Class: Conjur::Policy::Planner::Base

Inherits:
Object
  • Object
show all
Includes:
Logger
Defined in:
lib/conjur/policy/planner/base.rb

Direct Known Subclasses

Deny, Grant, Permit, Policy, Record, Resource, Revoke, Role

Instance Attribute Summary collapse

Instance Method Summary collapse

Methods included from Logger

included

Constructor Details

#initialize(record, api) ⇒ Base

Returns a new instance of Base.



10
11
12
13
14
 
# File 'lib/conjur/policy/planner/base.rb', line 10

def initialize record, api
  raise "Expecting Conjur::Policy::Types::Base, got #{record.class}" unless record.is_a?(Conjur::Policy::Types::Base)
  @record = record
  @api = api
end

Instance Attribute Details

#api ⇒ Object (readonly)

Returns the value of attribute api.



7
8
9
 
# File 'lib/conjur/policy/planner/base.rb', line 7

def api
  @api
end

#plan ⇒ Object

Returns the value of attribute plan.



8
9
10
 
# File 'lib/conjur/policy/planner/base.rb', line 8

def plan
  @plan
end

#record ⇒ Object (readonly)

Returns the value of attribute record.



7
8
9
 
# File 'lib/conjur/policy/planner/base.rb', line 7

def record
  @record
end

Instance Method Details

#account ⇒ Object 



20
21
22
 
# File 'lib/conjur/policy/planner/base.rb', line 20

def 
  record.
end

#action(a) ⇒ Object 



16
17
18
 
# File 'lib/conjur/policy/planner/base.rb', line 16

def action a
  @plan.action a
end

#create_record ⇒ Object 



138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
 
# File 'lib/conjur/policy/planner/base.rb', line 138

def create_record
  log { "Creating #{record}" }
    
  create = Conjur::Policy::Types::Create.new
  create.record = record
  
  if record.resource?
    existing = resource.exists? ? resource.annotations : {}
    # And this is why we don't name a class Array.
    current  = record.annotations.kind_of?(::Array) ? record.annotations[0] : record.annotations
    (current||{}).keys.each do |attr|
      existing_value = existing[attr]
      new_value = current[attr]
      if new_value == existing_value
       current.delete attr
      end
    end
  end

  plan.roles_created.add(record.roleid) if record.role?
  plan.resources_created.add(record.resourceid) if record.resource?
  action create
end

#error(message) ⇒ Object 



60
61
62
63
 
# File 'lib/conjur/policy/planner/base.rb', line 60

def error message
  # For now raise it, we can think about trying to recover down the road
  raise message
end

#log(&block) ⇒ Object 



65
66
67
68
69
 
# File 'lib/conjur/policy/planner/base.rb', line 65

def log &block
  logger.debug('conjur/policy/planner') {
    yield
  }
end

#resource ⇒ Object 



32
33
34
 
# File 'lib/conjur/policy/planner/base.rb', line 32

def resource
  api.resource(record.resourceid)
end

#resource_exists?(resource) ⇒ Boolean

Returns:

  • (Boolean) 


40
41
42
43
 
# File 'lib/conjur/policy/planner/base.rb', line 40

def resource_exists? resource
  resource_id = resource.respond_to?(:resourceid) ? resource.resourceid : resource.to_s
  (plan.resources_created.include?(resource_id) ||  api.resource(resource_id).exists?)
end

#resource_record(fullid) ⇒ Object 



28
29
30
 
# File 'lib/conjur/policy/planner/base.rb', line 28

def resource_record fullid
  detect_record fullid, Conjur::Policy::Types::Resource
end

#role ⇒ Object 



36
37
38
 
# File 'lib/conjur/policy/planner/base.rb', line 36

def role
  api.role(record.roleid)
end

#role_exists?(role) ⇒ Boolean

Returns:

  • (Boolean) 


45
46
47
48
49
50
51
52
53
54
55
56
57
58
 
# File 'lib/conjur/policy/planner/base.rb', line 45

def role_exists? role
  role_id = role.respond_to?(:roleid) ? role.roleid : role.to_s
  
  , kind, id = role_id.split(':', 3)
  if kind == "@"
    # For managed role, check if the parent record will be created
    role_tokens = id.split('/')
    # This is the role_name
    role_tokens.pop
    role_kind = role_tokens.shift
    role_id = [ , role_kind, role_tokens.join('/') ].join(":")
  end
  plan.roles_created.include?(role_id) || api.role(role_id).exists?
end

#role_record(fullid) ⇒ Object 



24
25
26
 
# File 'lib/conjur/policy/planner/base.rb', line 24

def role_record fullid
  detect_record fullid, Conjur::Policy::Types::Role
end

#update_record ⇒ Object 



71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
 
# File 'lib/conjur/policy/planner/base.rb', line 71

def update_record
  log { "Updating #{record}" }
  
  update = Conjur::Policy::Types::Update.new
  update.record = record

  changed = false
  record.custom_attribute_names.each do |attr|
    existing_value = if object.respond_to?(attr) 
      object.send(attr)
    else
      object.attributes[attr.to_s]
    end
    new_value = record.send(attr)
    if new_value
      if new_value == existing_value
        record.send "#{attr}=", nil
      else
        raise "Cannot modify immutable attribute '#{record.resource_kind}.#{attr}'" if record.immutable_attribute_names.member?(attr)
        log { "Attribute #{attr} will be updated" }
        changed = true
      end
    end
  end
  
  if record.resource?
    existing = resource.exists? ? resource.annotations : {}
    current = record.annotations.kind_of?(::Array) ? record.annotations[0] : record.annotations
    (record.annotations||{}).keys.each do |attr|
      existing_value = existing[attr]
      new_value = record.annotations[attr]
      if new_value == existing_value
        record.annotations.delete attr
      else
        log { "Annotation #{attr} will be updated" }
        changed = true
      end
    end
    
    log { "Record owner is #{record.owner.roleid}" }
    log { "Resource owner is #{resource.owner}" }
    if record.owner && resource.owner != record.owner.roleid
      log { "Resource owner will be changed to #{record.owner.roleid}" }

      give = Conjur::Policy::Types::Give.new
      give.resource = Conjur::Policy::Types::Resource.new(record.resourceid)
      give.owner = Conjur::Policy::Types::Role.new(record.owner.roleid)
      action give
    end
  end

  if record.role?
    unless api.role(record.owner.roleid).can_admin_role?(role)
      log { "Role will be granted to #{record.owner.roleid} with admin option" }
  
      grant = Conjur::Policy::Types::Grant.new
      grant.role = Conjur::Policy::Types::Role.new(record.roleid)
      grant.member = Conjur::Policy::Types::Member.new
      grant.member.role = Conjur::Policy::Types::Role.new(record.owner.roleid)
      grant.member.admin = true
      action grant
    end
  end
  
  action update if changed
end