List credentials by type

Currently the only attribute that you can filter a credential list by is
user_id. I want to be able to list by user_id and credential type (a
required field) so that I only get back my EC2 credentials (for example)
when I do a list.

Change-Id: I91f8fb15a2e9a8326059d7a60d2bf1b4c4aa6daa
Closes-bug: #1460492
bp list-credentials-by-type

keystone/credential/controllers.py

@@ -81,7 +81,7 @@ class CredentialV3(controller.V3Controller):
         else:
             return ref
 
-    @controller.filterprotected('user_id')
+    @controller.filterprotected('user_id', 'type')
     def list_credentials(self, context, filters):
         hints = CredentialV3.build_driver_hints(context, filters)
         refs = self.credential_api.list_credentials(hints)

keystone/tests/unit/core.py

@@ -329,7 +329,7 @@ def new_credential_ref(user_id, project_id=None, cred_type=None):
     ref['user_id'] = user_id
     if cred_type == 'ec2':
         ref['type'] = 'ec2'
-        ref['blob'] = {'blah': 'test'}
+        ref['blob'] = uuid.uuid4().hex
     else:
         ref['type'] = 'cert'
         ref['blob'] = uuid.uuid4().hex

keystone/tests/unit/test_v3_credential.py

@@ -98,6 +98,60 @@ class CredentialTestCase(CredentialBaseTestCase):
         for cred in r.result['credentials']:
             self.assertEqual(self.user['id'], cred['user_id'])
 
+    def test_list_credentials_filtered_by_type(self):
+        """Call ``GET  /credentials?type={type}``."""
+        # The type ec2 was chosen, instead of a random string,
+        # because the type must be in the list of supported types
+        ec2_credential = self.new_credential_ref(user_id=uuid.uuid4().hex,
+                                                 project_id=self.project_id,
+                                                 cred_type='ec2')
+
+        ec2_resp = self.credential_api.create_credential(
+            ec2_credential['id'], ec2_credential)
+
+        # The type cert was chosen for the same reason as ec2
+        r = self.get('/credentials?type=cert')
+
+        # Testing the filter for two different types
+        self.assertValidCredentialListResponse(r, ref=self.credential)
+        for cred in r.result['credentials']:
+            self.assertEqual('cert', cred['type'])
+
+        r_ec2 = self.get('/credentials?type=ec2')
+        self.assertThat(r_ec2.result['credentials'], matchers.HasLength(1))
+        cred_ec2 = r_ec2.result['credentials'][0]
+
+        self.assertValidCredentialListResponse(r_ec2, ref=ec2_resp)
+        self.assertEqual('ec2', cred_ec2['type'])
+        self.assertEqual(cred_ec2['id'], ec2_credential['id'])
+
+    def test_list_credentials_filtered_by_type_and_user_id(self):
+        """Call ``GET  /credentials?user_id={user_id}&type={type}``."""
+        user1_id = uuid.uuid4().hex
+        user2_id = uuid.uuid4().hex
+
+        # Creating credentials for two different users
+        credential_user1_ec2 = self.new_credential_ref(
+            user_id=user1_id, cred_type='ec2')
+        credential_user1_cert = self.new_credential_ref(
+            user_id=user1_id)
+        credential_user2_cert = self.new_credential_ref(
+            user_id=user2_id)
+
+        self.credential_api.create_credential(
+            credential_user1_ec2['id'], credential_user1_ec2)
+        self.credential_api.create_credential(
+            credential_user1_cert['id'], credential_user1_cert)
+        self.credential_api.create_credential(
+            credential_user2_cert['id'], credential_user2_cert)
+
+        r = self.get('/credentials?user_id=%s&type=ec2' % user1_id)
+        self.assertValidCredentialListResponse(r, ref=credential_user1_ec2)
+        self.assertThat(r.result['credentials'], matchers.HasLength(1))
+        cred = r.result['credentials'][0]
+        self.assertEqual('ec2', cred['type'])
+        self.assertEqual(user1_id, cred['user_id'])
+
     def test_create_credential(self):
         """Call ``POST /credentials``."""
         ref = self.new_credential_ref(user_id=self.user['id'])