vbatts/quay
Archived
1
0
Fork 0
Code Issues Pull requests Releases Wiki Activity

service_keys: s/get_keys/list_keys

Browse source
This commit is contained in:
Jimmy Zelinskie 2016-03-30 13:20:35 -04:00 • committed by Jimmy Zelinskie
parent 0ec54fc70e
commit c6b8b3ce8c
3 changed files with 24 additions and 17 deletions
Download patch file Download diff file Expand all files Collapse all files

21
endpoints/key_server.py
View file

@ -51,16 +51,16 @@ def _signer_kid(encoded_jwt):
return decoded_jwt.get('signer_kid', None)
def _signer_key(signer_kid):
def _signer_key(service, signer_kid):
try:
return data.model.service_keys.get_service_key(signer_kid)
return data.model.service_keys.get_service_key(signer_kid, service=service)
except data.model.ServiceKeyDoesNotExist:
abort(403)
@key_server.route('/services/<service>/keys', methods=['GET'])
def get_service_keys(service):
keys = data.model.service_keys.get_service_keys(service)
def list_service_keys(service):
keys = data.model.service_keys.list_service_keys(service)
return jsonify({'keys': [key.jwk for key in keys]})
@ -100,14 +100,14 @@ def put_service_keys(service, kid):
metadata = {'ip': request.remote_addr}
signer_kid = _signer_kid(encoded_jwt)
if kid == signer_kid:
if kid == signer_kid or signer_kid == '':
# The key is self-signed. Create a new instance and await approval.
_validate_jwt(encoded_jwt, jwk, service)
data.model.service_keys.create_service_key('', kid, service, jwk, metadata, expiration_date)
return make_response('', 202)
metadata.update({'created_by': 'Key Rotation'})
signer_key = _signer_key(signer_kid)
signer_key = _signer_key(service, signer_kid)
signer_jwk = signer_key.jwk
if signer_key.service != service:
abort(403)
@ -129,14 +129,19 @@ def delete_service_key(service, kid):
abort(400)
signer_kid = _signer_kid(encoded_jwt)
signer_key = _signer_key(signer_kid)
signer_key = _signer_key(service, signer_kid)
if (kid == signer_kid) or (signer_key.approval is not None):
self_signed = kid == signer_kid or signer_kid == ''
approved_key_for_service = signer_key.approval is not None
if self_signed or approved_key_for_service:
_validate_jwt(encoded_jwt, signer_key.jwk, service)
try:
data.model.service_keys.delete_service_key(service, kid)
except data.model.ServiceKeyDoesNotExist:
abort(404)
return make_response('', 200)
abort(403)