aboutsummaryrefslogtreecommitdiffstats
path: root/python_moondb
diff options
context:
space:
mode:
Diffstat (limited to 'python_moondb')
-rw-r--r--python_moondb/python_moondb/api/policy.py36
-rwxr-xr-xpython_moondb/tests/unit_python/policies/test_assignments.py29
-rwxr-xr-xpython_moondb/tests/unit_python/policies/test_data.py84
-rwxr-xr-xpython_moondb/tests/unit_python/policies/test_policies.py7
4 files changed, 107 insertions, 49 deletions
diff --git a/python_moondb/python_moondb/api/policy.py b/python_moondb/python_moondb/api/policy.py
index 97866bfd..ca313f9a 100644
--- a/python_moondb/python_moondb/api/policy.py
+++ b/python_moondb/python_moondb/api/policy.py
@@ -22,12 +22,16 @@ class PolicyManager(Managers):
policies = self.PolicyManager.get_policies("admin")
models = self.ModelManager.get_models("admin")
for pdp_key, pdp_value in self.PDPManager.get_pdp(user_id).items():
+ if 'security_pipeline' not in pdp_value:
+ raise exceptions.PdpContentError
for policy_id in pdp_value["security_pipeline"]:
- if not policies:
+ if not policies or policy_id not in policies:
raise exceptions.PolicyUnknown
model_id = policies[policy_id]["model_id"]
if not models:
raise exceptions.ModelUnknown
+ if model_id not in models:
+ raise exceptions.ModelUnknown
if meta_rule_id in models[model_id]["meta_rules"]:
return policy_id
@@ -78,6 +82,8 @@ class PolicyManager(Managers):
value.get('name'))
perimeter_id = uuid4().hex
value.update(k_user['users'][0])
+ if not self.get_policies(user_id=user_id, policy_id=policy_id):
+ raise exceptions.PolicyUnknown
return self.driver.set_subject(policy_id=policy_id, perimeter_id=perimeter_id, value=value)
@enforce(("read", "write"), "perimeter")
@@ -90,6 +96,8 @@ class PolicyManager(Managers):
@enforce(("read", "write"), "perimeter")
def add_object(self, user_id, policy_id, perimeter_id=None, value=None):
+ if not self.get_policies(user_id=user_id, policy_id=policy_id):
+ raise exceptions.PolicyUnknown
if not perimeter_id:
perimeter_id = uuid4().hex
return self.driver.set_object(policy_id=policy_id, perimeter_id=perimeter_id, value=value)
@@ -104,6 +112,8 @@ class PolicyManager(Managers):
@enforce(("read", "write"), "perimeter")
def add_action(self, user_id, policy_id, perimeter_id=None, value=None):
+ if not self.get_policies(user_id=user_id, policy_id=policy_id):
+ raise exceptions.PolicyUnknown
if not perimeter_id:
perimeter_id = uuid4().hex
return self.driver.set_action(policy_id=policy_id, perimeter_id=perimeter_id, value=value)
@@ -127,6 +137,10 @@ class PolicyManager(Managers):
@enforce(("read", "write"), "data")
def set_subject_data(self, user_id, policy_id, data_id=None, category_id=None, value=None):
+ if not category_id:
+ raise Exception('Invalid category id')
+ if not self.get_policies(user_id=user_id, policy_id=policy_id):
+ raise exceptions.PolicyUnknown
if not data_id:
data_id = uuid4().hex
return self.driver.set_subject_data(policy_id=policy_id, data_id=data_id, category_id=category_id, value=value)
@@ -151,6 +165,10 @@ class PolicyManager(Managers):
@enforce(("read", "write"), "data")
def add_object_data(self, user_id, policy_id, data_id=None, category_id=None, value=None):
+ if not category_id:
+ raise Exception('Invalid category id')
+ if not self.get_policies(user_id=user_id, policy_id=policy_id):
+ raise exceptions.PolicyUnknown
if not data_id:
data_id = uuid4().hex
return self.driver.set_object_data(policy_id=policy_id, data_id=data_id, category_id=category_id, value=value)
@@ -167,14 +185,18 @@ class PolicyManager(Managers):
if not category_id:
for cat in available_metadata["action"]:
results.append(self.driver.get_action_data(policy_id=policy_id, data_id=data_id,
- category_id=cat))
+ category_id=cat))
if category_id and category_id in available_metadata["action"]:
results.append(self.driver.get_action_data(policy_id=policy_id, data_id=data_id,
- category_id=category_id))
+ category_id=category_id))
return results
@enforce(("read", "write"), "data")
def add_action_data(self, user_id, policy_id, data_id=None, category_id=None, value=None):
+ if not category_id:
+ raise Exception('Invalid category id')
+ if not self.get_policies(user_id=user_id, policy_id=policy_id):
+ raise exceptions.PolicyUnknown
if not data_id:
data_id = uuid4().hex
return self.driver.set_action_data(policy_id=policy_id, data_id=data_id, category_id=category_id, value=value)
@@ -190,6 +212,8 @@ class PolicyManager(Managers):
@enforce(("read", "write"), "assignments")
def add_subject_assignment(self, user_id, policy_id, subject_id, category_id, data_id):
+ if not self.get_policies(user_id=user_id, policy_id=policy_id):
+ raise exceptions.PolicyUnknown
return self.driver.add_subject_assignment(policy_id=policy_id, subject_id=subject_id,
category_id=category_id, data_id=data_id)
@@ -204,6 +228,8 @@ class PolicyManager(Managers):
@enforce(("read", "write"), "assignments")
def add_object_assignment(self, user_id, policy_id, object_id, category_id, data_id):
+ if not self.get_policies(user_id=user_id, policy_id=policy_id):
+ raise exceptions.PolicyUnknown
return self.driver.add_object_assignment(policy_id=policy_id, object_id=object_id,
category_id=category_id, data_id=data_id)
@@ -218,6 +244,8 @@ class PolicyManager(Managers):
@enforce(("read", "write"), "assignments")
def add_action_assignment(self, user_id, policy_id, action_id, category_id, data_id):
+ if not self.get_policies(user_id=user_id, policy_id=policy_id):
+ raise exceptions.PolicyUnknown
return self.driver.add_action_assignment(policy_id=policy_id, action_id=action_id,
category_id=category_id, data_id=data_id)
@@ -232,6 +260,8 @@ class PolicyManager(Managers):
@enforce(("read", "write"), "rules")
def add_rule(self, user_id, policy_id, meta_rule_id, value):
+ if not self.get_policies(user_id=user_id, policy_id=policy_id):
+ raise exceptions.PolicyUnknown
return self.driver.add_rule(policy_id=policy_id, meta_rule_id=meta_rule_id, value=value)
@enforce(("read", "write"), "rules")
diff --git a/python_moondb/tests/unit_python/policies/test_assignments.py b/python_moondb/tests/unit_python/policies/test_assignments.py
index ccac205a..707632b0 100755
--- a/python_moondb/tests/unit_python/policies/test_assignments.py
+++ b/python_moondb/tests/unit_python/policies/test_assignments.py
@@ -1,3 +1,6 @@
+import policies.mock_data as mock_data
+
+
def get_action_assignments(policy_id, action_id=None, category_id=None):
from python_moondb.core import PolicyManager
return PolicyManager.get_action_assignments("", policy_id, action_id, category_id)
@@ -44,7 +47,7 @@ def delete_subject_assignment(policy_id, subject_id, category_id, data_id):
def test_get_action_assignments(db):
- policy_id = "admin"
+ policy_id = mock_data.get_policy_id()
action_id = "action_id_1"
category_id = "category_id_1"
data_id = "data_id_1"
@@ -59,7 +62,7 @@ def test_get_action_assignments(db):
def test_get_action_assignments_by_policy_id(db):
- policy_id = "admin"
+ policy_id = mock_data.get_policy_id()
action_id = "action_id_1"
category_id = "category_id_1"
data_id = "data_id_1"
@@ -77,7 +80,7 @@ def test_get_action_assignments_by_policy_id(db):
def test_add_action_assignments(db):
- policy_id = "admin"
+ policy_id = mock_data.get_policy_id()
action_id = "action_id_1"
category_id = "category_id_1"
data_id = "data_id_1"
@@ -92,9 +95,9 @@ def test_add_action_assignments(db):
def test_delete_action_assignment(db):
- policy_id = "admin_1"
+ policy_id = mock_data.get_policy_id()
add_action_assignment(policy_id, "", "", "")
- policy_id = "admin_2"
+ policy_id = mock_data.get_policy_id()
action_id = "action_id_2"
category_id = "category_id_2"
data_id = "data_id_2"
@@ -112,7 +115,7 @@ def test_delete_action_assignment_with_invalid_policy_id(db):
def test_get_object_assignments(db):
- policy_id = "admin"
+ policy_id = mock_data.get_policy_id()
object_id = "object_id_1"
category_id = "category_id_1"
data_id = "data_id_1"
@@ -127,7 +130,7 @@ def test_get_object_assignments(db):
def test_get_object_assignments_by_policy_id(db):
- policy_id = "admin"
+ policy_id = mock_data.get_policy_id()
object_id_1 = "object_id_1"
category_id_1 = "category_id_1"
data_id = "data_id_1"
@@ -145,7 +148,7 @@ def test_get_object_assignments_by_policy_id(db):
def test_add_object_assignments(db):
- policy_id = "admin"
+ policy_id = mock_data.get_policy_id()
object_id = "object_id_1"
category_id = "category_id_1"
data_id = "data_id_1"
@@ -160,7 +163,7 @@ def test_add_object_assignments(db):
def test_delete_object_assignment(db):
- policy_id = "admin_1"
+ policy_id = mock_data.get_policy_id()
add_object_assignment(policy_id, "", "", "")
object_id = "action_id_2"
category_id = "category_id_2"
@@ -179,7 +182,7 @@ def test_delete_object_assignment_with_invalid_policy_id(db):
def test_get_subject_assignments(db):
- policy_id = "admin"
+ policy_id = mock_data.get_policy_id()
subject_id = "object_id_1"
category_id = "category_id_1"
data_id = "data_id_1"
@@ -194,7 +197,7 @@ def test_get_subject_assignments(db):
def test_get_subject_assignments_by_policy_id(db):
- policy_id = "admin"
+ policy_id = mock_data.get_policy_id()
subject_id_1 = "subject_id_1"
category_id_1 = "category_id_1"
data_id = "data_id_1"
@@ -212,7 +215,7 @@ def test_get_subject_assignments_by_policy_id(db):
def test_add_subject_assignments(db):
- policy_id = "admin"
+ policy_id = mock_data.get_policy_id()
subject_id = "subject_id_1"
category_id = "category_id_1"
data_id = "data_id_1"
@@ -227,7 +230,7 @@ def test_add_subject_assignments(db):
def test_delete_subject_assignment(db):
- policy_id = "admin_1"
+ policy_id = mock_data.get_policy_id()
add_subject_assignment(policy_id, "", "", "")
subject_id = "subject_id_2"
category_id = "category_id_2"
diff --git a/python_moondb/tests/unit_python/policies/test_data.py b/python_moondb/tests/unit_python/policies/test_data.py
index 875121eb..67fa44fb 100755
--- a/python_moondb/tests/unit_python/policies/test_data.py
+++ b/python_moondb/tests/unit_python/policies/test_data.py
@@ -117,8 +117,6 @@ def test_get_action_data(db):
def test_get_action_data_with_invalid_category_id(db):
policy_id = mock_data.get_policy_id()
get_available_metadata(policy_id)
-
- policy_id = policy_id
data_id = "data_id_1"
category_id = "action_category_id1"
value = {
@@ -132,7 +130,7 @@ def test_get_action_data_with_invalid_category_id(db):
def test_add_action_data(db):
- policy_id = "policy_id_1"
+ policy_id = mock_data.get_policy_id()
data_id = "data_id_1"
category_id = "category_id_1"
value = {
@@ -145,6 +143,18 @@ def test_add_action_data(db):
assert action_data[action_data_id].get('policy_id') == policy_id
+def test_add_action_data_with_invalid_category_id(db):
+ policy_id = mock_data.get_policy_id()
+ data_id = "data_id_1"
+ value = {
+ "name": "action-type",
+ "description": {"vm-action": "", "storage-action": "", },
+ }
+ with pytest.raises(Exception) as exception_info:
+ add_action_data(policy_id=policy_id, data_id=data_id, value=value).get('data')
+ assert str(exception_info.value) == 'Invalid category id'
+
+
def test_delete_action_data(db):
policy_id = mock_data.get_policy_id()
get_available_metadata(policy_id)
@@ -164,8 +174,6 @@ def test_delete_action_data(db):
def test_get_object_data(db):
policy_id = mock_data.get_policy_id()
get_available_metadata(policy_id)
-
- policy_id = policy_id
data_id = "data_id_1"
category_id = "object_category_id1"
value = {
@@ -181,8 +189,6 @@ def test_get_object_data(db):
def test_get_object_data_with_invalid_category_id(db):
policy_id = mock_data.get_policy_id()
get_available_metadata(policy_id)
-
- policy_id = policy_id
data_id = "data_id_1"
category_id = "object_category_id1"
value = {
@@ -196,7 +202,7 @@ def test_get_object_data_with_invalid_category_id(db):
def test_add_object_data(db):
- policy_id = "policy_id_1"
+ policy_id = mock_data.get_policy_id()
data_id = "data_id_1"
category_id = "object_category_id1"
value = {
@@ -209,6 +215,18 @@ def test_add_object_data(db):
assert object_data[object_data_id].get('policy_id') == policy_id
+def test_add_object_data_with_invalid_category_id(db):
+ policy_id = mock_data.get_policy_id()
+ data_id = "data_id_1"
+ value = {
+ "name": "object-security-level",
+ "description": {"low": "", "medium": "", "high": ""},
+ }
+ with pytest.raises(Exception) as exception_info:
+ add_object_data(policy_id=policy_id, data_id=data_id, value=value).get('data')
+ assert str(exception_info.value) == 'Invalid category id'
+
+
def test_delete_object_data(db):
policy_id = mock_data.get_policy_id()
get_available_metadata(policy_id)
@@ -228,8 +246,6 @@ def test_delete_object_data(db):
def test_get_subject_data(db):
policy_id = mock_data.get_policy_id()
get_available_metadata(policy_id)
-
- policy_id = policy_id
data_id = "data_id_1"
category_id = "subject_category_id1"
value = {
@@ -245,8 +261,6 @@ def test_get_subject_data(db):
def test_get_subject_data_with_invalid_category_id(db):
policy_id = mock_data.get_policy_id()
get_available_metadata(policy_id)
-
- policy_id = policy_id
data_id = "data_id_1"
category_id = "subject_category_id1"
value = {
@@ -260,19 +274,31 @@ def test_get_subject_data_with_invalid_category_id(db):
def test_add_subject_data(db):
- policy_id = "policy_id_1"
+ policy_id = mock_data.get_policy_id()
data_id = "data_id_1"
category_id = "subject_category_id1"
value = {
"name": "subject-security-level",
"description": {"low": "", "medium": "", "high": ""},
}
- subject_data = add_object_data(policy_id, data_id, category_id, value).get('data')
+ subject_data = add_subject_data(policy_id, data_id, category_id, value).get('data')
assert subject_data
subject_data_id = list(subject_data.keys())[0]
assert subject_data[subject_data_id].get('policy_id') == policy_id
+def test_add_subject_data_with_no_category_id(db):
+ policy_id = mock_data.get_policy_id()
+ data_id = "data_id_1"
+ value = {
+ "name": "subject-security-level",
+ "description": {"low": "", "medium": "", "high": ""},
+ }
+ with pytest.raises(Exception) as exception_info:
+ add_subject_data(policy_id=policy_id, data_id=data_id, value=value).get('data')
+ assert str(exception_info.value) == 'Invalid category id'
+
+
def test_delete_subject_data(db):
policy_id = mock_data.get_policy_id()
get_available_metadata(policy_id)
@@ -290,7 +316,7 @@ def test_delete_subject_data(db):
def test_get_actions(db):
- policy_id = "policy_id_1"
+ policy_id = mock_data.get_policy_id()
value = {
"name": "test_action",
"description": "test",
@@ -304,7 +330,7 @@ def test_get_actions(db):
def test_add_action(db):
- policy_id = "policy_id_1"
+ policy_id = mock_data.get_policy_id()
value = {
"name": "test_action",
"description": "test",
@@ -316,7 +342,7 @@ def test_add_action(db):
def test_add_action_multiple_times(db):
- policy_id = "policy_id_1"
+ policy_id = mock_data.get_policy_id()
value = {
"name": "test_action",
"description": "test",
@@ -330,14 +356,14 @@ def test_add_action_multiple_times(db):
"description": "test",
"policy_list": ['policy_id_3', 'policy_id_4']
}
- action = add_action('policy_id_7', perimeter_id, value)
+ action = add_action(mock_data.get_policy_id(), perimeter_id, value)
assert action
action_id = list(action.keys())[0]
assert len(action[action_id].get('policy_list')) == 2
def test_delete_action(db):
- policy_id = "policy_id_1"
+ policy_id = mock_data.get_policy_id()
value = {
"name": "test_action",
"description": "test",
@@ -358,7 +384,7 @@ def test_delete_action_with_invalid_perimeter_id(db):
def test_get_objects(db):
- policy_id = "policy_id_1"
+ policy_id = mock_data.get_policy_id()
value = {
"name": "test_object",
"description": "test",
@@ -372,7 +398,7 @@ def test_get_objects(db):
def test_add_object(db):
- policy_id = "policy_id_1"
+ policy_id = mock_data.get_policy_id()
value = {
"name": "test_object",
"description": "test",
@@ -384,7 +410,7 @@ def test_add_object(db):
def test_add_objects_multiple_times(db):
- policy_id = "policy_id_1"
+ policy_id = mock_data.get_policy_id()
value = {
"name": "test_object",
"description": "test",
@@ -398,14 +424,14 @@ def test_add_objects_multiple_times(db):
"description": "test",
"policy_list": ['policy_id_3', 'policy_id_4']
}
- added_object = add_object('policy_id_7', perimeter_id, value)
+ added_object = add_object(mock_data.get_policy_id(), perimeter_id, value)
assert added_object
object_id = list(added_object.keys())[0]
assert len(added_object[object_id].get('policy_list')) == 2
def test_delete_object(db):
- policy_id = "policy_id_1"
+ policy_id = mock_data.get_policy_id()
value = {
"name": "test_object",
"description": "test",
@@ -426,7 +452,7 @@ def test_delete_object_with_invalid_perimeter_id(db):
def test_get_subjects(db):
- policy_id = "policy_id_1"
+ policy_id = mock_data.get_policy_id()
value = {
"name": "testuser",
"description": "test",
@@ -440,7 +466,7 @@ def test_get_subjects(db):
def test_add_subject(db):
- policy_id = "policy_id_1"
+ policy_id = mock_data.get_policy_id()
value = {
"name": "testuser",
"description": "test",
@@ -452,7 +478,7 @@ def test_add_subject(db):
def test_add_subjects_multiple_times(db):
- policy_id = "policy_id_1"
+ policy_id = mock_data.get_policy_id()
value = {
"name": "testuser",
"description": "test",
@@ -466,14 +492,14 @@ def test_add_subjects_multiple_times(db):
"description": "test",
"policy_list": ['policy_id_3', 'policy_id_4']
}
- subject = add_subject('policy_id_7', perimeter_id, value)
+ subject = add_subject(mock_data.get_policy_id(), perimeter_id, value)
assert subject
subject_id = list(subject.keys())[0]
assert len(subject[subject_id].get('policy_list')) == 2
def test_delete_subject(db):
- policy_id = "policy_id_1"
+ policy_id = mock_data.get_policy_id()
value = {
"name": "testuser",
"description": "test",
diff --git a/python_moondb/tests/unit_python/policies/test_policies.py b/python_moondb/tests/unit_python/policies/test_policies.py
index 487cb6a1..148034ef 100755
--- a/python_moondb/tests/unit_python/policies/test_policies.py
+++ b/python_moondb/tests/unit_python/policies/test_policies.py
@@ -231,7 +231,7 @@ def test_get_rules(db):
"instructions": ({"decision": "grant"}),
"enabled": "",
}
- policy_id = "1"
+ policy_id = mock_data.get_policy_id()
meta_rule_id = "1"
add_rule(policy_id, meta_rule_id, value)
value = {
@@ -239,7 +239,6 @@ def test_get_rules(db):
"instructions": ({"decision": "grant"}),
"enabled": "",
}
- policy_id = "1"
meta_rule_id = "1"
add_rule(policy_id, meta_rule_id, value)
rules = get_rules(policy_id, meta_rule_id)
@@ -261,7 +260,7 @@ def test_add_rule(db):
"instructions": ({"decision": "grant"}),
"enabled": "",
}
- policy_id = "1"
+ policy_id = mock_data.get_policy_id()
meta_rule_id = "1"
rules = add_rule(policy_id, meta_rule_id, value)
assert rules
@@ -279,7 +278,7 @@ def test_delete_rule(db):
"instructions": ({"decision": "grant"}),
"enabled": "",
}
- policy_id = "2"
+ policy_id = mock_data.get_policy_id()
meta_rule_id = "2"
rules = add_rule(policy_id, meta_rule_id, value)
rule_id = list(rules.keys())[0]