diff options
author | Zuul <zuul@review.opendev.org> | 2019-09-25 11:22:26 +0000 |
---|---|---|
committer | Gerrit Code Review <review@openstack.org> | 2019-09-25 11:22:26 +0000 |
commit | 20331c35974bac73693e0f5c19faef4c5ba5abea (patch) | |
tree | 11040b7d0fa757b4f82996c51e1c303f0ef9484e | |
parent | 6b0586894f6d7c2260acb6b2b30cfcebadd3f974 (diff) | |
parent | 0a4adba1a53c25ad75a10525130d832138f4fc68 (diff) | |
download | oslo-policy-2.1.2.tar.gz |
Merge "Fix reference cycle caused by deprecated sample override" into stable/stein2.1.2
-rw-r--r-- | oslo_policy/policy.py | 8 | ||||
-rw-r--r-- | oslo_policy/tests/test_policy.py | 33 |
2 files changed, 40 insertions, 1 deletions
diff --git a/oslo_policy/policy.py b/oslo_policy/policy.py index dd53ba7..2b19eda 100644 --- a/oslo_policy/policy.py +++ b/oslo_policy/policy.py @@ -668,8 +668,14 @@ class Enforcer(object): # the default deprecated policy, override the new policy's default # with the old check string. This should prevents unwanted exposure # to APIs on upgrade. + # There's one exception to this: When we generate a sample policy, + # we set the deprecated rule name to reference the new rule. If we + # see that the deprecated override rule is just the new rule, then + # we shouldn't mess with it. if (self.file_rules[deprecated_rule.name].check - != _parser.parse_rule(deprecated_rule.check_str)): + != _parser.parse_rule(deprecated_rule.check_str) and + str(self.file_rules[deprecated_rule.name].check) + != 'rule:%s' % default.name): if default.name not in self.file_rules.keys(): self.rules[default.name] = self.file_rules[ deprecated_rule.name diff --git a/oslo_policy/tests/test_policy.py b/oslo_policy/tests/test_policy.py index 9a7f6a4..a39e825 100644 --- a/oslo_policy/tests/test_policy.py +++ b/oslo_policy/tests/test_policy.py @@ -1452,6 +1452,39 @@ class DocumentedRuleDefaultDeprecationTestCase(base.PolicyBaseTestCase): self.enforcer.enforce('foo:create_bar', {}, {'roles': ['bazz']}) ) + def test_override_deprecated_policy_with_new_rule(self): + # Simulate an operator overriding a deprecated policy with a reference + # to the new policy, as done by the sample policy generator. + rules = jsonutils.dumps({'old_rule': 'rule:new_rule'}) + self.create_config_file('policy.json', rules) + + # Deprecate the policy name in favor of something better. + deprecated_rule = policy.DeprecatedRule( + name='old_rule', + check_str='role:bang' + ) + rule_list = [policy.DocumentedRuleDefault( + name='new_rule', + check_str='role:bang', + description='Replacement for old_rule.', + operations=[{'path': '/v1/bars', 'method': 'POST'}], + deprecated_rule=deprecated_rule, + deprecated_reason='"old_rule" is a bad name', + deprecated_since='N' + )] + self.enforcer.register_defaults(rule_list) + + # Make sure the override supplied by the operator using the old policy + # name is used in favor of the old or new default. + self.assertFalse( + self.enforcer.enforce('new_rule', {}, {'roles': ['fizz']}) + ) + self.assertTrue( + self.enforcer.enforce('new_rule', {}, {'roles': ['bang']}) + ) + # Verify that we didn't overwrite the new rule. + self.assertEqual('bang', self.enforcer.rules['new_rule'].match) + class DocumentedRuleDefaultTestCase(base.PolicyBaseTestCase): |