNotifierLabels(atlasNotification.NotifierId, slackIntegrationType).
							Build())

				case datadogIntegrationType:
					akoNotification.DatadogAPIKeyRef = akov2common.ResourceRefNamespaced{
						Name:      resources.NormalizeAtlasName(generateName("datadog-api-key-"), dictionary),
						Namespace: targetNamespace,
					}

					akoSecrets = append(akoSecrets,
						secrets.NewAtlasSecretBuilder(akoNotification.DatadogAPIKeyRef.Name, akoNotification.DatadogAPIKeyRef.Namespace, dictionary).
							WithData(map[string][]byte{"DatadogAPIKey": []byte("")}).
							WithProjectLabels(projectID, projectName).
							WithNotifierLabels(atlasNotification.NotifierId, datadogIntegrationType).
							Build())

				case opsGenieIntegrationType:
					akoNotification.OpsGenieAPIKeyRef = akov2common.ResourceRefNamespaced{
						Name:      resources.NormalizeAtlasName(generateName("ops-genie-api-key-"), dictionary),
						Namespace: targetNamespace,
					}

					akoSecrets = append(akoSecrets,
						secrets.NewAtlasSecretBuilder(akoNotification.OpsGenieAPIKeyRef.Name, akoNotification.OpsGenieAPIKeyRef.Namespace, dictionary).
							WithData(map[string][]byte{"OpsGenieAPIKey": []byte("")}).
							WithProjectLabels(projectID, projectName).
							WithNotifierLabels(atlasNotification.NotifierId, opsGenieIntegrationType).
							Build())

				case victorOpsIntegrationType:
					akoNotification.VictorOpsSecretRef = akov2common.ResourceRefNamespaced{
						Name:      resources.NormalizeAtlasName(generateName("victor-ops-credentials-"), dictionary),
						Namespace: targetNamespace,
					}

					akoSecrets = append(akoSecrets,
						secrets.NewAtlasSecretBuilder(akoNotification.VictorOpsSecretRef.Name, akoNotification.VictorOpsSecretRef.Namespace, dictionary).
							WithData(map[string][]byte{"VictorOpsAPIKey": []byte(""), "VictorOpsRoutingKey": []byte("")}).
							WithProjectLabels(projectID, projectName).
							WithNotifierLabels(atlasNotification.NotifierId, victorOpsIntegrationType).
							Build())
				}
			}

			akoNotifications = append(akoNotifications, akoNotification)
		}

		return akoNotifications, akoSecrets
	}

	var secretResults []*corev1.Secret
	results := make([]akov2.AlertConfiguration, 0, len(data.GetResults()))
	for _, alertConfig := range data.GetResults() {
		notifications, notificationSecrets := convertNotifications(alertConfig.GetNotifications())
		secretResults = append(secretResults, notificationSecrets...)

		results = append(results, akov2.AlertConfiguration{
			EventTypeName:   store.StringOrEmpty(alertConfig.EventTypeName),
			Enabled:         pointer.GetOrDefault(alertConfig.Enabled, false),
			Matchers:        convertMatchers(alertConfig.GetMatchers()),
			MetricThreshold: convertMetricThreshold(alertConfig.MetricThreshold),
			Threshold:       convertThreshold(alertConfig.Threshold),
			Notifications:   notifications,
		})
	}
	return results, secretResults, nil
}

func generateName(base string) string {
	return k8snames.SimpleNameGenerator.GenerateName(base)
}

func buildTeams(teamsProvider store.OperatorTeamsStore, orgID, projectID, projectName, targetNamespace, version string, dictionary map[string]string) ([]akov2.Team, []*akov2.AtlasTeam, error) {
	projectTeams, err := teamsProvider.ProjectTeams(projectID, nil)
	if err != nil {
		return nil, nil, err
	}

	fetchUsers := func(teamID string) ([]string, error) {
		users, err := teamsProvider.TeamUsers(orgID, teamID)
		if err != nil {
			return nil, err
		}
		result := make([]string, 0, len(users.GetResults()))
		for _, user := range users.GetResults() {
			result = append(result, user.Username)
		}
		return result, nil
	}

	convertRoleNames := func(input []string) []akov2.TeamRole {
		if len(input) == 0 {
			return nil
		}
		result := make([]akov2.TeamRole, 0, len(input))
		for i := range input {
			result = append(result, akov2.TeamRole(input[i]))
		}
		return result
	}

	convertUserNames := func(input []string) []akov2.TeamUser {
		if len(input) == 0 {
			return nil
		}

		result := make([]akov2.TeamUser, 0, len(input))
		for i := range input {
			result = append(result, akov2.TeamUser(input[i]))
		}
		return result
	}

	teamsRefs := make([]akov2.Team, 0, len(projectTeams.GetResults()))
	atlasTeamCRs := make([]*akov2.AtlasTeam, 0, len(projectTeams.GetResults()))

	for _, teamRef := range projectTeams.GetResults() {
		teamID := store.StringOrEmpty(teamRef.TeamId)

		team, err := teamsProvider.TeamByID(orgID, teamID)
		if err != nil {
			return nil, nil, fmt.Errorf("team id: %s is assigned to project %s (id: %s) but not found. %w",
				teamID, projectName, projectID, err)
		}

		teamName := store.StringOrEmpty(team.Name)
		crName := resources.NormalizeAtlasName(fmt.Sprintf("%s-team-%s", projectName, teamName), dictionary)
		teamsRefs = append(teamsRefs, akov2.Team{
			TeamRef: akov2common.ResourceRefNamespaced{
				Name:      crName,
				Namespace: targetNamespace,
			},
			Roles: convertRoleNames(teamRef.GetRoleNames()),
		})

		users, err := fetchUsers(store.StringOrEmpty(team.Id))
		if err != nil {
			return nil, nil, err
		}

		atlasTeamCRs = append(atlasTeamCRs, &akov2.AtlasTeam{
			TypeMeta: v1.TypeMeta{
				Kind:       "AtlasTeam",
				APIVersion: "atlas.mongodb.com/v1",
			},
			ObjectMeta: v1.ObjectMeta{
				Name:      crName,
				Namespace: targetNamespace,
				Labels: map[string]string{
					features.ResourceVersion: version,
				},
			},
			Spec: akov2.TeamSpec{
				Name:      store.StringOrEmpty(team.Name),
				Usernames: convertUserNames(users),
			},
			Status: akov2status.TeamStatus{
				Common: akov2status.Common{
					Conditions: []akov2status.Condition{},
				},
			},
		})
	}

	return teamsRefs, atlasTeamCRs, nil
}

func firstElementOrZeroValue[T any](collection []T) T {
	var item T

	if len(collection) > 0 {
		item = collection[0]
	}

	return item
}