chef-zero 4.5.0 → 4.6.0

data/lib/chef_zero/endpoints/actor_key_endpoint.rb

@@ -0,0 +1,62 @@
+require 'chef_zero/rest_base'
+
+module ChefZero
+  module Endpoints
+    # ActorKeyEndpoint
+    #
+    # This class handles DELETE/GET/PUT requests for all client/user keys
+    # **except** default public keys, i.e. requests with identity key
+    # "default". Those are handled by ActorDefaultKeyEndpoint. See that class
+    # for more information.
+    #
+    # /users/USER/keys/NAME
+    # /organizations/ORG/clients/CLIENT/keys/NAME
+    class ActorKeyEndpoint < RestBase
+      def get(request)
+        validate_actor!(request)
+        key_path = data_path(request)
+        already_json_response(200, get_data(request, key_path))
+      end
+
+      def delete(request)
+        validate_actor!(request) # 404 if actor doesn't exist
+
+        key_path = data_path(request)
+        data = get_data(request, key_path)
+        delete_data(request, key_path)
+
+        already_json_response(200, data)
+      end
+
+      def put(request)
+        validate_actor!(request) # 404 if actor doesn't exist
+        set_data(request, data_path(request), request.body)
+      end
+
+      private
+
+      # Returns the keys data store path, which is the same as
+      # `request.rest_path` except with "client_keys" instead of "clients" or
+      # "user_keys" instead of "users."
+      def data_path(request)
+        request.rest_path.dup.tap do |path|
+          if client?(request)
+            path[2] = "client_keys"
+          else
+            path[0] = "user_keys"
+          end
+        end
+      end
+
+      # Raises RestErrorResponse (404) if actor doesn't exist
+      def validate_actor!(request)
+        actor_path = request.rest_path[ client?(request) ? 0..3 : 0..1 ]
+        get_data(request, actor_path)
+      end
+
+      def client?(request)
+        request.rest_path[2] == "clients"
+      end
+    end
+  end
+end

data/lib/chef_zero/endpoints/actor_keys_endpoint.rb

@@ -0,0 +1,129 @@
+require 'chef_zero/rest_base'
+
+module ChefZero
+  module Endpoints
+    # /users/USER/keys
+    # /organizations/ORG/clients/CLIENT/keys
+    class ActorKeysEndpoint < RestBase
+      DEFAULT_PUBLIC_KEY_NAME = "default"
+      DATE_FORMAT = "%FT%TZ" # e.g. 2015-12-24T21:00:00Z
+
+      def get(request, alt_uri_root=nil)
+        path = data_path(request)
+
+        # Get actor or 404 if it doesn't exist
+        actor_json = get_data(request, actor_path(request))
+
+        key_names = list_data_or_else(request, path, [])
+        key_names.unshift(DEFAULT_PUBLIC_KEY_NAME) if actor_has_default_public_key?(actor_json)
+
+        result = key_names.map do |key_name|
+          list_key(request, [ *path, key_name ], alt_uri_root)
+        end
+
+        json_response(200, result)
+      end
+
+      def post(request)
+        request_body = parse_json(request.body)
+
+        # Try loading the client or user so a 404 is returned if it doesn't exist
+        actor_json = get_data(request, actor_path(request))
+
+        generate_keys = request_body["public_key"].nil?
+
+        if generate_keys
+          private_key, public_key = server.gen_key_pair
+        else
+          public_key = request_body['public_key']
+        end
+
+        key_name = request_body["name"]
+
+        if key_name == DEFAULT_PUBLIC_KEY_NAME
+          store_actor_default_public_key!(request, actor_json, public_key)
+        else
+          store_actor_public_key!(request, key_name, public_key, request_body["expiration_date"])
+        end
+
+        response_body = { "uri" => key_uri(request, key_name) }
+        response_body["private_key"] = private_key if generate_keys
+
+        json_response(201, response_body,
+                      headers: { "Location" => response_body["uri"] })
+      end
+
+      private
+
+      def store_actor_public_key!(request, name, public_key, expiration_date)
+        data = to_json(
+          "name" => name,
+          "public_key" => public_key,
+          "expiration_date" => expiration_date
+        )
+
+        create_data(request, data_path(request), name, data, :create_dir)
+      end
+
+      def store_actor_default_public_key!(request, actor_json, public_key)
+        actor_data = parse_json(actor_json)
+
+        if actor_data["public_key"]
+          raise RestErrorResponse.new(409, "Object already exists: #{key_uri(request, DEFAULT_PUBLIC_KEY_NAME)}")
+        end
+
+        actor_data["public_key"] = public_key
+        set_data(request, actor_path(request), to_json(actor_data))
+
+      end
+
+      # Returns the keys data store path, which is the same as
+      # `request.rest_path` except with "user_keys" instead of "users" or
+      # "client_keys" instead of "clients."
+      def data_path(request)
+        request.rest_path.dup.tap do |path|
+          if client?(request)
+            path[2] = "client_keys"
+          else
+            path[0] = "user_keys"
+          end
+        end
+      end
+
+      def list_key(request, data_path, alt_uri_root=nil)
+        key_name, expiration_date =
+          if data_path[-1] == DEFAULT_PUBLIC_KEY_NAME
+            [ DEFAULT_PUBLIC_KEY_NAME, "infinity" ]
+          else
+            parse_json(get_data(request, data_path))
+              .values_at("name", "expiration_date")
+          end
+
+        expired = expiration_date != "infinity" &&
+          DateTime.now > DateTime.strptime(expiration_date, DATE_FORMAT)
+
+        { "name" => key_name,
+          "uri" => key_uri(request, key_name, alt_uri_root),
+          "expired" => expired }
+      end
+
+      def client?(request)
+        request.rest_path[2] == "clients"
+      end
+
+      def key_uri(request, key_name, alt_uri_root=nil)
+        uri_root = alt_uri_root.nil? ? request.rest_path : alt_uri_root
+        build_uri(request.base_uri, [ *uri_root, key_name ])
+      end
+
+      def actor_path(request)
+        return request.rest_path[0..3] if client?(request)
+        request.rest_path[0..1]
+      end
+
+      def actor_has_default_public_key?(actor_json)
+        !!parse_json(actor_json)["public_key"]
+      end
+    end
+  end
+end

data/lib/chef_zero/endpoints/actors_endpoint.rb

@@ -9,29 +9,29 @@ module ChefZero
         response = super(request)
 
         if request.query_params['email']
-          results = FFI_Yajl::Parser.parse(response[2], :create_additions => false)
+          results = parse_json(response[2])
           new_results = {}
           results.each do |name, url|
             record = get_data(request, request.rest_path + [ name ], :nil)
             if record
-              record = FFI_Yajl::Parser.parse(record, :create_additions => false)
+              record = parse_json(record)
               new_results[name] = url if record['email'] == request.query_params['email']
             end
           end
-          response[2] = FFI_Yajl::Encoder.encode(new_results, :pretty => true)
+          response[2] = to_json(new_results)
         end
 
         if request.query_params['verbose']
-          results = FFI_Yajl::Parser.parse(response[2], :create_additions => false)
+          results = parse_json(response[2])
           results.each do |name, url|
             record = get_data(request, request.rest_path + [ name ], :nil)
             if record
-              record = FFI_Yajl::Parser.parse(record, :create_additions => false)
+              record = parse_json(record)
               record = ChefData::DataNormalizer.normalize_user(record, name, identity_keys, server.options[:osc_compat])
               results[name] = record
             end
           end
-          response[2] = FFI_Yajl::Encoder.encode(results, :pretty => true)
+          response[2] = to_json(results)
         end
         response
       end
@@ -39,21 +39,47 @@ module ChefZero
       def post(request)
         # First, find out if the user actually posted a public key.  If not, make
         # one.
-        request_body = FFI_Yajl::Parser.parse(request.body, :create_additions => false)
+        request_body = parse_json(request.body)
         public_key = request_body['public_key']
-        if !public_key
+
+        skip_key_create = !request.api_v0? && !request_body["create_key"]
+
+        if !public_key && !skip_key_create
           private_key, public_key = server.gen_key_pair
           request_body['public_key'] = public_key
-          request.body = FFI_Yajl::Encoder.encode(request_body, :pretty => true)
+          request.body = to_json(request_body)
+        elsif skip_key_create
+          request_body['public_key'] = nil
+          request.body = to_json(request_body)
         end
 
         result = super(request)
 
         if result[0] == 201
           # If we generated a key, stuff it in the response.
-          response = FFI_Yajl::Parser.parse(result[2], :create_additions => false)
-          response['private_key'] = private_key if private_key
-          response['public_key'] = public_key unless request.rest_path[0] == 'users'
+          user_data = parse_json(result[2])
+
+          key_data = {}
+          key_data['private_key'] = private_key if private_key
+          key_data['public_key'] = public_key unless request.rest_path[0] == 'users'
+
+          response =
+            if request.api_v0?
+              user_data.merge(key_data)
+            elsif skip_key_create && !public_key
+              user_data
+            else
+              actor_name = request_body["name"] || request_body["username"] || request_body["clientname"]
+
+              relpath_to_default_key = [ actor_name, "keys", "default" ]
+              key_data["uri"] = build_uri(request.base_uri, request.rest_path + relpath_to_default_key)
+              key_data["public_key"] = public_key
+              key_data["name"] = "default"
+              key_data["expiration_date"] = "infinity"
+              user_data["chef_key"] = key_data
+              user_data
+            end
+
           json_response(201, response)
         else
           result

data/lib/chef_zero/endpoints/organization_user_default_key_endpoint.rb

@@ -0,0 +1,16 @@
+require 'chef_zero/rest_base'
+
+module ChefZero
+  module Endpoints
+    # GET /organizations/ORG/users/USER/keys/default
+    class OrganizationUserDefaultKeyEndpoint < RestBase
+      def get(request)
+        # 404 if it doesn't exist
+        get_data(request, request.rest_path[0..3])
+        # Just use the /users/USER/keys/default endpoint
+        request.rest_path = request.rest_path[2..-1]
+        ActorDefaultKeyEndpoint.new(server).get(request)
+      end
+    end
+  end
+end

data/lib/chef_zero/endpoints/organization_user_key_endpoint.rb

@@ -0,0 +1,17 @@
+require 'chef_zero/rest_base'
+require 'chef_zero/endpoints/actor_keys_endpoint'
+
+module ChefZero
+  module Endpoints
+    # GET /organizations/ORG/users/USER/keys/NAME
+    class OrganizationUserKeyEndpoint < RestBase
+      def get(request)
+        # 404 if not a member of the org
+        get_data(request, request.rest_path[0..3])
+        # Just use the /users/USER/keys endpoint
+        request.rest_path = request.rest_path[2..-1]
+        ActorKeyEndpoint.new(server).get(request)
+      end
+    end
+  end
+end

data/lib/chef_zero/endpoints/organization_user_keys_endpoint.rb

@@ -0,0 +1,17 @@
+require 'chef_zero/rest_base'
+
+module ChefZero
+  module Endpoints
+    # GET /organizations/ORG/users/USER/keys
+    class OrganizationUserKeysEndpoint < RestBase
+      def get(request)
+        # 404 if it doesn't exist
+        get_data(request, request.rest_path[0..3])
+        # Just use the /users/USER/keys/key endpoint
+        original_path = request.rest_path
+        request.rest_path = request.rest_path[2..-1]
+        ActorKeysEndpoint.new(server).get(request, original_path)
+      end
+    end
+  end
+end

data/lib/chef_zero/endpoints/principal_endpoint.rb

@@ -30,13 +30,22 @@ module ChefZero
           end
         end
         if json
-          json_response(200, {
+          principal_data = {
             'name' => name,
             'type' => type,
             'public_key' => FFI_Yajl::Parser.parse(json)['public_key'] || PUBLIC_KEY,
             'authz_id' => '0'*32,
             'org_member' => org_member
-          })
+          }
+
+          response_data =
+            if request.api_v0?
+              principal_data
+            else
+              { "principals" => [ principal_data ] }
+            end
+
+          json_response(200, response_data)
         else
           error(404, 'Principal not found')
         end

data/lib/chef_zero/endpoints/rest_object_endpoint.rb

@@ -21,12 +21,11 @@ module ChefZero
       def put(request)
         # We grab the old body to trigger a 404 if it doesn't exist
         old_body = get_data(request)
-        request_json = FFI_Yajl::Parser.parse(request.body, :create_additions => false)
-        key = identity_keys.map { |k| request_json[k] }.select { |v| v }.first
-        key ||= request.rest_path[-1]
+
         # If it's a rename, check for conflict and delete the old value
-        rename = key != request.rest_path[-1]
-        if rename
+        if is_rename?(request)
+          key = identity_key_value(request)
+
           begin
             create_data(request, request.rest_path[0..-2], key, request.body, :data_store_exceptions)
           rescue DataStore::DataAlreadyExistsError
@@ -56,8 +55,23 @@ module ChefZero
             return FFI_Yajl::Encoder.encode(merged_json, :pretty => true)
           end
         end
+
         request.body
       end
+
+      private
+
+      # Get the value of the (first existing) identity key from the request body or nil
+      def identity_key_value(request)
+        request_json = parse_json(request.body)
+        identity_keys.map { |k| request_json[k] }.compact.first
+      end
+
+      # Does this request change the value of the identity key?
+      def is_rename?(request)
+        return false unless key = identity_key_value(request)
+        key != request.rest_path[-1]
+      end
     end
   end
 end

data/lib/chef_zero/endpoints/server_api_version_endpoint.rb

@@ -7,7 +7,7 @@ module ChefZero
       API_VERSION = 1
       def get(request)
         json_response(200, {"min_api_version"=>MIN_API_VERSION, "max_api_version"=>MAX_API_VERSION},
-          request.api_version, API_VERSION)
+          request_version: request.api_version, response_version: API_VERSION)
       end
     end
   end

data/lib/chef_zero/rest_base.rb

@@ -5,6 +5,9 @@ require 'chef_zero/chef_data/acl_path'
 
 module ChefZero
   class RestBase
+    DEFAULT_REQUEST_VERSION = 0
+    DEFAULT_RESPONSE_VERSION = 0
+
     def initialize(server)
       @server = server
     end
@@ -16,21 +19,28 @@ module ChefZero
     end
 
     def check_api_version(request)
-      version = request.api_version
-      return nil if version.nil? # Not present in headers
+      return if request.api_version.nil? # Not present in headers
+      version = request.api_version.to_i
+
+      unless version.to_s == request.api_version.to_s # Version is not an Integer
+        return json_response(406,
+          { "username" => request.requestor },
+          request_version: -1, response_version: -1
+        )
+      end
 
-      if version.to_i.to_s != version.to_s # Version is not an Integer
-        return json_response(406, { "username" => request.requestor }, -1, -1)
-      elsif version.to_i > MAX_API_VERSION or version.to_i < MIN_API_VERSION
+      if version > MAX_API_VERSION || version < MIN_API_VERSION
         response = {
           "error" => "invalid-x-ops-server-api-version",
           "message" => "Specified version #{version} not supported",
           "min_api_version" => MIN_API_VERSION,
           "max_api_version" => MAX_API_VERSION
         }
-        return json_response(406, response, version, -1)
-      else
-        return nil
+
+        return json_response(406,
+          response,
+          request_version: version, response_version: -1
+        )
       end
     end
 
@@ -51,7 +61,7 @@ module ChefZero
       begin
         self.send(method, request)
       rescue RestErrorResponse => e
-        ChefZero::Log.debug("#{e.inspect}\n#{e.backtrace.join("\n")}")
+        ChefZero::Log.info("#{e.inspect}\n#{e.backtrace.join("\n")}")
         error(e.response_code, e.error)
       end
     end
@@ -104,7 +114,7 @@ module ChefZero
         if options.include?(:data_store_exceptions)
           raise
         else
-          raise RestErrorResponse.new(404, "Object not found: #{build_uri(request.base_uri, request.rest_path)}")
+          raise RestErrorResponse.new(404, "Object not found: #{build_uri(request.base_uri, rest_path)}")
         end
       end
 
@@ -123,7 +133,7 @@ module ChefZero
         if options.include?(:data_store_exceptions)
           raise
         else
-          raise RestErrorResponse.new(404, "Object not found: #{build_uri(request.base_uri, request.rest_path)}")
+          raise RestErrorResponse.new(404, "Object not found: #{build_uri(request.base_uri, rest_path)}")
         end
       end
 
@@ -142,7 +152,7 @@ module ChefZero
         if options.include?(:data_store_exceptions)
           raise
         else
-          raise RestErrorResponse.new(404, "Object not found: #{build_uri(request.base_uri, request.rest_path)}")
+          raise RestErrorResponse.new(404, "Object not found: #{build_uri(request.base_uri, rest_path)}")
         end
       end
     end
@@ -155,13 +165,13 @@ module ChefZero
         if options.include?(:data_store_exceptions)
           raise
         else
-          raise RestErrorResponse.new(404, "Parent not found: #{build_uri(request.base_uri, request.rest_path)}")
+          raise RestErrorResponse.new(404, "Parent not found: #{build_uri(request.base_uri, rest_path)}")
         end
       rescue DataStore::DataAlreadyExistsError
         if options.include?(:data_store_exceptions)
           raise
         else
-          raise RestErrorResponse.new(409, "Object already exists: #{build_uri(request.base_uri, request.rest_path + [name])}")
+          raise RestErrorResponse.new(409, "Object already exists: #{build_uri(request.base_uri, rest_path + [name])}")
         end
       end
     end
@@ -174,13 +184,13 @@ module ChefZero
         if options.include?(:data_store_exceptions)
           raise
         else
-          raise RestErrorResponse.new(404, "Parent not found: #{build_uri(request.base_uri, request.rest_path)}")
+          raise RestErrorResponse.new(404, "Parent not found: #{build_uri(request.base_uri, rest_path)}")
         end
       rescue DataStore::DataAlreadyExistsError
         if options.include?(:data_store_exceptions)
           raise
         else
-          raise RestErrorResponse.new(409, "Object already exists: #{build_uri(request.base_uri, request.rest_path + [name])}")
+          raise RestErrorResponse.new(409, "Object already exists: #{build_uri(request.base_uri, rest_path + [name])}")
         end
       end
     end
@@ -196,26 +206,59 @@ module ChefZero
     end
 
     def error(response_code, error, opts={})
-      json_response(response_code, {"error" => [error]}, 0, 0, opts)
+      json_response(response_code, { "error" => [ error ] }, opts)
     end
 
-    def json_response(response_code, json, request_version=0, response_version=0, opts={pretty: true})
-      do_pretty_json = !!opts[:pretty]    # make sure we have a proper Boolean.
-      already_json_response(response_code, FFI_Yajl::Encoder.encode(json, :pretty => do_pretty_json), request_version, response_version)
+    # Serializes `data` to JSON and returns an Array with the
+    # response code, HTTP headers and JSON body.
+    #
+    # @param [Fixnum] response_code HTTP response code
+    # @param [Hash] data The data for the response body as a Hash
+    # @param [Hash] options
+    # @option options [Hash] :headers (see #already_json_response)
+    # @option options [Boolean] :pretty (true) Pretty-format the JSON
+    # @option options [Fixnum] :request_version (see #already_json_response)
+    # @option options [Fixnum] :response_version (see #already_json_response)
+    #
+    # @return (see #already_json_response)
+    #
+    def json_response(response_code, data, options={})
+      options = { pretty: true }.merge(options)
+      do_pretty_json = !!options.delete(:pretty) # make sure we have a proper Boolean.
+      json = FFI_Yajl::Encoder.encode(data, pretty: do_pretty_json)
+      already_json_response(response_code, json, options)
     end
 
     def text_response(response_code, text)
       [response_code, {"Content-Type" => "text/plain"}, text]
     end
 
-    def already_json_response(response_code, json_text, request_version=0, response_version=0)
-      header = { "min_version" => MIN_API_VERSION.to_s, "max_version" => MAX_API_VERSION.to_s,
-                 "request_version" => request_version.to_s,
-                 "response_version" => response_version.to_s }
-      [ response_code,
-        { "Content-Type" => "application/json",
-          "X-Ops-Server-API-Version" => FFI_Yajl::Encoder.encode(header) },
-        json_text ]
+    # Returns an Array with the response code, HTTP headers, and JSON body.
+    #
+    # @param [Fixnum] response_code The HTTP response code
+    # @param [String] json_text The JSON body for the response
+    # @param [Hash] options
+    # @option options [Hash] :headers ({}) HTTP headers (may override default headers)
+    # @option options [Fixnum] :request_version (0) Request API version
+    # @option options [Fixnum] :response_version (0) Response API version
+    #
+    # @return [Array(Fixnum, Hash{String => String}, String)]
+    #
+    def already_json_response(response_code, json_text, options={})
+      version_header = FFI_Yajl::Encoder.encode(
+        "min_version" => MIN_API_VERSION.to_s,
+        "max_version" => MAX_API_VERSION.to_s,
+        "request_version" => options[:request_version] || DEFAULT_REQUEST_VERSION.to_s,
+        "response_version" => options[:response_version] || DEFAULT_RESPONSE_VERSION.to_s
+      )
+
+      headers = {
+        "Content-Type" => "application/json",
+        "X-Ops-Server-API-Version" => version_header
+      }
+      headers.merge!(options[:headers]) if options[:headers]
+
+      [ response_code, headers, json_text ]
     end
 
     # To be called from inside rest endpoints
@@ -224,12 +267,12 @@ module ChefZero
         # Strip off /organizations/chef if we are in single org mode
         if rest_path[0..1] != [ 'organizations', server.options[:single_org] ]
           raise "Unexpected URL #{rest_path[0..1]} passed to build_uri in single org mode"
-        else
-          "#{base_uri}/#{rest_path[2..-1].join('/')}"
         end
-      else
-        "#{base_uri}/#{rest_path.join('/')}"
+
+        return self.class.build_uri(base_uri, rest_path[2..-1])
       end
+
+      self.class.build_uri(base_uri, rest_path)
     end
 
     def self.build_uri(base_uri, rest_path)