openstack/deb-keystone
Code Issues Proposed changes

Merge "Remove trust dependency on token_api"

Browse Source
This commit is contained in:
Jenkins 2014-08-27 08:27:19 +00:00 committed by Gerrit Code Review
commit 949c65db39
6 changed files with 60 additions and 24 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
keystone/tests/test_backend.py
View File

@ -3479,6 +3479,19 @@ class TrustTests(object):
self.assertIsNotNone(trust_data)
trust_data = self.trust_api.get_trust(trust_id)
self.assertEqual(new_id, trust_data['id'])
self.trust_api.delete_trust(trust_data['id'])
def test_get_deleted_trust(self):
new_id = uuid.uuid4().hex
trust_data = self.create_sample_trust(new_id)
self.assertIsNotNone(trust_data)
self.assertIsNone(trust_data['deleted_at'])
self.trust_api.delete_trust(new_id)
self.assertIsNone(self.trust_api.get_trust(new_id))
deleted_trust = self.trust_api.get_trust(trust_data['id'],
deleted=True)
self.assertEqual(trust_data['id'], deleted_trust['id'])
self.assertIsNotNone(deleted_trust.get('deleted_at'))
def test_create_trust(self):
new_id = uuid.uuid4().hex

13
keystone/token/provider.py
View File

@ -149,6 +149,12 @@ class Manager(manager.Manager):
def __init__(self):
super(Manager, self).__init__(self.get_token_provider())
# This is used by the @dependency.provider decorator to register the
# provider (token_provider_api) manager to listen for trust deletions.
self.event_callbacks = {
'deleted': {'OS-TRUST:trust': [self._trust_deleted_event_callback]}
}
@property
def persistence(self):
# NOTE(morganfainberg): This should not be handled via __init__ to
@ -455,6 +461,13 @@ class Manager(manager.Manager):
def list_revoked_tokens(self):
return self.persistence.list_revoked_tokens()
def _trust_deleted_event_callback(self, service, resource_type, operation,
payload):
trust_id = payload['resource_info']
trust = self.trust_api.get_trust(trust_id, deleted=True)
self.persistence.delete_tokens(user_id=trust['trustor_user_id'],
trust_id=trust_id)
@six.add_metaclass(abc.ABCMeta)
class Provider(object):

19
keystone/trust/backends/kvs.py
View File

@ -24,14 +24,15 @@ from keystone import exception
from keystone import trust as keystone_trust
def _filter_trust(ref):
if ref['deleted']:
def _filter_trust(ref, deleted=False):
if ref['deleted_at'] and not deleted:
return None
if ref.get('expires_at') and timeutils.utcnow() > ref['expires_at']:
if (ref.get('expires_at') and timeutils.utcnow() > ref['expires_at'] and
not deleted):
return None
remaining_uses = ref.get('remaining_uses')
# Do not return trusts that can't be used anymore
if remaining_uses is not None:
if remaining_uses is not None and not deleted:
if remaining_uses <= 0:
return None
ref = copy.deepcopy(ref)
@ -42,7 +43,7 @@ class Trust(kvs.Base, keystone_trust.Driver):
def create_trust(self, trust_id, trust, roles):
trust_ref = copy.deepcopy(trust)
trust_ref['id'] = trust_id
trust_ref['deleted'] = False
trust_ref['deleted_at'] = None
trust_ref['roles'] = roles
if (trust_ref.get('expires_at') and
trust_ref['expires_at'].tzinfo is not None):
@ -76,10 +77,10 @@ class Trust(kvs.Base, keystone_trust.Driver):
else:
raise exception.TrustUseLimitReached(trust_id=trust_id)
def get_trust(self, trust_id):
def get_trust(self, trust_id, deleted=False):
try:
ref = self.db.get('trust-%s' % trust_id)
return _filter_trust(ref)
return _filter_trust(ref, deleted=deleted)
except exception.NotFound:
return None
@ -88,13 +89,13 @@ class Trust(kvs.Base, keystone_trust.Driver):
ref = self.db.get('trust-%s' % trust_id)
except exception.NotFound:
raise exception.TrustNotFound(trust_id=trust_id)
ref['deleted'] = True
ref['deleted_at'] = timeutils.utcnow()
self.db.set('trust-%s' % trust_id, ref)
def list_trusts(self):
trusts = []
for key, value in self.db.items():
if key.startswith("trust-") and not value['deleted']:
if key.startswith("trust-") and not value['deleted_at']:
trusts.append(value)
return trusts

15
keystone/trust/backends/sql.py
View File

@ -32,7 +32,7 @@ class TrustModel(sql.ModelBase, sql.DictBase):
__tablename__ = 'trust'
attributes = ['id', 'trustor_user_id', 'trustee_user_id',
'project_id', 'impersonation', 'expires_at',
'remaining_uses']
'remaining_uses', 'deleted_at']
id = sql.Column(sql.String(64), primary_key=True)
# user id of owner
trustor_user_id = sql.Column(sql.String(64), nullable=False,)
@ -128,19 +128,20 @@ class Trust(trust.Driver):
# incorrectly indicating a trust was consumed.
raise exception.TrustConsumeMaximumAttempt(trust_id=trust_id)
def get_trust(self, trust_id):
def get_trust(self, trust_id, deleted=False):
session = sql.get_session()
ref = (session.query(TrustModel).
filter_by(deleted_at=None).
filter_by(id=trust_id).first())
query = session.query(TrustModel).filter_by(id=trust_id)
if not deleted:
query = query.filter_by(deleted_at=None)
ref = query.first()
if ref is None:
return None
if ref.expires_at is not None:
if ref.expires_at is not None and not deleted:
now = timeutils.utcnow()
if now > ref.expires_at:
return None
# Do not return trusts that can't be used anymore
if ref.remaining_uses is not None:
if ref.remaining_uses is not None and not deleted:
if ref.remaining_uses <= 0:
return None
trust_dict = ref.to_dict()

14
keystone/trust/controllers.py
View File

@ -22,6 +22,7 @@ from keystone.common import controller
from keystone.common import dependency
from keystone import exception
from keystone.i18n import _
from keystone.models import token_model
from keystone.openstack.common import log
@ -39,8 +40,8 @@ def _admin_trustor_only(context, trust, user_id):
raise exception.Forbidden()
@dependency.requires('assignment_api', 'identity_api', 'trust_api',
'token_api')
@dependency.requires('assignment_api', 'identity_api', 'token_provider_api',
'trust_api')
class TrustV3(controller.V3Controller):
collection_name = "trusts"
member_name = "trust"
@ -57,9 +58,10 @@ class TrustV3(controller.V3Controller):
def _get_user_id(self, context):
if 'token_id' in context:
token_id = context['token_id']
token = self.token_api.get_token(token_id)
user_id = token['user']['id']
return user_id
token_data = self.token_provider_api.validate_token(token_id)
token_ref = token_model.KeystoneToken(token_id=token_id,
token_data=token_data)
return token_ref.user_id
return None
def get_trust(self, context, trust_id):
@ -229,8 +231,6 @@ class TrustV3(controller.V3Controller):
user_id = self._get_user_id(context)
_admin_trustor_only(context, trust, user_id)
self.trust_api.delete_trust(trust_id)
userid = trust['trustor_user_id']
self.token_api.delete_tokens(userid, trust_id=trust_id)
@controller.protected()
def list_roles_for_trust(self, context, trust_id):

10
keystone/trust/core.py
View File

@ -80,7 +80,15 @@ class Driver(object):
raise exception.NotImplemented() # pragma: no cover
@abc.abstractmethod
def get_trust(self, trust_id):
def get_trust(self, trust_id, deleted=False):
"""Get a trust by the trust id.
:param trust_id: the trust identifier
:type trust_id: string
:param deleted: return the trust even if it is deleted, expired, or
has no consumptions left
:type deleted: bool
"""
raise exception.NotImplemented() # pragma: no cover
@abc.abstractmethod