This file is indexed.

/usr/lib/python2.7/dist-packages/barbicanclient/acls.py is in python-barbicanclient 4.0.1-2.

This file is owned by root:root, with mode 0o644.

The actual contents of the file can be viewed below.

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
# Copyright (c) 2015 Hewlett-Packard Development Company, L.P.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#    http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
# implied.
# See the License for the specific language governing permissions and
# limitations under the License.

import logging

from oslo_utils.timeutils import parse_isotime

from barbicanclient import base
from barbicanclient import formatter


LOG = logging.getLogger(__name__)

DEFAULT_OPERATION_TYPE = 'read'

VALID_ACL_OPERATIONS = ['read', 'write', 'delete', 'list']


class ACLFormatter(formatter.EntityFormatter):

    columns = ("Operation Type",
               "Project Access",
               "Users",
               "Created",
               "Updated",
               )

    def _get_formatted_data(self):
        data = (self.operation_type,
                self.project_access,
                self.users,
                self.created,
                self.updated,
                self.acl_ref,
                )
        return data


class _PerOperationACL(ACLFormatter):

    def __init__(self, parent_acl, entity_ref=None, users=None,
                 project_access=None, operation_type=None,
                 created=None, updated=None):
        """Per Operation ACL data instance for secret or container.

        This class not to be instantiated outside of this module.

        :param parent_acl: acl entity to this per operation data belongs to
        :param str entity_ref: Full HATEOAS reference to a secret or container
        :param users: List of Keystone userid(s) to be used for ACL.
        :type users: List or None
        :param bool project_access: Flag indicating project access behavior
        :param str operation_type: Type indicating which class of Barbican
            operations this ACL is defined for e.g. 'read' operations
        :param str created: Time string indicating ACL create timestamp. This
            is populated only when populating data from api response. Not
            needed in client input.
        :param str updated: Time string indicating ACL last update timestamp.
            This is populated only when populating data from api response. Not
            needed in client input.
        """
        self._parent_acl = parent_acl
        self._entity_ref = entity_ref
        self._users = users if users else list()
        self._project_access = project_access
        self._operation_type = operation_type
        self._created = parse_isotime(created) if created else None
        self._updated = parse_isotime(updated) if updated else None

    @property
    def acl_ref(self):
        return ACL.get_acl_ref_from_entity_ref(self.entity_ref)

    @property
    def entity_ref(self):
        return self._entity_ref

    @property
    def project_access(self):
        """Flag indicating project access behavior is enabled or not"""
        return self._project_access

    @property
    def users(self):
        """List of users for this ACL setting"""
        return self._users

    @property
    def operation_type(self):
        """Type indicating class of Barbican operations for this ACL"""
        return self._operation_type

    @property
    def created(self):
        return self._created

    @property
    def updated(self):
        return self._updated

    @operation_type.setter
    def operation_type(self, value):
        self._operation_type = value

    @project_access.setter
    def project_access(self, value):
        self._project_access = value

    @users.setter
    def users(self, value):
        self._users = value

    def remove(self):
        """
        Remove operation specific setting defined for a secret or container

        :raises barbicanclient.exceptions.HTTPAuthError: 401 Responses
        :raises barbicanclient.exceptions.HTTPClientError: 4xx Responses
        """
        LOG.debug('Removing {0} operation specific ACL for href: {1}'
                  .format(self.operation_type, self.acl_ref))

        self._parent_acl.load_acls_data()
        acl_entity = self._parent_acl

        # Find matching operation specific acl entry and remove from list
        per_op_acl = acl_entity.get(self.operation_type)
        if per_op_acl:
            acl_entity.operation_acls.remove(per_op_acl)

            # after above operation specific acl removal, check if there are
            # any remaining acls. If yes, then submit updates to server.
            # If not, then remove/delete acls from server.
            if acl_entity.operation_acls:
                acl_entity.submit()
            else:
                acl_entity.remove()

    def _validate_users_type(self):
        if self.users and not (type(self.users) is list or
                               type(self.users) is set):
            raise ValueError('Users value is expected to be provided'
                             ' as list/set.')


class ACL(object):

    _resource_name = 'acl'

    def __init__(self, api, entity_ref, users=None, project_access=None,
                 operation_type=DEFAULT_OPERATION_TYPE, created=None,
                 updated=None):
        """Base ACL entity instance for secret or container.

        Provide ACL data arguments to set ACL setting for given operation_type.

        To add ACL setting for other operation types, use `add_operation_acl`
        method.

        :param api: client instance reference
        :param str entity_ref: Full HATEOAS reference to a secret or container
        :param users: List of Keystone userid(s) to be used for ACL.
        :type users: str List or None
        :param bool project_access: Flag indicating project access behavior
        :param str operation_type: Type indicating which class of Barbican
            operations this ACL is defined for e.g. 'read' operations
        :param str created: Time string indicating ACL create timestamp. This
            is populated only when populating data from api response. Not
            needed in client input.
        :param str updated: Time string indicating ACL last update timestamp.
            This is populated only when populating data from api response. Not
            needed in client input.
        """

        self._api = api
        self._entity_ref = entity_ref
        self._operation_acls = []

        # create per operation ACL data entity only when client has set users
        # or project_access flag.
        if users is not None or project_access is not None:
            acl = _PerOperationACL(parent_acl=self, entity_ref=entity_ref,
                                   users=users, project_access=project_access,
                                   operation_type=operation_type,
                                   created=created, updated=updated)
            self._operation_acls.append(acl)

    @property
    def entity_ref(self):
        """Entity URI reference."""
        return self._entity_ref

    @property
    def operation_acls(self):
        """List of operation specific ACL settings."""
        return self._operation_acls

    @property
    def acl_ref(self):
        return ACL.get_acl_ref_from_entity_ref(self.entity_ref)

    def add_operation_acl(self, users=None, project_access=None,
                          operation_type=None, created=None,
                          updated=None,):
        """Add ACL settings to entity for specific operation type.

        If matching operation_type ACL already exists, then it replaces it with
        new PerOperationACL object using provided inputs. Otherwise it appends
        new PerOperationACL object to existing per operation ACL list.

        This just adds to local entity and have not yet applied these changes
        to server.

        :param users: List of Keystone userid(s) to be used in ACL.
        :type users: List or None
        :param bool project_access: Flag indicating project access behavior
        :param str operation_type: Type indicating which class of Barbican
            operations this ACL is defined for e.g. 'read' operations
        :param str created: Time string indicating ACL create timestamp. This
            is populated only when populating data from api response. Not
            needed in client input.
        :param str updated: Time string indicating ACL last update timestamp.
            This is populated only when populating data from api response. Not
            needed in client input.
        """
        new_acl = _PerOperationACL(parent_acl=self, entity_ref=self.entity_ref,
                                   users=users, project_access=project_access,
                                   operation_type=operation_type,
                                   created=created, updated=updated)

        for i, acl in enumerate(self._operation_acls):
            if acl.operation_type == operation_type:
                # replace with new ACL setting
                self._operation_acls[i] = new_acl
                break
        else:
            self._operation_acls.append(new_acl)

    def _get_operation_acl(self, operation_type):
            return next((acl for acl in self._operation_acls
                        if acl.operation_type == operation_type), None)

    def get(self, operation_type):
        """Get operation specific ACL instance.

        :param str operation_type: Type indicating which operation's ACL
        setting is needed.
        """
        return self._get_operation_acl(operation_type)

    def __getattr__(self, name):
        if name in VALID_ACL_OPERATIONS:
            return self._get_operation_acl(name)
        else:
            raise AttributeError(name)

    def submit(self):
        """Submits ACLs for a secret or a container defined in server

        In existing ACL case, this overwrites the existing ACL setting with
        provided inputs. If input users are None or empty list, this will
        remove existing ACL users if there. If input project_access flag is
        None, then default project access behavior is enabled.

        :returns: str acl_ref: Full HATEOAS reference to a secret or container
            ACL.
        :raises barbicanclient.exceptions.HTTPAuthError: 401 Responses
        :raises barbicanclient.exceptions.HTTPClientError: 4xx Responses
        :raises barbicanclient.exceptions.HTTPServerError: 5xx Responses
        """
        LOG.debug('Submitting complete {0} ACL for href: {1}'
                  .format(self.acl_type, self.entity_ref))
        if not self.operation_acls:
            raise ValueError('ACL data for {0} is not provided.'.
                             format(self._acl_type))

        self.validate_input_ref()

        acl_dict = {}

        for per_op_acl in self.operation_acls:
            per_op_acl._validate_users_type()
            op_type = per_op_acl.operation_type
            acl_data = {}
            if per_op_acl.project_access is not None:
                acl_data['project-access'] = per_op_acl.project_access
            if per_op_acl.users is not None:
                acl_data['users'] = per_op_acl.users
            acl_dict[op_type] = acl_data

        response = self._api.put(self.acl_ref, json=acl_dict)

        return response.json().get('acl_ref')

    def remove(self):
        """
        Remove Barbican ACLs setting defined for a secret or container

        :raises barbicanclient.exceptions.HTTPAuthError: 401 Responses
        :raises barbicanclient.exceptions.HTTPClientError: 4xx Responses
        """
        self.validate_input_ref()
        LOG.debug('Removing ACL for {0} for href: {1}'
                  .format(self.acl_type, self.entity_ref))
        self._api.delete(self.acl_ref)

    def load_acls_data(self):
        """Loads ACL entity from Barbican server using its acl_ref

        Clears the existing list of per operation ACL settings if there.
        Populates current ACL entity with ACL settings received from Barbican
        server.

        :raises barbicanclient.exceptions.HTTPAuthError: 401 Responses
        :raises barbicanclient.exceptions.HTTPClientError: 4xx Responses
        :raises barbicanclient.exceptions.HTTPServerError: 5xx Responses
        """

        response = self._api.get(self.acl_ref)

        del self.operation_acls[:]  # clearing list for all of its references
        for op_type in response:
            acl_dict = response.get(op_type)
            proj_access = acl_dict.get('project-access')
            users = acl_dict.get('users')
            created = acl_dict.get('created')
            updated = acl_dict.get('updated')
            self.add_operation_acl(operation_type=op_type,
                                   project_access=proj_access,
                                   users=users, created=created,
                                   updated=updated)

    def validate_input_ref(self):
        res_title = self._acl_type.title()
        if not self.entity_ref:
            raise ValueError('{0} href is required.'.format(res_title))
        if self._parent_entity_path in self.entity_ref:
            if '/acl' in self.entity_ref:
                raise ValueError('{0} ACL URI provided. Expecting {0} URI.'
                                 .format(res_title))
            ref_type = self._acl_type
        else:
            raise ValueError('{0} URI is not specified.'.format(res_title))

        base.validate_ref(self.entity_ref, ref_type)
        return ref_type

    @staticmethod
    def get_acl_ref_from_entity_ref(entity_ref):
        # Utility for converting entity ref to acl ref
        if entity_ref:
            entity_ref = entity_ref.rstrip('/')
            return '{0}/{1}'.format(entity_ref, ACL._resource_name)

    @staticmethod
    def identify_ref_type(entity_ref):
        # Utility for identifying ACL type from given entity URI.
        if not entity_ref:
            raise ValueError('Secret or container href is required.')
        if '/secrets' in entity_ref:
            ref_type = 'secret'
        elif '/containers' in entity_ref:
            ref_type = 'container'
        else:
            raise ValueError('Secret or container URI is not specified.')

        return ref_type


class SecretACL(ACL):
    """ACL entity for a secret"""

    columns = ACLFormatter.columns + ("Secret ACL Ref",)
    _acl_type = 'secret'
    _parent_entity_path = '/secrets'

    @property
    def acl_type(self):
        return self._acl_type


class ContainerACL(ACL):
    """ACL entity for a container"""

    columns = ACLFormatter.columns + ("Container ACL Ref",)
    _acl_type = 'container'
    _parent_entity_path = '/containers'

    @property
    def acl_type(self):
        return self._acl_type


class ACLManager(base.BaseEntityManager):
    """Entity Manager for Secret or Container ACL entities"""

    acl_class_map = {
        'secret': SecretACL,
        'container': ContainerACL
    }

    def __init__(self, api):
        super(ACLManager, self).__init__(api, ACL._resource_name)

    def create(self, entity_ref=None, users=None, project_access=None,
               operation_type=DEFAULT_OPERATION_TYPE):
        """
        Factory method for creating `ACL` entity.

        `ACL` object returned by this method have not yet been
        stored in Barbican.

        Input entity_ref is used to determine whether
        ACL object type needs to be :class:`barbicanclient.acls.SecretACL`
        or  :class:`barbicanclient.acls.ContainerACL`.

        :param str entity_ref: Full HATEOAS reference to a secret or container
        :param users: List of Keystone userid(s) to be used in ACL.
        :type users: List or None
        :param bool project_access: Flag indicating project access behavior
        :param str operation_type: Type indicating which class of Barbican
            operations this ACL is defined for e.g. 'read' operations
        :returns: ACL object instance
        :rtype: :class:`barbicanclient.acls.SecretACL` or
            :class:`barbicanclient.acls.ContainerACL`
        """
        entity_type = ACL.identify_ref_type(entity_ref)

        entity_class = ACLManager.acl_class_map.get(entity_type)
        # entity_class cannot be None as entity_ref is already validated above
        return entity_class(api=self._api, entity_ref=entity_ref, users=users,
                            project_access=project_access,
                            operation_type=operation_type)

    def get(self, entity_ref):
        """
        Retrieve existing ACLs for a secret or container defined in Barbican

        :param str entity_ref: Full HATEOAS reference to a secret or container.
        :returns: ACL entity object instance
        :rtype: :class:`barbicanclient.acls.SecretACL` or
            :class:`barbicanclient.acls.ContainerACL`
        :raises barbicanclient.exceptions.HTTPAuthError: 401 Responses
        :raises barbicanclient.exceptions.HTTPClientError: 4xx Responses
        """
        entity = self._validate_acl_ref(entity_ref)
        LOG.debug('Getting ACL for {0} href: {1}'
                  .format(entity.acl_type, entity.acl_ref))
        entity.load_acls_data()
        return entity

    def _validate_acl_ref(self, entity_ref):
        if entity_ref is None:
            raise ValueError('Expected secret or container URI is not '
                             'specified.')

        entity_ref = entity_ref.rstrip('/')
        entity_type = ACL.identify_ref_type(entity_ref)

        entity_class = ACLManager.acl_class_map.get(entity_type)
        acl_entity = entity_class(api=self._api, entity_ref=entity_ref)
        acl_entity.validate_input_ref()
        return acl_entity