Merge lp:~hazmat/pyjuju/security-policy-with-topology into lp:pyjuju

[Kapil Thangavelu]

security policies now have a topology accessor for rules and can be created or applied with a modified topology.

[lp:~hazmat/pyjuju/security-policy-with-topology]

318. By Kapil Thangavelu on 2011-08-05

Merged states-with-principals into security-policy-with-topology.

319. By Kapil Thangavelu on 2011-08-05

Merged states-with-principals into security-policy-with-topology.

320. By Kapil Thangavelu on 2011-08-05

Merged states-with-principals into security-policy-with-topology.

321. By Kapil Thangavelu on 2011-08-05

Merged states-with-principals into security-policy-with-topology.

322. By Kapil Thangavelu on 2011-08-08

Merged states-with-principals into security-policy-with-topology.

323. By Kapil Thangavelu on 2011-08-08

Merged states-with-principals into security-policy-with-topology.

324. By Kapil Thangavelu on 2011-08-08

resurrect policy.get_token earlier into branch pipeline, yank policy.client access.

325. By Kapil Thangavelu on 2011-08-10

Merged states-with-principals into security-policy-with-topology.

[Gustavo Niemeyer (niemeyer)]

This looks good. +1, assuming the pre-req is sorted.

review: Approve

[Benjamin Saller (bcsaller)]

This looks good to me. As we talked about I think its good policy that we allow the topology to be passed as an argument here.

Also, I like the way this test works

+ def test_policy_with_given_topology(self):

+1

review: Approve

[lp:~hazmat/pyjuju/security-policy-with-topology]

326. By Kapil Thangavelu on 2011-08-17

merge trunk and resolve conflict

327. By Kapil Thangavelu on 2012-03-31

merge trunk

328. By Kapil Thangavelu on 2012-03-31

Merged states-with-principals into security-policy-with-topology.

329. By Kapil Thangavelu on 2012-04-02

merge states-with-principals

Unmerged revisions

329. By Kapil Thangavelu on 2012-04-02

merge states-with-principals

328. By Kapil Thangavelu on 2012-03-31

Merged states-with-principals into security-policy-with-topology.

327. By Kapil Thangavelu on 2012-03-31

merge trunk

326. By Kapil Thangavelu on 2011-08-17

merge trunk and resolve conflict

325. By Kapil Thangavelu on 2011-08-10

Merged states-with-principals into security-policy-with-topology.

324. By Kapil Thangavelu on 2011-08-08

resurrect policy.get_token earlier into branch pipeline, yank policy.client access.

323. By Kapil Thangavelu on 2011-08-08

Merged states-with-principals into security-policy-with-topology.

322. By Kapil Thangavelu on 2011-08-08

Merged states-with-principals into security-policy-with-topology.

321. By Kapil Thangavelu on 2011-08-05

Merged states-with-principals into security-policy-with-topology.

320. By Kapil Thangavelu on 2011-08-05

Merged states-with-principals into security-policy-with-topology.

=== modified file 'juju/state/security.py'
--- juju/state/security.py	2012-04-02 14:10:24 +0000
+++ juju/state/security.py	2012-04-02 14:10:24 +0000
@@ -13,6 +13,7 @@
 from juju.state.auth import make_identity, make_ace
 from juju.state.errors import (
     StateChanged, StateNotFound, PrincipalNotFound)
+from juju.state.topology import InternalTopology
 from juju.state.utils import YAMLState
 from juju.state import securityrules
 
@@ -29,8 +30,9 @@
     """Apply security policy ACL to the given path."""
     token_db = TokenDatabase(client)
     policy = SecurityPolicy(
-        client, token_db, securityrules.get_default_rules())
-    acl = yield policy(path, topology)
+        client, token_db, securityrules.get_default_rules(),
+        topology)
+    acl = yield policy(path)
     yield client.set_acl(path, acl)
 
 apply_security_rules = apply_rules
@@ -377,6 +379,7 @@
         self._rules = list(rules)
         self._token_db = token_db
         self._owner = None
+        self._topology = topology
 
     def set_owner(self, principal):
         """If an owner is set all nodes ACLs will grant access to the owner.
@@ -384,6 +387,18 @@
         assert not self._owner, "Owner already assigned"
         self._owner = principal
 
+    def get_token(self, principal_name):
+        return self._token_db.get(principal_name)
+
+    @inlineCallbacks
+    def get_topology(self):
+        if not self._topology:
+            content, stat = yield self._client.get("/topology")
+            self._topology = InternalTopology()
+            if content:
+                self._topology.parse(content)
+        returnValue(self._topology)
+
     def add_rule(self, rule):
         """Add a security rule to the policy.
 

=== modified file 'juju/state/tests/test_security.py'
--- juju/state/tests/test_security.py	2012-04-02 14:10:24 +0000
+++ juju/state/tests/test_security.py	2012-04-02 14:10:24 +0000
@@ -2,7 +2,7 @@
 import yaml
 import zookeeper
 
-from twisted.internet.defer import inlineCallbacks, succeed
+from twisted.internet.defer import inlineCallbacks, succeed, returnValue
 
 from juju.state.auth import make_identity, make_ace
 from juju.state.errors import (
@@ -12,6 +12,7 @@
     ACL, Principal, GroupPrincipal, OTPPrincipal, TokenDatabase,
     SecurityPolicy, SecurityPolicyConnection, apply_security_rules)
 
+from juju.state.topology import InternalTopology
 from juju.lib.testing import TestCase
 from juju.state.tests.common import StateTestBase, security_test
 from juju.tests.common import get_test_zookeeper_address
@@ -363,6 +364,57 @@
         self.client.close()
 
     @inlineCallbacks
+    def test_policy_with_topology(self):
+        """A security policy has a topology accessible from it.
+        """
+        topology = InternalTopology()
+        topology.add_machine("m-1")
+        data = topology.dump()
+        yield self.client.create("/topology", data)
+        topology = yield self.policy.get_topology()
+        self.assertEqual(topology.dump(), data)
+
+    @inlineCallbacks
+    def test_policy_with_empty_topology(self):
+        """A topology can be utilized even with empty node contents.
+        """
+        yield self.client.create("/topology")
+        topology = yield self.policy.get_topology()
+        self.assertEqual(topology.get_machines(), [])
+
+    @inlineCallbacks
+    def test_policy_with_given_topology(self):
+        """A modified topology can be passed and used by rules.
+        """
+        yield self.client.create("/topology")
+
+        topology = InternalTopology()
+        topology.add_machine("m-1")
+        topology.add_machine("m-2")
+
+        @inlineCallbacks
+        def rule(policy, path):
+            topology = yield policy.get_topology()
+            self.assertEqual(
+                topology.get_machines(),
+                ["m-1", "m-2"])
+
+            returnValue(
+                [make_ace("m-1:", read=True)])
+
+        policy = SecurityPolicy(
+            self.client, self.tokens, [rule], topology=topology)
+
+        acl = yield policy("/zoo")
+        self.assertACE(acl, name="m-1")
+
+    @inlineCallbacks
+    def test_get_token(self):
+        self.assertEqual(
+            (yield self.policy.get_token("admin")),
+            Principal("admin", "admin").get_token())
+
+    @inlineCallbacks
     def test_default_no_owner_no_rules_gives_admin_access(self):
         """By default the policy setups a global access for the cli admins.
         """
@@ -371,7 +423,7 @@
             make_ace(Principal("admin", "admin").get_token(), all=True), acl)
 
     @inlineCallbacks
-    def test_default_no_rules_gives_global_authenticated_access(self):
+    def test_default_no_rules_gives_global_access(self):
         """If no rules match, the default acl gives authenticated users access.
 
         XXX/TODO: This is intended as a temporary crutch for