vbatts/quay
Archived
1
0
Fork 0
Code Issues Pull requests Releases Wiki Activity

service key worker to refresh automatic keys

Browse source
This commit is contained in:
Evan Cordell 2016-04-29 10:51:22 -05:00 • committed by Jimmy Zelinskie
parent 2242c6773d
commit a6f6a114c2
6 changed files with 82 additions and 18 deletions
Download patch file Download diff file Expand all files Collapse all files

23
data/model/service_keys.py
View file

@ -7,7 +7,7 @@ from peewee import JOIN_LEFT_OUTER
from Crypto.PublicKey import RSA
from jwkest.jwk import RSAKey
from data.database import db_for_update, User, ServiceKey, ServiceKeyApproval
from data.database import db_for_update, User, ServiceKey, ServiceKeyApproval, ServiceKeyApprovalType
from data.model import (ServiceKeyDoesNotExist, ServiceKeyAlreadyApproved, ServiceNameInvalid,
db_transaction, config)
from data.model.notification import create_notification, delete_all_notifications_by_path_prefix
@ -20,9 +20,11 @@ def _expired_keys_clause(service):
return ((ServiceKey.service == service) &
(ServiceKey.expiration_date <= datetime.utcnow()))
def _stale_expired_keys_service_clause(service):
return ((ServiceKey.service == service) & _stale_expired_keys_clause())
def _stale_expired_keys_clause():
expired_ttl = timedelta(seconds=config.app_config['EXPIRED_SERVICE_KEY_TTL_SEC'])
return (ServiceKey.expiration_date <= (datetime.utcnow() - expired_ttl))
@ -34,6 +36,10 @@ def _stale_unapproved_keys_clause(service):
(ServiceKey.created_date <= (datetime.utcnow() - unapproved_ttl)))
def _unexpired_clause():
return ServiceKey.expiration_date >= datetime.utcnow()
def _gc_expired(service):
ServiceKey.delete().where(_stale_expired_keys_service_clause(service) |
_stale_unapproved_keys_clause(service)).execute()
@ -141,6 +147,16 @@ def set_key_expiration(kid, expiration_date):
service_key.save()
def refresh_automatic_service_keys(extension):
"""
Finds all unexpired automatic keys and sets their
expiration to `now + extension`
"""
for service_key in list(_list_service_keys_query(approval_type=ServiceKeyApprovalType.AUTOMATIC).where(_unexpired_clause())):
service_key.expiration_date = datetime.now() + extension
service_key.save()
def approve_service_key(kid, approver, approval_type, notes=''):
try:
with db_transaction():
@ -159,12 +175,15 @@ def approve_service_key(kid, approver, approval_type, notes=''):
return key
def _list_service_keys_query(kid=None, service=None, approved_only=False):
def _list_service_keys_query(kid=None, service=None, approved_only=False, approval_type=None):
query = ServiceKey.select().join(ServiceKeyApproval, JOIN_LEFT_OUTER)
if approved_only:
query = query.where(~(ServiceKey.approval >> None))
if approval_type is not None:
query = query.where(ServiceKeyApproval.approval_type == approval_type)
if service is not None:
query = query.where(ServiceKey.service == service)
query = query.where(~(_expired_keys_clause(service)) |