def from_model(cls, model, mask_secrets=True):
if not KeyValuePairAPI.crypto_setup:
KeyValuePairAPI._setup_crypto()
doc = cls._from_model(model, mask_secrets=mask_secrets)
if getattr(model, "expire_timestamp", None) and model.expire_timestamp:
doc["expire_timestamp"] = isotime.format(model.expire_timestamp,
offset=False)
encrypted = False
secret = getattr(model, "secret", False)
if secret:
encrypted = True
if not mask_secrets and secret:
doc["value"] = symmetric_decrypt(KeyValuePairAPI.crypto_key,
model.value)
encrypted = False
scope = getattr(model, "scope", SYSTEM_SCOPE)
if scope:
doc["scope"] = scope
key = doc.get("name", None)
if (scope == USER_SCOPE or scope == FULL_USER_SCOPE) and key:
doc["user"] = UserKeyReference.get_user(key)
doc["name"] = UserKeyReference.get_name(key)
doc["encrypted"] = encrypted
attrs = {
attr: value
for attr, value in six.iteritems(doc) if value is not None
}
return cls(**attrs)
def from_model(cls, model, mask_secrets=True):
if not KeyValuePairAPI.crypto_setup:
KeyValuePairAPI._setup_crypto()
doc = cls._from_model(model, mask_secrets=mask_secrets)
if getattr(model, 'expire_timestamp', None) and model.expire_timestamp:
doc['expire_timestamp'] = isotime.format(model.expire_timestamp, offset=False)
encrypted = False
secret = getattr(model, 'secret', False)
if secret:
encrypted = True
if not mask_secrets and secret:
doc['value'] = symmetric_decrypt(KeyValuePairAPI.crypto_key, model.value)
encrypted = False
scope = getattr(model, 'scope', SYSTEM_SCOPE)
if scope:
doc['scope'] = scope
key = doc.get('name', None)
if scope == USER_SCOPE and key:
doc['user'] = UserKeyReference.get_user(key)
doc['name'] = UserKeyReference.get_name(key)
doc['encrypted'] = encrypted
attrs = {attr: value for attr, value in six.iteritems(doc) if value is not None}
return cls(**attrs)
def from_model(cls, model, mask_secrets=True):
if not KeyValuePairAPI.crypto_setup:
KeyValuePairAPI._setup_crypto()
doc = cls._from_model(model, mask_secrets=mask_secrets)
if getattr(model, 'expire_timestamp', None) and model.expire_timestamp:
doc['expire_timestamp'] = isotime.format(model.expire_timestamp, offset=False)
encrypted = False
secret = getattr(model, 'secret', False)
if secret:
encrypted = True
if not mask_secrets and secret:
doc['value'] = symmetric_decrypt(KeyValuePairAPI.crypto_key, model.value)
encrypted = False
scope = getattr(model, 'scope', SYSTEM_SCOPE)
if scope:
doc['scope'] = scope
key = doc.get('name', None)
if (scope == USER_SCOPE or scope == FULL_USER_SCOPE) and key:
doc['user'] = UserKeyReference.get_user(key)
doc['name'] = UserKeyReference.get_name(key)
doc['encrypted'] = encrypted
attrs = {attr: value for attr, value in six.iteritems(doc) if value is not None}
return cls(**attrs)
def get_key_reference(scope, name, user=None):
"""
Given a key name and user this method returns a new name (string ref)
to address the key value pair in the context of that user.
:param user: User to whom key belongs.
:type user: ``str``
:param name: Original name of the key.
:type name: ``str``
:rtype: ``str``
"""
if scope == SYSTEM_SCOPE or scope == FULL_SYSTEM_SCOPE:
return name
elif scope == USER_SCOPE or scope == FULL_USER_SCOPE:
if not user:
raise InvalidUserException(
"A valid user must be specified for user key ref."
)
return UserKeyReference(name=name, user=user).ref
else:
raise InvalidScopeException(
'Scope "%s" is not valid. Allowed scopes are %s.' % (scope, ALLOWED_SCOPES)
)
def _get(self, name):
# get the value for this key and save in value_cache
if self._key_prefix:
key = "%s.%s" % (self._key_prefix, name)
else:
key = UserKeyReference(name=name, user=self._user).ref
if self._prefix:
kvp_key = DATASTORE_KEY_SEPARATOR.join([self._prefix, key])
else:
kvp_key = key
value = self._get_kv(kvp_key)
self._value_cache[key] = value
# return a KeyValueLookup as response since the lookup may not be complete e.g. if
# the lookup is for 'key_base.key_value' it is likely that the calling code, e.g. Jinja,
# will expect to do a dictionary style lookup for key_base and key_value as subsequent
# calls. Saving the value in cache avoids extra DB calls.
return UserKeyValueLookup(
prefix=self._prefix,
user=self._user,
key_prefix=key,
cache=self._value_cache,
scope=self._scope,
)
def test_from_string_reference(self):
user, name = UserKeyReference.from_string_reference('stanley:foo')
self.assertEqual(user, 'stanley')
self.assertEqual(name, 'foo')
self.assertRaises(InvalidUserKeyReferenceError,
UserKeyReference.from_string_reference,
'this_key_has_no_sep')
def test_to_string_reference(self):
key_ref = UserKeyReference.to_string_reference(user='******',
name='foo')
self.assertEqual(key_ref, 'stanley:foo')
self.assertRaises(ValueError,
UserKeyReference.to_string_reference,
user=None,
name='foo')
def test_from_string_reference(self):
user, name = UserKeyReference.from_string_reference("stanley:foo")
self.assertEqual(user, "stanley")
self.assertEqual(name, "foo")
self.assertRaises(
InvalidUserKeyReferenceError,
UserKeyReference.from_string_reference,
"this_key_has_no_sep",
)
def test_from_string_reference(self):
user, name = UserKeyReference.from_string_reference('stanley:foo')
self.assertEqual(user, 'stanley')
self.assertEqual(name, 'foo')
self.assertRaises(InvalidUserKeyReferenceError, UserKeyReference.from_string_reference,
'this_key_has_no_sep')
def test_to_string_reference(self):
key_ref = UserKeyReference.to_string_reference(user='******', name='foo')
self.assertEqual(key_ref, 'stanley:foo')
self.assertRaises(ValueError, UserKeyReference.to_string_reference, user=None, name='foo')
