Implied Roles

While the entity for an inference rule should be thought of as a
resource, the rules are essentially relationships between roles.
The `implied_role` API is linked with the role API, and thus the
client functions are part of v3/role.py.  However, it does not
map completely cleanly to the Crud baseclass, and requires
some custom URL generation.

Change-Id: I80a40e88b571fe9b0eca3af8b705ea79f28eb904

keystoneclient/tests/functional/v3/test_implied_roles.py

@@ -0,0 +1,99 @@
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+
+from keystoneclient.tests.functional import base
+
+role_defs = ["test_admin",
+             "test_id_manager",
+             "test_resource_manager",
+             "test_role_manager",
+             "test_assignment_manager",
+             "test_domain_manager",
+             "test_project_manager",
+             "test_catalog_manager",
+             "test_policy_manager",
+             "test_observer",
+             "test_domain_tech_lead",
+             "test_project_observer",
+             "test_member"]
+
+inference_rules = {"test_admin": "test_id_manager",
+                   "test_admin": "test_resource_manager",
+                   "test_admin": "test_role_manager",
+                   "test_admin": "test_catalog_manager",
+                   "test_admin": "test_policy_manager",
+                   "test_id_manager": "test_project_observer",
+                   "test_resource_manager": "test_project_observer",
+                   "test_role_manager": "test_project_observer",
+                   "test_catalog_manager": "test_project_observer",
+                   "test_policy_manager": "test_project_observer",
+                   "test_project_observer": "test_observer",
+                   "test_member": "test_observer"}
+
+
+class TestImpliedRoles(base.V3ClientTestCase):
+
+    def setUp(self):
+        super(TestImpliedRoles, self).setUp()
+        self.delete_rules()
+        self.delete_roles()
+
+    def test_implied_roles(self):
+
+        initial_role_count = len(self.client.roles.list())
+        initial_rule_count = len(self.client.roles.list_role_inferences())
+
+        self.create_roles()
+        self.create_rules()
+        role_count = len(self.client.roles.list())
+        self.assertEqual(initial_role_count + len(role_defs),
+                         role_count)
+        rule_count = len(self.client.roles.list_role_inferences())
+        self.assertEqual(initial_rule_count + len(inference_rules),
+                         rule_count)
+
+        self.delete_rules()
+        self.delete_roles()
+        role_count = len(self.client.roles.list())
+        self.assertEqual(initial_role_count, role_count)
+        rule_count = len(self.client.roles.list_role_inferences())
+        self.assertEqual(initial_rule_count, rule_count)
+
+    def role_dict(self):
+        roles = {role.name: role.id for role in self.client.roles.list()}
+        return roles
+
+    def create_roles(self):
+        for role_def in role_defs:
+            self.client.roles.create(role_def)
+
+    def delete_roles(self):
+        roles = self.role_dict()
+        for role_def in role_defs:
+            print ("role %s" % role_def)
+            try:
+                self.client.roles.delete(roles[role_def])
+            except KeyError:
+                pass
+
+    def create_rules(self):
+        roles = self.role_dict()
+        for prior, implied in inference_rules.items():
+            self.client.roles.create_implied(roles[prior], roles[implied])
+
+    def delete_rules(self):
+        roles = self.role_dict()
+        for prior, implied in inference_rules.items():
+            try:
+                self.client.roles.delete_implied(roles[prior], roles[implied])
+            except KeyError:
+                pass

keystoneclient/tests/unit/v3/test_roles.py

@@ -572,3 +572,48 @@ class RoleTests(utils.ClientTestCase, utils.CrudTests):
             project=project_id,
             group=group_id,
             user=user_id)
+
+    def test_implied_role_check(self):
+        prior_role_id = uuid.uuid4().hex
+        implied_role_id = uuid.uuid4().hex
+        self.stub_url('HEAD',
+                      ['roles', prior_role_id, 'implies', implied_role_id],
+                      status_code=200)
+
+        self.manager.check_implied(prior_role_id, implied_role_id)
+
+    def test_implied_role_get(self):
+        prior_role_id = uuid.uuid4().hex
+        implied_role_id = uuid.uuid4().hex
+        self.stub_url('GET',
+                      ['roles', prior_role_id, 'implies', implied_role_id],
+                      json={'role': {}},
+                      status_code=204)
+
+        self.manager.get_implied(prior_role_id, implied_role_id)
+
+    def test_implied_role_create(self):
+        prior_role_id = uuid.uuid4().hex
+        implied_role_id = uuid.uuid4().hex
+        self.stub_url('PUT',
+                      ['roles', prior_role_id, 'implies', implied_role_id],
+                      status_code=200)
+
+        self.manager.create_implied(prior_role_id, implied_role_id)
+
+    def test_implied_role_delete(self):
+        prior_role_id = uuid.uuid4().hex
+        implied_role_id = uuid.uuid4().hex
+        self.stub_url('DELETE',
+                      ['roles', prior_role_id, 'implies', implied_role_id],
+                      status_code=200)
+
+        self.manager.delete_implied(prior_role_id, implied_role_id)
+
+    def test_list_role_inferences(self, **kwargs):
+        self.stub_url('GET',
+                      ['role_inferences', ''],
+                      json={'role_inferences': {}},
+                      status_code=204)
+
+        self.manager.list_role_inferences()

keystoneclient/v3/roles.py

@@ -32,6 +32,17 @@ class Role(base.Resource):
     pass
 
 
+class InferenceRule(base.Resource):
+    """Represents an Rule that states one ROle implies another
+
+    Attributes:
+        * prior_role: this role implies the other
+        * implied_role: this role is implied by the other
+
+    """
+    pass
+
+
 class RoleManager(base.CrudManager):
     """Manager class for manipulating Identity roles."""
     resource_class = Role
@@ -85,6 +96,34 @@ class RoleManager(base.CrudManager):
             name=name,
             **kwargs)
 
+    def _implied_role_url_tail(self, prior_role, implied_role):
+        base_url = ('/%(prior_role_id)s/implies/%(implied_role_id)s' %
+                    {'prior_role_id': base.getid(prior_role),
+                     'implied_role_id': base.getid(implied_role)})
+        return base_url
+
+    def create_implied(self, prior_role, implied_role, **kwargs):
+        url_tail = self._implied_role_url_tail(prior_role, implied_role)
+        self.client.put("/roles" + url_tail, **kwargs)
+
+    def delete_implied(self, prior_role, implied_role, **kwargs):
+        url_tail = self._implied_role_url_tail(prior_role, implied_role)
+        return super(RoleManager, self).delete(tail=url_tail, **kwargs)
+
+    def get_implied(self, prior_role, implied_role, **kwargs):
+        url_tail = self._implied_role_url_tail(prior_role, implied_role)
+        return super(RoleManager, self).get(tail=url_tail, **kwargs)
+
+    def check_implied(self, prior_role, implied_role, **kwargs):
+        url_tail = self._implied_role_url_tail(prior_role, implied_role)
+        return super(RoleManager, self).head(tail=url_tail, **kwargs)
+
+    def list_role_inferences(self, **kwargs):
+        resp, body = self.client.get('/role_inferences/', **kwargs)
+        obj_class = InferenceRule
+        return [obj_class(self, res, loaded=True)
+                for res in body['role_inferences']]
+
     def get(self, role):
         return super(RoleManager, self).get(
             role_id=base.getid(role))

releasenotes/notes/implied_roles-ea39d3c3d998d482.yaml

@@ -0,0 +1,3 @@
+---
+features:
+  - support for implied roles in v3 API.