def setUp(self): super(PolicyTypeControllerRBACTestCase, self).setUp() self.models = self.fixtures_loader.save_fixtures_to_db(fixtures_pack=FIXTURES_PACK, fixtures_dict=TEST_FIXTURES) file_name = 'fake_policy_type_1.yaml' PolicyTypeControllerRBACTestCase.POLICY_TYPE_1 = self.fixtures_loader.load_fixtures( fixtures_pack=FIXTURES_PACK, fixtures_dict={'policytypes': [file_name]})['policytypes'][file_name] file_name = 'fake_policy_type_2.yaml' PolicyTypeControllerRBACTestCase.POLICY_TYPE_2 = self.fixtures_loader.load_fixtures( fixtures_pack=FIXTURES_PACK, fixtures_dict={'policytypes': [file_name]})['policytypes'][file_name] # Insert mock users, roles and assignments # Users user_1_db = UserDB(name='policy_type_list') user_1_db = User.add_or_update(user_1_db) self.users['policy_type_list'] = user_1_db user_2_db = UserDB(name='policy_type_view') user_2_db = User.add_or_update(user_2_db) self.users['policy_type_view'] = user_2_db # Roles # policy_type_list grant_db = PermissionGrantDB(resource_uid=None, resource_type=ResourceType.POLICY_TYPE, permission_types=[PermissionType.POLICY_TYPE_LIST]) grant_db = PermissionGrant.add_or_update(grant_db) permission_grants = [str(grant_db.id)] role_1_db = RoleDB(name='policy_type_list', permission_grants=permission_grants) role_1_db = Role.add_or_update(role_1_db) self.roles['policy_type_list'] = role_1_db # policy_type_view on timer 1 policy_type_uid = self.models['policytypes']['fake_policy_type_1.yaml'].get_uid() grant_db = PermissionGrantDB(resource_uid=policy_type_uid, resource_type=ResourceType.POLICY_TYPE, permission_types=[PermissionType.POLICY_TYPE_VIEW]) grant_db = PermissionGrant.add_or_update(grant_db) permission_grants = [str(grant_db.id)] role_1_db = RoleDB(name='policy_type_view', permission_grants=permission_grants) role_1_db = Role.add_or_update(role_1_db) self.roles['policy_type_view'] = role_1_db # Role assignments role_assignment_db = UserRoleAssignmentDB( user=self.users['policy_type_list'].name, role=self.roles['policy_type_list'].name, source='assignments/%s.yaml' % self.users['policy_type_list'].name) UserRoleAssignment.add_or_update(role_assignment_db) role_assignment_db = UserRoleAssignmentDB( user=self.users['policy_type_view'].name, role=self.roles['policy_type_view'].name, source='assignments/%s.yaml' % self.users['policy_type_view'].name) UserRoleAssignment.add_or_update(role_assignment_db)
def setUp(self): super(ActionExecutionRBACControllerTestCase, self).setUp() self.fixtures_loader.save_fixtures_to_db(fixtures_pack=FIXTURES_PACK, fixtures_dict=TEST_FIXTURES) # Insert mock users, roles and assignments # Users user_1_db = UserDB(name='multiple_roles') user_1_db = User.add_or_update(user_1_db) self.users['multiple_roles'] = user_1_db # Roles roles = ['role_1', 'role_2', 'role_3'] for role in roles: role_db = RoleDB(name=role) Role.add_or_update(role_db) # Role assignments user_db = self.users['multiple_roles'] role_assignment_db = UserRoleAssignmentDB( user=user_db.name, role='admin', source='assignments/%s.yaml' % user_db.name) UserRoleAssignment.add_or_update(role_assignment_db) for role in roles: role_assignment_db = UserRoleAssignmentDB( user=user_db.name, role=role, source='assignments/%s.yaml' % user_db.name) UserRoleAssignment.add_or_update(role_assignment_db)
def setUp(self): super(TestRbacController, self).setUp() permissions = [ PermissionType.RULE_CREATE, PermissionType.RULE_VIEW, PermissionType.RULE_MODIFY, PermissionType.RULE_DELETE ] for name in permissions: user_db = UserDB(name=name) user_db = User.add_or_update(user_db) self.users[name] = user_db # Roles # action_create grant on parent pack grant_db = PermissionGrantDB(resource_uid='pack:examples', resource_type=ResourceType.PACK, permission_types=[name]) grant_db = PermissionGrant.add_or_update(grant_db) grant_2_db = PermissionGrantDB( resource_uid='action:wolfpack:action-1', resource_type=ResourceType.ACTION, permission_types=[PermissionType.ACTION_EXECUTE]) grant_2_db = PermissionGrant.add_or_update(grant_2_db) permission_grants = [str(grant_db.id), str(grant_2_db.id)] role_db = RoleDB(name=name, permission_grants=permission_grants) role_db = Role.add_or_update(role_db) self.roles[name] = role_db # Role assignments role_assignment_db = UserRoleAssignmentDB(user=user_db.name, role=role_db.name) UserRoleAssignment.add_or_update(role_assignment_db)
def setUp(self): super(RBACRoleAssignmentsControllerRBACTestCase, self).setUp() # Insert mock users, roles and assignments self.role_assignments = {} # Users user_1_db = UserDB(name='user_foo') user_1_db = User.add_or_update(user_1_db) self.users['user_foo'] = user_1_db # Roles role_1_db = RoleDB(name='user_foo', permission_grants=[]) role_1_db = Role.add_or_update(role_1_db) self.roles['user_foo'] = role_1_db # Role assignments role_assignment_db = UserRoleAssignmentDB( user=self.users['user_foo'].name, role=self.roles['user_foo'].name, source='assignments/%s.yaml' % self.users['user_foo'].name) UserRoleAssignment.add_or_update(role_assignment_db) self.role_assignments['assignment_one'] = role_assignment_db role_assignment_db = UserRoleAssignmentDB( user='******', role=self.roles['user_foo'].name, source='assignments/user_bar.yaml') UserRoleAssignment.add_or_update(role_assignment_db) self.role_assignments['assignment_two'] = role_assignment_db
def setUp(self): super(APIControllerWithRBACTestCase, self).setUp() self.users = {} self.roles = {} # Run RBAC migrations run_all_rbac_migrations() # Insert mock users with default role assignments role_names = [SystemRole.SYSTEM_ADMIN, SystemRole.ADMIN, SystemRole.OBSERVER] for role_name in role_names: user_db = UserDB(name=role_name) user_db = User.add_or_update(user_db) self.users[role_name] = user_db role_assignment_db = UserRoleAssignmentDB( user=user_db.name, role=role_name) UserRoleAssignment.add_or_update(role_assignment_db) # Insert a user with no permissions and role assignments user_1_db = UserDB(name='no_permissions') user_1_db = User.add_or_update(user_1_db) self.users['no_permissions'] = user_1_db
def setUp(self): super(ExecutionViewsFiltersControllerRBACTestCase, self).setUp() # Insert mock users, roles and assignments # Users user_1_db = UserDB(name='execution_views_filters_list') user_1_db = User.add_or_update(user_1_db) self.users['execution_views_filters_list'] = user_1_db # Roles # trace_list permission_types = [PermissionType.EXECUTION_VIEWS_FILTERS_LIST] grant_db = PermissionGrantDB(resource_uid=None, resource_type=ResourceType.EXECUTION, permission_types=permission_types) grant_db = PermissionGrant.add_or_update(grant_db) permission_grants = [str(grant_db.id)] role_1_db = RoleDB(name='execution_views_filters_list', permission_grants=permission_grants) role_1_db = Role.add_or_update(role_1_db) self.roles['execution_views_filters_list'] = role_1_db # Role assignments role_assignment_db = UserRoleAssignmentDB( user=self.users['execution_views_filters_list'].name, role=self.roles['execution_views_filters_list'].name, source='assignments/%s.yaml' % self.users['execution_views_filters_list'].name) UserRoleAssignment.add_or_update(role_assignment_db)
def setUp(self): super(BaseAPIControllerWithRBACTestCase, self).setUp() self.users = {} self.roles = {} # Run RBAC migrations run_all_rbac_migrations() # Insert mock users with default role assignments role_names = [ SystemRole.SYSTEM_ADMIN, SystemRole.ADMIN, SystemRole.OBSERVER ] for role_name in role_names: user_db = UserDB(name=role_name) user_db = User.add_or_update(user_db) self.users[role_name] = user_db role_assignment_db = UserRoleAssignmentDB( user=user_db.name, role=role_name, source='assignments/%s.yaml' % user_db.name) UserRoleAssignment.add_or_update(role_assignment_db) # Insert a user with no permissions and role assignments user_1_db = UserDB(name='no_permissions') user_1_db = User.add_or_update(user_1_db) self.users['no_permissions'] = user_1_db
def setUp(self): super(ActionControllerRBACTestCase, self).setUp() self.fixtures_loader.save_fixtures_to_db(fixtures_pack=FIXTURES_PACK, fixtures_dict=TEST_FIXTURES) file_name = 'action1.yaml' ActionControllerRBACTestCase.ACTION_1 = self.fixtures_loader.load_fixtures( fixtures_pack=FIXTURES_PACK, fixtures_dict={'actions': [file_name]})['actions'][file_name] # Insert mock users, roles and assignments # Users user_2_db = UserDB(name='action_create') user_2_db = User.add_or_update(user_2_db) self.users['action_create'] = user_2_db # Roles # action_create grant on parent pack grant_db = PermissionGrantDB(resource_uid='pack:examples', resource_type=ResourceType.PACK, permission_types=[PermissionType.ACTION_CREATE]) grant_db = PermissionGrant.add_or_update(grant_db) permission_grants = [str(grant_db.id)] role_1_db = RoleDB(name='action_create', permission_grants=permission_grants) role_1_db = Role.add_or_update(role_1_db) self.roles['action_create'] = role_1_db # Role assignments user_db = self.users['action_create'] role_assignment_db = UserRoleAssignmentDB( user=user_db.name, role=self.roles['action_create'].name) UserRoleAssignment.add_or_update(role_assignment_db)
def setUp(self): super(WebhookPermissionsResolverTestCase, self).setUp() # Create some mock users user_1_db = UserDB(name='custom_role_webhook_grant') user_1_db = User.add_or_update(user_1_db) self.users['custom_role_webhook_grant'] = user_1_db # Create some mock resources on which permissions can be granted webhook_1_db = WebhookDB(name='st2/') self.resources['webhook_1'] = webhook_1_db # Create some mock roles with associated permission grants # Custom role - "webhook_send" grant on webhook_1 grant_db = PermissionGrantDB(resource_uid=self.resources['webhook_1'].get_uid(), resource_type=ResourceType.WEBHOOK, permission_types=[PermissionType.WEBHOOK_SEND]) grant_db = PermissionGrant.add_or_update(grant_db) permission_grants = [str(grant_db.id)] role_db = RoleDB(name='custom_role_webhook_grant', permission_grants=permission_grants) role_db = Role.add_or_update(role_db) self.roles['custom_role_webhook_grant'] = role_db # Create some mock role assignments user_db = self.users['custom_role_webhook_grant'] role_assignment_db = UserRoleAssignmentDB( user=user_db.name, role=self.roles['custom_role_webhook_grant'].name, source='assignments/%s.yaml' % user_db.name) UserRoleAssignment.add_or_update(role_assignment_db)
def setUp(self): super(ActionControllerRBACTestCase, self).setUp() self.fixtures_loader.save_fixtures_to_db(fixtures_pack=FIXTURES_PACK, fixtures_dict=TEST_FIXTURES) file_name = 'action1.yaml' ActionControllerRBACTestCase.ACTION_1 = self.fixtures_loader.load_fixtures( fixtures_pack=FIXTURES_PACK, fixtures_dict={'actions': [file_name]})['actions'][file_name] # Insert mock users, roles and assignments # Users user_2_db = UserDB(name='action_create') user_2_db = User.add_or_update(user_2_db) self.users['action_create'] = user_2_db # Roles # action_create grant on parent pack grant_db = PermissionGrantDB( resource_uid='pack:examples', resource_type=ResourceType.PACK, permission_types=[PermissionType.ACTION_CREATE]) grant_db = PermissionGrant.add_or_update(grant_db) permission_grants = [str(grant_db.id)] role_1_db = RoleDB(name='action_create', permission_grants=permission_grants) role_1_db = Role.add_or_update(role_1_db) self.roles['action_create'] = role_1_db # Role assignments user_db = self.users['action_create'] role_assignment_db = UserRoleAssignmentDB( user=user_db.name, role=self.roles['action_create'].name) UserRoleAssignment.add_or_update(role_assignment_db)
def _sync_user_role_assignments(self, user_db, role_assignment_dbs, role_assignment_api): """ Synchronize role assignments for a particular user. :param user_db: User to synchronize the assignments for. :type user_db: :class:`UserDB` :param role_assignment_dbs: Existing user role assignments. :type role_assignment_dbs: ``list`` of :class:`UserRoleAssignmentDB` :param role_assignment_api: Role assignment API for a particular user. :param role_assignment_api: :class:`UserRoleAssignmentFileFormatAPI` :rtype: ``tuple`` """ db_role_names = [role_assignment_db.role for role_assignment_db in role_assignment_dbs] db_role_names = set(db_role_names) api_role_names = role_assignment_api.roles if role_assignment_api else [] api_role_names = set(api_role_names) # A list of new assignments which should be added to the database new_role_names = api_role_names.difference(db_role_names) # A list of assgignments which need to be updated in the database updated_role_names = db_role_names.intersection(api_role_names) # A list of assignments which should be removed from the database removed_role_names = db_role_names - api_role_names LOG.debug('New assignments for user "%s": %r' % (user_db.name, new_role_names)) LOG.debug('Updated assignments for user "%s": %r' % (user_db.name, updated_role_names)) LOG.debug('Removed assignments for user "%s": %r' % (user_db.name, removed_role_names)) # Build a list of role assignments to delete role_names_to_delete = updated_role_names.union(removed_role_names) role_assignment_dbs_to_delete = [ role_assignment_db for role_assignment_db in role_assignment_dbs if role_assignment_db.role in role_names_to_delete ] UserRoleAssignment.query(user=user_db.name, role__in=role_names_to_delete).delete() LOG.debug('Removed %s assignments for user "%s"' % (len(role_assignment_dbs_to_delete), user_db.name)) # Build a list of roles assignments to create role_names_to_create = new_role_names.union(updated_role_names) role_dbs_to_assign = Role.query(name__in=role_names_to_create) created_role_assignment_dbs = [] for role_db in role_dbs_to_assign: if role_db.name in role_assignment_api.roles: description = getattr(role_assignment_api, "description", None) else: description = None assignment_db = rbac_services.assign_role_to_user(role_db=role_db, user_db=user_db, description=description) created_role_assignment_dbs.append(assignment_db) LOG.debug('Created %s new assignments for user "%s"' % (len(role_dbs_to_assign), user_db.name)) return (created_role_assignment_dbs, role_assignment_dbs_to_delete)
def setUp(self): super(WebhookPermissionsResolverTestCase, self).setUp() # Create some mock users user_1_db = UserDB(name='custom_role_webhook_grant') user_1_db = User.add_or_update(user_1_db) self.users['custom_role_webhook_grant'] = user_1_db # Create some mock resources on which permissions can be granted webhook_1_db = WebhookDB(name='st2/') self.resources['webhook_1'] = webhook_1_db # Create some mock roles with associated permission grants # Custom role - "webhook_send" grant on webhook_1 grant_db = PermissionGrantDB( resource_uid=self.resources['webhook_1'].get_uid(), resource_type=ResourceType.WEBHOOK, permission_types=[PermissionType.WEBHOOK_SEND]) grant_db = PermissionGrant.add_or_update(grant_db) permission_grants = [str(grant_db.id)] role_db = RoleDB(name='custom_role_webhook_grant', permission_grants=permission_grants) role_db = Role.add_or_update(role_db) self.roles['custom_role_webhook_grant'] = role_db # Create some mock role assignments user_db = self.users['custom_role_webhook_grant'] role_assignment_db = UserRoleAssignmentDB( user=user_db.name, role=self.roles['custom_role_webhook_grant'].name) UserRoleAssignment.add_or_update(role_assignment_db)
def setUp(self): super(RunnerPermissionsResolverTestCase, self).setUp() # Create some mock users user_1_db = UserDB(name='custom_role_runner_view_grant') user_1_db = User.add_or_update(user_1_db) self.users['custom_role_runner_view_grant'] = user_1_db user_2_db = UserDB(name='custom_role_runner_modify_grant') user_2_db = User.add_or_update(user_2_db) self.users['custom_role_runner_modify_grant'] = user_2_db # Create some mock resources on which permissions can be granted runner_1_db = RunnerTypeDB(name='runner_1') self.resources['runner_1'] = runner_1_db runner_2_db = RunnerTypeDB(name='runner_2') self.resources['runner_2'] = runner_2_db # Create some mock roles with associated permission grants # Custom role - "runner_view" grant on runner_1 grant_db = PermissionGrantDB( resource_uid=self.resources['runner_1'].get_uid(), resource_type=ResourceType.RUNNER, permission_types=[PermissionType.RUNNER_VIEW]) grant_db = PermissionGrant.add_or_update(grant_db) permission_grants = [str(grant_db.id)] role_db = RoleDB(name='custom_role_runner_view_grant', permission_grants=permission_grants) role_db = Role.add_or_update(role_db) self.roles['custom_role_runner_view_grant'] = role_db # Custom role - "runner_modify" grant on runner_2 grant_db = PermissionGrantDB( resource_uid=self.resources['runner_2'].get_uid(), resource_type=ResourceType.RUNNER, permission_types=[PermissionType.RUNNER_MODIFY]) grant_db = PermissionGrant.add_or_update(grant_db) permission_grants = [str(grant_db.id)] role_db = RoleDB(name='custom_role_runner_modify_grant', permission_grants=permission_grants) role_db = Role.add_or_update(role_db) self.roles['custom_role_runner_modify_grant'] = role_db # Create some mock role assignments user_db = self.users['custom_role_runner_view_grant'] role_assignment_db = UserRoleAssignmentDB( user=user_db.name, role=self.roles['custom_role_runner_view_grant'].name, source='assignments/%s.yaml' % user_db.name) UserRoleAssignment.add_or_update(role_assignment_db) user_db = self.users['custom_role_runner_modify_grant'] role_assignment_db = UserRoleAssignmentDB( user=user_db.name, role=self.roles['custom_role_runner_modify_grant'].name, source='assignments/%s.yaml' % user_db.name) UserRoleAssignment.add_or_update(role_assignment_db)
def setUp(self): super(WebhookControllerRBACTestCase, self).setUp() # Insert mock users, roles and assignments # Users user_1_db = UserDB(name='webhook_list') user_1_db = User.add_or_update(user_1_db) self.users['webhook_list'] = user_1_db user_2_db = UserDB(name='webhook_view') user_2_db = User.add_or_update(user_2_db) self.users['webhook_view'] = user_2_db # Roles # webhook_list grant_db = PermissionGrantDB( resource_uid=None, resource_type=ResourceType.WEBHOOK, permission_types=[PermissionType.WEBHOOK_LIST]) grant_db = PermissionGrant.add_or_update(grant_db) permission_grants = [str(grant_db.id)] role_1_db = RoleDB(name='webhook_list', permission_grants=permission_grants) role_1_db = Role.add_or_update(role_1_db) self.roles['webhook_list'] = role_1_db # webhook_view on webhook 1 (git) name = 'git' webhook_db = WebhookDB(name=name) webhook_uid = webhook_db.get_uid() grant_db = PermissionGrantDB( resource_uid=webhook_uid, resource_type=ResourceType.WEBHOOK, permission_types=[PermissionType.WEBHOOK_VIEW]) grant_db = PermissionGrant.add_or_update(grant_db) permission_grants = [str(grant_db.id)] role_1_db = RoleDB(name='webhook_view', permission_grants=permission_grants) role_1_db = Role.add_or_update(role_1_db) self.roles['webhook_view'] = role_1_db # Role assignments role_assignment_db = UserRoleAssignmentDB( user=self.users['webhook_list'].name, role=self.roles['webhook_list'].name, source='assignments/%s.yaml' % self.users['webhook_list'].name) UserRoleAssignment.add_or_update(role_assignment_db) role_assignment_db = UserRoleAssignmentDB( user=self.users['webhook_view'].name, role=self.roles['webhook_view'].name, source='assignments/%s.yaml' % self.users['webhook_view'].name) UserRoleAssignment.add_or_update(role_assignment_db)
def setUp(self): super(RunnerPermissionsResolverTestCase, self).setUp() # Create some mock users user_1_db = UserDB(name='custom_role_runner_view_grant') user_1_db = User.add_or_update(user_1_db) self.users['custom_role_runner_view_grant'] = user_1_db user_2_db = UserDB(name='custom_role_runner_modify_grant') user_2_db = User.add_or_update(user_2_db) self.users['custom_role_runner_modify_grant'] = user_2_db # Create some mock resources on which permissions can be granted runner_1_db = RunnerTypeDB(name='runner_1') self.resources['runner_1'] = runner_1_db runner_2_db = RunnerTypeDB(name='runner_2') self.resources['runner_2'] = runner_2_db # Create some mock roles with associated permission grants # Custom role - "runner_view" grant on runner_1 grant_db = PermissionGrantDB(resource_uid=self.resources['runner_1'].get_uid(), resource_type=ResourceType.RUNNER, permission_types=[PermissionType.RUNNER_VIEW]) grant_db = PermissionGrant.add_or_update(grant_db) permission_grants = [str(grant_db.id)] role_db = RoleDB(name='custom_role_runner_view_grant', permission_grants=permission_grants) role_db = Role.add_or_update(role_db) self.roles['custom_role_runner_view_grant'] = role_db # Custom role - "runner_modify" grant on runner_2 grant_db = PermissionGrantDB(resource_uid=self.resources['runner_2'].get_uid(), resource_type=ResourceType.RUNNER, permission_types=[PermissionType.RUNNER_MODIFY]) grant_db = PermissionGrant.add_or_update(grant_db) permission_grants = [str(grant_db.id)] role_db = RoleDB(name='custom_role_runner_modify_grant', permission_grants=permission_grants) role_db = Role.add_or_update(role_db) self.roles['custom_role_runner_modify_grant'] = role_db # Create some mock role assignments user_db = self.users['custom_role_runner_view_grant'] role_assignment_db = UserRoleAssignmentDB( user=user_db.name, role=self.roles['custom_role_runner_view_grant'].name) UserRoleAssignment.add_or_update(role_assignment_db) user_db = self.users['custom_role_runner_modify_grant'] role_assignment_db = UserRoleAssignmentDB( user=user_db.name, role=self.roles['custom_role_runner_modify_grant'].name) UserRoleAssignment.add_or_update(role_assignment_db)
def assign_role_to_user( role_db, user_db, description=None, is_remote=False, source=None, ignore_already_exists_error=False, ): """ Assign role to a user. :param role_db: Role to assign. :type role_db: :class:`RoleDB` :param user_db: User to assign the role to. :type user_db: :class:`UserDB` :param description: Optional assingment description. :type description: ``str`` :param include_remote: True if this a remote assignment. :type include_remote: ``bool`` :param source: Source from where this assignment comes from. For example, path of a file if it's a local assignment or mapping or "API". :type source: ``str`` :param: ignore_already_exists_error: True to ignore error if an assignment already exists. :type ignore_already_exists_error: ``bool`` """ role_assignment_db = UserRoleAssignmentDB( user=user_db.name, role=role_db.name, source=source, description=description, is_remote=is_remote, ) try: role_assignment_db = UserRoleAssignment.add_or_update( role_assignment_db) except (NotUniqueError, StackStormDBObjectConflictError) as e: if not ignore_already_exists_error: raise e role_assignment_db = UserRoleAssignment.query( user=user_db.name, role=role_db.name, source=source, description=description).first() return role_assignment_db
def revoke_role_from_user(role_db, user_db): """ Revoke role from a user. :param role_db: Role to revoke. :type role_db: :class:`RoleDB` :param user_db: User to revoke the role from. :type user_db: :class:`UserDB` """ role_assignment_db = UserRoleAssignment.get(user=user_db.name, role=role_db.name) result = UserRoleAssignment.delete(role_assignment_db) return result
def setUp(self): super(WebhookControllerRBACTestCase, self).setUp() # Insert mock users, roles and assignments # Users user_1_db = UserDB(name='webhook_list') user_1_db = User.add_or_update(user_1_db) self.users['webhook_list'] = user_1_db user_2_db = UserDB(name='webhook_view') user_2_db = User.add_or_update(user_2_db) self.users['webhook_view'] = user_2_db # Roles # webhook_list grant_db = PermissionGrantDB(resource_uid=None, resource_type=ResourceType.WEBHOOK, permission_types=[PermissionType.WEBHOOK_LIST]) grant_db = PermissionGrant.add_or_update(grant_db) permission_grants = [str(grant_db.id)] role_1_db = RoleDB(name='webhook_list', permission_grants=permission_grants) role_1_db = Role.add_or_update(role_1_db) self.roles['webhook_list'] = role_1_db # webhook_view on webhook 1 (git) name = 'git' webhook_db = WebhookDB(name=name) webhook_uid = webhook_db.get_uid() grant_db = PermissionGrantDB(resource_uid=webhook_uid, resource_type=ResourceType.WEBHOOK, permission_types=[PermissionType.WEBHOOK_VIEW]) grant_db = PermissionGrant.add_or_update(grant_db) permission_grants = [str(grant_db.id)] role_1_db = RoleDB(name='webhook_view', permission_grants=permission_grants) role_1_db = Role.add_or_update(role_1_db) self.roles['webhook_view'] = role_1_db # Role assignments role_assignment_db = UserRoleAssignmentDB( user=self.users['webhook_list'].name, role=self.roles['webhook_list'].name, source='assignments/%s.yaml' % self.users['webhook_list'].name) UserRoleAssignment.add_or_update(role_assignment_db) role_assignment_db = UserRoleAssignmentDB( user=self.users['webhook_view'].name, role=self.roles['webhook_view'].name, source='assignments/%s.yaml' % self.users['webhook_view'].name) UserRoleAssignment.add_or_update(role_assignment_db)
def setUp(self): super(APIControllersRBACTestCase, self).setUp() # Register packs if self.register_packs: self._register_packs() # Insert mock objects - those objects are used to test get one, edit and delete operations self.models = self.fixtures_loader.save_fixtures_to_db( fixtures_pack=FIXTURES_PACK, fixtures_dict=TEST_FIXTURES) self.role_assignment_db_model = UserRoleAssignmentDB(user='******', role='role') UserRoleAssignment.add_or_update(self.role_assignment_db_model)
def revoke_role_from_user(role_db, user_db): """ Revoke role from a user. :param role_db: Role to revoke. :type role_db: :class:`RoleDB` :param user_db: User to revoke the role from. :type user_db: :class:`UserDB` """ role_assignment_dbs = UserRoleAssignment.query(user=user_db.name, role=role_db.name) for role_assignment_db in role_assignment_dbs: UserRoleAssignment.delete(role_assignment_db)
def setUp(self): super(APIControllersRBACTestCase, self).setUp() # Register packs if self.register_packs: self._register_packs() # Insert mock objects - those objects are used to test get one, edit and delete operations self.models = self.fixtures_loader.save_fixtures_to_db(fixtures_pack=FIXTURES_PACK, fixtures_dict=TEST_FIXTURES) self.role_assignment_db_model = UserRoleAssignmentDB( user='******', role='role', source='assignments/user.yaml') UserRoleAssignment.add_or_update(self.role_assignment_db_model)
def get_all_permission_grants_for_user(user_db, resource_uid=None, resource_types=None, permission_types=None): """ Retrieve all the permission grants for a particular user optionally filtering on: - Resource uid - Resource types - Permission types The result is a union of all the permission grants assigned to the roles which are assigned to the user. :rtype: ``list`` or :class:`PermissionGrantDB` """ role_names = UserRoleAssignment.query(user=user_db.name).only('role').scalar('role') permission_grant_ids = Role.query(name__in=role_names).scalar('permission_grants') permission_grant_ids = sum(permission_grant_ids, []) permission_grants_filters = {} permission_grants_filters['id__in'] = permission_grant_ids if resource_uid: permission_grants_filters['resource_uid'] = resource_uid if resource_types: permission_grants_filters['resource_type__in'] = resource_types if permission_types: permission_grants_filters['permission_types__in'] = permission_types permission_grant_dbs = PermissionGrant.query(**permission_grants_filters) return permission_grant_dbs
def get_all_permission_grants_for_user(user_db, resource_uid=None, resource_types=None, permission_types=None): """ Retrieve all the permission grants for a particular user optionally filtering on: - Resource uid - Resource types - Permission types The result is a union of all the permission grants assigned to the roles which are assigned to the user. :rtype: ``list`` or :class:`PermissionGrantDB` """ role_names = UserRoleAssignment.query(user=user_db.name).only("role").scalar("role") permission_grant_ids = Role.query(name__in=role_names).scalar("permission_grants") permission_grant_ids = sum(permission_grant_ids, []) permission_grants_filters = {} permission_grants_filters["id__in"] = permission_grant_ids if resource_uid: permission_grants_filters["resource_uid"] = resource_uid if resource_types: permission_grants_filters["resource_type__in"] = resource_types if permission_types: permission_grants_filters["permission_types__in"] = permission_types permission_grant_dbs = PermissionGrant.query(**permission_grants_filters) return permission_grant_dbs
def assign_role_to_user(role_db, user_db, description=None, is_remote=False, source=None): """ Assign role to a user. :param role_db: Role to assign. :type role_db: :class:`RoleDB` :param user_db: User to assign the role to. :type user_db: :class:`UserDB` :param description: Optional assingment description. :type description: ``str`` :param include_remote: True if this a remote assignment. :type include_remote: ``bool`` :param source: Source from where this assignment comes from. For example, path of a file if it's a local assignment or mapping or "API". :type source: ``str`` """ role_assignment_db = UserRoleAssignmentDB(user=user_db.name, role=role_db.name, source=source, description=description, is_remote=is_remote) role_assignment_db = UserRoleAssignment.add_or_update(role_assignment_db) return role_assignment_db
def get_roles_for_user(user_db, include_remote=True): """ Retrieve all the roles assigned to the provided user. :param user_db: User to retrieve the roles for. :type user_db: :class:`UserDB` :param include_remote: True to also include remote role assignments. :type include_remote: ``bool`` :rtype: ``list`` of :class:`RoleDB` """ if include_remote: queryset = UserRoleAssignment.query(user=user_db.name) else: # when upgrading from pre v2.3.0 when this field didn't exist yet # Note: We also include None for pre v2.3 when this field didn't exist yet queryset_filter = ( Q(user=user_db.name) & (Q(is_remote=False) | Q(is_remote__exists=False))) queryset = UserRoleAssignmentDB.objects(queryset_filter) role_names = queryset.only('role').scalar('role') result = Role.query(name__in=role_names) return result
def get_key_uids_for_user(user): role_names = UserRoleAssignment.query(user=user).only("role").scalar("role") permission_grant_ids = Role.query(name__in=role_names).scalar("permission_grants") permission_grant_ids = sum(permission_grant_ids, []) permission_grants_filters = {} permission_grants_filters["id__in"] = permission_grant_ids permission_grants_filters["resource_type"] = ResourceType.KEY_VALUE_PAIR return PermissionGrant.query(**permission_grants_filters).scalar("resource_uid")
def get_role_assignments_for_user(user_db, include_remote=True): """ Retrieve all the UserRoleAssignmentDB objects for a particular user. :param user_db: User to retrieve the role assignments for. :type user_db: :class:`UserDB` :param include_remote: True to also include remote role assignments. :type include_remote: ``bool`` :rtype: ``list`` of :class:`UserRoleAssignmentDB` """ if include_remote: result = UserRoleAssignment.query(user=user_db.name) else: result = UserRoleAssignment.query(user=user_db.name, is_remote=False) return result
def setUp(self): super(ActionViewsControllerRBACTestCase, self).setUp() self.models = self.fixtures_loader.save_fixtures_to_db( fixtures_pack=FIXTURES_PACK, fixtures_dict=TEST_FIXTURES) file_name = 'a1.yaml' ActionViewsControllerRBACTestCase.ACTION_1 = self.fixtures_loader.load_fixtures( fixtures_pack=FIXTURES_PACK, fixtures_dict={'actions': [file_name]})['actions'][file_name] file_name = 'a2.yaml' ActionViewsControllerRBACTestCase.ACTION_1 = self.fixtures_loader.load_fixtures( fixtures_pack=FIXTURES_PACK, fixtures_dict={'actions': [file_name]})['actions'][file_name] # Insert mock users, roles and assignments # Users user_2_db = UserDB(name='action_view_a1') user_2_db = User.add_or_update(user_2_db) self.users['action_view_a1'] = user_2_db # Roles # action_view on a1 action_uid = self.models['actions']['a1.yaml'].get_uid() grant_db = PermissionGrantDB( resource_uid=action_uid, resource_type=ResourceType.ACTION, permission_types=[PermissionType.ACTION_VIEW]) grant_db = PermissionGrant.add_or_update(grant_db) permission_grants = [str(grant_db.id)] role_1_db = RoleDB(name='action_view_a1', permission_grants=permission_grants) role_1_db = Role.add_or_update(role_1_db) self.roles['action_view_a1'] = role_1_db # Role assignments role_assignment_db = UserRoleAssignmentDB( user=self.users['action_view_a1'].name, role=self.roles['action_view_a1'].name, source='assignments/%s.yaml' % self.users['action_view_a1'].name) UserRoleAssignment.add_or_update(role_assignment_db)
def get_role_assignments_for_user(user_db): """ Retrieve all the UserRoleAssignmentDB objects for a particular user. :param user_db: User to retrieve the role assignments for. :type user_db: :class:`UserDB` :rtype: ``list`` of :class:`UserRoleAssignmentDB` """ result = UserRoleAssignment.query(user=user_db.name) return result
def get_roles_for_user(user_db, include_remote=True): """ Retrieve all the roles assigned to the provided user. :param user_db: User to retrieve the roles for. :type user_db: :class:`UserDB` :param include_remote: True to also include remote role assignments. :type include_remote: ``bool`` :rtype: ``list`` of :class:`RoleDB` """ if include_remote: queryset = UserRoleAssignment.query(user=user_db.name) else: queryset = UserRoleAssignment.query(user=user_db.name, is_remote=False) role_names = queryset.only('role').scalar('role') result = Role.query(name__in=role_names) return result
def setUp(self): super(ActionViewsControllerRBACTestCase, self).setUp() self.models = self.fixtures_loader.save_fixtures_to_db(fixtures_pack=FIXTURES_PACK, fixtures_dict=TEST_FIXTURES) file_name = 'a1.yaml' ActionViewsControllerRBACTestCase.ACTION_1 = self.fixtures_loader.load_fixtures( fixtures_pack=FIXTURES_PACK, fixtures_dict={'actions': [file_name]})['actions'][file_name] file_name = 'a2.yaml' ActionViewsControllerRBACTestCase.ACTION_1 = self.fixtures_loader.load_fixtures( fixtures_pack=FIXTURES_PACK, fixtures_dict={'actions': [file_name]})['actions'][file_name] # Insert mock users, roles and assignments # Users user_2_db = UserDB(name='action_view_a1') user_2_db = User.add_or_update(user_2_db) self.users['action_view_a1'] = user_2_db # Roles # action_view on a1 action_uid = self.models['actions']['a1.yaml'].get_uid() grant_db = PermissionGrantDB(resource_uid=action_uid, resource_type=ResourceType.ACTION, permission_types=[PermissionType.ACTION_VIEW]) grant_db = PermissionGrant.add_or_update(grant_db) permission_grants = [str(grant_db.id)] role_1_db = RoleDB(name='action_view_a1', permission_grants=permission_grants) role_1_db = Role.add_or_update(role_1_db) self.roles['action_view_a1'] = role_1_db # Role assignments role_assignment_db = UserRoleAssignmentDB( user=self.users['action_view_a1'].name, role=self.roles['action_view_a1'].name, source='assignments/%s.yaml' % self.users['action_view_a1'].name) UserRoleAssignment.add_or_update(role_assignment_db)
def setUp(self): super(RBACControllerTestCase, self).setUp() permissions = [PermissionType.RULE_CREATE, PermissionType.RULE_VIEW, PermissionType.RULE_MODIFY, PermissionType.RULE_DELETE] for name in permissions: user_db = UserDB(name=name) user_db = User.add_or_update(user_db) self.users[name] = user_db # Roles # action_create grant on parent pack grant_db = PermissionGrantDB(resource_uid='pack:examples', resource_type=ResourceType.PACK, permission_types=[name]) grant_db = PermissionGrant.add_or_update(grant_db) grant_2_db = PermissionGrantDB(resource_uid='action:wolfpack:action-1', resource_type=ResourceType.ACTION, permission_types=[PermissionType.ACTION_EXECUTE]) grant_2_db = PermissionGrant.add_or_update(grant_2_db) permission_grants = [str(grant_db.id), str(grant_2_db.id)] role_db = RoleDB(name=name, permission_grants=permission_grants) role_db = Role.add_or_update(role_db) self.roles[name] = role_db # Role assignments role_assignment_db = UserRoleAssignmentDB( user=user_db.name, role=role_db.name, source='assignments/%s.yaml' % user_db.name) UserRoleAssignment.add_or_update(role_assignment_db) role_assignment_db = UserRoleAssignmentDB( user='******', role='role_two', source='assignments/user_two.yaml', is_remote=True) UserRoleAssignment.add_or_update(role_assignment_db)
def get_roles_for_user(user_db): """ Retrieve all the roles assigned to the provided user. :param user_db: User to retrieve the roles for. :type user_db: :class:`UserDB` :rtype: ``list`` of :class:`RoleDB` """ role_names = UserRoleAssignment.query(user=user_db.name).only("role").scalar("role") result = Role.query(name__in=role_names) return result
def _insert_common_mock_role_assignments(self): # Insert common mock role assignments role_assignment_admin = UserRoleAssignmentDB( user=self.users['admin'].name, role=self.roles['admin_role'].name, source='assignments/admin.yaml') role_assignment_admin = UserRoleAssignment.add_or_update( role_assignment_admin) role_assignment_observer = UserRoleAssignmentDB( user=self.users['observer'].name, role=self.roles['observer_role'].name, source='assignments/observer.yaml') role_assignment_observer = UserRoleAssignment.add_or_update( role_assignment_observer) user_db = self.users['1_custom_role_no_permissions'] role_assignment_db = UserRoleAssignmentDB( user=user_db.name, role=self.roles['custom_role_1'].name, source='assignments/%s.yaml' % user_db.name) UserRoleAssignment.add_or_update(role_assignment_db) user_db = self.users['custom_role_pack_grant'] role_assignment_db = UserRoleAssignmentDB( user=user_db.name, role=self.roles['custom_role_pack_grant'].name, source='assignments/%s.yaml' % user_db.name) UserRoleAssignment.add_or_update(role_assignment_db)
def _insert_common_mock_role_assignments(self): # Insert common mock role assignments role_assignment_admin = UserRoleAssignmentDB( user=self.users['admin'].name, role=self.roles['admin_role'].name, source='assignments/admin.yaml') role_assignment_admin = UserRoleAssignment.add_or_update(role_assignment_admin) role_assignment_observer = UserRoleAssignmentDB( user=self.users['observer'].name, role=self.roles['observer_role'].name, source='assignments/observer.yaml') role_assignment_observer = UserRoleAssignment.add_or_update(role_assignment_observer) user_db = self.users['1_custom_role_no_permissions'] role_assignment_db = UserRoleAssignmentDB( user=user_db.name, role=self.roles['custom_role_1'].name, source='assignments/%s.yaml' % user_db.name) UserRoleAssignment.add_or_update(role_assignment_db) user_db = self.users['custom_role_pack_grant'] role_assignment_db = UserRoleAssignmentDB( user=user_db.name, role=self.roles['custom_role_pack_grant'].name, source='assignments/%s.yaml' % user_db.name) UserRoleAssignment.add_or_update(role_assignment_db)
def assign_role_to_user(role_db, user_db): """ Assign role to a user. :param role_db: Role to assign. :type role_db: :class:`RoleDB` :param user_db: User to assign the role to. :type user_db: :class:`UserDB` """ role_assignment_db = UserRoleAssignmentDB(user=user_db.name, role=role_db.name) role_assignment_db = UserRoleAssignment.add_or_update(role_assignment_db) return role_assignment_db
def get_roles_for_user(user_db): """ Retrieve all the roles assigned to the provided user. :param user_db: User to retrieve the roles for. :type user_db: :class:`UserDB` :rtype: ``list`` of :class:`RoleDB` """ role_names = UserRoleAssignment.query( user=user_db.name).only('role').scalar('role') result = Role.query(name__in=role_names) return result
def assign_role_to_user(role_db, user_db, description=None, is_remote=False, source=None, ignore_already_exists_error=False): """ Assign role to a user. :param role_db: Role to assign. :type role_db: :class:`RoleDB` :param user_db: User to assign the role to. :type user_db: :class:`UserDB` :param description: Optional assingment description. :type description: ``str`` :param include_remote: True if this a remote assignment. :type include_remote: ``bool`` :param source: Source from where this assignment comes from. For example, path of a file if it's a local assignment or mapping or "API". :type source: ``str`` :param: ignore_already_exists_error: True to ignore error if an assignment already exists. :type ignore_already_exists_error: ``bool`` """ role_assignment_db = UserRoleAssignmentDB(user=user_db.name, role=role_db.name, source=source, description=description, is_remote=is_remote) try: role_assignment_db = UserRoleAssignment.add_or_update(role_assignment_db) except (NotUniqueError, StackStormDBObjectConflictError) as e: if not ignore_already_exists_error: raise e role_assignment_db = UserRoleAssignment.query(user=user_db.name, role=role_db.name, source=source, description=description).first() return role_assignment_db
def assign_role_to_user(role_db, user_db, description=None): """ Assign role to a user. :param role_db: Role to assign. :type role_db: :class:`RoleDB` :param user_db: User to assign the role to. :type user_db: :class:`UserDB` :param description: Optional assingment description. :type description: ``str`` """ role_assignment_db = UserRoleAssignmentDB(user=user_db.name, role=role_db.name, description=description) role_assignment_db = UserRoleAssignment.add_or_update(role_assignment_db) return role_assignment_db
def get_all_role_assignments(include_remote=True): """ Retrieve all the UserRoleAssignmentDB objects. :param include_remote: True to also include remote role assignments. :type include_remote: ``bool`` :rtype: ``list`` of :class:`UserRoleAssignmentDB` """ if include_remote: result = UserRoleAssignment.query() else: # Note: We also include documents with no "is_remote" field so it also works correctly # when upgrading from pre v2.3.0 when this field didn't exist yet queryset_filter = (Q(is_remote=False) | Q(is_remote__exists=False)) result = UserRoleAssignmentDB.objects(queryset_filter) return result
def setUp(self): super(RBACServicesTestCase, self).setUp() # TODO: Share mocks self.users = {} self.roles = {} self.resources = {} # Create some mock users user_1_db = UserDB(name='admin') user_1_db = User.add_or_update(user_1_db) self.users['admin'] = user_1_db user_2_db = UserDB(name='observer') user_2_db = User.add_or_update(user_2_db) self.users['observer'] = user_2_db user_3_db = UserDB(name='no_roles') user_3_db = User.add_or_update(user_3_db) self.users['no_roles'] = user_3_db user_4_db = UserDB(name='custom_role') user_4_db = User.add_or_update(user_4_db) self.users['1_custom_role'] = user_4_db # Create some mock roles role_1_db = rbac_services.create_role(name='custom_role_1') role_2_db = rbac_services.create_role(name='custom_role_2', description='custom role 2') self.roles['custom_role_1'] = role_1_db self.roles['custom_role_2'] = role_2_db # Create some mock role assignments role_assignment_1 = UserRoleAssignmentDB( user=self.users['1_custom_role'].name, role=self.roles['custom_role_1'].name) role_assignment_1 = UserRoleAssignment.add_or_update(role_assignment_1) # Create some mock resources on which permissions can be granted rule_1_db = RuleDB(pack='test1', name='rule1', ref='test1.rule1') rule_1_db = Rule.add_or_update(rule_1_db) self.resources['rule_1'] = rule_1_db
def setUp(self): super(RBACServicesTestCase, self).setUp() # TODO: Share mocks self.users = {} self.roles = {} self.resources = {} # Create some mock users user_1_db = UserDB(name='admin') user_1_db = User.add_or_update(user_1_db) self.users['admin'] = user_1_db user_2_db = UserDB(name='observer') user_2_db = User.add_or_update(user_2_db) self.users['observer'] = user_2_db user_3_db = UserDB(name='no_roles') user_3_db = User.add_or_update(user_3_db) self.users['no_roles'] = user_3_db user_4_db = UserDB(name='custom_role') user_4_db = User.add_or_update(user_4_db) self.users['1_custom_role'] = user_4_db # Create some mock roles role_1_db = rbac_services.create_role(name='custom_role_1') role_2_db = rbac_services.create_role(name='custom_role_2', description='custom role 2') self.roles['custom_role_1'] = role_1_db self.roles['custom_role_2'] = role_2_db # Create some mock role assignments role_assignment_1 = UserRoleAssignmentDB(user=self.users['1_custom_role'].name, role=self.roles['custom_role_1'].name) role_assignment_1 = UserRoleAssignment.add_or_update(role_assignment_1) # Create some mock resources on which permissions can be granted rule_1_db = RuleDB(pack='test1', name='rule1', ref='test1.rule1') rule_1_db = Rule.add_or_update(rule_1_db) self.resources['rule_1'] = rule_1_db
def assign_role_to_user(role_db, user_db, description=None, is_remote=False): """ Assign role to a user. :param role_db: Role to assign. :type role_db: :class:`RoleDB` :param user_db: User to assign the role to. :type user_db: :class:`UserDB` :param description: Optional assingment description. :type description: ``str`` :param include_remote: True if this a remote assignment. :type include_remote: ``bool`` """ role_assignment_db = UserRoleAssignmentDB(user=user_db.name, role=role_db.name, description=description, is_remote=is_remote) role_assignment_db = UserRoleAssignment.add_or_update(role_assignment_db) return role_assignment_db
def _insert_common_mock_role_assignments(self): # Insert common mock role assignments role_assignment_admin = UserRoleAssignmentDB(user=self.users["admin"].name, role=self.roles["admin_role"].name) role_assignment_admin = UserRoleAssignment.add_or_update(role_assignment_admin) role_assignment_observer = UserRoleAssignmentDB( user=self.users["observer"].name, role=self.roles["observer_role"].name ) role_assignment_observer = UserRoleAssignment.add_or_update(role_assignment_observer) user_db = self.users["1_custom_role_no_permissions"] role_assignment_db = UserRoleAssignmentDB(user=user_db.name, role=self.roles["custom_role_1"].name) UserRoleAssignment.add_or_update(role_assignment_db) user_db = self.users["custom_role_pack_grant"] role_assignment_db = UserRoleAssignmentDB(user=user_db.name, role=self.roles["custom_role_pack_grant"].name) UserRoleAssignment.add_or_update(role_assignment_db)
def get_role_assignments_for_user(user_db, include_remote=True): """ Retrieve all the UserRoleAssignmentDB objects for a particular user. :param user_db: User to retrieve the role assignments for. :type user_db: :class:`UserDB` :param include_remote: True to also include remote role assignments. :type include_remote: ``bool`` :rtype: ``list`` of :class:`UserRoleAssignmentDB` """ if include_remote: result = UserRoleAssignment.query(user=user_db.name) else: # Note: We also include documents with no "is_remote" field so it also works correctly # when upgrading from pre v2.3.0 when this field didn't exist yet queryset_filter = (Q(user=user_db.name) & (Q(is_remote=False) | Q(is_remote__exists=False))) result = UserRoleAssignmentDB.objects(queryset_filter) return result
def get_roles_for_user(user_db, include_remote=True): """ Retrieve all the roles assigned to the provided user. :param user_db: User to retrieve the roles for. :type user_db: :class:`UserDB` :param include_remote: True to also include remote role assignments. :type include_remote: ``bool`` :rtype: ``list`` of :class:`RoleDB` """ if include_remote: queryset = UserRoleAssignment.query(user=user_db.name) else: # when upgrading from pre v2.3.0 when this field didn't exist yet # Note: We also include None for pre v2.3 when this field didn't exist yet queryset_filter = (Q(user=user_db.name) & (Q(is_remote=False) | Q(is_remote__exists=False))) queryset = UserRoleAssignmentDB.objects(queryset_filter) role_names = queryset.only('role').scalar('role') result = Role.query(name__in=role_names) return result
def sync(self, user_db, groups): """ :param user_db: User to sync the assignments for. :type user: :class:`UserDB` :param groups: A list of remote groups user is a member of. :type groups: ``list`` of ``str`` :return: A list of mappings which have been created. :rtype: ``list`` of :class:`UserRoleAssignmentDB` """ groups = list(set(groups)) extra = {'user_db': user_db, 'groups': groups} LOG.info('Synchronizing remote role assignments for user "%s"' % (str(user_db)), extra=extra) # 1. Retrieve group to role mappings for the provided groups all_mapping_dbs = GroupToRoleMapping.query(group__in=groups) enabled_mapping_dbs = [ mapping_db for mapping_db in all_mapping_dbs if mapping_db.enabled ] disabled_mapping_dbs = [ mapping_db for mapping_db in all_mapping_dbs if not mapping_db.enabled ] if not all_mapping_dbs: LOG.debug('No group to role mappings found for user "%s"' % (str(user_db)), extra=extra) # 2. Remove all the existing remote role assignments remote_assignment_dbs = UserRoleAssignment.query(user=user_db.name, is_remote=True) existing_role_names = [ assignment_db.role for assignment_db in remote_assignment_dbs ] existing_role_names = set(existing_role_names) current_role_names = set([]) for mapping_db in all_mapping_dbs: for role in mapping_db.roles: current_role_names.add(role) # A list of new role assignments which should be added to the database new_role_names = current_role_names.difference(existing_role_names) # A list of role assignments which need to be updated in the database updated_role_names = existing_role_names.intersection( current_role_names) # A list of role assignments which should be removed from the database removed_role_names = (existing_role_names - new_role_names) # Also remove any assignments for mappings which are disabled in the database for mapping_db in disabled_mapping_dbs: for role in mapping_db.roles: removed_role_names.add(role) LOG.debug('New role assignments: %r' % (new_role_names)) LOG.debug('Updated role assignments: %r' % (updated_role_names)) LOG.debug('Removed role assignments: %r' % (removed_role_names)) # Build a list of role assignments to delete role_names_to_delete = updated_role_names.union(removed_role_names) role_assignment_dbs_to_delete = [ role_assignment_db for role_assignment_db in remote_assignment_dbs if role_assignment_db.role in role_names_to_delete ] UserRoleAssignment.query(user=user_db.name, role__in=role_names_to_delete, is_remote=True).delete() # 3. Create role assignments for all the current groups created_assignments_dbs = [] for mapping_db in enabled_mapping_dbs: extra['mapping_db'] = mapping_db for role_name in mapping_db.roles: role_db = rbac_services.get_role_by_name(name=role_name) if not role_db: # Gracefully skip assignment for role which doesn't exist in the db LOG.info( 'Role with name "%s" for mapping "%s" not found, skipping assignment.' % (role_name, str(mapping_db)), extra=extra) continue description = ( 'Automatic role assignment based on the remote user membership in ' 'group "%s"' % (mapping_db.group)) assignment_db = rbac_services.assign_role_to_user( role_db=role_db, user_db=user_db, description=description, is_remote=True, source=mapping_db.source, ignore_already_exists_error=True) assert assignment_db.is_remote is True created_assignments_dbs.append(assignment_db) LOG.debug('Created %s new remote role assignments for user "%s"' % (len(created_assignments_dbs), str(user_db)), extra=extra) return (created_assignments_dbs, role_assignment_dbs_to_delete)
def setUp(self): super(RulePermissionsResolverTestCase, self).setUp() # Create some mock users user_1_db = UserDB(name='1_role_rule_pack_grant') user_1_db = User.add_or_update(user_1_db) self.users['custom_role_rule_pack_grant'] = user_1_db user_2_db = UserDB(name='1_role_rule_grant') user_2_db = User.add_or_update(user_2_db) self.users['custom_role_rule_grant'] = user_2_db user_3_db = UserDB(name='custom_role_pack_rule_all_grant') user_3_db = User.add_or_update(user_3_db) self.users['custom_role_pack_rule_all_grant'] = user_3_db user_4_db = UserDB(name='custom_role_rule_all_grant') user_4_db = User.add_or_update(user_4_db) self.users['custom_role_rule_all_grant'] = user_4_db user_5_db = UserDB(name='custom_role_rule_modify_grant') user_5_db = User.add_or_update(user_5_db) self.users['custom_role_rule_modify_grant'] = user_5_db # Create some mock resources on which permissions can be granted rule_1_db = RuleDB(pack='test_pack_1', name='rule1') rule_1_db = Rule.add_or_update(rule_1_db) self.resources['rule_1'] = rule_1_db rule_2_db = RuleDB(pack='test_pack_1', name='rule2') rule_2_db = Rule.add_or_update(rule_2_db) self.resources['rule_2'] = rule_2_db rule_3_db = RuleDB(pack='test_pack_2', name='rule3') rule_3_db = Rule.add_or_update(rule_3_db) self.resources['rule_3'] = rule_3_db # Create some mock roles with associated permission grants # Custom role 2 - one grant on parent pack # "rule_view" on pack_1 grant_db = PermissionGrantDB(resource_uid=self.resources['pack_1'].get_uid(), resource_type=ResourceType.PACK, permission_types=[PermissionType.RULE_VIEW]) grant_db = PermissionGrant.add_or_update(grant_db) permission_grants = [str(grant_db.id)] role_3_db = RoleDB(name='custom_role_rule_pack_grant', permission_grants=permission_grants) role_3_db = Role.add_or_update(role_3_db) self.roles['custom_role_rule_pack_grant'] = role_3_db # Custom role 4 - one grant on rule # "rule_view on rule_3 grant_db = PermissionGrantDB(resource_uid=self.resources['rule_3'].get_uid(), resource_type=ResourceType.RULE, permission_types=[PermissionType.RULE_VIEW]) grant_db = PermissionGrant.add_or_update(grant_db) permission_grants = [str(grant_db.id)] role_4_db = RoleDB(name='custom_role_rule_grant', permission_grants=permission_grants) role_4_db = Role.add_or_update(role_4_db) self.roles['custom_role_rule_grant'] = role_4_db # Custom role - "rule_all" grant on a parent rule pack grant_db = PermissionGrantDB(resource_uid=self.resources['pack_1'].get_uid(), resource_type=ResourceType.PACK, permission_types=[PermissionType.RULE_ALL]) grant_db = PermissionGrant.add_or_update(grant_db) permission_grants = [str(grant_db.id)] role_4_db = RoleDB(name='custom_role_pack_rule_all_grant', permission_grants=permission_grants) role_4_db = Role.add_or_update(role_4_db) self.roles['custom_role_pack_rule_all_grant'] = role_4_db # Custom role - "rule_all" grant on a rule grant_db = PermissionGrantDB(resource_uid=self.resources['rule_1'].get_uid(), resource_type=ResourceType.RULE, permission_types=[PermissionType.RULE_ALL]) grant_db = PermissionGrant.add_or_update(grant_db) permission_grants = [str(grant_db.id)] role_4_db = RoleDB(name='custom_role_rule_all_grant', permission_grants=permission_grants) role_4_db = Role.add_or_update(role_4_db) self.roles['custom_role_rule_all_grant'] = role_4_db # Custom role - "rule_modify" on role_1 grant_db = PermissionGrantDB(resource_uid=self.resources['rule_1'].get_uid(), resource_type=ResourceType.RULE, permission_types=[PermissionType.RULE_MODIFY]) grant_db = PermissionGrant.add_or_update(grant_db) permission_grants = [str(grant_db.id)] role_5_db = RoleDB(name='custom_role_rule_modify_grant', permission_grants=permission_grants) role_5_db = Role.add_or_update(role_5_db) self.roles['custom_role_rule_modify_grant'] = role_5_db # Create some mock role assignments user_db = self.users['custom_role_rule_pack_grant'] role_assignment_db = UserRoleAssignmentDB( user=user_db.name, role=self.roles['custom_role_rule_pack_grant'].name) UserRoleAssignment.add_or_update(role_assignment_db) user_db = self.users['custom_role_rule_grant'] role_assignment_db = UserRoleAssignmentDB(user=user_db.name, role=self.roles['custom_role_rule_grant'].name) UserRoleAssignment.add_or_update(role_assignment_db) user_db = self.users['custom_role_pack_rule_all_grant'] role_assignment_db = UserRoleAssignmentDB( user=user_db.name, role=self.roles['custom_role_pack_rule_all_grant'].name) UserRoleAssignment.add_or_update(role_assignment_db) user_db = self.users['custom_role_rule_all_grant'] role_assignment_db = UserRoleAssignmentDB( user=user_db.name, role=self.roles['custom_role_rule_all_grant'].name) UserRoleAssignment.add_or_update(role_assignment_db) user_db = self.users['custom_role_rule_modify_grant'] role_assignment_db = UserRoleAssignmentDB( user=user_db.name, role=self.roles['custom_role_rule_modify_grant'].name) UserRoleAssignment.add_or_update(role_assignment_db)
def setUp(self): super(ActionPermissionsResolverTestCase, self).setUp() # Create some mock users user_1_db = UserDB(name='1_role_action_pack_grant') user_1_db = User.add_or_update(user_1_db) self.users['custom_role_action_pack_grant'] = user_1_db user_2_db = UserDB(name='1_role_action_grant') user_2_db = User.add_or_update(user_2_db) self.users['custom_role_action_grant'] = user_2_db user_3_db = UserDB(name='custom_role_pack_action_all_grant') user_3_db = User.add_or_update(user_3_db) self.users['custom_role_pack_action_all_grant'] = user_3_db user_4_db = UserDB(name='custom_role_action_all_grant') user_4_db = User.add_or_update(user_4_db) self.users['custom_role_action_all_grant'] = user_4_db user_5_db = UserDB(name='custom_role_action_execute_grant') user_5_db = User.add_or_update(user_5_db) self.users['custom_role_action_execute_grant'] = user_5_db user_6_db = UserDB(name='action_pack_action_create_grant') user_6_db = User.add_or_update(user_6_db) self.users['action_pack_action_create_grant'] = user_6_db user_7_db = UserDB(name='action_pack_action_all_grant') user_7_db = User.add_or_update(user_7_db) self.users['action_pack_action_all_grant'] = user_7_db user_8_db = UserDB(name='action_action_create_grant') user_8_db = User.add_or_update(user_8_db) self.users['action_action_create_grant'] = user_8_db user_9_db = UserDB(name='action_action_all_grant') user_9_db = User.add_or_update(user_9_db) self.users['action_action_all_grant'] = user_9_db user_10_db = UserDB(name='custom_role_action_list_grant') user_10_db = User.add_or_update(user_10_db) self.users['custom_role_action_list_grant'] = user_10_db # Create some mock resources on which permissions can be granted action_1_db = ActionDB(pack='test_pack_1', name='action1', entry_point='', runner_type={'name': 'run-local'}) action_1_db = Action.add_or_update(action_1_db) self.resources['action_1'] = action_1_db action_2_db = ActionDB(pack='test_pack_1', name='action2', entry_point='', runner_type={'name': 'run-local'}) action_2_db = Action.add_or_update(action_1_db) self.resources['action_2'] = action_2_db action_3_db = ActionDB(pack='test_pack_2', name='action3', entry_point='', runner_type={'name': 'run-local'}) action_3_db = Action.add_or_update(action_3_db) self.resources['action_3'] = action_3_db # Create some mock roles with associated permission grants # Custom role 2 - one grant on parent pack # "action_view" on pack_1 grant_db = PermissionGrantDB(resource_uid=self.resources['pack_1'].get_uid(), resource_type=ResourceType.PACK, permission_types=[PermissionType.ACTION_VIEW]) grant_db = PermissionGrant.add_or_update(grant_db) permission_grants = [str(grant_db.id)] role_3_db = RoleDB(name='custom_role_action_pack_grant', permission_grants=permission_grants) role_3_db = Role.add_or_update(role_3_db) self.roles['custom_role_action_pack_grant'] = role_3_db # Custom role 4 - one grant on action # "action_view" on action_3 grant_db = PermissionGrantDB(resource_uid=self.resources['action_3'].get_uid(), resource_type=ResourceType.ACTION, permission_types=[PermissionType.ACTION_VIEW]) grant_db = PermissionGrant.add_or_update(grant_db) permission_grants = [str(grant_db.id)] role_4_db = RoleDB(name='custom_role_action_grant', permission_grants=permission_grants) role_4_db = Role.add_or_update(role_4_db) self.roles['custom_role_action_grant'] = role_4_db # Custom role - "action_all" grant on a parent action pack grant_db = PermissionGrantDB(resource_uid=self.resources['pack_1'].get_uid(), resource_type=ResourceType.PACK, permission_types=[PermissionType.ACTION_ALL]) grant_db = PermissionGrant.add_or_update(grant_db) permission_grants = [str(grant_db.id)] role_4_db = RoleDB(name='custom_role_pack_action_all_grant', permission_grants=permission_grants) role_4_db = Role.add_or_update(role_4_db) self.roles['custom_role_pack_action_all_grant'] = role_4_db # Custom role - "action_all" grant on action grant_db = PermissionGrantDB(resource_uid=self.resources['action_1'].get_uid(), resource_type=ResourceType.ACTION, permission_types=[PermissionType.ACTION_ALL]) grant_db = PermissionGrant.add_or_update(grant_db) permission_grants = [str(grant_db.id)] role_4_db = RoleDB(name='custom_role_action_all_grant', permission_grants=permission_grants) role_4_db = Role.add_or_update(role_4_db) self.roles['custom_role_action_all_grant'] = role_4_db # Custom role - "action_execute" on action_1 grant_db = PermissionGrantDB(resource_uid=self.resources['action_1'].get_uid(), resource_type=ResourceType.ACTION, permission_types=[PermissionType.ACTION_EXECUTE]) grant_db = PermissionGrant.add_or_update(grant_db) permission_grants = [str(grant_db.id)] role_5_db = RoleDB(name='custom_role_action_execute_grant', permission_grants=permission_grants) role_5_db = Role.add_or_update(role_5_db) self.roles['custom_role_action_execute_grant'] = role_5_db # Custom role - "action_create" grant on pack_1 grant_db = PermissionGrantDB(resource_uid=self.resources['pack_1'].get_uid(), resource_type=ResourceType.PACK, permission_types=[PermissionType.ACTION_CREATE]) grant_db = PermissionGrant.add_or_update(grant_db) permission_grants = [str(grant_db.id)] role_6_db = RoleDB(name='action_pack_action_create_grant', permission_grants=permission_grants) role_6_db = Role.add_or_update(role_6_db) self.roles['action_pack_action_create_grant'] = role_6_db # Custom role - "action_all" grant on pack_1 grant_db = PermissionGrantDB(resource_uid=self.resources['pack_1'].get_uid(), resource_type=ResourceType.PACK, permission_types=[PermissionType.ACTION_ALL]) grant_db = PermissionGrant.add_or_update(grant_db) permission_grants = [str(grant_db.id)] role_7_db = RoleDB(name='action_pack_action_all_grant', permission_grants=permission_grants) role_7_db = Role.add_or_update(role_7_db) self.roles['action_pack_action_all_grant'] = role_7_db # Custom role - "action_create" grant on action_1 grant_db = PermissionGrantDB(resource_uid=self.resources['action_1'].get_uid(), resource_type=ResourceType.ACTION, permission_types=[PermissionType.ACTION_CREATE]) grant_db = PermissionGrant.add_or_update(grant_db) permission_grants = [str(grant_db.id)] role_8_db = RoleDB(name='action_action_create_grant', permission_grants=permission_grants) role_8_db = Role.add_or_update(role_8_db) self.roles['action_action_create_grant'] = role_8_db # Custom role - "action_all" grant on action_1 grant_db = PermissionGrantDB(resource_uid=self.resources['action_1'].get_uid(), resource_type=ResourceType.ACTION, permission_types=[PermissionType.ACTION_ALL]) grant_db = PermissionGrant.add_or_update(grant_db) permission_grants = [str(grant_db.id)] role_9_db = RoleDB(name='action_action_all_grant', permission_grants=permission_grants) role_9_db = Role.add_or_update(role_9_db) self.roles['action_action_all_grant'] = role_9_db # Custom role - "action_list" grant grant_db = PermissionGrantDB(resource_uid=None, resource_type=None, permission_types=[PermissionType.ACTION_LIST]) grant_db = PermissionGrant.add_or_update(grant_db) permission_grants = [str(grant_db.id)] role_10_db = RoleDB(name='custom_role_action_list_grant', permission_grants=permission_grants) role_10_db = Role.add_or_update(role_10_db) self.roles['custom_role_action_list_grant'] = role_10_db # Create some mock role assignments user_db = self.users['custom_role_action_pack_grant'] role_assignment_db = UserRoleAssignmentDB( user=user_db.name, role=self.roles['custom_role_action_pack_grant'].name, source='assignments/%s.yaml' % user_db.name) UserRoleAssignment.add_or_update(role_assignment_db) user_db = self.users['custom_role_action_grant'] role_assignment_db = UserRoleAssignmentDB( user=user_db.name, role=self.roles['custom_role_action_grant'].name, source='assignments/%s.yaml' % user_db.name) UserRoleAssignment.add_or_update(role_assignment_db) user_db = self.users['custom_role_pack_action_all_grant'] role_assignment_db = UserRoleAssignmentDB( user=user_db.name, role=self.roles['custom_role_pack_action_all_grant'].name, source='assignments/%s.yaml' % user_db.name) UserRoleAssignment.add_or_update(role_assignment_db) user_db = self.users['custom_role_action_all_grant'] role_assignment_db = UserRoleAssignmentDB( user=user_db.name, role=self.roles['custom_role_action_all_grant'].name, source='assignments/%s.yaml' % user_db.name) UserRoleAssignment.add_or_update(role_assignment_db) user_db = self.users['custom_role_action_execute_grant'] role_assignment_db = UserRoleAssignmentDB( user=user_db.name, role=self.roles['custom_role_action_execute_grant'].name, source='assignments/%s.yaml' % user_db.name) UserRoleAssignment.add_or_update(role_assignment_db) user_db = self.users['action_pack_action_create_grant'] role_assignment_db = UserRoleAssignmentDB( user=user_db.name, role=self.roles['action_pack_action_create_grant'].name, source='assignments/%s.yaml' % user_db.name) UserRoleAssignment.add_or_update(role_assignment_db) user_db = self.users['action_pack_action_all_grant'] role_assignment_db = UserRoleAssignmentDB( user=user_db.name, role=self.roles['action_pack_action_all_grant'].name, source='assignments/%s.yaml' % user_db.name) UserRoleAssignment.add_or_update(role_assignment_db) user_db = self.users['action_action_create_grant'] role_assignment_db = UserRoleAssignmentDB( user=user_db.name, role=self.roles['action_action_create_grant'].name, source='assignments/%s.yaml' % user_db.name) UserRoleAssignment.add_or_update(role_assignment_db) user_db = self.users['action_action_all_grant'] role_assignment_db = UserRoleAssignmentDB( user=user_db.name, role=self.roles['action_action_all_grant'].name, source='assignments/%s.yaml' % user_db.name) UserRoleAssignment.add_or_update(role_assignment_db) user_db = self.users['custom_role_action_list_grant'] role_assignment_db = UserRoleAssignmentDB( user=user_db.name, role=self.roles['custom_role_action_list_grant'].name, source='assignments/%s.yaml' % user_db.name) UserRoleAssignment.add_or_update(role_assignment_db)
def setUp(self): super(RuleControllerRBACTestCase, self).setUp() self.fixtures_loader.save_fixtures_to_db(fixtures_pack=FIXTURES_PACK, fixtures_dict=TEST_FIXTURES) file_name = 'rule_with_webhook_trigger.yaml' RuleControllerRBACTestCase.RULE_1 = self.fixtures_loader.load_fixtures( fixtures_pack=FIXTURES_PACK, fixtures_dict={'rules': [file_name]})['rules'][file_name] file_name = 'rule_example_pack.yaml' RuleControllerRBACTestCase.RULE_2 = self.fixtures_loader.load_fixtures( fixtures_pack=FIXTURES_PACK, fixtures_dict={'rules': [file_name]})['rules'][file_name] # Insert mock users, roles and assignments self = self self.users = {} self.roles = {} # Users user_1_db = UserDB(name='rule_create') user_1_db = User.add_or_update(user_1_db) self.users['rule_create'] = user_1_db user_2_db = UserDB(name='rule_create_webhook_create') user_2_db = User.add_or_update(user_2_db) self.users['rule_create_webhook_create'] = user_2_db user_3_db = UserDB(name='rule_create_webhook_create_core_local_execute') user_3_db = User.add_or_update(user_3_db) self.users['rule_create_webhook_create_core_local_execute'] = user_3_db # Roles # rule_create grant on parent pack grant_db = PermissionGrantDB(resource_uid='pack:examples', resource_type=ResourceType.PACK, permission_types=[PermissionType.RULE_CREATE]) grant_db = PermissionGrant.add_or_update(grant_db) permission_grants = [str(grant_db.id)] role_1_db = RoleDB(name='rule_create', permission_grants=permission_grants) role_1_db = Role.add_or_update(role_1_db) self.roles['rule_create'] = role_1_db # rule_create grant on parent pack, webhook_create on webhook "sample" grant_1_db = PermissionGrantDB(resource_uid='pack:examples', resource_type=ResourceType.PACK, permission_types=[PermissionType.RULE_CREATE]) grant_1_db = PermissionGrant.add_or_update(grant_1_db) grant_2_db = PermissionGrantDB(resource_uid='webhook:sample', resource_type=ResourceType.WEBHOOK, permission_types=[PermissionType.WEBHOOK_CREATE]) grant_2_db = PermissionGrant.add_or_update(grant_2_db) permission_grants = [str(grant_1_db.id), str(grant_2_db.id)] role_2_db = RoleDB(name='rule_create_webhook_create', permission_grants=permission_grants) role_2_db = Role.add_or_update(role_2_db) self.roles['rule_create_webhook_create'] = role_2_db # rule_create grant on parent pack, webhook_create on webhook "sample", action_execute on # core.local grant_1_db = PermissionGrantDB(resource_uid='pack:examples', resource_type=ResourceType.PACK, permission_types=[PermissionType.RULE_CREATE]) grant_1_db = PermissionGrant.add_or_update(grant_1_db) grant_2_db = PermissionGrantDB(resource_uid='webhook:sample', resource_type=ResourceType.WEBHOOK, permission_types=[PermissionType.WEBHOOK_CREATE]) grant_2_db = PermissionGrant.add_or_update(grant_2_db) grant_3_db = PermissionGrantDB(resource_uid='action:core:local', resource_type=ResourceType.ACTION, permission_types=[PermissionType.ACTION_EXECUTE]) grant_3_db = PermissionGrant.add_or_update(grant_3_db) permission_grants = [str(grant_1_db.id), str(grant_2_db.id), str(grant_3_db.id)] role_3_db = RoleDB(name='rule_create_webhook_create_core_local_execute', permission_grants=permission_grants) role_3_db = Role.add_or_update(role_3_db) self.roles['rule_create_webhook_create_core_local_execute'] = role_3_db # Role assignments user_db = self.users['rule_create'] role_assignment_db = UserRoleAssignmentDB( user=user_db.name, role=self.roles['rule_create'].name) UserRoleAssignment.add_or_update(role_assignment_db) user_db = self.users['rule_create_webhook_create'] role_assignment_db = UserRoleAssignmentDB( user=user_db.name, role=self.roles['rule_create_webhook_create'].name) UserRoleAssignment.add_or_update(role_assignment_db) user_db = self.users['rule_create_webhook_create_core_local_execute'] role_assignment_db = UserRoleAssignmentDB( user=user_db.name, role=self.roles['rule_create_webhook_create_core_local_execute'].name) UserRoleAssignment.add_or_update(role_assignment_db)
def setUp(self): super(ActionAliasPermissionsResolverTestCase, self).setUp() # Create some mock users user_1_db = UserDB(name='alias_pack_grant') user_1_db = User.add_or_update(user_1_db) self.users['alias_pack_grant'] = user_1_db user_2_db = UserDB(name='alias_grant') user_2_db = User.add_or_update(user_2_db) self.users['alias_grant'] = user_2_db user_3_db = UserDB(name='pack_alias_all_grant') user_3_db = User.add_or_update(user_3_db) self.users['pack_alias_all_grant'] = user_3_db user_4_db = UserDB(name='alias_all_grant') user_4_db = User.add_or_update(user_4_db) self.users['alias_all_grant'] = user_4_db user_5_db = UserDB(name='alias_modify_grant') user_5_db = User.add_or_update(user_5_db) self.users['alias_modify_grant'] = user_5_db user_6_db = UserDB(name='alias_pack_alias_create_grant') user_6_db = User.add_or_update(user_6_db) self.users['alias_pack_alias_create_grant'] = user_6_db user_7_db = UserDB(name='alias_pack_alias_all_grant') user_7_db = User.add_or_update(user_7_db) self.users['alias_pack_alias_all_grant'] = user_7_db user_8_db = UserDB(name='alias_alias_create_grant') user_8_db = User.add_or_update(user_8_db) self.users['alias_alias_create_grant'] = user_8_db user_10_db = UserDB(name='alias_list_grant') user_10_db = User.add_or_update(user_10_db) self.users['alias_list_grant'] = user_10_db # Create some mock resources on which permissions can be granted alias_1_db = ActionAliasDB(pack='test_pack_1', name='alias1', formats=['a'], action_ref='core.local') self.resources['alias_1'] = alias_1_db alias_2_db = ActionAliasDB(pack='test_pack_1', name='alias2', formats=['a'], action_ref='core.local') self.resources['alias_2'] = alias_2_db alias_3_db = ActionAliasDB(pack='test_pack_2', name='alias3', formats=['a'], action_ref='core.local') self.resources['alias_3'] = alias_3_db # Create some mock roles with associated permission grants # One grant on parent pack, action_alias_view on pack1 grant_db = PermissionGrantDB(resource_uid=self.resources['pack_1'].get_uid(), resource_type=ResourceType.PACK, permission_types=[PermissionType.ACTION_ALIAS_VIEW]) grant_db = PermissionGrant.add_or_update(grant_db) permission_grants = [str(grant_db.id)] role_3_db = RoleDB(name='alias_pack_grant', permission_grants=permission_grants) role_3_db = Role.add_or_update(role_3_db) self.roles['alias_pack_grant'] = role_3_db # "action_alias_view" on alias_3 grant_db = PermissionGrantDB(resource_uid=self.resources['alias_3'].get_uid(), resource_type=ResourceType.ACTION_ALIAS, permission_types=[PermissionType.ACTION_ALIAS_VIEW]) grant_db = PermissionGrant.add_or_update(grant_db) permission_grants = [str(grant_db.id)] role_4_db = RoleDB(name='alias_grant', permission_grants=permission_grants) role_4_db = Role.add_or_update(role_4_db) self.roles['alias_grant'] = role_4_db # Custom role - "action_alias_all" grant on a parent pack grant_db = PermissionGrantDB(resource_uid=self.resources['pack_1'].get_uid(), resource_type=ResourceType.PACK, permission_types=[PermissionType.ACTION_ALIAS_ALL]) grant_db = PermissionGrant.add_or_update(grant_db) permission_grants = [str(grant_db.id)] role_4_db = RoleDB(name='pack_alias_all_grant', permission_grants=permission_grants) role_4_db = Role.add_or_update(role_4_db) self.roles['pack_alias_all_grant'] = role_4_db # Custom role - "action_alias_all" grant on alias grant_db = PermissionGrantDB(resource_uid=self.resources['alias_1'].get_uid(), resource_type=ResourceType.ACTION_ALIAS, permission_types=[PermissionType.ACTION_ALIAS_ALL]) grant_db = PermissionGrant.add_or_update(grant_db) permission_grants = [str(grant_db.id)] role_4_db = RoleDB(name='alias_all_grant', permission_grants=permission_grants) role_4_db = Role.add_or_update(role_4_db) self.roles['alias_all_grant'] = role_4_db # Custom role - "alias_modify" on alias_1 grant_db = PermissionGrantDB(resource_uid=self.resources['alias_1'].get_uid(), resource_type=ResourceType.ACTION_ALIAS, permission_types=[PermissionType.ACTION_ALIAS_MODIFY]) grant_db = PermissionGrant.add_or_update(grant_db) permission_grants = [str(grant_db.id)] role_5_db = RoleDB(name='alias_modify_grant', permission_grants=permission_grants) role_5_db = Role.add_or_update(role_5_db) self.roles['alias_modify_grant'] = role_5_db # Custom role - "action_alias_create" grant on pack_1 grant_db = PermissionGrantDB(resource_uid=self.resources['pack_1'].get_uid(), resource_type=ResourceType.PACK, permission_types=[PermissionType.ACTION_ALIAS_CREATE]) grant_db = PermissionGrant.add_or_update(grant_db) permission_grants = [str(grant_db.id)] role_6_db = RoleDB(name='alias_pack_alias_create_grant', permission_grants=permission_grants) role_6_db = Role.add_or_update(role_6_db) self.roles['alias_pack_alias_create_grant'] = role_6_db # Custom role - "action_alias_all" grant on pack_1 grant_db = PermissionGrantDB(resource_uid=self.resources['pack_1'].get_uid(), resource_type=ResourceType.PACK, permission_types=[PermissionType.ACTION_ALIAS_ALL]) grant_db = PermissionGrant.add_or_update(grant_db) permission_grants = [str(grant_db.id)] role_7_db = RoleDB(name='alias_pack_alias_all_grant', permission_grants=permission_grants) role_7_db = Role.add_or_update(role_7_db) self.roles['alias_pack_alias_all_grant'] = role_7_db # Custom role - "action_alias_create" grant on alias_1 grant_db = PermissionGrantDB(resource_uid=self.resources['alias_1'].get_uid(), resource_type=ResourceType.ACTION_ALIAS, permission_types=[PermissionType.ACTION_ALIAS_CREATE]) grant_db = PermissionGrant.add_or_update(grant_db) permission_grants = [str(grant_db.id)] role_8_db = RoleDB(name='alias_alias_create_grant', permission_grants=permission_grants) role_8_db = Role.add_or_update(role_8_db) self.roles['alias_alias_create_grant'] = role_8_db # Custom role - "alias_list" grant grant_db = PermissionGrantDB(resource_uid=None, resource_type=None, permission_types=[PermissionType.ACTION_ALIAS_LIST]) grant_db = PermissionGrant.add_or_update(grant_db) permission_grants = [str(grant_db.id)] role_10_db = RoleDB(name='alias_list_grant', permission_grants=permission_grants) role_10_db = Role.add_or_update(role_10_db) self.roles['alias_list_grant'] = role_10_db # Create some mock role assignments user_db = self.users['alias_pack_grant'] role_assignment_db = UserRoleAssignmentDB( user=user_db.name, role=self.roles['alias_pack_grant'].name, source='assignments/%s.yaml' % user_db.name) UserRoleAssignment.add_or_update(role_assignment_db) user_db = self.users['alias_grant'] role_assignment_db = UserRoleAssignmentDB( user=user_db.name, role=self.roles['alias_grant'].name, source='assignments/%s.yaml' % user_db.name) UserRoleAssignment.add_or_update(role_assignment_db) user_db = self.users['pack_alias_all_grant'] role_assignment_db = UserRoleAssignmentDB( user=user_db.name, role=self.roles['pack_alias_all_grant'].name, source='assignments/%s.yaml' % user_db.name) UserRoleAssignment.add_or_update(role_assignment_db) user_db = self.users['alias_all_grant'] role_assignment_db = UserRoleAssignmentDB( user=user_db.name, role=self.roles['alias_all_grant'].name, source='assignments/%s.yaml' % user_db.name) UserRoleAssignment.add_or_update(role_assignment_db) user_db = self.users['alias_modify_grant'] role_assignment_db = UserRoleAssignmentDB( user=user_db.name, role=self.roles['alias_modify_grant'].name, source='assignments/%s.yaml' % user_db.name) UserRoleAssignment.add_or_update(role_assignment_db) user_db = self.users['alias_pack_alias_create_grant'] role_assignment_db = UserRoleAssignmentDB( user=user_db.name, role=self.roles['alias_pack_alias_create_grant'].name, source='assignments/%s.yaml' % user_db.name) UserRoleAssignment.add_or_update(role_assignment_db) user_db = self.users['alias_pack_alias_all_grant'] role_assignment_db = UserRoleAssignmentDB( user=user_db.name, role=self.roles['alias_pack_alias_all_grant'].name, source='assignments/%s.yaml' % user_db.name) UserRoleAssignment.add_or_update(role_assignment_db) user_db = self.users['alias_alias_create_grant'] role_assignment_db = UserRoleAssignmentDB( user=user_db.name, role=self.roles['alias_alias_create_grant'].name, source='assignments/%s.yaml' % user_db.name) UserRoleAssignment.add_or_update(role_assignment_db) user_db = self.users['alias_list_grant'] role_assignment_db = UserRoleAssignmentDB( user=user_db.name, role=self.roles['alias_list_grant'].name, source='assignments/%s.yaml' % user_db.name) UserRoleAssignment.add_or_update(role_assignment_db)