Merge lp:~hazmat/pyjuju/security-principal-def into lp:pyjuju

[Kapil Thangavelu]

Basic security constructs (principals and token db), as a basis for future security integration.

[Gustavo Niemeyer (niemeyer)]

That looks awesome. +1!

review: Approve

[William Reade (fwereade)]

Needs updating from trunk before tests will run on my machine, but otherwise looks good to me :).

review: Approve

=== added file 'ensemble/state/security.py'
--- ensemble/state/security.py	1970-01-01 00:00:00 +0000
+++ ensemble/state/security.py	2011-07-11 20:16:06 +0000
@@ -0,0 +1,62 @@
+from twisted.internet.defer import inlineCallbacks, returnValue
+from ensemble.state.auth import make_identity
+from ensemble.state.utils import YAMLState
+
+
+class Principal(object):
+    """An ensemble/zookeeper principal.
+    """
+
+    def __init__(self, name, password):
+        self._name = name
+        self._password = password
+
+    @property
+    def name(self):
+        """A principal has a login name."""
+        return self._name
+
+    def get_token(self):
+        """A principal identity token can be retrieved.
+
+        An identity token is used to construct ACLs.
+        """
+        return make_identity("%s:%s" % (self._name, self._password))
+
+    def attach(self, connection):
+        """A princpal can be attached to a connection."""
+        return connection.add_auth(
+            "digest", "%s:%s" % (self._name, self._password))
+
+
+class TokenDatabase(object):
+    """A hash map of principal names to their identity tokens.
+
+    Identity tokens are used to construct node ACLs.
+    """
+    def __init__(self, client, path="/auth-tokens"):
+        self._state = YAMLState(client, path)
+
+    @inlineCallbacks
+    def add(self, principal):
+        """Add a principal to the token database.
+        """
+        yield self._state.read()
+        self._state[principal.name] = principal.get_token()
+        yield self._state.write()
+
+    @inlineCallbacks
+    def get(self, name):
+        """Return the identity token for a principal name.
+        """
+        yield self._state.read()
+        returnValue(self._state[name])
+
+    @inlineCallbacks
+    def remove(self, name):
+        """Remove a principal by name from the token database.
+        """
+        yield self._state.read()
+        if name in self._state:
+            del self._state[name]
+            yield self._state.write()
 
=== added file 'ensemble/state/tests/test_security.py'
--- ensemble/state/tests/test_security.py	1970-01-01 00:00:00 +0000
+++ ensemble/state/tests/test_security.py	2011-07-11 20:16:06 +0000
@@ -0,0 +1,95 @@
+import yaml
+import zookeeper
+
+from twisted.internet.defer import inlineCallbacks
+
+from ensemble.state.auth import make_identity, make_ace
+from ensemble.state.security import Principal, TokenDatabase
+
+from ensemble.lib.testing import TestCase
+from txzookeeper.tests.utils import deleteTree
+
+
+class PrincipalTests(TestCase):
+
+    @inlineCallbacks
+    def setUp(self):
+        zookeeper.set_debug_level(0)
+        self.client = yield self.get_zookeeper_client().connect()
+
+    def tearDown(self):
+        deleteTree(handle=self.client.handle)
+        self.client.close()
+
+    def test_name(self):
+        """Principals have names."""
+        principal = Principal("foobar", "secret")
+        self.assertEqual(principal.name, "foobar")
+
+    def test_get_token(self):
+        """An identity token can be gotten from a Principal."""
+        principal = Principal("foobar", "secret")
+        self.assertEqual(principal.get_token(),
+                         make_identity("foobar:secret"))
+
+    @inlineCallbacks
+    def test_activate(self):
+        """A principal can be used with a client connection."""
+        client = yield self.get_zookeeper_client().connect()
+        self.addCleanup(lambda: client.close())
+        admin_credentials = "admin:admin"
+        test_credentials = "test:test"
+        self.client.add_auth("digest", admin_credentials)
+
+        acl = [make_ace(make_identity(admin_credentials), all=True),
+               make_ace(make_identity(
+                   test_credentials), read=True, create=True)]
+
+        yield client.create("/acl-test", "content", acls=acl)
+
+        # Verify the acl is active
+        yield self.assertFailure(
+            client.get("/acl-test"), zookeeper.NoAuthException)
+
+        # Attach the principal to the connection
+        principal = Principal("test", "test")
+        yield principal.attach(client)
+        content, stat = yield client.get("/acl-test")
+        self.assertEqual(content, "content")
+
+
+class TokenDatabaseTest(TestCase):
+
+    @inlineCallbacks
+    def setUp(self):
+        zookeeper.set_debug_level(0)
+        self.client = yield self.get_zookeeper_client().connect()
+        self.db = TokenDatabase(self.client, "/token-test")
+
+    def tearDown(self):
+        deleteTree(handle=self.client.handle)
+        self.client.close()
+
+    @inlineCallbacks
+    def test_add(self):
+        principal = Principal("zebra", "zoo")
+        yield self.db.add(principal)
+        content, stat = yield self.client.get("/token-test")
+        data = yaml.load(content)
+        self.assertEqual(data, {"zebra": principal.get_token()})
+
+    @inlineCallbacks
+    def test_remove(self):
+        principal = Principal("zebra", "zoo")
+        yield self.db.add(principal)
+        yield self.db.remove(principal)
+        content, stat = yield self.client.get("/token-test")
+        data = yaml.load(content)
+        self.assertEqual(data, {"zebra": principal.get_token()})
+
+    @inlineCallbacks
+    def test_get(self):
+        principal = Principal("zebra", "zoo")
+        yield self.db.add(principal)
+        token = yield self.db.get(principal.name)
+        self.assertEqual(token, principal.get_token())