conjur-asset-policy 0.11.0 → 0.12.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 64cf9174fc3ed6a86366f2f46c052952c054440e
-  data.tar.gz: 1f02801a02ae8d60b28c78faa1d254872778d2ea
+  metadata.gz: 732a8fcb5a23935b82fc07265db3be863089812c
+  data.tar.gz: 784b0e8d3b8046139505bd22e2b7391c3834e77a
 SHA512:
-  metadata.gz: 1744445bfee08b4c08f0dc5bbde0931d744559659a348e4158e1863b571b1a699f37c8292942e8171d5156076a07558f59abccf7fd3516dbeed00695a99b5e8d
-  data.tar.gz: 29dede5e8aaab32f3fd7ecf4915908da281b15b3896984c388252cd332ba8cc1dad16e45dd8711bd535de8343d11f5c9f722296b5e0721753537c9626302850a
+  metadata.gz: bd97981df95275d082423425b57a31d298d101350f5660c7bb0172907848fec16028c50bc86d432e6770bd4b114f3fd3630df8d753fd17faff40b548af742877
+  data.tar.gz: debefb8562d2cea4420b78b268e78732574046db85fd5b01039eb4f4cce79b4fa82ae1930f358761f4e84ae268e87f9fc0f2dc4f4b584a17c86858f73378b9e9

data/CHANGELOG.md

@@ -1,3 +1,8 @@
+# 0.12.0
+
+* In annotation values, the string `$namespace` is replaced with the current namespace and policy id.
+* Executor handles both http and https base URLs.
+
 # 0.11.0
 
 * Enable management of user public keys.

data/lib/conjur/policy/executor.rb

@@ -54,8 +54,9 @@ module Conjur
       def execute actions
         require 'net/https'
         uri = URI.parse(Conjur.configuration.appliance_url)
+        use_ssl = uri.scheme == 'https'
         @base_path = uri.path
-        Net::HTTP.start uri.host, uri.port, use_ssl: true do |http|
+        Net::HTTP.start uri.host, uri.port, use_ssl: use_ssl do |http|
           @http = http
           actions.each do |step|
             invoke step

data/lib/conjur/policy/planner/facts.rb

@@ -106,7 +106,7 @@ module Conjur
           end
         end
       
-        # Add a Conjur::API::Rolerevoke that is already held.
+        # Add a Conjur::API::Role grant that is already held.
         def add_existing_grant role, grant
           existing.add [ role.roleid, grant.member.roleid ]
           existing_with_admin_flag.add [ role.roleid, grant.member.roleid, grant.admin_option ]

data/lib/conjur/policy/resolver.rb

@@ -6,7 +6,7 @@ module Conjur
       class << self
         # Resolve records to the specified owner id and namespace.
         def resolve records, account, ownerid, namespace = nil
-          resolver_classes = [ AccountResolver, IdResolver, OwnerResolver, FlattenResolver, DuplicateResolver ]
+          resolver_classes = [ AccountResolver, IdSubstitutionResolver, AnnotationSubstitutionResolver, OwnerResolver, FlattenResolver, DuplicateResolver ]
           resolver_classes.each do |cls|
             resolver = cls.new account, ownerid, namespace
             records = resolver.resolve records
@@ -67,15 +67,35 @@ module Conjur
       end
     end
 
-    # Makes all ids absolute, by prepending the namespace (if any) and the enclosing policy (if any).
-    class IdResolver < Resolver
+    class SubstitutionResolver < Resolver
       SUBSTITUTIONS = { "$namespace" => :namespace }
-      
+        
       def resolve records
-        traverse records, Set.new, method(:resolve_id), method(:on_resolve_policy)
+        traverse records, Set.new, method(:resolve_field), method(:on_resolve_policy)
+      end
+      
+      protected
+      
+      def substitute! id
+        SUBSTITUTIONS.each do |k,v|
+          next unless value = send(v)
+          id.gsub! k, value
+        end
+      end
+      
+      def on_resolve_policy policy, visited
+        saved_namespace = @namespace
+        @namespace = policy.id
+        traverse policy.body, visited, method(:resolve_field), method(:on_resolve_policy)
+      ensure
+        @namespace = saved_namespace
       end
+    end
+    
+    # Makes all ids absolute, by prepending the namespace (if any) and the enclosing policy (if any).
+    class IdSubstitutionResolver < SubstitutionResolver
       
-      def resolve_id record, visited
+      def resolve_field record, visited
         if record.respond_to?(:id) && record.respond_to?(:id=)
           id = record.id
           if id.blank?
@@ -96,15 +116,7 @@ module Conjur
           record.id = id
         end
         
-        traverse record.referenced_records, visited, method(:resolve_id), method(:on_resolve_policy)
-      end
-      
-      def on_resolve_policy policy, visited
-        saved_namespace = @namespace
-        @namespace = policy.id
-        traverse policy.body, visited, method(:resolve_id), method(:on_resolve_policy)
-      ensure
-        @namespace = saved_namespace
+        traverse record.referenced_records, visited, method(:resolve_field), method(:on_resolve_policy)
       end
       
       protected
@@ -112,12 +124,17 @@ module Conjur
       def user_namespace
         namespace.gsub('/', '-') if namespace
       end
-      
-      def substitute! id
-        SUBSTITUTIONS.each do |k,v|
-          next unless value = send(v)
-          id.gsub! k, value
+    end
+    
+    class AnnotationSubstitutionResolver < SubstitutionResolver
+      def resolve_field record, visited
+        if record.respond_to?(:annotations) && (annotations = record.annotations)
+          annotations.each do |k,v|
+            substitute! v
+          end
         end
+
+        traverse record.referenced_records, visited, method(:resolve_field), method(:on_resolve_policy)
       end
     end
     

data/lib/conjur/policy/types/grant.rb

@@ -60,7 +60,7 @@ See also: [Permit](#reference/permit) for [Resources](#reference/resource)
                    then member.map(&:admin).all?
                    else member.admin
                    end
-      "Grant #{role_str} to #{member_str}#{replace ? ' exclusively ' : ''}#{admin ? ' with admin option' : ''}"
+      "Grant #{role_str} to #{member_str}#{replace ? ' with replacement ' : ''}#{admin ? ' with admin option' : ''}"
     end
   end
 end

data/lib/conjur-asset-policy-version.rb

@@ -1,7 +1,7 @@
 module Conjur
   module Asset
     module Policy
-      VERSION = "0.11.0"
+      VERSION = "0.12.0"
     end
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: conjur-asset-policy
 version: !ruby/object:Gem::Version
-  version: 0.11.0
+  version: 0.12.0
 platform: ruby
 authors:
 - Kevin Gilpin
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2016-04-29 00:00:00.000000000 Z
+date: 2016-06-20 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: safe_yaml