fix: remove all selected tags when using dump

The expected behaviour for `deck dump` when using `--select-tag`
is the following:
1. selected tags information should be summarized at the top of
   the configuration file inside the `_info` structure
2. selected tags must be removed from entity-level tags

Right now decK doesn't perform (2) consistently, stripping out
selected tags from some entities, but not from some others.
For example:

```
$ deck dump --select-tag test-tag --yes

$ cat kong.yaml
_format_version: "3.0"
_info:
  defaults: {}
  select_tags:
  - test-tag
services:
- connect_timeout: 60000
  enabled: true
  host: mockbin.org
  name: svc1
  port: 80
  protocol: http
  read_timeout: 60000
  retries: 5
  routes:
  - https_redirect_status_code: 301
    name: r1
    path_handling: v0
    paths:
    - /r1
    preserve_host: false
    protocols:
    - http
    - https
    regex_priority: 0
    request_buffering: true
    response_buffering: true
    strip_path: true
    tags:
    - another-test-tag
  tags:
  - test-tag
  write_timeout: 60000
```

Here, `test-tag` is correctly stripped out from the route
entity, which now has only the `another-test-tag` tag, but the
`test-tag` is still included in the service entity.

This PR makes sure that selected tags are removed from all
entities, so that this information will only be included in the
`_info` structure.

file/writer.go

@@ -320,6 +320,7 @@ func fetchService(id string, kongState *state.KongState, config WriteConfig) (*F
 	})
 	utils.ZeroOutID(&s, s.Name, config.WithID)
 	utils.ZeroOutTimestamps(&s)
+	utils.MustRemoveTags(&s, config.SelectTags)
 	return &s, nil
 }
 
@@ -567,6 +568,7 @@ func populateConsumers(kongState *state.KongState, file *Content,
 		for _, k := range keyAuths {
 			utils.ZeroOutID(k, k.Key, config.WithID)
 			utils.ZeroOutTimestamps(k)
+			utils.MustRemoveTags(k, config.SelectTags)
 			k.Consumer = nil
 			c.KeyAuths = append(c.KeyAuths, &k.KeyAuth)
 		}
@@ -578,6 +580,7 @@ func populateConsumers(kongState *state.KongState, file *Content,
 			k.Consumer = nil
 			utils.ZeroOutID(k, k.Username, config.WithID)
 			utils.ZeroOutTimestamps(k)
+			utils.MustRemoveTags(k, config.SelectTags)
 			c.HMACAuths = append(c.HMACAuths, &k.HMACAuth)
 		}
 		jwtSecrets, err := kongState.JWTAuths.GetAllByConsumerID(*c.ID)
@@ -588,6 +591,7 @@ func populateConsumers(kongState *state.KongState, file *Content,
 			k.Consumer = nil
 			utils.ZeroOutID(k, k.Key, config.WithID)
 			utils.ZeroOutTimestamps(k)
+			utils.MustRemoveTags(k, config.SelectTags)
 			c.JWTAuths = append(c.JWTAuths, &k.JWTAuth)
 		}
 		basicAuths, err := kongState.BasicAuths.GetAllByConsumerID(*c.ID)
@@ -598,6 +602,7 @@ func populateConsumers(kongState *state.KongState, file *Content,
 			k.Consumer = nil
 			utils.ZeroOutID(k, k.Username, config.WithID)
 			utils.ZeroOutTimestamps(k)
+			utils.MustRemoveTags(k, config.SelectTags)
 			c.BasicAuths = append(c.BasicAuths, &k.BasicAuth)
 		}
 		oauth2Creds, err := kongState.Oauth2Creds.GetAllByConsumerID(*c.ID)
@@ -608,6 +613,7 @@ func populateConsumers(kongState *state.KongState, file *Content,
 			k.Consumer = nil
 			utils.ZeroOutID(k, k.ClientID, config.WithID)
 			utils.ZeroOutTimestamps(k)
+			utils.MustRemoveTags(k, config.SelectTags)
 			c.Oauth2Creds = append(c.Oauth2Creds, &k.Oauth2Credential)
 		}
 		aclGroups, err := kongState.ACLGroups.GetAllByConsumerID(*c.ID)
@@ -618,6 +624,7 @@ func populateConsumers(kongState *state.KongState, file *Content,
 			k.Consumer = nil
 			utils.ZeroOutID(k, k.Group, config.WithID)
 			utils.ZeroOutTimestamps(k)
+			utils.MustRemoveTags(k, config.SelectTags)
 			c.ACLGroups = append(c.ACLGroups, &k.ACLGroup)
 		}
 		mtlsAuths, err := kongState.MTLSAuths.GetAllByConsumerID(*c.ID)
@@ -626,6 +633,7 @@ func populateConsumers(kongState *state.KongState, file *Content,
 		}
 		for _, k := range mtlsAuths {
 			utils.ZeroOutTimestamps(k)
+			utils.MustRemoveTags(k, config.SelectTags)
 			k.Consumer = nil
 			c.MTLSAuths = append(c.MTLSAuths, &k.MTLSAuth)
 		}

tests/integration/dump_test.go

@@ -0,0 +1,44 @@
+//go:build integration
+
+package integration
+
+import (
+	"testing"
+
+	"github.com/kong/go-kong/kong"
+	"github.com/stretchr/testify/assert"
+)
+
+func Test_Dump_SelectTags(t *testing.T) {
+	tests := []struct {
+		name         string
+		stateFile    string
+		expectedFile string
+	}{
+		{
+			name:         "dump with select-tags",
+			stateFile:    "testdata/dump/001-entities-with-tags/kong.yaml",
+			expectedFile: "testdata/dump/001-entities-with-tags/expected.yaml",
+		},
+	}
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			kong.RunWhenKong(t, ">=3.0.0")
+			teardown := setup(t)
+			defer teardown(t)
+
+			assert.NoError(t, sync(tc.stateFile))
+
+			output, err := dump(
+				"--select-tag", "managed-by-deck",
+				"--select-tag", "org-unit-42",
+				"-o", "-",
+			)
+			assert.NoError(t, err)
+
+			expected, err := readFile(tc.expectedFile)
+			assert.NoError(t, err)
+			assert.Equal(t, output, expected)
+		})
+	}
+}

tests/integration/test_utils.go

@@ -3,13 +3,14 @@ package integration
 
 import (
 	"context"
+	"io/ioutil"
 	"os"
 	"testing"
 
 	"github.com/google/go-cmp/cmp"
 	"github.com/google/go-cmp/cmp/cmpopts"
 	"github.com/kong/deck/cmd"
-	"github.com/kong/deck/dump"
+	deckDump "github.com/kong/deck/dump"
 	"github.com/kong/deck/utils"
 	"github.com/kong/go-kong/kong"
 )
@@ -74,11 +75,11 @@ func testKongState(t *testing.T, client *kong.Client,
 ) {
 	// Get entities from Kong
 	ctx := context.Background()
-	dumpConfig := dump.Config{}
+	dumpConfig := deckDump.Config{}
 	if expectedState.RBACEndpointPermissions != nil {
 		dumpConfig.RBACResourcesOnly = true
 	}
-	kongState, err := dump.Get(ctx, client, dumpConfig)
+	kongState, err := deckDump.Get(ctx, client, dumpConfig)
 	if err != nil {
 		t.Errorf(err.Error())
 	}
@@ -119,6 +120,14 @@ func reset(t *testing.T, opts ...string) {
 	}
 }
 
+func readFile(filepath string) (string, error) {
+	content, err := ioutil.ReadFile(filepath)
+	if err != nil {
+		return "", err
+	}
+	return string(content), nil
+}
+
 func setup(t *testing.T) func(t *testing.T) {
 	// disable analytics for integration tests
 	os.Setenv("DECK_ANALYTICS", "off")
@@ -146,3 +155,25 @@ func diff(kongFile string, opts ...string) error {
 	deckCmd.SetArgs(args)
 	return deckCmd.ExecuteContext(context.Background())
 }
+
+func dump(opts ...string) (string, error) {
+	deckCmd := cmd.NewRootCmd()
+	args := []string{"dump"}
+	if len(opts) > 0 {
+		args = append(args, opts...)
+	}
+	deckCmd.SetArgs(args)
+
+	// capture command output to be used during tests
+	rescueStdout := os.Stdout
+	r, w, _ := os.Pipe()
+	os.Stdout = w
+
+	cmdErr := deckCmd.ExecuteContext(context.Background())
+
+	w.Close()
+	out, _ := ioutil.ReadAll(r)
+	os.Stdout = rescueStdout
+
+	return string(out), cmdErr
+}