List key by name. Handle: GET /keys/key1
(self, name, requester_user, scope=None, user=None, decrypt=False)
| 64 | self.get_one_db_method = self._get_by_name |
| 65 | |
| 66 | def get_one(self, name, requester_user, scope=None, user=None, decrypt=False): |
| 67 | """ |
| 68 | List key by name. |
| 69 | |
| 70 | Handle: |
| 71 | GET /keys/key1 |
| 72 | """ |
| 73 | if not scope or scope == ALL_SCOPE: |
| 74 | # Default to system scope |
| 75 | scope = FULL_SYSTEM_SCOPE |
| 76 | |
| 77 | if user: |
| 78 | # Providing a user implies a user scope |
| 79 | scope = FULL_USER_SCOPE |
| 80 | |
| 81 | if not requester_user: |
| 82 | requester_user = UserDB(name=cfg.CONF.system_user.user) |
| 83 | |
| 84 | scope = get_datastore_full_scope(scope) |
| 85 | self._validate_scope(scope=scope) |
| 86 | |
| 87 | user = user or requester_user.name |
| 88 | |
| 89 | rbac_utils = get_rbac_backend().get_utils_class() |
| 90 | |
| 91 | # Validate that the authenticated user is admin if user query param is provided |
| 92 | rbac_utils.assert_user_is_admin_if_user_query_param_is_provided( |
| 93 | user_db=requester_user, user=user, require_rbac=True |
| 94 | ) |
| 95 | |
| 96 | # Set key reference for system or user scope |
| 97 | key_ref = get_key_reference(scope=scope, name=name, user=user) |
| 98 | extra = {"scope": scope, "name": name, "user": user, "key_ref": key_ref} |
| 99 | LOG.debug("GET /v1/keys/%s", name, extra=extra) |
| 100 | |
| 101 | # Setup a kvp database object used for verifying permission |
| 102 | kvp_db = KeyValuePairDB( |
| 103 | uid="%s:%s:%s" % (ResourceType.KEY_VALUE_PAIR, scope, key_ref), |
| 104 | scope=scope, |
| 105 | name=key_ref, |
| 106 | ) |
| 107 | |
| 108 | # Check that user has permission to the key value pair. |
| 109 | # If RBAC is enabled, this check will verify if user has system role with all access. |
| 110 | # If RBAC is enabled, this check guards against a user accessing another user's kvp. |
| 111 | # If RBAC is enabled, user needs to be explicitly granted permission to view a system kvp. |
| 112 | # The check is sufficient to allow decryption of the system kvp. |
| 113 | rbac_utils.assert_user_has_resource_db_permission( |
| 114 | user_db=requester_user, |
| 115 | resource_db=kvp_db, |
| 116 | permission_type=PermissionType.KEY_VALUE_PAIR_VIEW, |
| 117 | ) |
| 118 | |
| 119 | from_model_kwargs = {"mask_secrets": not decrypt} |
| 120 | kvp_api = self._get_one_by_scope_and_name( |
| 121 | name=key_ref, scope=scope, from_model_kwargs=from_model_kwargs |
| 122 | ) |
| 123 | if decrypt and kvp_api.secret: |
nothing calls this directly
no test coverage detected