Class: Conjur::Policy::Planner::Base

Inherits:
Object
  • Object
show all
Includes:
Logger
Defined in:
lib/conjur/policy/planner/base.rb

Direct Known Subclasses

Deny, Grant, Permit, Policy, Record, Resource, Revoke, Role

Instance Attribute Summary collapse

Instance Method Summary collapse

Methods included from Logger

included

Constructor Details

#initialize(record, api) ⇒ Base

Returns a new instance of Base.



10
11
12
13
14
 
# File 'lib/conjur/policy/planner/base.rb', line 10

def initialize record, api
  raise "Expecting Conjur::Policy::Types::Base, got #{record.class}" unless record.is_a?(Conjur::Policy::Types::Base)
  @record = record
  @api = api
end

Instance Attribute Details

#api ⇒ Object (readonly)

Returns the value of attribute api.



7
8
9
 
# File 'lib/conjur/policy/planner/base.rb', line 7

def api
  @api
end

#plan ⇒ Object

Returns the value of attribute plan.



8
9
10
 
# File 'lib/conjur/policy/planner/base.rb', line 8

def plan
  @plan
end

#record ⇒ Object (readonly)

Returns the value of attribute record.



7
8
9
 
# File 'lib/conjur/policy/planner/base.rb', line 7

def record
  @record
end

Instance Method Details

#account ⇒ Object 



20
21
22
 
# File 'lib/conjur/policy/planner/base.rb', line 20

def 
  record.
end

#action(a) ⇒ Object 



16
17
18
 
# File 'lib/conjur/policy/planner/base.rb', line 16

def action a
  @plan.action a
end

#create_record ⇒ Object 



147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
 
# File 'lib/conjur/policy/planner/base.rb', line 147

def create_record
  create = Conjur::Policy::Types::Create.new
  create.record = record
  
  if record.resource?
    existing = resource.exists? ? resource.annotations : {}
    # And this is why we don't name a class Array.
    current  = record.annotations.kind_of?(::Array) ? record.annotations[0] : record.annotations
    (current||{}).keys.each do |attr|
      existing_value = existing[attr]
      new_value = current[attr]
      if new_value == existing_value
       current.delete attr
      end
    end
  end

  plan.roles_created.add(record.roleid) if record.role?
  plan.resources_created.add(record.resourceid) if record.resource?
  action create
end

#error(message) ⇒ Object 



81
82
83
84
 
# File 'lib/conjur/policy/planner/base.rb', line 81

def error message
  # For now raise it, we can think about trying to recover down the road
  raise message
end

#log(&block) ⇒ Object 



86
87
88
89
90
 
# File 'lib/conjur/policy/planner/base.rb', line 86

def log &block
  logger.debug('conjur/policy/planner') {
    yield
  }
end

#record_type(kind) ⇒ Object 



43
44
45
46
47
48
49
 
# File 'lib/conjur/policy/planner/base.rb', line 43

def record_type kind
  begin
    Conjur::Policy::Types.const_get(kind.classify)
  rescue NameError
    nil
  end
end

#resource ⇒ Object 



53
54
55
 
# File 'lib/conjur/policy/planner/base.rb', line 53

def resource
  api.resource(record.resourceid)
end

#resource_exists?(resource) ⇒ Boolean

Returns:

  • (Boolean) 


61
62
63
64
 
# File 'lib/conjur/policy/planner/base.rb', line 61

def resource_exists? resource
  resource_id = resource.respond_to?(:resourceid) ? resource.resourceid : resource.to_s
  (plan.resources_created.include?(resource_id) ||  api.resource(resource_id).exists?)
end

#role ⇒ Object 



57
58
59
 
# File 'lib/conjur/policy/planner/base.rb', line 57

def role
  api.role(record.roleid)
end

#role_exists?(role) ⇒ Boolean

Returns:

  • (Boolean) 


66
67
68
69
70
71
72
73
74
75
76
77
78
79
 
# File 'lib/conjur/policy/planner/base.rb', line 66

def role_exists? role
  role_id = role.respond_to?(:roleid) ? role.roleid : role.to_s
  
  , kind, id = role_id.split(':', 3)
  if kind == "@"
    # For managed role, check if the parent record will be created
    role_tokens = id.split('/')
    # This is the role_name
    role_tokens.pop
    role_kind = role_tokens.shift
    role_id = [ , role_kind, role_tokens.join('/') ].join(":")
  end
  plan.roles_created.include?(role_id) || api.role(role_id).exists?
end

#role_record(fullid) ⇒ Object Also known as: resource_record 



24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
 
# File 'lib/conjur/policy/planner/base.rb', line 24

def role_record fullid
  , kind, id = fullid.split(':', 3)
  if kind == '@'
    Conjur::Policy::Types::ManagedRole.build fullid
  else
    if record_class = record_type(kind)
      record_class.new.tap do |record|
        record. = 
        unless record.is_a?(Conjur::Policy::Types::Variable)
          record.kind = kind if record.respond_to?(:kind=)
        end
        record.id = id
      end
    else
      Conjur::Policy::Types::Role.new(fullid)
    end
  end
end

#update_record ⇒ Object 



92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
 
# File 'lib/conjur/policy/planner/base.rb', line 92

def update_record
  update = Conjur::Policy::Types::Update.new
  update.record = record

  changed = false
  record.custom_attribute_names.each do |attr|
    existing_value = if object.respond_to?(attr) 
      object.send(attr)
    else
      object.attributes[attr.to_s]
    end
    new_value = record.send(attr)
    if new_value
      if new_value == existing_value
        record.send "#{attr}=", nil
      else
        raise "Cannot modify immutable attribute '#{record.resource_kind}.#{attr}'" if record.immutable_attribute_names.member?(attr)
        changed = true
      end
    end
  end
  
  if record.resource?
    existing = resource.exists? ? resource.annotations : {}
    current = record.annotations.kind_of?(::Array) ? record.annotations[0] : record.annotations
    (record.annotations||{}).keys.each do |attr|
      existing_value = existing[attr]
      new_value = record.annotations[attr]
      if new_value == existing_value
        record.annotations.delete attr
      else
        changed = true
      end
    end
    
    if record.owner && resource.owner != record.owner.roleid
      give = Conjur::Policy::Types::Give.new
      give.resource = Conjur::Policy::Types::Resource.new(record.resourceid)
      give.owner = Conjur::Policy::Types::Role.new(record.owner.roleid)
      action give
      
      if record.role?
        grant = Conjur::Policy::Types::Grant.new
        grant.role = Conjur::Policy::Types::Role.new(record.roleid)
        grant.member = Conjur::Policy::Types::Member.new
        grant.member.role = Conjur::Policy::Types::Role.new(record.owner.roleid)
        grant.member.admin = true
        action grant
      end
    end
  end
  
  action update if changed
end