ó
ōEYc@s¢
dd
lZdd
l
Z
dd
lZdd
lZddlmZ
dd
lZdd
lZiZej	ej
ƒ
def
d„ƒYƒ
Zdef
d„ƒYZ
def
d„ƒYZd	ef
d
„ƒYZdef
d„ƒYZd
ef
d„ƒYZdef
d„ƒYZd
d„
Zedƒ
def
d„ƒYƒ
Zedƒ
def
d„ƒYƒ
Zedƒ
def
d„ƒYƒ
Zed
ƒ
def
d„ƒYƒ
Zd
S(iÿÿÿÿN(
t	jsonutilst	BaseCheckcBs2eZ
dZejd
„ƒ
Zejd„ƒ
ZRS(s&Abstract base class for Check classes.c


Csd
S(s<String representation of the Check tree rooted at this node.N((
tself((sH/home/tvault/.virtenv/lib/python2.7/site-packages/oslo_policy/_checks.pyt__str__#sc
Csd
S(s¸Triggers if instance of the class is called.

        Performs the check. Returns False to reject the access or a
        true value (not necessary True) to accept the access.
        N((Rttargettcredtenforcer((sH/home/tvault/.virtenv/lib/python2.7/site-packages/oslo_policy/_checks.pyt__call__)s(t__name__t
__module__t__doc__tabctabstractmethodRR(((sH/home/tvault/.virtenv/lib/python2.7/site-packages/oslo_policy/_checks.pyR
st
FalseCheckc
Bs eZ
dZd
„Zd„ZRS(s8A policy check that always returns ``False`` (disallow).c


Csd
S(s-Return a string representation of this check.t
!((
R((sH/home/tvault/.virtenv/lib/python2.7/site-packages/oslo_policy/_checks.pyR7sc
CstS(
sCheck the policy.(
tFalse(RRRR((sH/home/tvault/.virtenv/lib/python2.7/site-packages/oslo_policy/_checks.pyR<s(RR	R
RR(((sH/home/tvault/.virtenv/lib/python2.7/site-packages/oslo_policy/_checks.pyR
4s
	t	TrueCheckc
Bs eZ
dZd
„Zd„ZRS(s4A policy check that always returns ``True`` (allow).c


Csd
S(s-Return a string representation of this check.t
@((
R((sH/home/tvault/.virtenv/lib/python2.7/site-packages/oslo_policy/_checks.pyREsc
CstS(
sCheck the policy.(
tTrue(RRRR((sH/home/tvault/.virtenv/lib/python2.7/site-packages/oslo_policy/_checks.pyRJs(RR	R
RR(((sH/home/tvault/.virtenv/lib/python2.7/site-packages/oslo_policy/_checks.pyRBs
	tCheckc
BseZ
d„Zd
„ZRS(cCs|
|_||_
dS(
N(tkindtmatch(RRR((sH/home/tvault/.virtenv/lib/python2.7/site-packages/oslo_policy/_checks.pyt__init__Qs
	
c

Csd
|j|j
fS(s-Return a string representation of this check.s%s:%s(RR(
R((sH/home/tvault/.virtenv/lib/python2.7/site-packages/oslo_policy/_checks.pyRUs(RR	RR(((sH/home/tvault/.virtenv/lib/python2.7/site-packages/oslo_policy/_checks.pyRPs
	tNotCheckc
Bs#eZ
d„Zd
„Zd„ZRS(cCs
|
|_dS(
N(
trule(RR((sH/home/tvault/.virtenv/lib/python2.7/site-packages/oslo_policy/_checks.pyR\s
c

Csd
|jS(s-Return a string representation of this check.snot %s(
R(
R((sH/home/tvault/.virtenv/lib/python2.7/site-packages/oslo_policy/_checks.pyR_scCs|j|
||ƒS(
sUCheck the policy.

        Returns the logical inverse of the wrapped check.
        (
R(RRRR((sH/home/tvault/.virtenv/lib/python2.7/site-packages/oslo_policy/_checks.pyRds(RR	RRR(((sH/home/tvault/.virtenv/lib/python2.7/site-packages/oslo_policy/_checks.pyR[s
		tAndCheckc
Bs,eZ
d„Zd
„Zd„Zd„ZRS(cCs
|
|_dS(
N(
trules(RR((sH/home/tvault/.virtenv/lib/python2.7/site-packages/oslo_policy/_checks.pyRns
c

Csd
djd„|j
Dƒ
ƒ
S(s-Return a string representation of this check.s(%s)s and c
ss|]}
t|
ƒ
V
qdS(
N(
tstr(t.0t
r((sH/home/tvault/.virtenv/lib/python2.7/site-packages/oslo_policy/_checks.pys	<genexpr>ts(tjoinR(
R((sH/home/tvault/.virtenv/lib/python2.7/site-packages/oslo_policy/_checks.pyRqscCs.x'|jD]}||
||ƒs
t
Sq
WtS(
s[Check the policy.

        Requires that all rules accept in order to return True.
        (RRR(RRRRR((sH/home/tvault/.virtenv/lib/python2.7/site-packages/oslo_policy/_checks.pyRvs

cCs|jj
|
ƒ

|S(
s¶Adds rule to be tested.

        Allows addition of another rule to the list of rules that will
        be tested.

        :returns: self
        :rtype: :class:`.AndCheck`
        (Rtappend(RR((sH/home/tvault/.virtenv/lib/python2.7/site-packages/oslo_policy/_checks.pyt	add_check‚s

(RR	RRRR (((sH/home/tvault/.virtenv/lib/python2.7/site-packages/oslo_policy/_checks.pyRms
			tOrCheckc
Bs5eZ
d„Zd
„Zd„Zd„Zd„ZRS(cCs
|
|_dS(
N(
R(RR((sH/home/tvault/.virtenv/lib/python2.7/site-packages/oslo_policy/_checks.pyR‘s
c

Csd
djd„|j
Dƒ
ƒ
S(s-Return a string representation of this check.s(%s)s or c
ss|]}
t|
ƒ
V
qdS(
N(
R(RR((sH/home/tvault/.virtenv/lib/python2.7/site-packages/oslo_policy/_checks.pys	<genexpr>—s(RR(
R((sH/home/tvault/.virtenv/lib/python2.7/site-packages/oslo_policy/_checks.pyR”scCs.x'|jD]}||
||ƒr
t
Sq
WtS(
scCheck the policy.

        Requires that at least one rule accept in order to return True.
        (RRR(RRRRR((sH/home/tvault/.virtenv/lib/python2.7/site-packages/oslo_policy/_checks.pyR™s


cCs|jj
|
ƒ

|S(
s¨Adds rule to be tested.

        Allows addition of another rule to the list of rules that will
        be tested.  Returns the OrCheck object for convenience.
        (RR(RR((sH/home/tvault/.virtenv/lib/python2.7/site-packages/oslo_policy/_checks.pyR ¤s
c
Cs|jj
ƒ}
||
fS(
s—Pops the last check from the list and returns them

        :returns: self, the popped check
        :rtype: :class:`.OrCheck`, class:`.Check`
        (Rtpop(Rtcheck((sH/home/tvault/.virtenv/lib/python2.7/site-packages/oslo_policy/_checks.pyt	pop_check®s
(RR	RRRR R$(((sH/home/tvault/.virtenv/lib/python2.7/site-packages/oslo_policy/_checks.pyR!s

				
cs#‡f
d
†}|
r||
ƒ
S|S(Nc

s|tˆ<|S(
N(
tregistered_checks(
tfunc(
tname(sH/home/tvault/.virtenv/lib/python2.7/site-packages/oslo_policy/_checks.pyt	decorator½s


((R'R&R(((
R'sH/home/tvault/.virtenv/lib/python2.7/site-packages/oslo_policy/_checks.pytregister¹s

Rt	RuleCheckc
BseZ
d„ZRS(
cCs7y|j|j
|
||ƒSWntk
r2


tSXdS(
N(RRtKeyErrorR(RRtcredsR((sH/home/tvault/.virtenv/lib/python2.7/site-packages/oslo_policy/_checks.pyRÊs



(RR	R(((sH/home/tvault/.virtenv/lib/python2.7/site-packages/oslo_policy/_checks.pyR*Èstrolet	RoleCheckc
BseZ
dZd
„ZRS(s:Check that there is a matching role in the ``creds`` dict.cCscy|j|
}Wnt
k
r%


tSXd
|kr_|jƒg|d
D]}|jƒ^qFkStS(Ntroles(RR+Rtlower(RRR,RRt
x((sH/home/tvault/.virtenv/lib/python2.7/site-packages/oslo_policy/_checks.pyRÖs





-
(RR	R
R(((sH/home/tvault/.virtenv/lib/python2.7/site-packages/oslo_policy/_checks.pyR.Òsthttpt	HttpCheckc
BseZ
dZd
„ZRS(s•Check ``http:`` rules by calling to a remote server.

    This example implementation simply verifies that the response
    is exactly ``True``.
    c
CsÃd
|j|
}t
j|
ƒ
}xB|
jƒD]4}|
j|ƒ
}t|ƒ
tkr-i||<q-q-Witj|ƒ
d6tj|ƒ
d6}t	j
tj|d|ƒ

ƒ
}	|	j
dkSWdQXdS(Nshttp:RtcredentialstdataR(RtcopytdeepcopytkeystgetttypetobjectRtdumpst
contextlibtclosingtrequeststpostttext(
RRR,Rturlttemp_targettkeytelementR5R((sH/home/tvault/.virtenv/lib/python2.7/site-packages/oslo_policy/_checks.pyRês







!
(RR	R
R(((sH/home/tvault/.virtenv/lib/python2.7/site-packages/oslo_policy/_checks.pyR3âstGenericCheckc
Bs eZ
dZd
„Zd„ZRS(sµCheck an individual match.

    Matches look like:

        - tenant:%(tenant_id)s
        - role:compute:admin
        - True:%(user.enabled)s
        - 'Member':%(role.name)s
    cCs±t|ƒ
d
kr%|t
j|
ƒ
kS|d
|d}}y|
|}
Wntk
r\


tSXt|
tƒršx'|
D]}|j|||ƒrstSqsWtS|j|
||ƒSdS(sKSearches for a match in the dictionary.

        test_value is a reference inside the dictionary. Since the process is
        recursive, each call to _find_in_dict will be one level deeper.

        path_segments is the segments of the path to search.  The recursion
        ends when there are no more segments of path.

        When specifying a value inside a list, each element of the list is
        checked for a match. If the value is found within any of the sub lists
        the check succeeds; The check only fails if the entry is not in any of
        the sublists.

        ii
N(	tlentsixt	text_typeR+Rt
isinstancetlistt
_find_in_dictR(Rt
test_valuet
path_segmentsRRDtval((sH/home/tvault/.virtenv/lib/python2.7/site-packages/oslo_policy/_checks.pyRL
s












cCsˆy|j|
}Wnt
k
r%


tSXy)tj|jƒ
}|tj|ƒ
kSWntk
rb


n
X|jj	d
ƒ
}|j
|||ƒS(Nt
.(RR+Rtasttliteral_evalRRHRIt
ValueErrortsplitRL(RRR,RRRMRN((sH/home/tvault/.virtenv/lib/python2.7/site-packages/oslo_policy/_checks.pyR&
s







(RR	R
RLR(((sH/home/tvault/.virtenv/lib/python2.7/site-packages/oslo_policy/_checks.pyRFûs
	(RRQR=R6toslo_serializationRR?RHR%t
add_metaclasstABCMetaR;R
R
RRRRR!tNoneR)R*R.R3RF(((sH/home/tvault/.virtenv/lib/python2.7/site-packages/oslo_policy/_checks.pyt<module>s0





#)