prompt: We are currently solving the following issue within our repository. Here is the issue text:
  --- BEGIN ISSUE ---
  Creating an authority does not allow others with the role to issue certificates
  When creating an authority currently only the creator can see the authority, anyone with the owning role should be able to see and use the certificate.
  
  Currently even when a valid role is assigned and the user can see the authority they cannot use it because the cannot access the authorities key.
  
  
  --- END ISSUE ---
  
  Below are some code segments, each from a relevant file. One or more of these files may contain bugs.
  --- BEGIN FILES ---
  Path: `lemur/authorities/service.py`
  Content:
  ```
  1 """
  2 .. module: lemur.authorities.service
  3     :platform: Unix
  4     :synopsis: This module contains all of the services level functions used to
  5     administer authorities in Lemur
  6     :copyright: (c) 2015 by Netflix Inc., see AUTHORS for more
  7     :license: Apache, see LICENSE for more details.
  8 .. moduleauthor:: Kevin Glisson <kglisson@netflix.com>
  9 
  10 """
  11 from flask import g
  12 from flask import current_app
  13 
  14 from lemur import database
  15 from lemur.authorities.models import Authority
  16 from lemur.roles import service as role_service
  17 from lemur.notifications import service as notification_service
  18 
  19 from lemur.roles.models import Role
  20 from lemur.certificates.models import Certificate
  21 
  22 from lemur.plugins.base import plugins
  23 
  24 
  25 def update(authority_id, description=None, owner=None, active=None, roles=None):
  26     """
  27     Update a an authority with new values.
  28 
  29     :param authority_id:
  30     :param roles: roles that are allowed to use this authority
  31     :return:
  32     """
  33     authority = get(authority_id)
  34     if roles:
  35         authority = database.update_list(authority, 'roles', Role, roles)
  36 
  37     if active:
  38         authority.active = active
  39 
  40     authority.description = description
  41     authority.owner = owner
  42     return database.update(authority)
  43 
  44 
  45 def create(kwargs):
  46     """
  47     Create a new authority.
  48 
  49     :return:
  50     """
  51 
  52     issuer = plugins.get(kwargs.get('pluginName'))
  53 
  54     kwargs['creator'] = g.current_user.email
  55     cert_body, intermediate, issuer_roles = issuer.create_authority(kwargs)
  56 
  57     cert = Certificate(cert_body, chain=intermediate)
  58     cert.owner = kwargs['ownerEmail']
  59 
  60     if kwargs['caType'] == 'subca':
  61         cert.description = "This is the ROOT certificate for the {0} sub certificate authority the parent \
  62                                 authority is {1}.".format(kwargs.get('caName'), kwargs.get('caParent'))
  63     else:
  64         cert.description = "This is the ROOT certificate for the {0} certificate authority.".format(
  65             kwargs.get('caName')
  66         )
  67 
  68     cert.user = g.current_user
  69 
  70     cert.notifications = notification_service.create_default_expiration_notifications(
  71         'DEFAULT_SECURITY',
  72         current_app.config.get('LEMUR_SECURITY_TEAM_EMAIL')
  73     )
  74 
  75     # we create and attach any roles that the issuer gives us
  76     role_objs = []
  77     for r in issuer_roles:
  78 
  79         role = role_service.create(
  80             r['name'],
  81             password=r['password'],
  82             description="{0} auto generated role".format(kwargs.get('pluginName')),
  83             username=r['username'])
  84 
  85         # the user creating the authority should be able to administer it
  86         if role.username == 'admin':
  87             g.current_user.roles.append(role)
  88 
  89         role_objs.append(role)
  90 
  91     authority = Authority(
  92         kwargs.get('caName'),
  93         kwargs['ownerEmail'],
  94         kwargs['pluginName'],
  95         cert_body,
  96         description=kwargs['caDescription'],
  97         chain=intermediate,
  98         roles=role_objs
  99     )
  100 
  101     database.update(cert)
  102     authority = database.create(authority)
  103 
  104     g.current_user.authorities.append(authority)
  105 
  106     return authority
  107 
  108 
  109 def get_all():
  110     """
  111     Get all authorities that are currently in Lemur.
  112 
  113     :rtype : List
  114     :return:
  115     """
  116     query = database.session_query(Authority)
  117     return database.find_all(query, Authority, {}).all()
  118 
  119 
  120 def get(authority_id):
  121     """
  122     Retrieves an authority given it's ID
  123 
  124     :param authority_id:
  125     :return:
  126     """
  127     return database.get(Authority, authority_id)
  128 
  129 
  130 def get_by_name(authority_name):
  131     """
  132     Retrieves an authority given it's name.
  133 
  134     :param authority_name:
  135     :return:
  136     """
  137     return database.get(Authority, authority_name, field='name')
  138 
  139 
  140 def get_authority_role(ca_name):
  141     """
  142     Attempts to get the authority role for a given ca uses current_user
  143     as a basis for accomplishing that.
  144 
  145     :param ca_name:
  146     """
  147     if g.current_user.is_admin:
  148         authority = get_by_name(ca_name)
  149         # TODO we should pick admin ca roles for admin
  150         return authority.roles[0]
  151     else:
  152         for role in g.current_user.roles:
  153             if role.authority:
  154                 if role.authority.name == ca_name:
  155                     return role
  156 
  157 
  158 def render(args):
  159     """
  160     Helper that helps us render the REST Api responses.
  161     :param args:
  162     :return:
  163     """
  164     query = database.session_query(Authority)
  165     sort_by = args.pop('sort_by')
  166     sort_dir = args.pop('sort_dir')
  167     page = args.pop('page')
  168     count = args.pop('count')
  169     filt = args.pop('filter')
  170 
  171     if filt:
  172         terms = filt.split(';')
  173         if 'active' in filt:  # this is really weird but strcmp seems to not work here??
  174             query = query.filter(Authority.active == terms[1])
  175         else:
  176             query = database.filter(query, Authority, terms)
  177 
  178     # we make sure that a user can only use an authority they either own are are a member of - admins can see all
  179     if not g.current_user.is_admin:
  180         authority_ids = []
  181         for role in g.current_user.roles:
  182             if role.authority:
  183                 authority_ids.append(role.authority.id)
  184         query = query.filter(Authority.id.in_(authority_ids))
  185 
  186     query = database.find_all(query, Authority, args)
  187 
  188     if sort_by and sort_dir:
  189         query = database.sort(query, Authority, sort_by, sort_dir)
  190 
  191     return database.paginate(query, page, count)
  192
  ```
  --- END FILES ---
  
  Please first localize the bug based on the issue statement, and then generate a patch according to the `git diff` format fenced by three backticks.
  
  Here is an example:
  
  ```diff
  diff --git a/examples/server_async.py b/examples/server_async.py
  --- a/examples/server_async.py
  +++ b/examples/server_async.py
  @@ -313,4 +313,4 @@
   
   
   if __name__ == "__main__":
  -    asyncio.run(run_async_server("."), debug=True)
  +    asyncio.run(run_async_server(), debug=True)
  diff --git a/examples/server_sync.py b/examples/server_sync.py
  --- a/examples/server_sync.py
  +++ b/examples/server_sync.py
  @@ -313,5 +313,5 @@
   
   
   if __name__ == "__main__":
  -    server = run_sync_server(".")
  +    server = run_sync_server()
       server.shutdown()
  
  ```
  
golden_diff: diff --git a/lemur/authorities/service.py b/lemur/authorities/service.py
  --- a/lemur/authorities/service.py
  +++ b/lemur/authorities/service.py
  @@ -101,6 +101,10 @@
       database.update(cert)
       authority = database.create(authority)
   
  +    # the owning dl or role should have this authority associated with it
  +    owner_role = role_service.get_by_name(kwargs['ownerEmail'])
  +    owner_role.authority = authority
  +
       g.current_user.authorities.append(authority)
   
       return authority
  
verification_info: {"golden_diff": "diff --git a/lemur/authorities/service.py b/lemur/authorities/service.py\n--- a/lemur/authorities/service.py\n+++ b/lemur/authorities/service.py\n@@ -101,6 +101,10 @@\n     database.update(cert)\n     authority = database.create(authority)\n \n+    # the owning dl or role should have this authority associated with it\n+    owner_role = role_service.get_by_name(kwargs['ownerEmail'])\n+    owner_role.authority = authority\n+\n     g.current_user.authorities.append(authority)\n \n     return authority\n", "issue": "Creating an authority does not allow others with the role to issue certificates\nWhen creating an authority currently only the creator can see the authority, anyone with the owning role should be able to see and use the certificate.\n\nCurrently even when a valid role is assigned and the user can see the authority they cannot use it because the cannot access the authorities key.\n\n", "before_files": [{"content": "\"\"\"\n.. module: lemur.authorities.service\n    :platform: Unix\n    :synopsis: This module contains all of the services level functions used to\n    administer authorities in Lemur\n    :copyright: (c) 2015 by Netflix Inc., see AUTHORS for more\n    :license: Apache, see LICENSE for more details.\n.. moduleauthor:: Kevin Glisson <kglisson@netflix.com>\n\n\"\"\"\nfrom flask import g\nfrom flask import current_app\n\nfrom lemur import database\nfrom lemur.authorities.models import Authority\nfrom lemur.roles import service as role_service\nfrom lemur.notifications import service as notification_service\n\nfrom lemur.roles.models import Role\nfrom lemur.certificates.models import Certificate\n\nfrom lemur.plugins.base import plugins\n\n\ndef update(authority_id, description=None, owner=None, active=None, roles=None):\n    \"\"\"\n    Update a an authority with new values.\n\n    :param authority_id:\n    :param roles: roles that are allowed to use this authority\n    :return:\n    \"\"\"\n    authority = get(authority_id)\n    if roles:\n        authority = database.update_list(authority, 'roles', Role, roles)\n\n    if active:\n        authority.active = active\n\n    authority.description = description\n    authority.owner = owner\n    return database.update(authority)\n\n\ndef create(kwargs):\n    \"\"\"\n    Create a new authority.\n\n    :return:\n    \"\"\"\n\n    issuer = plugins.get(kwargs.get('pluginName'))\n\n    kwargs['creator'] = g.current_user.email\n    cert_body, intermediate, issuer_roles = issuer.create_authority(kwargs)\n\n    cert = Certificate(cert_body, chain=intermediate)\n    cert.owner = kwargs['ownerEmail']\n\n    if kwargs['caType'] == 'subca':\n        cert.description = \"This is the ROOT certificate for the {0} sub certificate authority the parent \\\n                                authority is {1}.\".format(kwargs.get('caName'), kwargs.get('caParent'))\n    else:\n        cert.description = \"This is the ROOT certificate for the {0} certificate authority.\".format(\n            kwargs.get('caName')\n        )\n\n    cert.user = g.current_user\n\n    cert.notifications = notification_service.create_default_expiration_notifications(\n        'DEFAULT_SECURITY',\n        current_app.config.get('LEMUR_SECURITY_TEAM_EMAIL')\n    )\n\n    # we create and attach any roles that the issuer gives us\n    role_objs = []\n    for r in issuer_roles:\n\n        role = role_service.create(\n            r['name'],\n            password=r['password'],\n            description=\"{0} auto generated role\".format(kwargs.get('pluginName')),\n            username=r['username'])\n\n        # the user creating the authority should be able to administer it\n        if role.username == 'admin':\n            g.current_user.roles.append(role)\n\n        role_objs.append(role)\n\n    authority = Authority(\n        kwargs.get('caName'),\n        kwargs['ownerEmail'],\n        kwargs['pluginName'],\n        cert_body,\n        description=kwargs['caDescription'],\n        chain=intermediate,\n        roles=role_objs\n    )\n\n    database.update(cert)\n    authority = database.create(authority)\n\n    g.current_user.authorities.append(authority)\n\n    return authority\n\n\ndef get_all():\n    \"\"\"\n    Get all authorities that are currently in Lemur.\n\n    :rtype : List\n    :return:\n    \"\"\"\n    query = database.session_query(Authority)\n    return database.find_all(query, Authority, {}).all()\n\n\ndef get(authority_id):\n    \"\"\"\n    Retrieves an authority given it's ID\n\n    :param authority_id:\n    :return:\n    \"\"\"\n    return database.get(Authority, authority_id)\n\n\ndef get_by_name(authority_name):\n    \"\"\"\n    Retrieves an authority given it's name.\n\n    :param authority_name:\n    :return:\n    \"\"\"\n    return database.get(Authority, authority_name, field='name')\n\n\ndef get_authority_role(ca_name):\n    \"\"\"\n    Attempts to get the authority role for a given ca uses current_user\n    as a basis for accomplishing that.\n\n    :param ca_name:\n    \"\"\"\n    if g.current_user.is_admin:\n        authority = get_by_name(ca_name)\n        # TODO we should pick admin ca roles for admin\n        return authority.roles[0]\n    else:\n        for role in g.current_user.roles:\n            if role.authority:\n                if role.authority.name == ca_name:\n                    return role\n\n\ndef render(args):\n    \"\"\"\n    Helper that helps us render the REST Api responses.\n    :param args:\n    :return:\n    \"\"\"\n    query = database.session_query(Authority)\n    sort_by = args.pop('sort_by')\n    sort_dir = args.pop('sort_dir')\n    page = args.pop('page')\n    count = args.pop('count')\n    filt = args.pop('filter')\n\n    if filt:\n        terms = filt.split(';')\n        if 'active' in filt:  # this is really weird but strcmp seems to not work here??\n            query = query.filter(Authority.active == terms[1])\n        else:\n            query = database.filter(query, Authority, terms)\n\n    # we make sure that a user can only use an authority they either own are are a member of - admins can see all\n    if not g.current_user.is_admin:\n        authority_ids = []\n        for role in g.current_user.roles:\n            if role.authority:\n                authority_ids.append(role.authority.id)\n        query = query.filter(Authority.id.in_(authority_ids))\n\n    query = database.find_all(query, Authority, args)\n\n    if sort_by and sort_dir:\n        query = database.sort(query, Authority, sort_by, sort_dir)\n\n    return database.paginate(query, page, count)\n", "path": "lemur/authorities/service.py"}], "after_files": [{"content": "\"\"\"\n.. module: lemur.authorities.service\n    :platform: Unix\n    :synopsis: This module contains all of the services level functions used to\n    administer authorities in Lemur\n    :copyright: (c) 2015 by Netflix Inc., see AUTHORS for more\n    :license: Apache, see LICENSE for more details.\n.. moduleauthor:: Kevin Glisson <kglisson@netflix.com>\n\n\"\"\"\nfrom flask import g\nfrom flask import current_app\n\nfrom lemur import database\nfrom lemur.authorities.models import Authority\nfrom lemur.roles import service as role_service\nfrom lemur.notifications import service as notification_service\n\nfrom lemur.roles.models import Role\nfrom lemur.certificates.models import Certificate\n\nfrom lemur.plugins.base import plugins\n\n\ndef update(authority_id, description=None, owner=None, active=None, roles=None):\n    \"\"\"\n    Update a an authority with new values.\n\n    :param authority_id:\n    :param roles: roles that are allowed to use this authority\n    :return:\n    \"\"\"\n    authority = get(authority_id)\n    if roles:\n        authority = database.update_list(authority, 'roles', Role, roles)\n\n    if active:\n        authority.active = active\n\n    authority.description = description\n    authority.owner = owner\n    return database.update(authority)\n\n\ndef create(kwargs):\n    \"\"\"\n    Create a new authority.\n\n    :return:\n    \"\"\"\n\n    issuer = plugins.get(kwargs.get('pluginName'))\n\n    kwargs['creator'] = g.current_user.email\n    cert_body, intermediate, issuer_roles = issuer.create_authority(kwargs)\n\n    cert = Certificate(cert_body, chain=intermediate)\n    cert.owner = kwargs['ownerEmail']\n\n    if kwargs['caType'] == 'subca':\n        cert.description = \"This is the ROOT certificate for the {0} sub certificate authority the parent \\\n                                authority is {1}.\".format(kwargs.get('caName'), kwargs.get('caParent'))\n    else:\n        cert.description = \"This is the ROOT certificate for the {0} certificate authority.\".format(\n            kwargs.get('caName')\n        )\n\n    cert.user = g.current_user\n\n    cert.notifications = notification_service.create_default_expiration_notifications(\n        'DEFAULT_SECURITY',\n        current_app.config.get('LEMUR_SECURITY_TEAM_EMAIL')\n    )\n\n    # we create and attach any roles that the issuer gives us\n    role_objs = []\n    for r in issuer_roles:\n\n        role = role_service.create(\n            r['name'],\n            password=r['password'],\n            description=\"{0} auto generated role\".format(kwargs.get('pluginName')),\n            username=r['username'])\n\n        # the user creating the authority should be able to administer it\n        if role.username == 'admin':\n            g.current_user.roles.append(role)\n\n        role_objs.append(role)\n\n    authority = Authority(\n        kwargs.get('caName'),\n        kwargs['ownerEmail'],\n        kwargs['pluginName'],\n        cert_body,\n        description=kwargs['caDescription'],\n        chain=intermediate,\n        roles=role_objs\n    )\n\n    database.update(cert)\n    authority = database.create(authority)\n\n    # the owning dl or role should have this authority associated with it\n    owner_role = role_service.get_by_name(kwargs['ownerEmail'])\n    owner_role.authority = authority\n\n    g.current_user.authorities.append(authority)\n\n    return authority\n\n\ndef get_all():\n    \"\"\"\n    Get all authorities that are currently in Lemur.\n\n    :rtype : List\n    :return:\n    \"\"\"\n    query = database.session_query(Authority)\n    return database.find_all(query, Authority, {}).all()\n\n\ndef get(authority_id):\n    \"\"\"\n    Retrieves an authority given it's ID\n\n    :param authority_id:\n    :return:\n    \"\"\"\n    return database.get(Authority, authority_id)\n\n\ndef get_by_name(authority_name):\n    \"\"\"\n    Retrieves an authority given it's name.\n\n    :param authority_name:\n    :return:\n    \"\"\"\n    return database.get(Authority, authority_name, field='name')\n\n\ndef get_authority_role(ca_name):\n    \"\"\"\n    Attempts to get the authority role for a given ca uses current_user\n    as a basis for accomplishing that.\n\n    :param ca_name:\n    \"\"\"\n    if g.current_user.is_admin:\n        authority = get_by_name(ca_name)\n        # TODO we should pick admin ca roles for admin\n        return authority.roles[0]\n    else:\n        for role in g.current_user.roles:\n            if role.authority:\n                if role.authority.name == ca_name:\n                    return role\n\n\ndef render(args):\n    \"\"\"\n    Helper that helps us render the REST Api responses.\n    :param args:\n    :return:\n    \"\"\"\n    query = database.session_query(Authority)\n    sort_by = args.pop('sort_by')\n    sort_dir = args.pop('sort_dir')\n    page = args.pop('page')\n    count = args.pop('count')\n    filt = args.pop('filter')\n\n    if filt:\n        terms = filt.split(';')\n        if 'active' in filt:  # this is really weird but strcmp seems to not work here??\n            query = query.filter(Authority.active == terms[1])\n        else:\n            query = database.filter(query, Authority, terms)\n\n    # we make sure that a user can only use an authority they either own are are a member of - admins can see all\n    if not g.current_user.is_admin:\n        authority_ids = []\n        for role in g.current_user.roles:\n            if role.authority:\n                authority_ids.append(role.authority.id)\n        query = query.filter(Authority.id.in_(authority_ids))\n\n    query = database.find_all(query, Authority, args)\n\n    if sort_by and sort_dir:\n        query = database.sort(query, Authority, sort_by, sort_dir)\n\n    return database.paginate(query, page, count)\n", "path": "lemur/authorities/service.py"}]}