conjur-asset-policy 0.12.0 → 0.13.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 732a8fcb5a23935b82fc07265db3be863089812c
-  data.tar.gz: 784b0e8d3b8046139505bd22e2b7391c3834e77a
+  metadata.gz: 6df5a543c035764e90d39bcb0b0c98c46a68b0be
+  data.tar.gz: edd5d3520bfc60c055b88f3f5db3d08ecc5efc9a
 SHA512:
-  metadata.gz: bd97981df95275d082423425b57a31d298d101350f5660c7bb0172907848fec16028c50bc86d432e6770bd4b114f3fd3630df8d753fd17faff40b548af742877
-  data.tar.gz: debefb8562d2cea4420b78b268e78732574046db85fd5b01039eb4f4cce79b4fa82ae1930f358761f4e84ae268e87f9fc0f2dc4f4b584a17c86858f73378b9e9
+  metadata.gz: cc86b5438e2eb8cd38bbf56bcef6294242030004c3d84a3db3fea4486642c673238a9d93e7eea5b59357d0bd201c442c3f07c48bb7d33ec0f8eab85d9e25bf40
+  data.tar.gz: 9ccc36084ce32575faeccbf24cc350ed0a440aa3b96c1ddbece721ab1b75ea9d23d21476efddb8722c75449af566f3f2aa602df9e5ad26d6190f0662fb3ec2e1

data/CHANGELOG.md

@@ -1,3 +1,7 @@
+# 0.13.0
+
+* Adds `!include` directive, which can be used to include sub-policies within a master Conjurfile.
+
 # 0.12.0
 
 * In annotation values, the string `$namespace` is replaced with the current namespace and policy id.

data/lib/conjur-asset-policy-version.rb

@@ -1,7 +1,7 @@
 module Conjur
   module Asset
     module Policy
-      VERSION = "0.12.0"
+      VERSION = "0.13.0"
     end
   end
 end

data/lib/conjur-asset-policy.rb

@@ -19,6 +19,7 @@ require 'conjur/api/patches/user'
 require 'conjur/policy/logger'
 require 'conjur/policy/invalid'
 require 'conjur/policy/types/base'
+require 'conjur/policy/types/include'
 require 'conjur/policy/types/records'
 require 'conjur/policy/types/member'
 require 'conjur/policy/types/grant'

data/lib/conjur/policy/resolver.rb

@@ -147,7 +147,7 @@ module Conjur
       end
       
       def resolve_owner record, visited
-        if record.respond_to?(:owner) && record.respond_to?(:owner) && record.owner.nil?
+        if record.respond_to?(:owner) && record.owner.nil?
           record.owner = Types::Role.new(@ownerid)
         end
       end

data/lib/conjur/policy/types/base.rb

@@ -51,7 +51,7 @@ module Conjur
         # +test_function+ a class or function which will determine if the value is already the correct type.
         # +converter+ if the +test_function+ fails, the converter is called to coerce the type. 
         # It should return +nil+ if its unable to do so.
-        def expect_type value, type_name, test_function, converter = nil
+        def expect_type attr_name, value, type_name, test_function, converter = nil
           if test_function.is_a?(Class)
             cls = test_function
             test_function = lambda{ value.is_a?(cls) } 
@@ -62,7 +62,7 @@ module Conjur
             v
           else
             name = value.class.respond_to?(:short_name) ? value.class.short_name : value.class.name
-            raise "Expecting #{type_name}, got #{name}"
+            raise "Expected a #{type_name} for field '#{attr_name}', got #{name}"
           end
         end
 
@@ -77,80 +77,86 @@ module Conjur
         end
         
         # If it's a Record
-        def expect_record value
-          expect_type value, "Record", lambda{ value.is_a?(Record) }
+        def expect_record name, value
+          expect_type name, value, "Record", lambda{ value.is_a?(Record) }
         end
         
         # If it's a Layer
-        def expect_layer value
-          expect_type value, "Layer", lambda{ value.is_a?(Layer) }
+        def expect_layer name, value
+          expect_type name, value, "Layer", lambda{ value.is_a?(Layer) }
         end
         
         # If it looks like a resource.
-        def expect_resource value
-          expect_type value, "Resource", lambda{ test_resource value }
+        def expect_resource name, value
+          expect_type name, value, "Resource", lambda{ test_resource value }
         end
         
         # If it looks like a role.
-        def expect_role value
-          expect_type value, "Role", lambda{ test_role value }
+        def expect_role name, value
+          expect_type name, value, "Role", lambda{ test_role value }
         end
         
         # +value+ may be a Member; Roles can also be converted to Members.
-        def expect_member value
-          expect_type value, 
+        def expect_member name, value
+          expect_type name,
+            value, 
             "Member", 
             Member,
             lambda{ Member.new(value) if test_role(value) }
         end
         
         # +value+ must be a Permission.
-        def expect_permission value
-          expect_type value, 
+        def expect_permission name, value
+          expect_type name,
+            value,
             "Permission", 
             Permission
         end
                   
         # +value+ must be a String.
-        def expect_string value
-          expect_type value, 
+        def expect_string name, value
+          expect_type name,
+            value, 
             "string",
             String
         end
 
         # +value+ must be a Integer.
-        def expect_integer value
-          expect_type value, 
+        def expect_integer name, value
+          expect_type name,
+            value,
             "integer",
             Integer
         end
                 
         # +value+ can be a Hash, or an object which implements +to_h+.
-        def expect_hash value
-          expect_type value, 
+        def expect_hash name, value
+          expect_type name,
+            value,
             "hash",
             lambda{ value.is_a?(Hash)},
             lambda{ value.to_h.stringify_keys if value.respond_to?(:to_h) }
         end
         
         # +v+ must be +true+ or +false+.
-        def expect_boolean v
+        def expect_boolean name, v
           v = true if v == "true"
           v = false if v == "false"
-          expect_type v, 
+          expect_type name,
+            v,
             "boolean",
             lambda{ [ true, false ].member?(v) }
         end
         
         # +values+ can be an instance of +type+ (as determined by the type-checking methods), or
         # it must be an array of them.
-        def expect_array kind, values
+        def expect_array name, kind, values
           # Hash gets converted to an array of key/value pairs by Array
           is_hash = values.kind_of?(Hash)
           values = [values] if is_hash
 
           result = Array(values).map do |v|
-            send "expect_#{kind}", v
+            send "expect_#{kind}", name, v
           end
 
           (values.is_a?(Array) and not is_hash) ? result : result[0]
@@ -181,7 +187,7 @@ module Conjur
                 else
                   v
                 end
-                self.instance_variable_set("@#{attr}", self.class.expect_array(kind, value))
+                self.instance_variable_set("@#{attr}", self.class.expect_array(attr, kind, value))
               else
                 self.instance_variable_get("@#{attr}")
               end
@@ -192,7 +198,7 @@ module Conjur
             end
           end
           define_method "#{attr}=" do |v|
-            self.instance_variable_set("@#{attr}", self.class.expect_array(kind, v))
+            self.instance_variable_set("@#{attr}", self.class.expect_array(attr, kind, v))
           end
         end
         
@@ -229,6 +235,7 @@ module Conjur
             type ||= Conjur::Policy::Types.const_get(attr.to_s.capitalize) 
           rescue NameError
           end
+          type = nil if type == String
           kind = options[:kind] 
           kind ||= type.short_name.downcase.to_sym if type
           

data/lib/conjur/policy/types/grant.rb

@@ -49,18 +49,24 @@ See also: [Permit](#reference/permit) for [Resources](#reference/resource)
 
     def to_s
       role_str   = if role.kind_of?(Array)
-                   then role.join(', ')
-                   else role
-                   end
+        role.join(', ')
+      else
+        role
+      end
       member_str = if member.kind_of?(Array)
-                   then member.map(&:role).join(', ')
-                   else member.role
-                   end
-      admin      = if member.kind_of?(Array)
-                   then member.map(&:admin).all?
-                   else member.admin
-                   end
-      "Grant #{role_str} to #{member_str}#{replace ? ' with replacement ' : ''}#{admin ? ' with admin option' : ''}"
+        member.map(&:role).join(', ')
+      elsif member 
+        member.role
+      end
+      admin = Array(member).map do |member|
+        member && member.admin
+      end
+      admin_str = if Array(member).count == admin.select{|admin| admin}.count
+        " with admin option"
+      elsif admin.any?
+        " with admin options: #{admin.join(', ')}"
+      end
+      %Q(Grant #{role_str} to #{member_str}#{replace ? ' with replacement ' : ''}#{admin_str})
     end
   end
 end

data/lib/conjur/policy/types/include.rb

@@ -0,0 +1,46 @@
+module Conjur::Policy::Types
+  # Include another policy into the policy.
+  class Include < Base
+    attribute :file, kind: :string, type: String, singular: true, dsl_accessor: true
+
+    self.description = %(
+Includes the contents of another policy file.
+
+By using this feature, policies for an entire organization can be
+defined in one source repository, and then unified by a top-level
+"Conjurfile".
+
+Attributes:
+
+* **file** path to the included policy file, relative to the including policy file.
+    This is the default attribute, so it can be specified in shorthand form as:
+    `- !include the-policy.yml`
+
+Included policies inherit the namespace and owner of the enclosing
+context. To include a policy with a different namespace and owner,
+first define an enclosing policy record with the following attributes:
+    
+* **id** the name which is appended to the current namespace
+* **owner** the desired owner
+    
+Then, within the body of that policy, include the additional 
+policy files.
+)
+
+    self.example = %(
+- !include groups.yml
+    
+- !policy
+  id: ops
+  owner: !group operations
+  body:
+  - !include jenkins-master.yml
+  - !include ansible.yml
+  - !include openvpn.yml
+)
+    
+    def id= value
+      self.file = value
+    end
+  end
+end

data/lib/conjur/policy/yaml/handler.rb

@@ -12,17 +12,13 @@ module Conjur
         # The handler can decide that the message is not allowed by not implementing the message.
         #
         class Base
-          attr_reader :parent
+          attr_reader :parent, :anchor
           
-          def initialize parent
+          def initialize parent, anchor
             @parent = parent
+            @anchor = anchor
           end
           
-          # Each handler should implement this method to return the result object (which may only be
-          # partially constructed). This method is used by the root handler to associate the handler
-          # result with an anchor (if applicable).
-          def result; raise "Not implemented"; end
-          
           # Handlers are organized in a stack. Each handler can find the root Handler by traversing up the stack.
           def handler
             parent.handler
@@ -45,13 +41,13 @@ module Conjur
           
           # Start a new mapping with the specified tag. 
           # If the handler wants to accept the message, it should return a new handler.
-          def start_mapping tag
+          def start_mapping tag, anchor
             raise "Unexpected mapping"
           end
           
           # Start a new sequence.
           # If the handler wants to accept the message, it should return a new handler.
-          def start_sequence
+          def start_sequence anchor
             raise "Unexpected sequence"
           end
           
@@ -66,9 +62,7 @@ module Conjur
           end
           
           # Process a scalar value. It may be a map key, a map value, or a sequence value.
-          # The handler should return a result from this method, so that the root Handler can
-          # associate it with an anchor, if any.
-          def scalar value, tag, quoted
+          def scalar value, tag, quoted, anchor
             raise "Unexpected scalar"
           end
           
@@ -103,7 +97,7 @@ module Conjur
           attr_reader :result, :handler
           
           def initialize handler
-            super nil
+            super nil, nil
             
             @handler = handler
             @result = nil
@@ -119,10 +113,10 @@ module Conjur
           # The document root is expected to start with a sequence. 
           # A Sequence handler is constructed with no implicit type. This
           # sub-handler handles the message.
-          def start_sequence
-            Sequence.new(self, nil).tap do |h|
+          def start_sequence anchor
+            Sequence.new(self, anchor, nil).tap do |h|
               h.push_handler
-            end.result
+            end
           end
           
           # Finish the sequence, and the document.
@@ -137,28 +131,29 @@ module Conjur
         class Sequence < Base
           attr_reader :record_type
           
-          def initialize parent, record_type
-            super parent
+          def initialize parent, anchor, record_type
+            super parent, anchor
             
             @record_type = record_type
             @list = []
           end
           
-          def result; @list; end
-          
           # Adds a mapping to the sequence.
           def mapping value
+            handler.log { "#{handler.indent}Adding mapping #{value} to sequence" }
             @list.push value
           end
   
           # Adds a sequence to the sequence.
           def sequence value
+            handler.log { "#{handler.indent}Adding sequence #{value} to sequence" }
             @list.push value
           end
           
           # When the sequence receives an alias, the alias should be mapped to the previously stored 
           # value and added to the result list.
           def alias anchor
+            handler.log { "#{handler.indent}Adding alias *#{anchor} to sequence, whose value is #{handler.anchor(anchor)}" }
             @list.push handler.anchor(anchor)
           end
           
@@ -168,32 +163,35 @@ module Conjur
           # * The implicit field type of the sequence
           #
           # If neither of these is available, it's an error.
-          def start_mapping tag
+          def start_mapping tag, anchor
             if type = type_of(tag, record_type)
-              Mapping.new(self, type).tap do |h|
+              Mapping.new(self, anchor, type).tap do |h|
                 h.push_handler
-              end.result
+              end
             else
               raise "No type given or inferred for sequence entry"
             end
           end
           
           # Process a sequence within a sequence.
-          def start_sequence
-            Sequence.new(self, record_type).tap do |h|
+          def start_sequence anchor
+            Sequence.new(self, anchor, record_type).tap do |h|
               h.push_handler
-            end.result
+            end
           end
           
           # When the sequence contains a scalar, the value should be appended to the result.
-          def scalar value, tag, quoted
+          def scalar value, tag, quoted, anchor
             scalar_value(value, tag, quoted, record_type).tap do |value|
+              handler.log { "#{handler.indent}Adding scalar *#{value} to sequence" }
               @list.push value
+              handler.anchor anchor, value if anchor
             end
           end
           
           def end_sequence
             parent.sequence @list
+            handler.anchor anchor, @list if anchor
             pop_handler
           end
         end
@@ -202,15 +200,14 @@ module Conjur
         class Mapping < Base
           attr_reader :type
           
-          def initialize parent, type
-            super parent
+          def initialize parent, anchor, type
+            super parent, anchor
             
             @record = type.new
           end
   
-          def result; @record; end
-          
           def map_entry key, value
+            handler.log { "#{handler.indent}Setting map entry #{key} = #{value}" }
             if @record.respond_to?(:[]=)
               @record.send(:[]=, key, value)
             else
@@ -225,21 +222,22 @@ module Conjur
           # Begins a mapping with the anchor value as the key.
           def alias anchor
             key = handler.anchor(anchor)
-            MapEntry.new(self, @record, key).tap do |h|
+            MapEntry.new(self, nil, @record, key).tap do |h|
               h.push_handler
-            end.result
+            end
           end
   
           # Begins a new map entry.
-          def scalar value, tag, quoted
+          def scalar value, tag, quoted, anchor
             value = scalar_value(value, tag, quoted, type)
-            MapEntry.new(self, @record, value).tap do |h|
+            MapEntry.new(self, anchor, @record, value).tap do |h|
               h.push_handler
-            end.result
+            end
           end
           
           def end_mapping
             parent.mapping @record
+            handler.anchor anchor, @record if anchor
             pop_handler
           end
         end
@@ -248,15 +246,13 @@ module Conjur
         class MapEntry < Base
           attr_reader :record, :key
   
-          def initialize parent, record, key
-            super parent
+          def initialize parent, anchor, record, key
+            super parent, anchor
             
             @record = record
             @key = key
           end
           
-          def result; nil; end
-          
           def sequence value
             value value
           end
@@ -267,6 +263,7 @@ module Conjur
           
           def value value
             parent.map_entry @key, value
+            handler.anchor anchor, value if anchor
             pop_handler
           end
           
@@ -276,11 +273,11 @@ module Conjur
           end
           
           # Start a mapping as a map value.
-          def start_mapping tag
+          def start_mapping tag, anchor
             if type = type_of(tag, yaml_field_type(key))
-              Mapping.new(self, type).tap do |h|
+              Mapping.new(self, anchor, type).tap do |h|
                 h.push_handler
-              end.result
+              end
             else
               # We got a mapping on a simple type
               raise "Attribute '#{key}' can't be a mapping"
@@ -288,13 +285,13 @@ module Conjur
           end
           
           # Start a sequence as a map value.
-          def start_sequence
-            Sequence.new(self, yaml_field_type(key)).tap do |h|
+          def start_sequence anchor
+            Sequence.new(self, anchor, yaml_field_type(key)).tap do |h|
               h.push_handler
-            end.result
+            end
           end
           
-          def scalar value, tag, quoted
+          def scalar value, tag, quoted, anchor
             value scalar_value(value, tag, quoted, yaml_field_type(key))
           end
           
@@ -312,9 +309,13 @@ module Conjur
           @filename = "<no-filename>"
         end
         
+        def result
+          @root.result
+        end
+        
         def push_handler handler
-          log {"#{indent}pushing handler #{handler.class}"}
           @handlers.push handler
+          log {"#{indent}pushed handler #{handler.class}"}
         end
           
         def pop_handler
@@ -338,11 +339,10 @@ module Conjur
           end
         end
         
-        def result; @root.result; end
-        
         def handler; @handlers.last; end
         
         def alias key
+          log {"#{indent}WARNING: anchor '#{key}' is not defined"} unless anchor(key)
           log {"#{indent}anchor '#{key}'=#{anchor(key)}"}
           handler.alias key
         end
@@ -351,15 +351,13 @@ module Conjur
           log {"#{indent}start mapping #{args}"}
           anchor, tag, _ = args
           tag = "!automatic-role" if %w(!managed-role !managed_role).include?(tag)
-          value = handler.start_mapping tag
-          anchor anchor, value
+          handler.start_mapping tag, anchor
         end
         
         def start_sequence *args
           log {"#{indent}start sequence : #{args}"}
           anchor, _ = args
-          value = handler.start_sequence
-          anchor anchor, value
+          handler.start_sequence anchor
         end
         
         def end_sequence
@@ -376,8 +374,7 @@ module Conjur
           # value, anchor, tag, plain, quoted, style
           value, anchor, tag, _, quoted = args
           log {"#{indent}got scalar #{tag ? tag + '=' : ''}#{value}#{anchor ? '#' + anchor : ''}"}
-          value = handler.scalar value, tag, quoted
-          anchor anchor, value
+          handler.scalar value, tag, quoted, anchor
         end
         
         def log &block

data/lib/conjur/policy/yaml/loader.rb

@@ -6,6 +6,12 @@ module Conjur
       class Loader
         class << self
           def load yaml, filename = nil
+            dirname = if filename
+              File.dirname(filename)
+            else
+              '.'
+            end
+            
             parser = Psych::Parser.new(handler = Handler.new)
             handler.filename = filename
             handler.parser = parser
@@ -16,12 +22,31 @@ module Conjur
               handler.log { $!.backtrace.join("  \n") }
               raise Invalid.new($!.message || "(no message)", filename, parser.mark)
             end
-            handler.result
+            records = handler.result
+            
+            parse_includes records, dirname
+
+            records
           end
           
           def load_file filename
             load File.read(filename), filename
           end
+          
+          protected
+          
+          def parse_includes records, dirname
+            records.each_with_index do |record, idx|
+              if record.is_a?(Array)
+                parse_includes record, dirname
+              elsif record.is_a?(Types::Policy)
+                parse_includes record.body, dirname
+              elsif record.is_a?(Types::Include)
+                included = load File.read(File.expand_path(record.file, dirname)), record.file
+                records[idx..idx] = included
+              end
+            end
+          end
         end
       end
     end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: conjur-asset-policy
 version: !ruby/object:Gem::Version
-  version: 0.12.0
+  version: 0.13.0
 platform: ruby
 authors:
 - Kevin Gilpin
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2016-06-20 00:00:00.000000000 Z
+date: 2016-07-07 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: safe_yaml
@@ -218,6 +218,7 @@ files:
 - lib/conjur/policy/types/deny.rb
 - lib/conjur/policy/types/give.rb
 - lib/conjur/policy/types/grant.rb
+- lib/conjur/policy/types/include.rb
 - lib/conjur/policy/types/member.rb
 - lib/conjur/policy/types/permit.rb
 - lib/conjur/policy/types/policy.rb