Skip to content

Commit 99540f6

Browse files
strantalisstrantalis
committed
feat: add new key management functionality
1 parent 7aa82eb commit 99540f6

File tree

3 files changed

+367
-78
lines changed

3 files changed

+367
-78
lines changed

‎xtest/abac.py

Lines changed: 149 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -128,17 +128,33 @@ class SubjectMapping(BaseModelIgnoreExtra):
128128
actions: list[Action]
129129
metadata: Metadata | None = None
130130

131+
class NamespaceKey(BaseModelIgnoreExtra):
132+
namespace_id: str
133+
key_access_server_id: str | None = None
134+
131135

136+
137+
# Deprecated
132138
class KasGrantNamespace(BaseModelIgnoreExtra):
133139
namespace_id: str
134-
key_access_server_id: str | None = None
140+
key_id: str
135141

136142

143+
class AttributeKey(BaseModelIgnoreExtra):
144+
attribute_id: str
145+
key_id: str
146+
147+
# Deprecated
137148
class KasGrantAttribute(BaseModelIgnoreExtra):
138149
attribute_id: str
139150
key_access_server_id: str | None = None
140151

141152

153+
class ValueKey(BaseModelIgnoreExtra):
154+
value_id: str
155+
key_id: str
156+
157+
# Deprecated
142158
class KasGrantValue(BaseModelIgnoreExtra):
143159
value_id: str
144160
key_access_server_id: str | None = None
@@ -153,6 +169,12 @@ class KasPublicKey(BaseModelIgnoreExtra):
153169
kid: str
154170
alg: int
155171

172+
class KasKey(BaseModelIgnoreExtra):
173+
id: str
174+
public_key_ctx: str
175+
private_key_ctx: str
176+
alg: str
177+
mode: str
156178

157179
class KasPublicKeySet(BaseModelIgnoreExtra):
158180
keys: list[KasPublicKey]
@@ -225,7 +247,42 @@ def kas_registry_create_if_not_present(self, uri: str, key: PublicKey) -> KasEnt
225247
if e.uri == uri:
226248
return e
227249
return self.kas_registry_create(uri, key)
250+
251+
def kas_registry_create_public_key_only(self, publicKey: KasPublicKey) -> KasKey:
252+
cmd = self.otdfctl + "policy kas-registry key create --mode public_key".split()
253+
cmd += [
254+
f"--public-key-pem={publicKey.pem}",
255+
f"--key-id={publicKey.kid}",
256+
f"--algorithm={publicKey.alg}",
257+
]
258+
process = subprocess.Popen(cmd, stdout=subprocess.PIPE)
259+
code = process.wait()
260+
out, err = process.communicate()
261+
if err:
262+
print(err, file=sys.stderr)
263+
if out:
264+
print(out)
265+
assert code == 0
266+
return KasKey.model_validate_json(out)
228267

268+
def key_assign_ns(self, keyID: KasKey, ns: Namespace) -> NamespaceKey:
269+
cmd = self.otdfctl + "policy attributes namespace key assign".split()
270+
cmd += [
271+
f"--key-id={keyID.id}",
272+
f"--namespace={ns.id}",
273+
]
274+
logger.info(f"key-assign [{' '.join(cmd)}]")
275+
process = subprocess.Popen(cmd, stdout=subprocess.PIPE)
276+
code = process.wait()
277+
out, err = process.communicate()
278+
if err:
279+
print(err, file=sys.stderr)
280+
if out:
281+
print(out)
282+
assert code == 0
283+
return NamespaceKey.model_validate_json(out)
284+
285+
# Deprecated
229286
def grant_assign_ns(self, kas: KasEntry, ns: Namespace) -> KasGrantNamespace:
230287
cmd = self.otdfctl + "policy kas-grants assign".split()
231288
cmd += [
@@ -242,7 +299,25 @@ def grant_assign_ns(self, kas: KasEntry, ns: Namespace) -> KasGrantNamespace:
242299
print(out)
243300
assert code == 0
244301
return KasGrantNamespace.model_validate_json(out)
302+
303+
def key_assign_attr(self, keyID: KasKey, attr: Attribute) -> AttributeKey:
304+
cmd = self.otdfctl + "policy attributes key assign".split()
305+
cmd += [
306+
f"--key-id={keyID.id}",
307+
f"--attribute={attr.id}",
308+
]
309+
logger.info(f"key-assign [{' '.join(cmd)}]")
310+
process = subprocess.Popen(cmd, stdout=subprocess.PIPE)
311+
code = process.wait()
312+
out, err = process.communicate()
313+
if err:
314+
print(err, file=sys.stderr)
315+
if out:
316+
print(out)
317+
assert code == 0
318+
return AttributeKey.model_validate_json(out)
245319

320+
# Deprecated
246321
def grant_assign_attr(self, kas: KasEntry, attr: Attribute) -> KasGrantAttribute:
247322
cmd = self.otdfctl + "policy kas-grants assign".split()
248323
cmd += [
@@ -260,6 +335,24 @@ def grant_assign_attr(self, kas: KasEntry, attr: Attribute) -> KasGrantAttribute
260335
assert code == 0
261336
return KasGrantAttribute.model_validate_json(out)
262337

338+
def key_assign_value(self, keyID: KasKey, val: AttributeValue) -> ValueKey:
339+
cmd = self.otdfctl + "policy attributes value key assign".split()
340+
cmd += [
341+
f"--key-id={keyID.id}",
342+
f"--value-id={val.id}",
343+
]
344+
logger.info(f"key-assign [{' '.join(cmd)}]")
345+
process = subprocess.Popen(cmd, stdout=subprocess.PIPE)
346+
code = process.wait()
347+
out, err = process.communicate()
348+
if err:
349+
print(err, file=sys.stderr)
350+
if out:
351+
print(out)
352+
assert code == 0
353+
return ValueKey.model_validate_json(out)
354+
355+
# Deprecated
263356
def grant_assign_value(self, kas: KasEntry, val: AttributeValue) -> KasGrantValue:
264357
cmd = self.otdfctl + "policy kas-grants assign".split()
265358
cmd += [
@@ -276,7 +369,25 @@ def grant_assign_value(self, kas: KasEntry, val: AttributeValue) -> KasGrantValu
276369
print(out)
277370
assert code == 0
278371
return KasGrantValue.model_validate_json(out)
372+
373+
def key_unassign_ns(self, keyID: KasKey, ns: Namespace) -> NamespaceKey:
374+
cmd = self.otdfctl + "policy attributes namespace key unassign".split()
375+
cmd += [
376+
f"--key-id={keyID.id}",
377+
f"--namespace={ns.id}",
378+
]
379+
logger.info(f"key-assign [{' '.join(cmd)}]")
380+
process = subprocess.Popen(cmd, stdout=subprocess.PIPE)
381+
code = process.wait()
382+
out, err = process.communicate()
383+
if err:
384+
print(err, file=sys.stderr)
385+
if out:
386+
print(out)
387+
assert code == 0
388+
return NamespaceKey.model_validate_json(out)
279389

390+
# Deprecated
280391
def grant_unassign_ns(self, kas: KasEntry, ns: Namespace) -> KasGrantNamespace:
281392
cmd = self.otdfctl + "policy kas-grants unassign".split()
282393
cmd += [
@@ -293,7 +404,25 @@ def grant_unassign_ns(self, kas: KasEntry, ns: Namespace) -> KasGrantNamespace:
293404
print(out)
294405
assert code == 0
295406
return KasGrantNamespace.model_validate_json(out)
296-
407+
408+
def key_unassign_attr(self, keyID: KasKey, attr: Attribute) -> AttributeKey:
409+
cmd = self.otdfctl + "policy attributes key unassign".split()
410+
cmd += [
411+
f"--key-id={keyID.id}",
412+
f"--attribute={attr.id}",
413+
]
414+
logger.info(f"key-assign [{' '.join(cmd)}]")
415+
process = subprocess.Popen(cmd, stdout=subprocess.PIPE)
416+
code = process.wait()
417+
out, err = process.communicate()
418+
if err:
419+
print(err, file=sys.stderr)
420+
if out:
421+
print(out)
422+
assert code == 0
423+
return AttributeKey.model_validate_json(out)
424+
425+
# Deprecated
297426
def grant_unassign_attr(self, kas: KasEntry, attr: Attribute) -> KasGrantAttribute:
298427
cmd = self.otdfctl + "policy kas-grants unassign".split()
299428
cmd += [
@@ -311,6 +440,24 @@ def grant_unassign_attr(self, kas: KasEntry, attr: Attribute) -> KasGrantAttribu
311440
assert code == 0
312441
return KasGrantAttribute.model_validate_json(out)
313442

443+
def key_unassign_value(self, keyID: KasKey, val: AttributeValue) -> ValueKey:
444+
cmd = self.otdfctl + "policy attributes value key unassign".split()
445+
cmd += [
446+
f"--key-id={keyID.id}",
447+
f"--value-id={val.id}",
448+
]
449+
logger.info(f"key-assign [{' '.join(cmd)}]")
450+
process = subprocess.Popen(cmd, stdout=subprocess.PIPE)
451+
code = process.wait()
452+
out, err = process.communicate()
453+
if err:
454+
print(err, file=sys.stderr)
455+
if out:
456+
print(out)
457+
assert code == 0
458+
return ValueKey.model_validate_json(out)
459+
460+
# Deprecated
314461
def grant_unassign_value(self, kas: KasEntry, val: AttributeValue) -> KasGrantValue:
315462
cmd = self.otdfctl + "policy kas-grants unassign".split()
316463
cmd += [

0 commit comments

Comments
 (0)