aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
-rw-r--r--python_moondb/Changelog4
-rw-r--r--python_moondb/python_moondb/__init__.py2
-rw-r--r--python_moondb/python_moondb/api/model.py33
-rw-r--r--python_moondb/python_moondb/api/policy.py15
-rw-r--r--python_moondb/python_moondb/backends/sql.py19
-rw-r--r--python_moondb/tests/unit_python/models/test_categories.py160
-rw-r--r--python_moondb/tests/unit_python/models/test_meta_rules.py32
-rw-r--r--python_moondb/tests/unit_python/models/test_models.py38
-rwxr-xr-xpython_moondb/tests/unit_python/policies/test_data.py69
-rwxr-xr-xpython_moondb/tests/unit_python/policies/test_policies.py35
-rw-r--r--python_moonutilities/Changelog6
-rw-r--r--python_moonutilities/python_moonutilities/__init__.py2
-rw-r--r--python_moonutilities/python_moonutilities/exceptions.py49
13 files changed, 437 insertions, 27 deletions
diff --git a/python_moondb/Changelog b/python_moondb/Changelog
index 19cd0ac0..acd72883 100644
--- a/python_moondb/Changelog
+++ b/python_moondb/Changelog
@@ -69,3 +69,7 @@ CHANGES
1.2.8
-----
- Add unique constraints on db tables
+
+1.2.9
+-----
+- Add some verifications when deleting some elements in database
diff --git a/python_moondb/python_moondb/__init__.py b/python_moondb/python_moondb/__init__.py
index b266a9d4..287558f7 100644
--- a/python_moondb/python_moondb/__init__.py
+++ b/python_moondb/python_moondb/__init__.py
@@ -3,5 +3,5 @@
# license which can be found in the file 'LICENSE' in this package distribution
# or at 'http://www.apache.org/licenses/LICENSE-2.0'.
-__version__ = "1.2.8"
+__version__ = "1.2.9"
diff --git a/python_moondb/python_moondb/api/model.py b/python_moondb/python_moondb/api/model.py
index 57857cd2..f5858662 100644
--- a/python_moondb/python_moondb/api/model.py
+++ b/python_moondb/python_moondb/api/model.py
@@ -9,7 +9,6 @@ from python_moonutilities import exceptions
from python_moonutilities.security_functions import filter_input, enforce
from python_moondb.api.managers import Managers
-
logger = logging.getLogger("moon.db.api.model")
@@ -30,6 +29,10 @@ class ModelManager(Managers):
if model_id not in self.driver.get_models(model_id=model_id):
raise exceptions.ModelUnknown
# TODO (asteroide): check that no policy is connected to this model
+ policies = Managers.PolicyManager.get_policies(user_id=user_id)
+ for policy in policies:
+ if policies[policy]['model_id'] == model_id:
+ raise exceptions.DeleteModelWithPolicy
return self.driver.delete_model(model_id=model_id)
@enforce(("read", "write"), "models")
@@ -65,6 +68,10 @@ class ModelManager(Managers):
if meta_rule_id not in self.driver.get_meta_rules(meta_rule_id=meta_rule_id):
raise exceptions.MetaRuleUnknown
# TODO (asteroide): check and/or delete data and assignments and rules linked to that meta_rule
+ models = self.get_models(user_id=user_id)
+ for model_id in models:
+ if models[model_id]['meta_rules'] == meta_rule_id:
+ raise exceptions.DeleteMetaRuleWithModel
return self.driver.delete_meta_rule(meta_rule_id=meta_rule_id)
@enforce("read", "meta_data")
@@ -83,6 +90,13 @@ class ModelManager(Managers):
# TODO (asteroide): delete all meta_rules linked to that category
if category_id not in self.driver.get_subject_categories(category_id=category_id):
raise exceptions.SubjectCategoryUnknown
+ meta_rules = self.get_meta_rules(user_id=user_id)
+ for meta_rule_id in meta_rules:
+ for subject_category_id in meta_rules[meta_rule_id]['subject_categories']:
+ if subject_category_id == category_id:
+ raise exceptions.DeleteCategoryWithMetaRule
+ if self.driver.is_subject_data_exist(category_id=category_id):
+ raise exceptions.DeleteCategoryWithData
return self.driver.delete_subject_category(category_id=category_id)
@enforce("read", "meta_data")
@@ -101,6 +115,13 @@ class ModelManager(Managers):
# TODO (asteroide): delete all meta_rules linked to that category
if category_id not in self.driver.get_object_categories(category_id=category_id):
raise exceptions.ObjectCategoryUnknown
+ meta_rules = self.get_meta_rules(user_id=user_id)
+ for meta_rule_id in meta_rules:
+ for object_category_id in meta_rules[meta_rule_id]['object_categories']:
+ if object_category_id == category_id:
+ raise exceptions.DeleteCategoryWithMetaRule
+ if self.driver.is_object_data_exist(category_id=category_id):
+ raise exceptions.DeleteCategoryWithData
return self.driver.delete_object_category(category_id=category_id)
@enforce("read", "meta_data")
@@ -118,6 +139,12 @@ class ModelManager(Managers):
# TODO (asteroide): delete all data linked to that category
# TODO (asteroide): delete all meta_rules linked to that category
if category_id not in self.driver.get_action_categories(category_id=category_id):
- raise exceptions.ActionCategoryExisting
+ raise exceptions.ActionCategoryUnknown
+ meta_rules = self.get_meta_rules(user_id=user_id)
+ for meta_rule_id in meta_rules:
+ for action_category_id in meta_rules[meta_rule_id]['action_categories']:
+ if action_category_id == category_id:
+ raise exceptions.DeleteCategoryWithMetaRule
+ if self.driver.is_action_data_exist(category_id=category_id):
+ raise exceptions.DeleteCategoryWithData
return self.driver.delete_action_category(category_id=category_id)
-
diff --git a/python_moondb/python_moondb/api/policy.py b/python_moondb/python_moondb/api/policy.py
index 9e7ad96c..69392e6d 100644
--- a/python_moondb/python_moondb/api/policy.py
+++ b/python_moondb/python_moondb/api/policy.py
@@ -8,6 +8,7 @@ import logging
from python_moonutilities.security_functions import enforce
from python_moondb.api.managers import Managers
from python_moonutilities import exceptions
+# from python_moondb.core import PDPManager
logger = logging.getLogger("moon.db.api.policy")
@@ -46,6 +47,11 @@ class PolicyManager(Managers):
# TODO (asteroide): unmap PDP linked to that policy
if policy_id not in self.driver.get_policies(policy_id=policy_id):
raise exceptions.PolicyUnknown
+ pdps = self.PDPManager.get_pdp(user_id=user_id)
+ for pdp in pdps:
+ for policy_id in pdps[pdp]['security_pipeline']:
+ if policy_id == policy_id:
+ raise exceptions.DeletePolicyWithPdp
return self.driver.delete_policy(policy_id=policy_id)
@enforce(("read", "write"), "policies")
@@ -147,6 +153,9 @@ class PolicyManager(Managers):
@enforce(("read", "write"), "data")
def delete_subject_data(self, user_id, policy_id, data_id):
# TODO (asteroide): check and/or delete assignments linked to that data
+ subject_assignments = self.get_subject_assignments(user_id=user_id, policy_id=policy_id, subject_id=data_id)
+ if subject_assignments:
+ raise exceptions.DeleteData
return self.driver.delete_subject_data(policy_id=policy_id, data_id=data_id)
@enforce("read", "data")
@@ -175,6 +184,9 @@ class PolicyManager(Managers):
@enforce(("read", "write"), "data")
def delete_object_data(self, user_id, policy_id, data_id):
# TODO (asteroide): check and/or delete assignments linked to that data
+ object_assignments = self.get_object_assignments(user_id=user_id, policy_id=policy_id, object_id=data_id)
+ if object_assignments:
+ raise exceptions.DeleteData
return self.driver.delete_object_data(policy_id=policy_id, data_id=data_id)
@enforce("read", "data")
@@ -203,6 +215,9 @@ class PolicyManager(Managers):
@enforce(("read", "write"), "data")
def delete_action_data(self, user_id, policy_id, data_id):
# TODO (asteroide): check and/or delete assignments linked to that data
+ action_assignments = self.get_action_assignments(user_id=user_id, policy_id=policy_id, action_id=data_id)
+ if action_assignments:
+ raise exceptions.DeleteData
return self.driver.delete_action_data(policy_id=policy_id, data_id=data_id)
@enforce("read", "assignments")
diff --git a/python_moondb/python_moondb/backends/sql.py b/python_moondb/python_moondb/backends/sql.py
index a838a854..366ed7de 100644
--- a/python_moondb/python_moondb/backends/sql.py
+++ b/python_moondb/python_moondb/backends/sql.py
@@ -548,6 +548,16 @@ class PolicyConnector(BaseConnector, PolicyDriver):
def delete_action(self, policy_id, perimeter_id):
self.__delete_perimeter(Action, ActionUnknown, policy_id, perimeter_id)
+ def __is_perimeter_data_exist(self, ClassType ,data_id=None, category_id=None):
+ logger.info("driver {} {}".format( data_id, category_id))
+ with self.get_session_for_read() as session:
+ query = session.query(ClassType)
+ query = query.filter_by(category_id=category_id)
+ ref_list = query.all()
+ if ref_list:
+ return True
+ return False
+
def __get_perimeter_data(self, ClassType, policy_id, data_id=None, category_id=None):
logger.info("driver {} {} {}".format(policy_id, data_id, category_id))
with self.get_session_for_read() as session:
@@ -602,6 +612,9 @@ class PolicyConnector(BaseConnector, PolicyDriver):
if ref:
session.delete(ref)
+ def is_subject_data_exist(self, data_id=None, category_id=None):
+ return self.__is_perimeter_data_exist(SubjectData, data_id=data_id, category_id=category_id)
+
def get_subject_data(self, policy_id, data_id=None, category_id=None):
return self.__get_perimeter_data(SubjectData, policy_id, data_id=data_id, category_id=category_id)
@@ -614,6 +627,9 @@ class PolicyConnector(BaseConnector, PolicyDriver):
def delete_subject_data(self, policy_id, data_id):
return self.__delete_perimeter_data(SubjectData, policy_id, data_id)
+ def is_object_data_exist(self, data_id=None, category_id=None):
+ return self.__is_perimeter_data_exist(ObjectData, data_id=data_id, category_id=category_id)
+
def get_object_data(self, policy_id, data_id=None, category_id=None):
return self.__get_perimeter_data(ObjectData, policy_id, data_id=data_id, category_id=category_id)
@@ -626,6 +642,9 @@ class PolicyConnector(BaseConnector, PolicyDriver):
def delete_object_data(self, policy_id, data_id):
return self.__delete_perimeter_data(ObjectData, policy_id, data_id)
+ def is_action_data_exist(self, data_id=None,category_id=None):
+ return self.__is_perimeter_data_exist(ActionData, data_id=data_id, category_id=category_id)
+
def get_action_data(self, policy_id, data_id=None, category_id=None):
return self.__get_perimeter_data(ActionData, policy_id, data_id=data_id, category_id=category_id)
diff --git a/python_moondb/tests/unit_python/models/test_categories.py b/python_moondb/tests/unit_python/models/test_categories.py
index 0ffcf96e..cdcf6bcb 100644
--- a/python_moondb/tests/unit_python/models/test_categories.py
+++ b/python_moondb/tests/unit_python/models/test_categories.py
@@ -1,6 +1,11 @@
-import pytest
-import logging
-from python_moonutilities.exceptions import *
+# Copyright 2018 Open Platform for NFV Project, Inc. and its contributors
+# This software is distributed under the terms and conditions of the 'Apache-2.0'
+# license which can be found in the file 'LICENSE' in this package distribution
+# or at 'http://www.apache.org/licenses/LICENSE-2.0'.
+
+from .test_meta_rules import *
+import policies.mock_data as mock_data
+import policies.test_data as test_data
logger = logging.getLogger("moon.db.tests.models.test_categories")
@@ -36,6 +41,55 @@ def test_get_subject_categories_with_invalid_id():
category_id = "invalid_id"
subject_category = get_subject_category(category_id)
assert len(subject_category) == 0
+ category = add_subject_category(value={"name": "category name", "description": "description 1"})
+ assert category is not None
+ with pytest.raises(SubjectCategoryExisting):
+ add_subject_category(value={"name": "category name", "description": "description 2"})
+
+
+def delete_subject_category(cat_id=None):
+ from python_moondb.core import ModelManager
+ ModelManager.delete_subject_category(user_id=None, category_id=cat_id)
+
+
+def test_delete_subject_category(db):
+ category = add_subject_category(value={"name": "category name", "description": "description 1"})
+ delete_subject_category(list(category.keys())[0])
+
+
+def test_delete_subject_category_with_invalid_id(db):
+ with pytest.raises(SubjectCategoryUnknown) as exception_info:
+ delete_subject_category(-1)
+
+
+def test_delete_subject_category_with_meta_rule(db):
+ category = add_subject_category(value={"name": "category name", "description": "description 1"})
+ subject_category_id = list(category.keys())[0]
+ value = {
+ "name": "MLS_meta_rule",
+ "description": "test",
+ "subject_categories": [subject_category_id],
+ "object_categories": ["vm_security_level_id_1"],
+ "action_categories": ["action_type_id_1"]
+ }
+ add_meta_rule(value=value)
+ with pytest.raises(DeleteCategoryWithMetaRule):
+ delete_subject_category(subject_category_id)
+
+
+def test_delete_subject_category_with_data(db):
+ category = add_subject_category(value={"name": "category name", "description": "description 1"})
+ subject_category_id = list(category.keys())[0]
+ policy_id = mock_data.get_policy_id()
+ data_id = "data_id_1"
+ category_id = subject_category_id
+ value = {
+ "name": "subject-security-level",
+ "description": {"low": "", "medium": "", "high": ""},
+ }
+ test_data.add_subject_data(policy_id, data_id, category_id, value)
+ with pytest.raises(DeleteCategoryWithData):
+ delete_subject_category(subject_category_id)
def add_object_category(cat_id=None, value=None):
@@ -69,6 +123,55 @@ def test_get_object_categories_with_invalid_id():
category_id = "invalid_id"
object_category = get_object_category(category_id)
assert len(object_category) == 0
+ category = add_object_category(value={"name": "category name", "description": "description 1"})
+ assert category is not None
+ with pytest.raises(ObjectCategoryExisting):
+ add_object_category(value={"name": "category name", "description": "description 2"})
+
+
+def delete_object_category(cat_id=None):
+ from python_moondb.core import ModelManager
+ ModelManager.delete_object_category(user_id=None, category_id=cat_id)
+
+
+def test_delete_object_category(db):
+ category = add_object_category(value={"name": "category name", "description": "description 1"})
+ delete_object_category(list(category.keys())[0])
+
+
+def test_delete_object_category_with_invalid_id(db):
+ with pytest.raises(ObjectCategoryUnknown) as exception_info:
+ delete_object_category(-1)
+
+
+def test_delete_object_category_with_meta_rule(db):
+ category = add_object_category(value={"name": "category name", "description": "description 1"})
+ object_category_id = list(category.keys())[0]
+ value = {
+ "name": "MLS_meta_rule",
+ "description": "test",
+ "subject_categories": ["subject_id_1"],
+ "object_categories": [object_category_id],
+ "action_categories": ["action_type_id_1"]
+ }
+ add_meta_rule(value=value)
+ with pytest.raises(DeleteCategoryWithMetaRule):
+ delete_object_category(object_category_id)
+
+
+def test_delete_object_category_with_data(db):
+ policy_id = mock_data.get_policy_id()
+ category = add_object_category(value={"name": "category name", "description": "description 1"})
+ object_category_id = list(category.keys())[0]
+ data_id = "data_id_1"
+ category_id = object_category_id
+ value = {
+ "name": "object-security-level",
+ "description": {"low": "", "medium": "", "high": ""},
+ }
+ test_data.add_object_data(policy_id, data_id, category_id, value)
+ with pytest.raises(DeleteCategoryWithData):
+ delete_object_category(object_category_id)
def add_action_category(cat_id=None, value=None):
@@ -101,4 +204,53 @@ def test_get_action_categories():
def test_get_action_categories_with_invalid_id():
category_id = "invalid_id"
action_category = get_action_category(category_id)
- assert len(action_category) == 0 \ No newline at end of file
+ assert len(action_category) == 0
+ category = add_action_category(value={"name": "category name", "description": "description 1"})
+ assert category is not None
+ with pytest.raises(ActionCategoryExisting):
+ add_action_category(value={"name": "category name", "description": "description 2"})
+
+
+def delete_action_category(cat_id=None):
+ from python_moondb.core import ModelManager
+ ModelManager.delete_action_category(user_id=None, category_id=cat_id)
+
+
+def test_delete_action_category(db):
+ category = add_action_category(value={"name": "category name", "description": "description 1"})
+ delete_action_category(list(category.keys())[0])
+
+
+def test_delete_action_category_with_invalid_id(db):
+ with pytest.raises(ActionCategoryUnknown) as exception_info:
+ delete_action_category(-1)
+
+
+def test_delete_action_category_with_meta_rule(db):
+ category = add_action_category(value={"name": "category name", "description": "description 1"})
+ action_category_id = list(category.keys())[0]
+ value = {
+ "name": "MLS_meta_rule",
+ "description": "test",
+ "subject_categories": ["subject_id_1"],
+ "object_categories": ["vm_security_level_id_1"],
+ "action_categories": [action_category_id]
+ }
+ add_meta_rule(value=value)
+ with pytest.raises(DeleteCategoryWithMetaRule):
+ delete_action_category(action_category_id)
+
+
+def test_delete_action_category_with_data(db):
+ category = add_action_category(value={"name": "category name", "description": "description 1"})
+ action_category_id = list(category.keys())[0]
+ policy_id = mock_data.get_policy_id()
+ data_id = "data_id_1"
+ category_id = action_category_id
+ value = {
+ "name": "action-type",
+ "description": {"vm-action": "", "storage-action": "", },
+ }
+ test_data.add_action_data(policy_id, data_id, category_id, value)
+ with pytest.raises(DeleteCategoryWithData):
+ delete_action_category(action_category_id)
diff --git a/python_moondb/tests/unit_python/models/test_meta_rules.py b/python_moondb/tests/unit_python/models/test_meta_rules.py
index 585274d9..a5a11552 100644
--- a/python_moondb/tests/unit_python/models/test_meta_rules.py
+++ b/python_moondb/tests/unit_python/models/test_meta_rules.py
@@ -1,4 +1,9 @@
-import pytest
+# Copyright 2018 Open Platform for NFV Project, Inc. and its contributors
+# This software is distributed under the terms and conditions of the 'Apache-2.0'
+# license which can be found in the file 'LICENSE' in this package distribution
+# or at 'http://www.apache.org/licenses/LICENSE-2.0'.
+
+from .test_models import *
def set_meta_rule(meta_rule_id, value=None):
@@ -51,7 +56,7 @@ def test_add_new_meta_rule_success(db):
"object_categories": ["vm_security_level_id_1"],
"action_categories": ["action_type_id_1"]
}
- metaRules = add_meta_rule();
+ metaRules = add_meta_rule()
assert isinstance(metaRules, dict)
assert metaRules
assert len(metaRules) is 1
@@ -172,3 +177,26 @@ def test_delete_invalid_meta_rules_error(db):
with pytest.raises(Exception) as exception_info:
delete_meta_rules("INVALID_META_RULE_ID")
assert str(exception_info.value) == '400: Sub Meta Rule Unknown'
+
+
+def test_delete_meta_rule_with_assigned_model(db):
+ value = {
+ "name": "MLS_meta_rule",
+ "description": "test",
+ "subject_categories": ["user_security_level_id_1"],
+ "object_categories": ["vm_security_level_id_1"],
+ "action_categories": ["action_type_id_1"]
+ }
+ metaRules = add_meta_rule()
+ assert isinstance(metaRules, dict)
+ assert metaRules
+ assert len(metaRules) is 1
+ meta_rule_id = list(metaRules.keys())[0]
+ model_value1 = {
+ "name": "MLS",
+ "description": "test",
+ "meta_rules": meta_rule_id
+ }
+ add_model(value=model_value1)
+ with pytest.raises(DeleteMetaRuleWithModel) as exception_info:
+ delete_meta_rules(meta_rule_id)
diff --git a/python_moondb/tests/unit_python/models/test_models.py b/python_moondb/tests/unit_python/models/test_models.py
index 54c45e77..06c2b6be 100644
--- a/python_moondb/tests/unit_python/models/test_models.py
+++ b/python_moondb/tests/unit_python/models/test_models.py
@@ -1,11 +1,19 @@
+# Copyright 2018 Open Platform for NFV Project, Inc. and its contributors
+# This software is distributed under the terms and conditions of the 'Apache-2.0'
+# license which can be found in the file 'LICENSE' in this package distribution
+# or at 'http://www.apache.org/licenses/LICENSE-2.0'.
+
import pytest
from python_moonutilities.exceptions import *
import logging
+import policies.test_policies as test_policies
+
logger = logging.getLogger("moon.db.tests.test_model")
+
def get_models(model_id=None):
from python_moondb.core import ModelManager
- return ModelManager.get_models(user_id= None , model_id= model_id)
+ return ModelManager.get_models(user_id=None, model_id=model_id)
def add_model(model_id=None, value=None):
@@ -62,6 +70,7 @@ def test_get_model(db):
assert len(models) is 1
delete_all_models()
+
def test_get_specific_model(db):
# prepare
add_model(model_id="mls_model_id")
@@ -74,6 +83,7 @@ def test_get_specific_model(db):
assert len(models) is 1
delete_all_models()
+
def test_add_model(db):
# act
model = add_model()
@@ -91,7 +101,7 @@ def test_add_same_model_twice(db):
with pytest.raises(ModelExisting) as exception_info:
add_model(model_id="model_1")
delete_all_models()
- #assert str(exception_info.value) == '409: Model Error'
+ # assert str(exception_info.value) == '409: Model Error'
def test_add_model_generate_new_uuid(db):
@@ -175,4 +185,26 @@ def test_update_model(db):
for key in ("name", "meta_rules", "description"):
assert key in model[model_id]
assert model[model_id][key] == new_model_value[key]
- delete_all_models() \ No newline at end of file
+ delete_all_models()
+
+
+def test_delete_model_assigned_to_policy(db):
+ model_value1 = {
+ "name": "MLS",
+ "description": "test",
+ "meta_rules": "meta_rule_mls_1"
+ }
+ models = add_model(value=model_value1)
+ assert isinstance(models, dict)
+ assert models
+ assert len(models.keys()) == 1
+ model_id = list(models.keys())[0]
+ value = {
+ "name": "test_policy",
+ "model_id": model_id,
+ "genre": "authz",
+ "description": "test",
+ }
+ test_policies.add_policies(value=value)
+ with pytest.raises(DeleteModelWithPolicy) as exception_info:
+ delete_models(uuid=model_id)
diff --git a/python_moondb/tests/unit_python/policies/test_data.py b/python_moondb/tests/unit_python/policies/test_data.py
index 6a57130e..5e00fe65 100755
--- a/python_moondb/tests/unit_python/policies/test_data.py
+++ b/python_moondb/tests/unit_python/policies/test_data.py
@@ -1,7 +1,10 @@
+# Copyright 2018 Open Platform for NFV Project, Inc. and its contributors
+# This software is distributed under the terms and conditions of the 'Apache-2.0'
+# license which can be found in the file 'LICENSE' in this package distribution
+# or at 'http://www.apache.org/licenses/LICENSE-2.0'.
+
import policies.mock_data as mock_data
-import pytest
-import logging
-from python_moonutilities.exceptions import *
+from .test_assignments import *
logger = logging.getLogger("python_moondb.tests.api.test_data")
@@ -178,6 +181,22 @@ def test_delete_action_data(db):
assert len(new_action_data[0]['data']) == 0
+def test_delete_action_data_assigned_to_action_assignment(db):
+ policy_id = mock_data.get_policy_id()
+ get_available_metadata(policy_id)
+ data_id = "data_id_1"
+ category_id = "category_id_1"
+ value = {
+ "name": "action-type",
+ "description": {"vm-action": "", "storage-action": "", },
+ }
+ action_data = add_action_data(policy_id, data_id, category_id, value).get('data')
+ action_data_id = list(action_data.keys())[0]
+ add_action_assignment(policy_id, "action_id_1", category_id, action_data_id)
+ with pytest.raises(DeleteData) as exception_info:
+ delete_action_data(action_data[action_data_id].get('policy_id'), None)
+
+
def test_get_object_data(db):
policy_id = mock_data.get_policy_id()
get_available_metadata(policy_id)
@@ -253,6 +272,22 @@ def test_delete_object_data(db):
assert len(new_object_data[0]['data']) == 0
+def test_delete_object_data_assigned_to_object_assignment(db):
+ policy_id = mock_data.get_policy_id()
+ get_available_metadata(policy_id)
+ data_id = "data_id_1"
+ category_id = "category_id_1"
+ value = {
+ "name": "object-type",
+ "description": {"vm-action": "", "storage-action": "", },
+ }
+ object_data = add_object_data(policy_id, data_id, category_id, value).get('data')
+ object_data_id = list(object_data.keys())[0]
+ add_object_assignment(policy_id, "object_id_1", category_id, object_data_id)
+ with pytest.raises(DeleteData) as exception_info:
+ delete_object_data(object_data[object_data_id].get('policy_id'), None)
+
+
def test_get_subject_data(db):
policy_id = mock_data.get_policy_id()
get_available_metadata(policy_id)
@@ -327,6 +362,22 @@ def test_delete_subject_data(db):
assert len(new_subject_data[0]['data']) == 0
+def test_delete_subject_data_assigned_to_subject_assignment(db):
+ policy_id = mock_data.get_policy_id()
+ get_available_metadata(policy_id)
+ data_id = "data_id_1"
+ category_id = "category_id_1"
+ value = {
+ "name": "subject-type",
+ "description": {"vm-action": "", "storage-action": "", },
+ }
+ subject_data = add_subject_data(policy_id, data_id, category_id, value).get('data')
+ subject_data_id = list(subject_data.keys())[0]
+ add_subject_assignment(policy_id, "object_id_1", category_id, subject_data_id)
+ with pytest.raises(DeleteData) as exception_info:
+ delete_subject_data(subject_data[subject_data_id].get('policy_id'), None)
+
+
def test_get_actions(db):
policy_id = mock_data.get_policy_id()
value = {
@@ -372,7 +423,9 @@ def test_add_action_multiple_times(db):
"description": "test",
"policy_list": ['policy_id_3', 'policy_id_4']
}
- action = add_action(mock_data.get_policy_id(model_name="test_model2", policy_name="policy_2", meta_rule_name="meta_rule2", category_prefix="_"), perimeter_id, value)
+ action = add_action(
+ mock_data.get_policy_id(model_name="test_model2", policy_name="policy_2", meta_rule_name="meta_rule2",
+ category_prefix="_"), perimeter_id, value)
logger.info("action : {}".format(action))
assert action
action_id = list(action.keys())[0]
@@ -444,7 +497,9 @@ def test_add_objects_multiple_times(db):
"description": "test",
"policy_list": ['policy_id_3', 'policy_id_4']
}
- added_object = add_object(mock_data.get_policy_id(model_name="test_model2", policy_name="policy_2", meta_rule_name="meta_rule2", category_prefix="_"), perimeter_id, value)
+ added_object = add_object(
+ mock_data.get_policy_id(model_name="test_model2", policy_name="policy_2", meta_rule_name="meta_rule2",
+ category_prefix="_"), perimeter_id, value)
assert added_object
object_id = list(added_object.keys())[0]
assert len(added_object[object_id].get('policy_list')) == 2
@@ -515,7 +570,9 @@ def test_add_subjects_multiple_times(db):
"description": "test",
"policy_list": ['policy_id_3', 'policy_id_4']
}
- subject = add_subject(mock_data.get_policy_id(model_name="test_model2", policy_name="policy_2", meta_rule_name="meta_rule2", category_prefix="_"), perimeter_id, value)
+ subject = add_subject(
+ mock_data.get_policy_id(model_name="test_model2", policy_name="policy_2", meta_rule_name="meta_rule2",
+ category_prefix="_"), perimeter_id, value)
assert subject
subject_id = list(subject.keys())[0]
assert len(subject[subject_id].get('policy_list')) == 2
diff --git a/python_moondb/tests/unit_python/policies/test_policies.py b/python_moondb/tests/unit_python/policies/test_policies.py
index f81f0d39..003361d0 100755
--- a/python_moondb/tests/unit_python/policies/test_policies.py
+++ b/python_moondb/tests/unit_python/policies/test_policies.py
@@ -7,6 +7,7 @@ import pytest
import policies.mock_data as mock_data
from python_moonutilities.exceptions import *
+
def get_policies():
from python_moondb.core import PolicyManager
return PolicyManager.get_policies("admin")
@@ -99,7 +100,7 @@ def test_add_policies_twice_with_same_id(db):
add_policies(policy_id, value)
with pytest.raises(PolicyExisting) as exception_info:
add_policies(policy_id, value)
- #assert str(exception_info.value) == '409: Policy Error'
+ # assert str(exception_info.value) == '409: Policy Error'
def test_delete_policies(db):
@@ -129,7 +130,29 @@ def test_delete_policies_with_invalid_id(db):
policy_id = 'policy_id_1'
with pytest.raises(PolicyUnknown) as exception_info:
delete_policies(policy_id)
- #assert str(exception_info.value) == '400: Policy Unknown'
+ # assert str(exception_info.value) == '400: Policy Unknown'
+
+
+def test_delete_policies_with_pdp(db):
+ from python_moondb.core import PDPManager
+ value = {
+ "name": "test_policy1",
+ "model_id": "",
+ "genre": "authz",
+ "description": "test",
+ }
+ policies = add_policies(value=value)
+ policy_id1 = list(policies.keys())[0]
+ pdp_id = "pdp_id1"
+ value = {
+ "name": "test_pdp",
+ "security_pipeline": [policy_id1],
+ "keystone_project_id": "keystone_project_id1",
+ "description": "...",
+ }
+ PDPManager.add_pdp(user_id="admin" ,pdp_id=pdp_id, value=value)
+ with pytest.raises(DeletePolicyWithPdp) as exception_info:
+ delete_policies(policy_id1)
def test_update_policy(db):
@@ -158,7 +181,7 @@ def test_update_policy_with_invalid_id(db):
}
with pytest.raises(PolicyUnknown) as exception_info:
update_policy(policy_id, value)
- #assert str(exception_info.value) == '400: Policy Unknown'
+ # assert str(exception_info.value) == '400: Policy Unknown'
def test_get_policy_from_meta_rules(db):
@@ -173,7 +196,7 @@ def test_get_policy_from_meta_rules(db):
policy = add_policies(value=value)
assert policy
policy_id = list(policy.keys())[0]
- pdp_ids = [policy_id,]
+ pdp_ids = [policy_id, ]
pdp_obj = mock_data.create_pdp(pdp_ids)
test_pdp.add_pdp(value=pdp_obj)
matched_policy_id = get_policy_from_meta_rules(meta_rule_id)
@@ -199,7 +222,7 @@ def test_get_policy_from_meta_rules_with_no_policies(db):
import test_pdp as test_pdp
meta_rule_id = 'meta_rule_id'
policy_id = 'invalid'
- pdp_ids = [policy_id,]
+ pdp_ids = [policy_id, ]
pdp_obj = mock_data.create_pdp(pdp_ids)
test_pdp.add_pdp(value=pdp_obj)
with pytest.raises(Exception) as exception_info:
@@ -217,7 +240,7 @@ def test_get_policy_from_meta_rules_with_no_models(db):
policy = add_policies(value=value)
assert policy
policy_id = list(policy.keys())[0]
- pdp_ids = [policy_id,]
+ pdp_ids = [policy_id, ]
pdp_obj = mock_data.create_pdp(pdp_ids)
test_pdp.add_pdp(value=pdp_obj)
with pytest.raises(Exception) as exception_info:
diff --git a/python_moonutilities/Changelog b/python_moonutilities/Changelog
index e6ab2f6e..61225b2b 100644
--- a/python_moonutilities/Changelog
+++ b/python_moonutilities/Changelog
@@ -89,4 +89,8 @@ CHANGES
1.4.8
-----
-- Add SubjectScopeExisting, ObjectScopeExisting, ActionScopeExisting exceptions \ No newline at end of file
+- Add SubjectScopeExisting, ObjectScopeExisting, ActionScopeExisting exceptions
+
+1.4.9
+-----
+- Add some exceptions when deletion of elements is impossible
diff --git a/python_moonutilities/python_moonutilities/__init__.py b/python_moonutilities/python_moonutilities/__init__.py
index cabb4c52..d313ecc3 100644
--- a/python_moonutilities/python_moonutilities/__init__.py
+++ b/python_moonutilities/python_moonutilities/__init__.py
@@ -3,6 +3,6 @@
# license which can be found in the file 'LICENSE' in this package distribution
# or at 'http://www.apache.org/licenses/LICENSE-2.0'.
-__version__ = "1.4.8"
+__version__ = "1.4.9"
diff --git a/python_moonutilities/python_moonutilities/exceptions.py b/python_moonutilities/python_moonutilities/exceptions.py
index f1dcd31e..bb2d35b7 100644
--- a/python_moonutilities/python_moonutilities/exceptions.py
+++ b/python_moonutilities/python_moonutilities/exceptions.py
@@ -651,3 +651,52 @@ class PolicyExisting(MoonError):
code = 409
title = 'Policy Error'
logger = "Error"
+
+
+class DeleteData(MoonError):
+ description = _("Cannot delete data with assignment")
+ code = 400
+ title = 'Data Error'
+ logger = "Error"
+
+
+class DeleteCategoryWithData(MoonError):
+ description = _("Cannot delete category with data")
+ code = 400
+ title = 'Category Error'
+ logger = "Error"
+
+
+class DeleteCategoryWithMetaRule(MoonError):
+ description = _("Cannot delete category with meta rule")
+ code = 400
+ title = 'Category Error'
+ logger = "Error"
+
+
+class DeleteCategoryWithData(MoonError):
+ description = _("Cannot delete category with data")
+ code = 400
+ title = 'Category Error'
+ logger = "Error"
+
+
+class DeleteModelWithPolicy(MoonError):
+ description = _("Cannot delete model with policy")
+ code = 400
+ title = 'Model Error'
+ logger = "Error"
+
+
+class DeletePolicyWithPdp(MoonError):
+ description = _("Cannot delete policy with pdp")
+ code = 400
+ title = 'Policy Error'
+ logger = "Error"
+
+
+class DeleteMetaRuleWithModel(MoonError):
+ description = _("Cannot delete meta rule with model")
+ code = 400
+ title = 'Meta rule Error'
+ logger = "Error"