a

èÉe4"ã@s
dZd
dl
Z
d
dlZd
dlZd
dlmZ
d
dlmZ
d
dl	m
Z

d
dlmZ
d
dl
mZ
d
dlmZmZ
d
d	l
mZ
ejZe e¡
Zdad
g
Zgae d¡
Zdd
„Zd'dd„
Zdd„Zdd„Zd(dd„
Z d)dd„
Z!dd„Z"e
 #d¡
Gdd„de
j$ƒƒ
Z%dd „Z&d!d"„Z'd#d$„Z(d%d&„Z)dS)*zPolicy Engine For Dmapi.éN)
Úcfg)
Úlog)
Úpolicy)
Úexcutils)
Ú	exception)Ú_LEÚ_LW)
Úpolicieszos-keypairsz%\((\w+)\)scCstrt 
¡
dadS©
N)Ú	_ENFORCERÚclear©r
r
ú0/usr/lib/python3.9/site-packages/dmapi/policy.pyÚreset"s

rTcCsTts(t
jt||
||d
attƒ

t ¡
tj}t|ƒ
}t|krPt	|ƒ

t
 |¡
adS)aë
Init an Enforcer class.

       :param policy_file: Custom policy file to use, if none is specified,
                           `CONF.policy_file` will be used.
       :param rules: Default dictionary / Rules to use. It will be
                     considered just in the first instantiation.
       :param default_rule: Default rule to use, CONF.default_rule will
                            be used if none is specified.
       :param use_conf: Whether to load rules from config file.
    )Úpolicy_fileÚrulesÚdefault_ruleÚuse_confN)rrZEnforcerÚCONFÚregister_rulesZ
load_rulesZ
file_rulesÚ_serialize_rulesÚsaved_file_rulesÚ(_warning_for_deprecated_user_based_rulesÚcopyÚdeepcopy)rrrrZcurrent_file_rulesr
r
rÚinit)s




ü



rc
Cs&d
d„t| 
¡ƒ
Dƒ
}
t|
dd„dS)zYSerialize all the Rule object as string which is used to compare the
    rules list.
    c
Ssg|]\}
}|
t|ƒ
f‘qSr
)
Ústr)Ú.0Z	rule_nameÚruler
r
rÚ
<listcomp>Os
ÿz$_serialize_rules.<locals>.<listcomp>c

Ss|d
S)Nr
r
©
rr
r
rÚ<lambda>Qóz"_serialize_rules.<locals>.<lambda>)
Úkey)ÚlistÚitemsÚsorted)rÚresultr
r
rrKs

ÿrc

sH|D]>‰‡f
d
d„tDƒ
rqdt
 ˆd¡
vrt tdƒ
ˆd¡
qdS)z`Warning user based policy enforcement used in the rule but the rule
    doesn't support it.
    c
sg|]}
|
ˆdvr|
‘qS)
r
r
)rÚresourcer r
rr[s
ÿz<_warning_for_deprecated_user_based_rules.<locals>.<listcomp>Zuser_idé
zThe user_id attribute isn't supported in the rule '%s'. All the user_id based policy enforcement will be removed in the future.r
N)ÚUSER_BASED_RESOURCESÚKEY_EXPRÚfindallÚLOGÚwarningr)
rr
r rrTs


ýrFcCstd
d

t
 ||
|¡
dS)a7
Set rules based on the provided dict of rules.

       :param rules: New rules to use. It should be an instance of dict.
       :param overwrite: Whether to overwrite current rules or update them
                         with the new rules.
       :param use_conf: Whether to reload rules from config file.
    F)
rN)rrÚ	set_rules)rZ	overwriterr
r
rr/es	

r/cCsÌtƒ
| 
¡}|stj}ztj|
|||||
d
}Wn”tjy|


t 	¡
t
 tdƒ
¡

Wdƒ
n1sn0


Y
YnLtyÆ


t 	¡"
t
 
d|
|dœ¡
Wdƒ
n1s¸0


Y
Yn0|S)acVerifies that the action is valid on the target in this context.

       :param context: dmapi context
       :param action: string representing the action to be checked
           this should be colon separated for clarity.
           i.e. ``compute:create_instance``,
           ``compute:attach_volume``,
           ``volume:attach_volume``
       :param target: dictionary representing the object of the action
           for object creation this should be a dictionary representing the
           location of the object e.g. ``{'project_id': context.project_id}``
       :param do_raise: if True (the default), raises PolicyNotAuthorized;
           if False, returns False
       :param exc: Class of the exception to raise if the check fails.
                   Any remaining arguments passed to :meth:`authorize` (both
                   positional and keyword arguments) will be passed to
                   the exception class. If not specified,
                   :class:`PolicyNotAuthorized` will be used.

       :raises dmapi.exception.PolicyNotAuthorized: if verification fails
           and do_raise is True. Or if 'exc' is specified it will raise an
           exception of that type.

       :return: returns a non-False value (not necessarily "True") if
           authorized, and the exact value False if not authorized and
           do_raise is False.
    )Údo_raiseÚexcÚactionzPolicy not registeredNzCPolicy check for %(action)s failed with credentials %(credentials)s)r2Úcredentials)rÚto_policy_valuesrZPolicyNotAuthorizedrÚ	authorizerZPolicyNotRegisteredrZsave_and_reraise_exceptionr-rÚ	ExceptionÚdebug)Úcontextr2Útargetr0r1r3r'r
r
rr5rs"






ÿ



0



þ(r5c
Cs tƒ
| 
¡}
|
}t d
||
¡S)zMWhether or not roles contains 'admin' role according to policy setting.

    Zcontext_is_admin)rr4rr5)r8r3r9r
r
rÚcheck_is_admin s

r:Úis_admincs(eZ
dZd
Z‡f
dd„Zdd„Z‡ZS)ÚIsAdminCheckzAn explicit check for is_admin.cs*| ¡d
k|_
tt|ƒ |
t|j
ƒ
¡
dS)zInitialize the check.ÚtrueN)ÚlowerÚexpectedÚsuperr<Ú__init__r)ÚselfÚkindÚmatch©
Ú	__class__r
rrA°szIsAdminCheck.__init__cCs|d
|jkS)z7Determine whether is_admin matches the requested value.r;)
r?)rBr9ZcredsÚenforcerr
r
rÚ__call__·szIsAdminCheck.__call__)Ú__name__Ú
__module__Ú__qualname__Ú__doc__rArHÚ
__classcell__r
r
rErr<¬sr<c
Cstr
tj
SdSr
)rrr
r
r
rÚ	get_rules½s

rNc

Cs| t
 ¡¡

dSr
)Zregister_defaultsr	Z
list_rules)
rGr
r
rrÂs
rcCsfg}d
}
|
tt
jƒ
krNt
j|
 d¡
dvr4|
d7}
q| t
j|
¡

|
d
7}
qtj|dd
tƒ
tS)Nr)ú
-)Ú	namespacezoutput-fileéÚdmapi)
Zproject)	ÚlenÚsysÚargvÚstripÚappendrrrr)Z	conf_argsÚ
ir
r
rÚget_enforcerÆs








rYcCsHtrt
tj|ƒ
}nd
}||kr@t d |
|¡¡

| |¡

dSdSd
S)aCheck the rule of the deprecated policy action

    If the current rule of the deprecated policy action is set to a non-default
    value, then a warning message is logged stating that the new policy
    action should be used to dictate permissions as the old policy action is
    being deprecated.

    :param old_policy: policy action that is being deprecated
    :param new_policy: policy action that is replacing old_policy
    :param default_rule: the old_policy action default rule value
    :param context: the dmapi context
    NzvStart using the new action '{0}'. The existing action '{1}' is being deprecated and will be removed in future release.TF)rrrr-r.ÚformatZcan)Z
old_policyZ
new_policyrr8Zcurrent_ruler
r
rÚverify_deprecated_policyÚs


ý

r[)NNNT)TF)TN)*rLrÚrerTZoslo_configrZoslo_logrZloggingZoslo_policyrZ
oslo_utilsrrRrZ
dmapi.i18nrrr	rZ	getLoggerrIr-rr*rÚcompiler+rrrrr/r5r:ÚregisterZCheckr<rNrrYr[r
r
r
rÚ<module>s:













"	

.