conjur-asset-dsl2 0.5.0 → 0.6.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 4e808b958cc3f5faac0227b00000b8b11d5ad255
-  data.tar.gz: 9f4f5bb57310b929f8b7d8f3e7785e39cb8441b1
+  metadata.gz: 57aa36f4305e541f313b8a833623d6100929ae50
+  data.tar.gz: dcabd391389d702f971b3a12aee54afadf53c914
 SHA512:
-  metadata.gz: f7f304a0432b4cb7fbea8b079c8b690c081c073833b257c8f5fb14e8b17fc3ba28f63436e33e506ec5f812ef6c6a60d64ae4e23eb5b35b22ea0ba20255846728
-  data.tar.gz: a52561942757c5fef6c95dfdcb83eb8c85b864e1d738337d4e72e5bcd587057610dd2d42efbd68a8f11853a911eaa8deb4a9940d5fe51ce248048c32e6f58776
+  metadata.gz: 62e2362f4202eaa0d48b0db4c597515531c592b63abcc8118bd88c1b8ce5ee9e4354e895ca1cf43dbea79e4a823d1d8c250c1fa5b724fca284a501fdbad695fb
+  data.tar.gz: 08a1ec598a5d4f23e1bb27dd939f5eaddeff097bcf0d9aebaf1ca8fabf6949134827daaf656d5a27c3d384b07dc7f5bf6b9e6a579a65f264109744f0e9dddb70

data/{CHANGELOG → CHANGELOG.md}

@@ -1,6 +1,13 @@
+# 0.6.0
+
+* Implement the !deny statement.
+* Eliminate un-necessary privilege and role revocations.
+
 # 0.5.0
 
 * Refactor how the policy statements are validated and normalized, fixing some bugs in the process.
+* In record ids, replace the string '$namespace' with the policy namespace. This enables cross-policy
+  entitlements to be made more flexibly. 
 
 # 0.4.4
 

data/Gemfile

@@ -2,3 +2,5 @@ source 'https://rubygems.org'
 
 # Specify your gem's dependencies in conjur-asset-dsl2.gemspec
 gemspec
+
+gem 'simplecov', require: false

data/conjur-asset-dsl2.gemspec

@@ -30,4 +30,5 @@ Gem::Specification.new do |spec|
   spec.add_development_dependency "ci_reporter_rspec"
   spec.add_development_dependency "aruba"
   spec.add_development_dependency 'io-grab'
+  spec.add_development_dependency 'simplecov'
 end

data/lib/conjur-asset-dsl2-version.rb

@@ -1,7 +1,7 @@
 module Conjur
   module Asset
     module DSL2
-      VERSION = "0.5.0"
+      VERSION = "0.6.0"
     end
   end
 end

data/lib/conjur/dsl2/planner/facts.rb

@@ -0,0 +1,179 @@
+module Conjur
+  module DSL2
+    module Planner
+      # Stores the state of existing and requested grants (roles or privileges).
+      # 
+      # The difference between the existing and requested grants can be used to determine
+      # specifically what actions should be performed in order to bring the state of the server
+      # into compliance with the policy.
+      class BaseFacts
+        attr_accessor :planner, :existing, :requested, :existing_with_admin_flag, :requested_with_admin_flag
+        
+        # Whether to sort the grants. By default this is off; turning it on makes the output
+        # deterministic which is nice for testing.
+        cattr_accessor :sort
+        
+        def initialize planner
+          @planner = planner
+          @requested = Set.new
+          @requested_with_admin_flag = Set.new
+          @existing  = Set.new
+          @existing_with_admin_flag  = Set.new
+        end
+        
+        def api
+          planner.api
+        end
+        
+        # Return the set of grants which are requested but not already held.
+        #
+        # Note that if a grant is held with a different admin option than requested,
+        # re-applying with the new admin option will update the grant and create
+        # the desired state.
+        def grants_to_apply
+          sort(requested_with_admin_flag - existing_with_admin_flag)
+        end
+        
+        # Return the set of grants which are held but not requested.
+        #
+        # The admin flag is ignored by this method. So, if a grant exists (with or without
+        # admin), and it is not requested (with or without admin), it is revoked. The
+        # case in which the grant is held with a different admin option than requested
+        # is handled by +grants_to_apply+.
+        def grants_to_revoke
+          sort(existing - requested)
+        end
+        
+        def validate_role_exists! role
+          error("Role not found: #{role}") unless planner.role_exists?(role)
+        end
+        
+        def validate_resource_exists! resource
+          error("Resource not found: #{resource}") unless planner.resource_exists?(resource)
+        end
+        
+        protected
+        
+        # Sort a result if +sort+ is enabled.
+        def sort result
+          self.class.sort ? result.to_a.sort : result
+        end
+      end
+      
+      # Role grants are a tuple of [ roleid, member_roleid, admin_option ].
+      class RoleFacts < BaseFacts
+        
+        # Enumerate all existing grants on the specified +role+.
+        # Each grant is yielded to the block.
+        def role_grants role, &block
+          begin
+            api.role(role.roleid).members
+          rescue RestClient::ResourceNotFound
+            if api.role(role.roleid).exists?
+              $stderr.puts "WARNING: Unable to fetch members of role #{role.roleid}. Use 'elevate' mode, or at least 'reveal' mode, for policy management."
+            end
+            []
+          end.each do |grant|
+            yield grant
+          end
+        end
+
+        # Validate that all the requested roles exist.
+        def validate!
+          requested.to_a.flatten.uniq.each do |roleid|
+            validate_role_exists! roleid
+          end
+        end
+
+        # Add a Types::Grant to the set of requested grants.
+        def add_requested_grant grant
+          Array(grant.roles).each do |role|
+            Array(grant.members).each do |member|
+              requested.add [ role.roleid, member.role.roleid ]
+              requested_with_admin_flag.add [ role.roleid, member.role.roleid, !!member.admin ]
+            end
+          end
+        end
+
+        # Removes a Types::Revoke from the set of requested grants.
+        def remove_revoked_grant revoke
+          Array(revoke.roles).each do |role|
+            Array(revoke.members).each do |member|
+              requested.delete [ role.roleid, member.roleid ]
+              requested_with_admin_flag.delete [ role.roleid, member.roleid, true ]
+              requested_with_admin_flag.delete [ role.roleid, member.roleid, false ]
+            end
+          end
+        end
+      
+        # Add a Conjur::API::Rolerevoke that is already held.
+        def add_existing_grant role, grant
+          existing.add [ role.roleid, grant.member.roleid ]
+          existing_with_admin_flag.add [ role.roleid, grant.member.roleid, grant.admin_option ]
+        end
+      end
+      
+      # Privilege grants are [ roleid, privilege, resourceid, grant_option ].
+      class PrivilegeFacts < BaseFacts
+        
+        # Enumerate all existing permissions for the specified +resource+.
+        # Only permissions that apply the specified +privilege+ are considered.
+        # Each permission is yielded to the block.
+        def resource_permissions resource, privileges, &block
+          permissions = begin
+            JSON.parse(api.resource(resource.resourceid).get)['permissions'] 
+          rescue RestClient::ResourceNotFound
+            if api.resource(resource.resourceid).exists?
+              $stderr.puts "WARNING: Unable to fetch permissions of resource #{resource.resourceid}. Use 'elevate' mode, or at least 'reveal' mode, for policy management."
+            end
+            []
+          end
+          permissions.select{|p| privileges.member?(p['privilege'])}.each do |permission|
+            yield permission
+          end
+        end
+        
+        # Validate that all the requested roles exist.
+        def validate!
+          requested.to_a.map{|row| row[0]}.uniq.each do |roleid|
+            validate_role_exists! roleid
+          end
+          requested.to_a.map{|row| row[2]}.uniq.each do |resourceid|
+            validate_resource_exists! resourceid
+          end
+        end
+        
+        # Add a Types::deny to the set of requested grants.
+        def add_requested_permission permit
+          Array(permit.roles).each do |member|
+            Array(permit.privileges).each do |privilege|
+              Array(permit.resources).each do |resource|
+                requested.add [ member.role.roleid, privilege, resource.resourceid ]
+                requested_with_admin_flag.add [ member.role.roleid, privilege, resource.resourceid, !!member.admin ]
+              end
+            end
+          end
+        end
+
+        # Removes a Types::Deny from the set of requested grants.
+        def remove_revoked_permission deny
+          Array(deny.roles).each do |role|
+            Array(deny.privileges).each do |privilege|
+              Array(deny.resources).each do |resource|
+                requested.delete [ role.roleid, privilege, resource.resourceid ]
+                requested_with_admin_flag.delete [ role.roleid, privilege, resource.resourceid, true ]
+                requested_with_admin_flag.delete [ role.roleid, privilege, resource.resourceid, false ]
+              end
+            end
+          end
+        end
+      
+        # Add a permission that is already held.
+        def add_existing_permission permission
+          existing.add [ permission['role'], permission['privilege'], permission['resource'] ]
+          existing_with_admin_flag.add [ permission['role'], permission['privilege'], permission['resource'], permission['grant_option'] ]
+        end
+      end
+    end
+  end
+end

data/lib/conjur/dsl2/planner/grants.rb

@@ -1,110 +1,77 @@
 require 'conjur/dsl2/planner/base'
+require 'conjur/dsl2/planner/facts'
 
 module Conjur
   module DSL2
     module Planner
-      class RoleAction < Base
-        def verify_roles_available roles
-          # Check all roles / members involved
-          roles.each do |role|
-            error("role not found: #{role.roleid} in #{plan.roles_created.to_a}") unless role_exists?(role)
-          end
-        end
-      end
-      
-      class Grant < RoleAction
+      class Grant < Base
         # Plans a role grant.
         # 
         # The Grant record can list multiple roles and members. Each member should
         # be granted every role. If the +replace+ option is set, then any existing
         # grant on a role that is *not* given should be revoked, except for role admins.
         def do_plan
-          roles = Array(record.roles)
-          members = Array(record.members)
-          given_grants = Hash.new { |hash, key| hash[key] = [] }
-          given_admins = Set.new
-          requested_grants = Hash.new { |hash, key| hash[key] = [] }
-
-          verify_roles_available roles + members.map(&:role)
-
-          roles.each do |role|
-            grants = begin
-              api.role(role.roleid).members
-            rescue RestClient::ResourceNotFound
-              []
-            end
-            
-            grants.each do |grant|
-              member_roleid = grant.member.roleid
-              given_grants[role.roleid].push [ member_roleid, grant.admin_option ]
-              given_admins << member_roleid if grant.admin_option
-            end
-            members.each do |member|
-              requested_grants[role.roleid].push [ member.role.roleid, !!member.admin ]
+          facts = RoleFacts.new self
+          
+          facts.add_requested_grant record
+          
+          Array(record.roles).each do |role|
+            facts.role_grants(role) do |grant|
+              facts.add_existing_grant role, grant
             end
           end
           
-          roles.each do |role|
-            roleid = role.roleid
-            given = given_grants[roleid]
-            requested = requested_grants[roleid]
-            
-            (Set.new(requested) - Set.new(given)).each do |p|
-              member, admin = p
-              grant = Conjur::DSL2::Types::Grant.new
-              grant.role = role_record roleid
-              grant.member = Conjur::DSL2::Types::Member.new role_record(member)
-              grant.member.admin = true if admin
-              action grant
-            end
+          facts.validate!
+          
+          facts.grants_to_apply.each do |grant|
+            roleid, memberid, admin = grant
+            grant = Conjur::DSL2::Types::Grant.new
+            grant.role = role_record roleid
+            grant.member = Conjur::DSL2::Types::Member.new role_record(memberid)
+            grant.member.admin = admin
+            action grant
+          end
 
-            if record.replace
-              (Set.new(given) - Set.new(requested)).each do |p|
-                member, _ = p
-                member_roleid = role_record(member).roleid
-                next if given_admins.member?(member_roleid)
-                revoke = Conjur::DSL2::Types::Revoke.new
-                revoke.role = role_record roleid
-                revoke.member = role_record(member)
-                action revoke
-              end
+          if record.replace
+            facts.grants_to_revoke.each do |grant|
+              roleid, memberid = grant
+              revoke = Conjur::DSL2::Types::Revoke.new
+              revoke.role = role_record roleid
+              revoke.member = role_record(memberid)
+              action revoke
             end
           end
         end
       end
       
-      class Revoke < RoleAction
+      class Revoke < Base
         def do_plan
-          roles = Array(record.roles)
-          members = Array(record.members)
-          given_grants = Hash.new { |hash, key| hash[key] = [] }
-
-          verify_roles_available roles + members
-
-          roles.each do |role|
-            grants = begin
-              api.role(role.roleid).members
-            rescue RestClient::ResourceNotFound
-              []
-            end
-            
-            grants.each do |grant|
-              member_roleid = grant.member.roleid
-              given_grants[role.roleid].push member_roleid
+          facts = RoleFacts.new self
+          
+          # Load all the role members as both requested and existing grants.
+          # Then revoke the Grant record, and see what's left.
+          Array(record.roles).each do |role|
+            facts.role_grants(role) do |grant|
+              grant_record = Types::Grant.new
+              grant_record.role = Types::Role.new(role.roleid)
+              grant_record.member = Types::Member.new Types::Role.new(grant.member.roleid)
+              grant_record.member.admin = grant.admin_option
+              facts.add_requested_grant grant_record
+              
+              facts.add_existing_grant role, grant
             end
           end
+
+          facts.remove_revoked_grant record
           
-          roles.each do |role|
-            roleid = role.roleid
-            given = given_grants[roleid]
-            members.each do |member|
-              next unless given.member?(member.roleid)
+          facts.validate!
           
-              revoke = Conjur::DSL2::Types::Revoke.new
-              revoke.role = role
-              revoke.member = member
-              action revoke
-            end
+          facts.grants_to_revoke.each do |grant|
+            roleid, memberid = grant
+            revoke = Conjur::DSL2::Types::Revoke.new
+            revoke.role = role_record roleid
+            revoke.member = role_record(memberid)
+            action revoke
           end
         end        
       end

data/lib/conjur/dsl2/planner/permissions.rb

@@ -1,5 +1,5 @@
 require 'conjur/dsl2/planner/base'
-require 'set'
+require 'conjur/dsl2/planner/facts'
 
 module Conjur
   module DSL2
@@ -11,65 +11,78 @@ module Conjur
       # privilege on an existing resource that is *not* given should be denied.
       class Permit < Base
         def do_plan
-          resources = Array(record.resources)
-          privileges = Array(record.privilege)
-          given_permissions = Hash.new { |hash, key| hash[key] = [] }
-          requested_permissions = Hash.new { |hash, key| hash[key] = [] }
-
-          resources.each do |resource|
-            permissions = begin
-              JSON.parse(api.resource(resource.resourceid).get)['permissions'] 
-            rescue RestClient::ResourceNotFound
-              []
-            end
-
-            permissions.each do |permission|
-              if privileges.member?(permission['privilege'])
-                given_permissions[[permission['privilege'], permission['resource']]].push [ permission['role'], permission['grant_option'] ]
-              end
+          facts = PrivilegeFacts.new self
+          
+          facts.add_requested_permission record
+          
+          privileges = Array(record.privileges)
+          Array(record.resources).each do |resource|
+            facts.resource_permissions(resource, privileges) do |permission|
+              facts.add_existing_permission permission
             end
+          end
+              
+          facts.validate!
 
-            privileges.each do |privilege|
-              Array(record.roles).each do |role|
-                requested_permissions[[privilege, resource.resourceid]].push [ role.role.roleid, !!role.admin ]
-              end
+          facts.grants_to_apply.each do |grant|
+            role, privilege, resource, admin = grant
+            
+            permit = Conjur::DSL2::Types::Permit.new
+            permit.resource = resource_record resource
+            permit.privilege = privilege
+            permit.role = Conjur::DSL2::Types::Member.new role_record(role)
+            permit.role.admin = true if admin
+            action permit
+          end          
+        
+          if record.replace
+            facts.grants_to_revoke.each do |grant|
+              roleid, privilege, resourceid = grant
+              deny = Conjur::DSL2::Types::Deny.new
+              deny.resource = resource_record resourceid
+              deny.privilege = privilege
+              deny.role = role_record(roleid)
+              action deny
             end
           end
-                      
-          resources.each do |resource|
-            error(%Q("Resource "#{resource}" not found in [#{plan.resources_created.to_a.sort.join(', ')}])) unless resource_exists?(resource)
-
-            privileges.each do |privilege|
-
-              target = resource.resourceid
-              given = given_permissions[[privilege, target]]
-              requested = requested_permissions[[privilege, target]]
-
-              (Set.new(requested) - Set.new(given)).each do |p|
-                role, admin = p
-
-                error(%Q(Role "#{role}" not found")) unless role_exists?(role)
-
-                permit = Conjur::DSL2::Types::Permit.new
-                permit.resource = resource_record target
-                permit.privilege = privilege
-                permit.role = Conjur::DSL2::Types::Member.new role_record(role)
-                permit.role.admin = true if admin
-                action permit
-              end
-
-              if record.replace
-                (Set.new(given) - Set.new(requested)).each do |p|
-                  role, admin = p
-                  deny = Conjur::DSL2::Types::Deny.new
-                  deny.resource = resource_record target
-                  deny.privilege = privilege
-                  deny.role = role_record(role)
-                  action deny
-                end
-              end
+        end
+      end
+      
+      # Plans a permission denial.
+      #
+      # A Deny statement is generated if the permission is currently held. Otherwise, its a nop.
+      class Deny < Base
+        def do_plan
+          facts = PrivilegeFacts.new self
+          
+          # Load all the permissions as both requested and existing grants.
+          # Then remove the Deny record, and see what's left.
+          privileges = Array(record.privileges)
+          Array(record.resources).each do |resource|
+            facts.resource_permissions(resource, privileges) do |permission|
+              permit_record = Types::Permit.new
+              permit_record.role = Types::Role.new(permission['role'])
+              permit_record.role.admin = permission['grant_option']
+              permit_record.privilege = permission['privilege']
+              permit_record.resource = Types::Resource.new(permission['resource'])
+              facts.add_requested_permission permit_record
+              
+              facts.add_existing_permission permission
             end
           end
+            
+          facts.remove_revoked_permission record
+          
+          facts.validate!
+          
+          facts.grants_to_revoke.each do |grant|
+            role, privilege, resource = grant
+            deny = Conjur::DSL2::Types::Deny.new
+            deny.resource = resource_record resource
+            deny.privilege = privilege
+            deny.role = role_record(role)
+            action deny
+          end
         end
       end
     end

data/lib/conjur/dsl2/resolver.rb

@@ -69,6 +69,8 @@ module Conjur
 
     # Makes all ids absolute, by prepending the namespace (if any) and the enclosing policy (if any).
     class IdResolver < Resolver
+      SUBSTITUTIONS = { "$namespace" => :namespace }
+      
       def resolve records
         traverse records, Set.new, method(:resolve_id), method(:on_resolve_policy)
       end
@@ -78,12 +80,16 @@ module Conjur
           id = record.id
           if id.blank?
             raise "#{record.to_s} has no id, and no namespace is available to populate it" unless namespace
-            record.id = namespace
+            id = namespace
           elsif id[0] == '/'
-            record.id = id[1..-1]
+            id = id[1..-1]
           else
-            record.id = [ namespace, id ].compact.join('/')
+            id = [ namespace, id ].compact.join('/')
           end
+
+          substitute! id
+          
+          record.id = id
         end
         
         traverse record.referenced_records, visited, method(:resolve_id), method(:on_resolve_policy)
@@ -96,6 +102,15 @@ module Conjur
       ensure
         @namespace = saved_namespace
       end
+      
+      protected
+      
+      def substitute! id
+        SUBSTITUTIONS.each do |k,v|
+          next unless value = send(v)
+          id.gsub! k, value
+        end
+      end
     end
     
     # Sets the owner field for any records which support it, and don't have an owner specified.

data/lib/conjur/dsl2/types/member.rb

@@ -8,6 +8,10 @@ module Conjur
         
         attribute :role
         attribute :admin, kind: :boolean, singular: true
+        
+        def to_s
+          "#{role} #{admin ? 'with' : 'without'} admin option"
+        end
       end
     end
   end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: conjur-asset-dsl2
 version: !ruby/object:Gem::Version
-  version: 0.5.0
+  version: 0.6.0
 platform: ruby
 authors:
 - Kevin Gilpin
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2016-02-24 00:00:00.000000000 Z
+date: 2016-02-25 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: safe_yaml
@@ -164,6 +164,20 @@ dependencies:
     - - '>='
       - !ruby/object:Gem::Version
         version: '0'
+- !ruby/object:Gem::Dependency
+  name: simplecov
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - '>='
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - '>='
+      - !ruby/object:Gem::Version
+        version: '0'
 description: 
 email:
 - kgilpin@conjur.net
@@ -176,7 +190,7 @@ files:
 - .project
 - .rspec
 - .travis.yml
-- CHANGELOG
+- CHANGELOG.md
 - Gemfile
 - LICENSE.txt
 - README.md
@@ -205,6 +219,7 @@ files:
 - lib/conjur/dsl2/plan.rb
 - lib/conjur/dsl2/planner.rb
 - lib/conjur/dsl2/planner/base.rb
+- lib/conjur/dsl2/planner/facts.rb
 - lib/conjur/dsl2/planner/grants.rb
 - lib/conjur/dsl2/planner/permissions.rb
 - lib/conjur/dsl2/planner/record.rb