<NME> trust.py
<BEF> # Licensed under the Apache License, Version 2.0 (the "License"); you may
# not use this file except in compliance with the License. You may obtain
# a copy of the License at
#
#      http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
# License for the specific language governing permissions and limitations
# under the License.

from oslo_log import versionutils
from oslo_policy import policy
from keystone.common.policies import base

trust_policies = [
    policy.RuleDefault(
        name=base.IDENTITY % 'create_trust',
        check_str=base.RULE_TRUST_OWNER),
    policy.RuleDefault(
        name=base.IDENTITY % 'list_trusts',
        check_str=''),
    policy.RuleDefault(
        name=base.IDENTITY % 'list_roles_for_trust',
        check_str=''),
    policy.RuleDefault(
        name=base.IDENTITY % 'get_role_for_trust',
        check_str=''),
    policy.RuleDefault(
        name=base.IDENTITY % 'delete_trust',
        check_str=''),
]


        check_str=base.RULE_TRUST_OWNER,
        # FIXME(lbragstad): Trusts have the ability to optionally include a
        # project, but until trusts deal with system scope it's not really
        # useful. For now, this should be a project only operation.
        scope_types=['project'],
        description='Create trust.',
        operations=[{'path': '/v3/OS-TRUST/trusts',
                     'method': 'POST'}]),
    policy.DocumentedRuleDefault(
        name=base.IDENTITY % 'list_trusts',
        check_str=base.SYSTEM_READER,
        scope_types=['system'],
        description='List trusts.',
        operations=[{'path': '/v3/OS-TRUST/trusts',
                     'method': 'GET'},
                    {'path': '/v3/OS-TRUST/trusts',
                     'method': 'HEAD'}],
        deprecated_rule=deprecated_list_trusts),
    policy.DocumentedRuleDefault(
        name=base.IDENTITY % 'list_trusts_for_trustor',
        check_str=SYSTEM_READER_OR_TRUSTOR,
        scope_types=['system', 'project'],
        description='List trusts for trustor.',
        operations=[{'path': '/v3/OS-TRUST/trusts?'
                             'trustor_user_id={trustor_user_id}',
                     'method': 'GET'},
                    {'path': '/v3/OS-TRUST/trusts?'
                             'trustor_user_id={trustor_user_id}',
                     'method': 'HEAD'}]),
    policy.DocumentedRuleDefault(
        name=base.IDENTITY % 'list_trusts_for_trustee',
        check_str=SYSTEM_READER_OR_TRUSTEE,
        scope_types=['system', 'project'],
        description='List trusts for trustee.',
        operations=[{'path': '/v3/OS-TRUST/trusts?'
                             'trustee_user_id={trustee_user_id}',
                     'method': 'GET'},
                    {'path': '/v3/OS-TRUST/trusts?'
                             'trustee_user_id={trustee_user_id}',
                     'method': 'HEAD'}]),
    policy.DocumentedRuleDefault(
        name=base.IDENTITY % 'list_roles_for_trust',
        check_str=SYSTEM_READER_OR_TRUSTOR_OR_TRUSTEE,
        scope_types=['system', 'project'],
        description='List roles delegated by a trust.',
        operations=[{'path': '/v3/OS-TRUST/trusts/{trust_id}/roles',
                     'method': 'GET'},
                    {'path': '/v3/OS-TRUST/trusts/{trust_id}/roles',
                     'method': 'HEAD'}],
        deprecated_rule=deprecated_list_roles_for_trust),
    policy.DocumentedRuleDefault(
        name=base.IDENTITY % 'get_role_for_trust',
        check_str=SYSTEM_READER_OR_TRUSTOR_OR_TRUSTEE,
        scope_types=['system', 'project'],
        description='Check if trust delegates a particular role.',
        operations=[{'path': '/v3/OS-TRUST/trusts/{trust_id}/roles/{role_id}',
                     'method': 'GET'},
                    {'path': '/v3/OS-TRUST/trusts/{trust_id}/roles/{role_id}',
                     'method': 'HEAD'}],
        deprecated_rule=deprecated_get_role_for_trust),
    policy.DocumentedRuleDefault(
        name=base.IDENTITY % 'delete_trust',
        check_str=SYSTEM_ADMIN_OR_TRUSTOR,
        scope_types=['system', 'project'],
        description='Revoke trust.',
        operations=[{'path': '/v3/OS-TRUST/trusts/{trust_id}',
                     'method': 'DELETE'}],
        deprecated_rule=deprecated_delete_trust),
    policy.DocumentedRuleDefault(
        name=base.IDENTITY % 'get_trust',
        check_str=SYSTEM_READER_OR_TRUSTOR_OR_TRUSTEE,
        scope_types=['system', 'project'],
        description='Get trust.',
        operations=[{'path': '/v3/OS-TRUST/trusts/{trust_id}',
                     'method': 'GET'},
                    {'path': '/v3/OS-TRUST/trusts/{trust_id}',
                     'method': 'HEAD'}],
        deprecated_rule=deprecated_get_trust)
]


def list_rules():
    return trust_policies

<MSG> Move trust to DocumentedRuleDefault

A new policy class was introduced that requires
additional parameters when defining policy objects.

This patch switches our trust policy object to
the policy.DocumentedRuleDefault and fills the
required policy parameters as needed.

Implements: bp policy-docs

Change-Id: I7d4bab14ff257ede59a1b49088e16842e5b59a64
<DFF> @@ -15,21 +15,50 @@ from oslo_policy import policy
 from keystone.common.policies import base
 
 trust_policies = [
-    policy.RuleDefault(
+    policy.DocumentedRuleDefault(
         name=base.IDENTITY % 'create_trust',
-        check_str=base.RULE_TRUST_OWNER),
-    policy.RuleDefault(
+        check_str=base.RULE_TRUST_OWNER,
+        description='Create trust.',
+        operations=[{'path': '/v3/OS-TRUST/trusts',
+                     'method': 'POST'}]),
+    policy.DocumentedRuleDefault(
         name=base.IDENTITY % 'list_trusts',
-        check_str=''),
-    policy.RuleDefault(
+        check_str='',
+        description='List trusts.',
+        operations=[{'path': '/v3/OS-TRUST/trusts',
+                     'method': 'GET'},
+                    {'path': '/v3/OS-TRUST/trusts',
+                     'method': 'HEAD'}]),
+    policy.DocumentedRuleDefault(
         name=base.IDENTITY % 'list_roles_for_trust',
-        check_str=''),
-    policy.RuleDefault(
+        check_str='',
+        description='List roles delegated by a trust.',
+        operations=[{'path': '/v3/OS-TRUST/trusts/{trust_id}/roles',
+                     'method': 'GET'},
+                    {'path': '/v3/OS-TRUST/trusts/{trust_id}/roles',
+                     'method': 'HEAD'}]),
+    policy.DocumentedRuleDefault(
         name=base.IDENTITY % 'get_role_for_trust',
-        check_str=''),
-    policy.RuleDefault(
+        check_str='',
+        description='Check if trust delegates a particular role.',
+        operations=[{'path': '/v3/OS-TRUST/trusts/{trust_id}/roles/{role_id}',
+                     'method': 'GET'},
+                    {'path': '/v3/OS-TRUST/trusts/{trust_id}/roles/{role_id}',
+                     'method': 'HEAD'}]),
+    policy.DocumentedRuleDefault(
         name=base.IDENTITY % 'delete_trust',
-        check_str=''),
+        check_str='',
+        description='Revoke trust.',
+        operations=[{'path': '/v3/OS-TRUST/trusts/{trust_id}',
+                     'method': 'DELETE'}]),
+    policy.DocumentedRuleDefault(
+        name=base.IDENTITY % 'get_trust',
+        check_str='',
+        description='Get trust.',
+        operations=[{'path': '/v3/OS-TRUST/trusts/{trust_id}',
+                     'method': 'GET'},
+                    {'path': '/v3/OS-TRUST/trusts/{trust_id}',
+                     'method': 'HEAD'}])
 ]
 
 

{'addition_count': 39, 'commit_subject': 'Move trust to DocumentedRuleDefault', 'deletion_count': 10, 'file_extension': '.py', 'lang': 'py', 'license': 'apache-2.0', 'repo_name': 'openstack/keystone'}