ACL GETUSER Command Initial Implementation (#1038)

* ACL GETUSER Command Initial Implementation

* Add Tests and Docs

* Fix extra space on last line

* Restore Reply Documentation for Command

* Fix Arity of Command

---------

Co-authored-by: Kevin Bowersox <kbowersox@microsoft.com>
Co-authored-by: Badrish Chandramouli <badrishc@microsoft.com>

libs/resources/RespCommandsDocs.json

@@ -38,6 +38,22 @@
           }
         ]
       },
+      {
+        "Command": "ACL_GETUSER",
+        "Name": "ACL|GETUSER",
+        "Summary": "Returns the rules defined for an ACL user.",
+        "Group": "Server",
+        "Complexity": "O(1) amortized time considering the typical user.",
+        "Arguments": [
+          {
+            "TypeDiscriminator": "RespCommandBasicArgument",
+            "Name": "USERNAME",
+            "DisplayText": "username",
+            "Type": "String",
+            "ArgumentFlags": "Multiple"
+          }
+        ]
+      },
       {
         "Command": "ACL_LIST",
         "Name": "ACL|LIST",

libs/resources/RespCommandsInfo.json

@@ -23,6 +23,17 @@
           "response_policy:all_succeeded"
         ]
       },
+      {
+        "Command": "ACL_GETUSER",
+        "Name": "ACL|GETUSER",
+        "Arity": 3,
+        "Flags": "Admin, Loading, NoScript, Stale",
+        "AclCategories": "Admin, Dangerous, Slow",
+        "Tips": [
+          "request_policy:all_nodes",
+          "response_policy:all_succeeded"
+        ]
+      },
       {
         "Command": "ACL_LIST",
         "Name": "ACL|LIST",

libs/server/ACL/User.cs

@@ -3,6 +3,7 @@
 
 using System;
 using System.Collections.Generic;
+using System.Collections.Immutable;
 using System.Linq;
 using System.Runtime.CompilerServices;
 using System.Text;
@@ -31,6 +32,21 @@ public class User
         /// </summary>
         public bool IsPasswordless { get; set; }
 
+        /// <summary>
+        /// Returns a copy of the <see cref="User"/>s passwords.
+        /// </summary>
+        public ISet<ACLPassword> Passwords
+        {
+            get
+            {
+                lock (_passwordHashes)
+                {
+                    // Eventually replace with ReadOnlySet<T> in .NET 9
+                    return _passwordHashes.ToImmutableHashSet<ACLPassword>();
+                }
+            }
+        }
+
         /// <summary>
         /// Creates a new user with the given name
         /// </summary>
@@ -53,7 +69,7 @@ public User(User user)
             IsEnabled = user.IsEnabled;
             IsPasswordless = user.IsPasswordless;
             _enabledCommands = user._enabledCommands.Copy();
-            _passwordHashes = new HashSet<ACLPassword>(user._passwordHashes);
+            _passwordHashes = user.CopyPasswordHashes();
         }
 
         /// <summary>
@@ -431,6 +447,15 @@ public string DescribeUser()
             return stringBuilder.ToString();
         }
 
+        /// <summary>
+        /// Returns a <see cref="string"/> containing the enabled commands.
+        /// </summary>
+        /// <returns>A <see cref="string"/> containing the enabled commands.</returns>
+        public string GetEnabledCommandsDescription()
+        {
+            return _enabledCommands.Description;
+        }
+
         /// <summary>
         /// Determine the command / sub command pairs that are associated with this command information entries
         /// </summary>
@@ -496,6 +521,22 @@ private static string RationalizeACLDescription(CommandPermissionSet set, string
         internal CommandPermissionSet CopyCommandPermissionSet()
         => _enabledCommands.Copy();
 
+        /// <summary>
+        /// Returns a copy of the password hashes for the <see cref="User"/>.
+        /// </summary>
+        /// <returns>A <see cref="HashSet{T}"/> of <see cref="ACLPassword"/> representing password hashes for the user.</returns>
+        private HashSet<ACLPassword> CopyPasswordHashes()
+        {
+            HashSet<ACLPassword> passwordHashesCopy = null;
+
+            lock (_passwordHashes)
+            {
+                passwordHashesCopy = new HashSet<ACLPassword>(_passwordHashes);
+            }
+
+            return passwordHashesCopy;
+        }
+
         /// <summary>
         /// Commands enabled for the user
         /// </summary>

libs/server/ACL/UserHandle.cs

@@ -14,7 +14,7 @@ public class UserHandle
         /// <summary>
         /// The <see cref="User"/> referred to by the <see cref="UserHandle"/>.
         /// </summary>
-        public User user;
+        private User user;
 
         /// <summary>
         /// Constructor for a <see cref="UserHandle"/>.

libs/server/Resp/ACLCommands.cs

@@ -389,5 +389,88 @@ private bool NetworkAclSave()
 
             return true;
         }
+
+        /// <summary>
+        /// Processes ACL GETUSER subcommand.
+        /// </summary>
+        /// <returns>true if parsing succeeded correctly, false if not all tokens could be consumed and further processing is necessary.</returns>
+        private bool NetworkAclGetUser()
+        {
+            // The username must be provided.
+            if (parseState.Count != 1)
+            {
+                while (!RespWriteUtils.TryWriteError($"ERR Unknown subcommand or wrong number of arguments for ACL GETUSER.", ref dcurr, dend))
+                    SendAndReset();
+            }
+            else
+            {
+                if (!ValidateACLAuthenticator())
+                    return true;
+
+                var aclAuthenticator = (GarnetACLAuthenticator)_authenticator;
+                User user = null;
+
+                try
+                {
+                    var userHandle = aclAuthenticator
+                        .GetAccessControlList()
+                        .GetUserHandle(parseState.GetString(0));
+
+                    if (userHandle != null)
+                    {
+                        user = new User(userHandle.User);
+                    }
+                }
+                catch (ACLException exception)
+                {
+                    // Abort command execution
+                    while (!RespWriteUtils.TryWriteError($"ERR {exception.Message}", ref dcurr, dend))
+                        SendAndReset();
+
+                    return true;
+                }
+
+                if (user is null)
+                {
+                    while (!RespWriteUtils.TryWriteNull(ref dcurr, dend))
+                        SendAndReset();
+                }
+                else
+                {
+                    while (!RespWriteUtils.TryWriteArrayLength(6, ref dcurr, dend))
+                        SendAndReset();
+
+                    while (!RespWriteUtils.TryWriteAsciiBulkString("flags", ref dcurr, dend))
+                        SendAndReset();
+
+                    while (!RespWriteUtils.TryWriteArrayLength(1, ref dcurr, dend))
+                        SendAndReset();
+
+                    while (!RespWriteUtils.TryWriteAsciiBulkString(user.IsEnabled ? "on" : "off", ref dcurr, dend))
+                        SendAndReset();
+
+                    var passwords = user.Passwords;
+                    while (!RespWriteUtils.TryWriteAsciiBulkString("passwords", ref dcurr, dend))
+                        SendAndReset();
+
+                    while (!RespWriteUtils.TryWriteArrayLength(passwords.Count, ref dcurr, dend))
+                        SendAndReset();
+
+                    foreach (var password in passwords)
+                    {
+                        while (!RespWriteUtils.TryWriteAsciiBulkString($"#{password.ToString()}", ref dcurr, dend))
+                            SendAndReset();
+                    }
+
+                    while (!RespWriteUtils.TryWriteAsciiBulkString("commands", ref dcurr, dend))
+                        SendAndReset();
+
+                    while (!RespWriteUtils.TryWriteAsciiBulkString(user.GetEnabledCommandsDescription(), ref dcurr, dend))
+                        SendAndReset();
+                }
+            }
+
+            return true;
+        }
     }
 }

libs/server/Resp/AdminCommands.cs

@@ -61,6 +61,7 @@ RespCommand.MIGRATE or
                 RespCommand.HCOLLECT => NetworkHCOLLECT(ref storageApi),
                 RespCommand.MONITOR => NetworkMonitor(),
                 RespCommand.ACL_DELUSER => NetworkAclDelUser(),
+                RespCommand.ACL_GETUSER => NetworkAclGetUser(),
                 RespCommand.ACL_LIST => NetworkAclList(),
                 RespCommand.ACL_LOAD => NetworkAclLoad(),
                 RespCommand.ACL_SETUSER => NetworkAclSetUser(),

libs/server/Resp/CmdStrings.cs

@@ -328,6 +328,7 @@ static partial class CmdStrings
         public static ReadOnlySpan<byte> DELUSER => "DELUSER"u8;
         public static ReadOnlySpan<byte> EXISTS => "EXISTS"u8;
         public static ReadOnlySpan<byte> FLUSH => "FLUSH"u8;
+        public static ReadOnlySpan<byte> GETUSER => "GETUSER"u8;
         public static ReadOnlySpan<byte> LOAD => "LOAD"u8;
         public static ReadOnlySpan<byte> LOADCS => "LOADCS"u8;
         public static ReadOnlySpan<byte> SETUSER => "SETUSER"u8;

libs/server/Resp/Parser/RespCommand.cs

@@ -280,6 +280,7 @@ public enum RespCommand : ushort
         ACL,
         ACL_CAT,
         ACL_DELUSER,
+        ACL_GETUSER,
         ACL_LIST,
         ACL_LOAD,
         ACL_SAVE,
@@ -396,6 +397,7 @@ public static class RespCommandExtensions
             // ACL
             RespCommand.ACL_CAT,
             RespCommand.ACL_DELUSER,
+            RespCommand.ACL_GETUSER,
             RespCommand.ACL_LIST,
             RespCommand.ACL_LOAD,
             RespCommand.ACL_SAVE,
@@ -2317,6 +2319,10 @@ private RespCommand SlowParseCommand(ref int count, ref ReadOnlySpan<byte> speci
                 {
                     return RespCommand.ACL_DELUSER;
                 }
+                else if (subCommand.SequenceEqual(CmdStrings.GETUSER))
+                {
+                    return RespCommand.ACL_GETUSER;
+                }
                 else if (subCommand.SequenceEqual(CmdStrings.LIST))
                 {
                     return RespCommand.ACL_LIST;