Merge lp:~themue/pyjuju/go-state-auth into lp:pyjuju/go

[Frank Mueller]

Port off auth.py with tests to Go state.

https://codereview.appspot.com/5875047/

[Gustavo Niemeyer (niemeyer)]

On 2012/03/22 14:24:11, TheMue wrote:
> Please take a look.

As we discussed, we won't be using this yet, so I'm marking it as
rejected for the moment. It may be revived in the future.

https://codereview.appspot.com/5875047/

Unmerged revisions

101. By Frank Mueller on 2012-03-22

Added go port off auth.py.

=== added file 'state/auth.go'
--- state/auth.go	1970-01-01 00:00:00 +0000
+++ state/auth.go	2012-03-22 14:28:19 +0000
@@ -0,0 +1,65 @@
+// launchpad.net/juju/state
+//
+// Copyright (c) 2011-2012 Canonical Ltd.
+
+package state
+
+import (
+	"crypto/sha1"
+	"encoding/base64"
+	"fmt"
+	"io"
+	"launchpad.net/gozk/zookeeper"
+	"strings"
+)
+
+var permMap = map[string]int{
+	"read":   zookeeper.PERM_READ,
+	"write":  zookeeper.PERM_WRITE,
+	"create": zookeeper.PERM_CREATE,
+	"delete": zookeeper.PERM_DELETE,
+	"admin":  zookeeper.PERM_ADMIN,
+	"all":    zookeeper.PERM_ALL,
+}
+
+// MakeIdentity transforms principal credentials in the form of
+// principal_id:password into an identiy of the form principal_id:hash
+// that can be used for an access control list entry.
+func MakeIdentity(credentials string) (string, error) {
+	pp := strings.SplitN(credentials, ":", 2)
+	if len(pp) != 2 {
+		return "", fmt.Errorf("state: credentials in wrong format, should be principal_id:password")
+	}
+	hash := sha1.New()
+	io.WriteString(hash, credentials)
+	hash64 := base64.StdEncoding.EncodeToString(hash.Sum(nil))
+	return fmt.Sprintf("%s:%s", pp[0], hash64), nil
+}
+
+// AccessControlEntry is an association of identity to
+// scheme and permissions.
+type AccessControlEntry struct {
+	Identity    string `yaml:"id"`
+	Scheme      string
+	Permissions int `yaml:"perms"`
+}
+
+// MakeACE creates an access control entry (ACE) out of a user identity,
+// a scheme and a number of permissions.
+func MakeACE(identity, scheme string, permissions ...string) (*AccessControlEntry, error) {
+	if scheme != "digest" && scheme != "world" {
+		return nil, fmt.Errorf("state: invalid scheme %q", scheme)
+	}
+	acePermissions := 0
+	for _, permName := range permissions {
+		_, ok := permMap[permName]
+		if !ok {
+			return nil, fmt.Errorf("state: invalid permission keyword %q", permName)
+		}
+		acePermissions = acePermissions | permMap[permName]
+	}
+	if acePermissions == 0 {
+		return nil, fmt.Errorf("state: no permissions specified")
+	}
+	return &AccessControlEntry{identity, scheme, acePermissions}, nil
+}

=== added file 'state/auth_test.go'
--- state/auth_test.go	1970-01-01 00:00:00 +0000
+++ state/auth_test.go	2012-03-22 14:28:19 +0000
@@ -0,0 +1,97 @@
+// launchpad.net/juju/go/state
+//
+// Copyright (c) 2011-2012 Canonical Ltd.
+package state_test
+
+import (
+	"crypto/sha1"
+	"encoding/base64"
+	"fmt"
+	"io"
+	. "launchpad.net/gocheck"
+	"launchpad.net/gozk/zookeeper"
+	"launchpad.net/juju/go/state"
+)
+
+type AuthSuite struct{}
+
+var _ = Suite(&AuthSuite{})
+
+// encode64 builds the sha1 checksum of a string and
+// encodes it in base64.
+func encode64(s string) string {
+	hash := sha1.New()
+	io.WriteString(hash, s)
+	return base64.StdEncoding.EncodeToString(hash.Sum(nil))
+}
+
+func (s *AuthSuite) TestMakeIdentitiy(c *C) {
+	username := "admin"
+	password := "pass"
+	credentials := fmt.Sprintf("%s:%s", username, password)
+	identity := fmt.Sprintf("%s:%s", username, encode64(credentials))
+	makeIdentity, err := state.MakeIdentity(credentials)
+
+	c.Assert(err, IsNil)
+	c.Assert(identity, Equals, makeIdentity)
+}
+
+func (s *AuthSuite) TestMakeIdentitiyWithColonInPassword(c *C) {
+	username := "admin"
+	password := ":pass:"
+	credentials := fmt.Sprintf("%s:%s", username, password)
+	identity := fmt.Sprintf("%s:%s", username, encode64(credentials))
+	makeIdentity, err := state.MakeIdentity(credentials)
+
+	c.Assert(err, IsNil)
+	c.Assert(identity, Equals, makeIdentity)
+}
+
+func (s *AuthSuite) TestMakeIdentitiyInvalidCredentials(c *C) {
+	credentials := "abc"
+	_, err := state.MakeIdentity(credentials)
+
+	c.Assert(err, ErrorMatches, "state: credentials in wrong format, should be principal_id:password")
+}
+
+func (s *AuthSuite) TestMakeACE(c *C) {
+	identity := "admin:moss"
+	ace, err := state.MakeACE(identity, "digest", "write", "create")
+
+	c.Assert(err, IsNil)
+	c.Assert(ace.Identity, Equals, identity)
+	c.Assert(ace.Scheme, Equals, "digest")
+	c.Assert(ace.Permissions, Equals, zookeeper.PERM_WRITE|zookeeper.PERM_CREATE)
+}
+
+func (s *AuthSuite) TestMakeACEWithUnknownPermission(c *C) {
+	identity := "admin:moss"
+	_, err := state.MakeACE(identity, "digest", "read", "extra", "write")
+
+	c.Assert(err, ErrorMatches, `state: invalid permission keyword "extra"`)
+}
+
+func (s *AuthSuite) TestMakeACENoPermissions(c *C) {
+	identity := "admin:moss"
+
+	_, err := state.MakeACE(identity, "digest")
+
+	c.Assert(err, ErrorMatches, "state: no permissions specified")
+}
+
+func (s *AuthSuite) TestMakeACEWorldScheme(c *C) {
+	identity := "anyone"
+	ace, err := state.MakeACE(identity, "world", "all")
+
+	c.Assert(err, IsNil)
+	c.Assert(ace.Identity, Equals, identity)
+	c.Assert(ace.Scheme, Equals, "world")
+	c.Assert(ace.Permissions, Equals, zookeeper.PERM_ALL)
+}
+
+func (s *AuthSuite) TestMakeACEUnknownScheme(c *C) {
+	identity := "anyone"
+	_, err := state.MakeACE(identity, "mickey", "all")
+
+	c.Assert(err, ErrorMatches, `state: invalid scheme "mickey"`)
+}