knife-acl-1.0.6/0000755000004100000410000000000013605271675013413 5ustar www-datawww-dataknife-acl-1.0.6/LICENSE0000644000004100000410000002514213605271675014424 0ustar www-datawww-data Apache License Version 2.0, January 2004 http://www.apache.org/licenses/ TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION 1. Definitions. "License" shall mean the terms and conditions for use, reproduction, and distribution as defined by Sections 1 through 9 of this document. "Licensor" shall mean the copyright owner or entity authorized by the copyright owner that is granting the License. "Legal Entity" shall mean the union of the acting entity and all other entities that control, are controlled by, or are under common control with that entity. For the purposes of this definition, "control" means (i) the power, direct or indirect, to cause the direction or management of such entity, whether by contract or otherwise, or (ii) ownership of fifty percent (50%) or more of the outstanding shares, or (iii) beneficial ownership of such entity. "You" (or "Your") shall mean an individual or Legal Entity exercising permissions granted by this License. "Source" form shall mean the preferred form for making modifications, including but not limited to software source code, documentation source, and configuration files. "Object" form shall mean any form resulting from mechanical transformation or translation of a Source form, including but not limited to compiled object code, generated documentation, and conversions to other media types. "Work" shall mean the work of authorship, whether in Source or Object form, made available under the License, as indicated by a copyright notice that is included in or attached to the work (an example is provided in the Appendix below). "Derivative Works" shall mean any work, whether in Source or Object form, that is based on (or derived from) the Work and for which the editorial revisions, annotations, elaborations, or other modifications represent, as a whole, an original work of authorship. For the purposes of this License, Derivative Works shall not include works that remain separable from, or merely link (or bind by name) to the interfaces of, the Work and Derivative Works thereof. "Contribution" shall mean any work of authorship, including the original version of the Work and any modifications or additions to that Work or Derivative Works thereof, that is intentionally submitted to Licensor for inclusion in the Work by the copyright owner or by an individual or Legal Entity authorized to submit on behalf of the copyright owner. For the purposes of this definition, "submitted" means any form of electronic, verbal, or written communication sent to the Licensor or its representatives, including but not limited to communication on electronic mailing lists, source code control systems, and issue tracking systems that are managed by, or on behalf of, the Licensor for the purpose of discussing and improving the Work, but excluding communication that is conspicuously marked or otherwise designated in writing by the copyright owner as "Not a Contribution." "Contributor" shall mean Licensor and any individual or Legal Entity on behalf of whom a Contribution has been received by Licensor and subsequently incorporated within the Work. 2. Grant of Copyright License. Subject to the terms and conditions of this License, each Contributor hereby grants to You a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare Derivative Works of, publicly display, publicly perform, sublicense, and distribute the Work and such Derivative Works in Source or Object form. 3. Grant of Patent License. Subject to the terms and conditions of this License, each Contributor hereby grants to You a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable (except as stated in this section) patent license to make, have made, use, offer to sell, sell, import, and otherwise transfer the Work, where such license applies only to those patent claims licensable by such Contributor that are necessarily infringed by their Contribution(s) alone or by combination of their Contribution(s) with the Work to which such Contribution(s) was submitted. If You institute patent litigation against any entity (including a cross-claim or counterclaim in a lawsuit) alleging that the Work or a Contribution incorporated within the Work constitutes direct or contributory patent infringement, then any patent licenses granted to You under this License for that Work shall terminate as of the date such litigation is filed. 4. Redistribution. You may reproduce and distribute copies of the Work or Derivative Works thereof in any medium, with or without modifications, and in Source or Object form, provided that You meet the following conditions: (a) You must give any other recipients of the Work or Derivative Works a copy of this License; and (b) You must cause any modified files to carry prominent notices stating that You changed the files; and (c) You must retain, in the Source form of any Derivative Works that You distribute, all copyright, patent, trademark, and attribution notices from the Source form of the Work, excluding those notices that do not pertain to any part of the Derivative Works; and (d) If the Work includes a "NOTICE" text file as part of its distribution, then any Derivative Works that You distribute must include a readable copy of the attribution notices contained within such NOTICE file, excluding those notices that do not pertain to any part of the Derivative Works, in at least one of the following places: within a NOTICE text file distributed as part of the Derivative Works; within the Source form or documentation, if provided along with the Derivative Works; or, within a display generated by the Derivative Works, if and wherever such third-party notices normally appear. The contents of the NOTICE file are for informational purposes only and do not modify the License. You may add Your own attribution notices within Derivative Works that You distribute, alongside or as an addendum to the NOTICE text from the Work, provided that such additional attribution notices cannot be construed as modifying the License. You may add Your own copyright statement to Your modifications and may provide additional or different license terms and conditions for use, reproduction, or distribution of Your modifications, or for any such Derivative Works as a whole, provided Your use, reproduction, and distribution of the Work otherwise complies with the conditions stated in this License. 5. Submission of Contributions. Unless You explicitly state otherwise, any Contribution intentionally submitted for inclusion in the Work by You to the Licensor shall be under the terms and conditions of this License, without any additional terms or conditions. Notwithstanding the above, nothing herein shall supersede or modify the terms of any separate license agreement you may have executed with Licensor regarding such Contributions. 6. Trademarks. This License does not grant permission to use the trade names, trademarks, service marks, or product names of the Licensor, except as required for reasonable and customary use in describing the origin of the Work and reproducing the content of the NOTICE file. 7. Disclaimer of Warranty. Unless required by applicable law or agreed to in writing, Licensor provides the Work (and each Contributor provides its Contributions) on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. You are solely responsible for determining the appropriateness of using or redistributing the Work and assume any risks associated with Your exercise of permissions under this License. 8. Limitation of Liability. In no event and under no legal theory, whether in tort (including negligence), contract, or otherwise, unless required by applicable law (such as deliberate and grossly negligent acts) or agreed to in writing, shall any Contributor be liable to You for damages, including any direct, indirect, special, incidental, or consequential damages of any character arising as a result of this License or out of the use or inability to use the Work (including but not limited to damages for loss of goodwill, work stoppage, computer failure or malfunction, or any and all other commercial damages or losses), even if such Contributor has been advised of the possibility of such damages. 9. Accepting Warranty or Additional Liability. While redistributing the Work or Derivative Works thereof, You may choose to offer, and charge a fee for, acceptance of support, warranty, indemnity, or other liability obligations and/or rights consistent with this License. However, in accepting such obligations, You may act only on Your own behalf and on Your sole responsibility, not on behalf of any other Contributor, and only if You agree to indemnify, defend, and hold each Contributor harmless for any liability incurred by, or claims asserted against, such Contributor by reason of your accepting any such warranty or additional liability. END OF TERMS AND CONDITIONS APPENDIX: How to apply the Apache License to your work. To apply the Apache License to your work, attach the following boilerplate notice, with the fields enclosed by brackets "[]" replaced with your own identifying information. (Don't include the brackets!) The text should be enclosed in the appropriate comment syntax for the file format. We also recommend that a file or class name and description of purpose be included on the same "printed page" as the copyright notice for easier identification within third-party archives. Copyright [yyyy] [name of copyright owner] Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. knife-acl-1.0.6/lib/0000755000004100000410000000000013605271675014161 5ustar www-datawww-dataknife-acl-1.0.6/lib/chef/0000755000004100000410000000000013605271675015066 5ustar www-datawww-dataknife-acl-1.0.6/lib/chef/knife/0000755000004100000410000000000013605271675016162 5ustar www-datawww-dataknife-acl-1.0.6/lib/chef/knife/user_invite_add.rb0000644000004100000410000000221413605271675021652 0ustar www-datawww-data# # Author:: Steven Danna () # Copyright:: Copyright 2011-2016 Chef Software, Inc. # License:: Apache License, Version 2.0 # # Licensed under the Apache License, Version 2.0 (the "License"); # you may not use this file except in compliance with the License. # You may obtain a copy of the License at # # http://www.apache.org/licenses/LICENSE-2.0 # # Unless required by applicable law or agreed to in writing, software # distributed under the License is distributed on an "AS IS" BASIS, # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. # See the License for the specific language governing permissions and # limitations under the License. # module OpscodeAcl class UserInviteAdd < Chef::Knife category "OPSCODE HOSTED CHEF ACCESS CONTROL" banner "knife user invite add USERNAMES" def run if name_args.length < 1 show_usage ui.fatal("You must specify a username.") exit 1 end users = name_args api_endpoint = "association_requests/" users.each do |u| body = { user: u } rest.post_rest(api_endpoint, body) end end end end knife-acl-1.0.6/lib/chef/knife/acl_remove.rb0000644000004100000410000000414513605271675020627 0ustar www-datawww-data# # Author:: Steven Danna (steve@chef.io) # Author:: Jeremiah Snapp (jeremiah@chef.io) # Copyright:: Copyright 2011-2016 Chef Software, Inc. # License:: Apache License, Version 2.0 # # Licensed under the Apache License, Version 2.0 (the "License"); # you may not use this file except in compliance with the License. # You may obtain a copy of the License at # # http://www.apache.org/licenses/LICENSE-2.0 # # Unless required by applicable law or agreed to in writing, software # distributed under the License is distributed on an "AS IS" BASIS, # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. # See the License for the specific language governing permissions and # limitations under the License. # module OpscodeAcl class AclRemove < Chef::Knife category "OPSCODE HOSTED CHEF ACCESS CONTROL" banner "knife acl remove MEMBER_TYPE MEMBER_NAME OBJECT_TYPE OBJECT_NAME PERMS" deps do require_relative "acl_base" include OpscodeAcl::AclBase end def run member_type, member_name, object_type, object_name, perms = name_args if name_args.length != 5 show_usage ui.fatal "You must specify the member type [client|group|user], member name, object type, object name and perms" exit 1 end if member_name == "pivotal" && %w{client user}.include?(member_type) ui.fatal "ERROR: 'pivotal' is a system user so knife-acl will not remove it from an ACL." exit 1 end if member_name == "admins" && member_type == "group" && perms.to_s.split(",").include?("grant") ui.fatal "ERROR: knife-acl will not remove the 'admins' group from the 'grant' ACE." ui.fatal " Removal could prevent future attempts to modify permissions." exit 1 end validate_perm_type!(perms) validate_member_type!(member_type) validate_member_name!(member_name) validate_object_name!(object_name) validate_object_type!(object_type) validate_member_exists!(member_type, member_name) remove_from_acl!(member_type, member_name, object_type, object_name, perms) end end end knife-acl-1.0.6/lib/chef/knife/user_invite_list.rb0000644000004100000410000000176313605271675022105 0ustar www-datawww-data# # Author:: Steven Danna () # Copyright:: Copyright 2011-2016 Chef Software, Inc. # License:: Apache License, Version 2.0 # # Licensed under the Apache License, Version 2.0 (the "License"); # you may not use this file except in compliance with the License. # You may obtain a copy of the License at # # http://www.apache.org/licenses/LICENSE-2.0 # # Unless required by applicable law or agreed to in writing, software # distributed under the License is distributed on an "AS IS" BASIS, # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. # See the License for the specific language governing permissions and # limitations under the License. # module OpscodeAcl class UserInviteList < Chef::Knife category "OPSCODE HOSTED CHEF ACCESS CONTROL" banner "knife user invite list" def run api_endpoint = "association_requests/" invited_users = rest.get_rest(api_endpoint).map { |i| i["username"] } ui.output(invited_users) end end end knife-acl-1.0.6/lib/chef/knife/acl_show.rb0000644000004100000410000000312313605271675020305 0ustar www-datawww-data# # Author:: Steven Danna (steve@chef.io) # Copyright:: Copyright 2011-2016 Chef Software, Inc. # License:: Apache License, Version 2.0 # # Licensed under the Apache License, Version 2.0 (the "License"); # you may not use this file except in compliance with the License. # You may obtain a copy of the License at # # http://www.apache.org/licenses/LICENSE-2.0 # # Unless required by applicable law or agreed to in writing, software # distributed under the License is distributed on an "AS IS" BASIS, # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. # See the License for the specific language governing permissions and # limitations under the License. # module OpscodeAcl class AclShow < Chef::Knife category "OPSCODE HOSTED CHEF ACCESS CONTROL" banner "knife acl show OBJECT_TYPE OBJECT_NAME" deps do require_relative "acl_base" include OpscodeAcl::AclBase end def run object_type, object_name = name_args if name_args.length != 2 show_usage ui.fatal "You must specify an object type and object name" exit 1 end validate_object_type!(object_type) validate_object_name!(object_name) acl = get_acl(object_type, object_name) PERM_TYPES.each do |perm| # Filter out the actors field if we have # users and clients. Note that if one is present, # both will be - but we're checking both for completeness. if acl[perm].key?("users") && acl[perm].key?("clients") acl[perm].delete "actors" end end ui.output acl end end end knife-acl-1.0.6/lib/chef/knife/user_invite_recind.rb0000644000004100000410000000371613605271675022376 0ustar www-datawww-data# # Author:: Steven Danna () # Copyright:: Copyright 2011-2016 Chef Software, Inc. # License:: Apache License, Version 2.0 # # Licensed under the Apache License, Version 2.0 (the "License"); # you may not use this file except in compliance with the License. # You may obtain a copy of the License at # # http://www.apache.org/licenses/LICENSE-2.0 # # Unless required by applicable law or agreed to in writing, software # distributed under the License is distributed on an "AS IS" BASIS, # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. # See the License for the specific language governing permissions and # limitations under the License. # module OpscodeAcl class UserInviteRecind < Chef::Knife banner "knife user invite recind [USERNAMES] (options)" category "OPSCODE HOSTED CHEF ACCESS CONTROL" option :all, short: "-a", long: "--all", description: "Recind all invites!" def run if (name_args.length < 1) && ! config.key?(:all) show_usage ui.fatal("You must specify a username.") exit 1 end # To recind we need to send a DELETE to association_requests/INVITE_ID # For user friendliness we look up the invite ID based on username. @invites = {} usernames = name_args rest.get_rest("association_requests").each { |i| @invites[i["username"]] = i["id"] } if config[:all] ui.confirm("Are you sure you want to recind all association requests") @invites.each do |u, i| rest.delete_rest("association_requests/#{i}") end else ui.confirm("Are you sure you want to recind the association requests for: #{usernames.join(", ")}") usernames.each do |u| if @invites.key?(u) rest.delete_rest("association_requests/#{@invites[u]}") else ui.fatal("No association request for #{u}.") exit 1 end end end end end end knife-acl-1.0.6/lib/chef/knife/group_list.rb0000644000004100000410000000220413605271675020674 0ustar www-datawww-data# # Author:: Seth Falcon () # Author:: Jeremiah Snapp () # Copyright:: Copyright 2011-2016 Chef Software, Inc. # License:: Apache License, Version 2.0 # # Licensed under the Apache License, Version 2.0 (the "License"); # you may not use this file except in compliance with the License. # You may obtain a copy of the License at # # http://www.apache.org/licenses/LICENSE-2.0 # # Unless required by applicable law or agreed to in writing, software # distributed under the License is distributed on an "AS IS" BASIS, # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. # See the License for the specific language governing permissions and # limitations under the License. # module OpscodeAcl class GroupList < Chef::Knife category "OPSCODE HOSTED CHEF ACCESS CONTROL" banner "knife group list" deps do require_relative "acl_base" include OpscodeAcl::AclBase end def run groups = rest.get_rest("groups").keys.sort ui.output(remove_usags(groups)) end def remove_usags(groups) groups.select { |gname| !is_usag?(gname) } end end end knife-acl-1.0.6/lib/chef/knife/group_add.rb0000644000004100000410000000314313605271675020454 0ustar www-datawww-data# # Author:: Seth Falcon () # Author:: Jeremiah Snapp () # Copyright:: Copyright 2011-2016 Chef Software, Inc. # License:: Apache License, Version 2.0 # # Licensed under the Apache License, Version 2.0 (the "License"); # you may not use this file except in compliance with the License. # You may obtain a copy of the License at # # http://www.apache.org/licenses/LICENSE-2.0 # # Unless required by applicable law or agreed to in writing, software # distributed under the License is distributed on an "AS IS" BASIS, # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. # See the License for the specific language governing permissions and # limitations under the License. # module OpscodeAcl class GroupAdd < Chef::Knife category "OPSCODE HOSTED CHEF ACCESS CONTROL" banner "knife group add MEMBER_TYPE MEMBER_NAME GROUP_NAME" deps do require_relative "acl_base" include OpscodeAcl::AclBase end def run member_type, member_name, group_name = name_args if name_args.length != 3 show_usage ui.fatal "You must specify member type [client|group|user], member name and group name" exit 1 end validate_member_name!(group_name) validate_member_type!(member_type) validate_member_name!(member_name) if group_name.downcase == "users" ui.fatal "knife-acl can not manage members of the Users group" ui.fatal "please read knife-acl's README.md for more information" exit 1 end add_to_group!(member_type, member_name, group_name) end end end knife-acl-1.0.6/lib/chef/knife/user_list.rb0000644000004100000410000000177613605271675020533 0ustar www-datawww-data# # Author:: Seth Falcon () # Author:: Jeremiah Snapp () # Copyright:: Copyright 2011-2016 Chef Software, Inc. # License:: Apache License, Version 2.0 # # Licensed under the Apache License, Version 2.0 (the "License"); # you may not use this file except in compliance with the License. # You may obtain a copy of the License at # # http://www.apache.org/licenses/LICENSE-2.0 # # Unless required by applicable law or agreed to in writing, software # distributed under the License is distributed on an "AS IS" BASIS, # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. # See the License for the specific language governing permissions and # limitations under the License. # module OpscodeAcl class UserList < Chef::Knife category "OPSCODE HOSTED CHEF ACCESS CONTROL" banner "knife user list" deps do require "pp" end def run users = rest.get_rest("users").map { |u| u["user"]["username"] } pp users.sort end end end knife-acl-1.0.6/lib/chef/knife/group_create.rb0000644000004100000410000000242213605271675021166 0ustar www-datawww-data# # Author:: Seth Falcon () # Author:: Jeremiah Snapp () # Copyright:: Copyright 2011-2016 Chef Software, Inc. # License:: Apache License, Version 2.0 # # Licensed under the Apache License, Version 2.0 (the "License"); # you may not use this file except in compliance with the License. # You may obtain a copy of the License at # # http://www.apache.org/licenses/LICENSE-2.0 # # Unless required by applicable law or agreed to in writing, software # distributed under the License is distributed on an "AS IS" BASIS, # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. # See the License for the specific language governing permissions and # limitations under the License. # module OpscodeAcl class GroupCreate < Chef::Knife category "OPSCODE HOSTED CHEF ACCESS CONTROL" banner "knife group create GROUP_NAME" deps do require_relative "acl_base" include OpscodeAcl::AclBase end def run group_name = name_args[0] if name_args.length != 1 show_usage ui.fatal "You must specify group name" exit 1 end validate_member_name!(group_name) ui.msg "Creating '#{group_name}' group" rest.post_rest("groups", { groupname: group_name }) end end end knife-acl-1.0.6/lib/chef/knife/acl_base.rb0000644000004100000410000001440213605271675020241 0ustar www-datawww-data# # Author:: Steven Danna (steve@chef.io) # Author:: Jeremiah Snapp () # Copyright:: Copyright 2011-2016 Chef Software, Inc. # License:: Apache License, Version 2.0 # # Licensed under the Apache License, Version 2.0 (the "License"); # you may not use this file except in compliance with the License. # You may obtain a copy of the License at # # http://www.apache.org/licenses/LICENSE-2.0 # # Unless required by applicable law or agreed to in writing, software # distributed under the License is distributed on an "AS IS" BASIS, # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. # See the License for the specific language governing permissions and # limitations under the License. # module OpscodeAcl module AclBase PERM_TYPES = %w{create read update delete grant}.freeze unless defined? PERM_TYPES MEMBER_TYPES = %w{client group user}.freeze unless defined? MEMBER_TYPES OBJECT_TYPES = %w{clients containers cookbooks data environments groups nodes roles policies policy_groups}.freeze unless defined? OBJECT_TYPES OBJECT_NAME_SPEC = /^[\-[:alnum:]_\.]+$/.freeze unless defined? OBJECT_NAME_SPEC def validate_object_type!(type) unless OBJECT_TYPES.include?(type) ui.fatal "Unknown object type \"#{type}\". The following types are permitted: #{OBJECT_TYPES.join(", ")}" exit 1 end end def validate_object_name!(name) unless OBJECT_NAME_SPEC.match(name) ui.fatal "Invalid name: #{name}" exit 1 end end def validate_member_type!(type) unless MEMBER_TYPES.include?(type) ui.fatal "Unknown member type \"#{type}\". The following types are permitted: #{MEMBER_TYPES.join(", ")}" exit 1 end end def validate_member_name!(name) # Same rules apply to objects and members validate_object_name!(name) end def validate_perm_type!(perms) perms.split(",").each do |perm| unless PERM_TYPES.include?(perm) ui.fatal "Invalid permission \"#{perm}\". The following permissions are permitted: #{PERM_TYPES.join(",")}" exit 1 end end end def validate_member_exists!(member_type, member_name) true if rest.get_rest("#{member_type}s/#{member_name}") rescue NameError # ignore "NameError: uninitialized constant Chef::ApiClient" when finding a client true rescue ui.fatal "#{member_type} '#{member_name}' does not exist" exit 1 end def is_usag?(gname) gname.length == 32 && gname =~ /^[0-9a-f]+$/ end def get_acl(object_type, object_name) rest.get_rest("#{object_type}/#{object_name}/_acl?detail=granular") end def get_ace(object_type, object_name, perm) get_acl(object_type, object_name)[perm] end def add_to_acl!(member_type, member_name, object_type, object_name, perms) acl = get_acl(object_type, object_name) perms.split(",").each do |perm| ui.msg "Adding '#{member_name}' to '#{perm}' ACE of '#{object_name}'" ace = acl[perm] case member_type when "client", "user" # Our PUT body depends on the type of reply we get from _acl?detail=granular # When the server replies with json attributes 'users' and 'clients', # we'll want to modify entries under the same keys they arrived.- their presence # in the body tells us that CS will accept them in a PUT. # Older version of chef-server will continue to use 'actors' for a combined list # and expect the same in the body. key = "#{member_type}s" key = "actors" unless ace.key? key next if ace[key].include?(member_name) ace[key] << member_name when "group" next if ace["groups"].include?(member_name) ace["groups"] << member_name end update_ace!(object_type, object_name, perm, ace) end end def remove_from_acl!(member_type, member_name, object_type, object_name, perms) acl = get_acl(object_type, object_name) perms.split(",").each do |perm| ui.msg "Removing '#{member_name}' from '#{perm}' ACE of '#{object_name}'" ace = acl[perm] case member_type when "client", "user" key = "#{member_type}s" key = "actors" unless ace.key? key next unless ace[key].include?(member_name) ace[key].delete(member_name) when "group" next unless ace["groups"].include?(member_name) ace["groups"].delete(member_name) end update_ace!(object_type, object_name, perm, ace) end end def update_ace!(object_type, object_name, ace_type, ace) rest.put_rest("#{object_type}/#{object_name}/_acl/#{ace_type}", ace_type => ace) end def add_to_group!(member_type, member_name, group_name) validate_member_exists!(member_type, member_name) existing_group = rest.get_rest("groups/#{group_name}") ui.msg "Adding '#{member_name}' to '#{group_name}' group" unless existing_group["#{member_type}s"].include?(member_name) existing_group["#{member_type}s"] << member_name new_group = { "groupname" => existing_group["groupname"], "orgname" => existing_group["orgname"], "actors" => { "users" => existing_group["users"], "clients" => existing_group["clients"], "groups" => existing_group["groups"], }, } rest.put_rest("groups/#{group_name}", new_group) end end def remove_from_group!(member_type, member_name, group_name) validate_member_exists!(member_type, member_name) existing_group = rest.get_rest("groups/#{group_name}") ui.msg "Removing '#{member_name}' from '#{group_name}' group" if existing_group["#{member_type}s"].include?(member_name) existing_group["#{member_type}s"].delete(member_name) new_group = { "groupname" => existing_group["groupname"], "orgname" => existing_group["orgname"], "actors" => { "users" => existing_group["users"], "clients" => existing_group["clients"], "groups" => existing_group["groups"], }, } rest.put_rest("groups/#{group_name}", new_group) end end end end knife-acl-1.0.6/lib/chef/knife/acl_bulk_remove.rb0000644000004100000410000000550713605271675021647 0ustar www-datawww-data# # Author:: Jeremiah Snapp (jeremiah@chef.io) # Copyright:: Copyright 2011-2016 Chef Software, Inc. # License:: Apache License, Version 2.0 # # Licensed under the Apache License, Version 2.0 (the "License"); # you may not use this file except in compliance with the License. # You may obtain a copy of the License at # # http://www.apache.org/licenses/LICENSE-2.0 # # Unless required by applicable law or agreed to in writing, software # distributed under the License is distributed on an "AS IS" BASIS, # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. # See the License for the specific language governing permissions and # limitations under the License. # module OpscodeAcl class AclBulkRemove < Chef::Knife category "OPSCODE HOSTED CHEF ACCESS CONTROL" banner "knife acl bulk remove MEMBER_TYPE MEMBER_NAME OBJECT_TYPE REGEX PERMS" deps do require_relative "acl_base" include OpscodeAcl::AclBase end def run member_type, member_name, object_type, regex, perms = name_args object_name_matcher = /#{regex}/ if name_args.length != 5 show_usage ui.fatal "You must specify the member type [client|group|user], member name, object type, object name REGEX and perms" exit 1 end if member_name == "pivotal" && %w{client user}.include?(member_type) ui.fatal "ERROR: 'pivotal' is a system user so knife-acl will not remove it from an ACL." exit 1 end if member_name == "admins" && member_type == "group" && perms.to_s.split(",").include?("grant") ui.fatal "ERROR: knife-acl will not remove the 'admins' group from the 'grant' ACE." ui.fatal " Removal could prevent future attempts to modify permissions." exit 1 end validate_perm_type!(perms) validate_member_type!(member_type) validate_member_name!(member_name) validate_object_type!(object_type) validate_member_exists!(member_type, member_name) if %w{containers groups}.include?(object_type) ui.fatal "bulk modifying the ACL of #{object_type} is not permitted" exit 1 end objects_to_modify = [] all_objects = rest.get_rest(object_type) objects_to_modify = all_objects.keys.select { |object_name| object_name =~ object_name_matcher } if objects_to_modify.empty? ui.info "No #{object_type} match the expression /#{regex}/" exit 0 end ui.msg("The ACL of the following #{object_type} will be modified:") ui.msg("") ui.msg(ui.list(objects_to_modify.sort, :columns_down)) ui.msg("") ui.confirm("Are you sure you want to modify the ACL of these #{object_type}?") objects_to_modify.each do |object_name| remove_from_acl!(member_type, member_name, object_type, object_name, perms) end end end end knife-acl-1.0.6/lib/chef/knife/group_show.rb0000644000004100000410000000236013605271675020704 0ustar www-datawww-data# # Author:: Seth Falcon () # Author:: Jeremiah Snapp () # Copyright:: Copyright 2011-2016 Chef Software, Inc. # License:: Apache License, Version 2.0 # # Licensed under the Apache License, Version 2.0 (the "License"); # you may not use this file except in compliance with the License. # You may obtain a copy of the License at # # http://www.apache.org/licenses/LICENSE-2.0 # # Unless required by applicable law or agreed to in writing, software # distributed under the License is distributed on an "AS IS" BASIS, # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. # See the License for the specific language governing permissions and # limitations under the License. # module OpscodeAcl class GroupShow < Chef::Knife category "OPSCODE HOSTED CHEF ACCESS CONTROL" banner "knife group show GROUP_NAME" deps do require_relative "acl_base" include OpscodeAcl::AclBase end def run group_name = name_args[0] if name_args.length != 1 show_usage ui.fatal "You must specify group name" exit 1 end validate_member_name!(group_name) group = rest.get_rest("groups/#{group_name}") ui.output group end end end knife-acl-1.0.6/lib/chef/knife/group_destroy.rb0000644000004100000410000000272413605271675021421 0ustar www-datawww-data# # Author:: Christopher Maier () # Author:: Jeremiah Snapp () # Copyright:: Copyright 2015-2016 Chef Software, Inc. # License:: Apache License, Version 2.0 # # Licensed under the Apache License, Version 2.0 (the "License"); # you may not use this file except in compliance with the License. # You may obtain a copy of the License at # # http://www.apache.org/licenses/LICENSE-2.0 # # Unless required by applicable law or agreed to in writing, software # distributed under the License is distributed on an "AS IS" BASIS, # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. # See the License for the specific language governing permissions and # limitations under the License. # module OpscodeAcl class GroupDestroy < Chef::Knife category "OPSCODE HOSTED CHEF ACCESS CONTROL" banner "knife group destroy GROUP_NAME" deps do require_relative "acl_base" include OpscodeAcl::AclBase end def run group_name = name_args[0] if name_args.length != 1 show_usage ui.fatal "You must specify group name" exit 1 end validate_member_name!(group_name) if %w{admins billing-admins clients users}.include?(group_name.downcase) ui.fatal "the '#{group_name}' group is a special group that should not be destroyed" exit 1 end ui.msg "Destroying '#{group_name}' group" rest.delete_rest("groups/#{group_name}") end end end knife-acl-1.0.6/lib/chef/knife/acl_add.rb0000644000004100000410000000346313605271675020064 0ustar www-datawww-data# # Author:: Steven Danna (steve@chef.io) # Author:: Jeremiah Snapp (jeremiah@chef.io) # Copyright:: Copyright 2011-2016 Chef Software, Inc. # License:: Apache License, Version 2.0 # # Licensed under the Apache License, Version 2.0 (the "License"); # you may not use this file except in compliance with the License. # You may obtain a copy of the License at # # http://www.apache.org/licenses/LICENSE-2.0 # # Unless required by applicable law or agreed to in writing, software # distributed under the License is distributed on an "AS IS" BASIS, # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. # See the License for the specific language governing permissions and # limitations under the License. # module OpscodeAcl class AclAdd < Chef::Knife category "OPSCODE HOSTED CHEF ACCESS CONTROL" banner "knife acl add MEMBER_TYPE MEMBER_NAME OBJECT_TYPE OBJECT_NAME PERMS" deps do require_relative "acl_base" include OpscodeAcl::AclBase end def run member_type, member_name, object_type, object_name, perms = name_args if name_args.length != 5 show_usage ui.fatal "You must specify the member type [client|group], member name, object type, object name and perms" exit 1 end unless %w{client group}.include?(member_type) ui.fatal "ERROR: To enforce best practice, knife-acl can only add a client or a group to an ACL." ui.fatal " See the knife-acl README for more information." exit 1 end validate_perm_type!(perms) validate_member_name!(member_name) validate_object_name!(object_name) validate_object_type!(object_type) validate_member_exists!(member_type, member_name) add_to_acl!(member_type, member_name, object_type, object_name, perms) end end end knife-acl-1.0.6/lib/chef/knife/group_remove.rb0000644000004100000410000000315613605271675021225 0ustar www-datawww-data# # Author:: Seth Falcon () # Author:: Jeremiah Snapp () # Copyright:: Copyright 2011-2016 Chef Software, Inc. # License:: Apache License, Version 2.0 # # Licensed under the Apache License, Version 2.0 (the "License"); # you may not use this file except in compliance with the License. # You may obtain a copy of the License at # # http://www.apache.org/licenses/LICENSE-2.0 # # Unless required by applicable law or agreed to in writing, software # distributed under the License is distributed on an "AS IS" BASIS, # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. # See the License for the specific language governing permissions and # limitations under the License. # module OpscodeAcl class GroupRemove < Chef::Knife category "OPSCODE HOSTED CHEF ACCESS CONTROL" banner "knife group remove MEMBER_TYPE MEMBER_NAME GROUP_NAME" deps do require_relative "acl_base" include OpscodeAcl::AclBase end def run member_type, member_name, group_name = name_args if name_args.length != 3 show_usage ui.fatal "You must specify member type [client|group|user], member name and group name" exit 1 end validate_member_name!(group_name) validate_member_type!(member_type) validate_member_name!(member_name) if group_name.downcase == "users" ui.fatal "knife-acl can not manage members of the Users group" ui.fatal "please read knife-acl's README.md for more information" exit 1 end remove_from_group!(member_type, member_name, group_name) end end end knife-acl-1.0.6/lib/chef/knife/acl_bulk_add.rb0000644000004100000410000000502513605271675021075 0ustar www-datawww-data# # Author:: Jeremiah Snapp (jeremiah@chef.io) # Copyright:: Copyright 2011-2016 Chef Software, Inc. # License:: Apache License, Version 2.0 # # Licensed under the Apache License, Version 2.0 (the "License"); # you may not use this file except in compliance with the License. # You may obtain a copy of the License at # # http://www.apache.org/licenses/LICENSE-2.0 # # Unless required by applicable law or agreed to in writing, software # distributed under the License is distributed on an "AS IS" BASIS, # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. # See the License for the specific language governing permissions and # limitations under the License. # module OpscodeAcl class AclBulkAdd < Chef::Knife category "OPSCODE HOSTED CHEF ACCESS CONTROL" banner "knife acl bulk add MEMBER_TYPE MEMBER_NAME OBJECT_TYPE REGEX PERMS" deps do require_relative "acl_base" include OpscodeAcl::AclBase end def run member_type, member_name, object_type, regex, perms = name_args object_name_matcher = /#{regex}/ if name_args.length != 5 show_usage ui.fatal "You must specify the member type [client|group], member name, object type, object name REGEX and perms" exit 1 end unless %w{client group}.include?(member_type) ui.fatal "ERROR: To enforce best practice, knife-acl can only add a client or a group to an ACL." ui.fatal " See the knife-acl README for more information." exit 1 end validate_perm_type!(perms) validate_member_name!(member_name) validate_object_type!(object_type) validate_member_exists!(member_type, member_name) if %w{containers groups}.include?(object_type) ui.fatal "bulk modifying the ACL of #{object_type} is not permitted" exit 1 end objects_to_modify = [] all_objects = rest.get_rest(object_type) objects_to_modify = all_objects.keys.select { |object_name| object_name =~ object_name_matcher } if objects_to_modify.empty? ui.info "No #{object_type} match the expression /#{regex}/" exit 0 end ui.msg("The ACL of the following #{object_type} will be modified:") ui.msg("") ui.msg(ui.list(objects_to_modify.sort, :columns_down)) ui.msg("") ui.confirm("Are you sure you want to modify the ACL of these #{object_type}?") objects_to_modify.each do |object_name| add_to_acl!(member_type, member_name, object_type, object_name, perms) end end end end knife-acl-1.0.6/lib/chef/knife/user_show.rb0000644000004100000410000000273613605271675020535 0ustar www-datawww-data# # Author:: Steven Danna () # Copyright:: Copyright 2011-2016 Chef Software, Inc. # License:: Apache License, Version 2.0 # # Licensed under the Apache License, Version 2.0 (the "License"); # you may not use this file except in compliance with the License. # You may obtain a copy of the License at # # http://www.apache.org/licenses/LICENSE-2.0 # # Unless required by applicable law or agreed to in writing, software # distributed under the License is distributed on an "AS IS" BASIS, # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. # See the License for the specific language governing permissions and # limitations under the License. # module OpscodeAcl class UserShow < Chef::Knife category "OPSCODE HOSTED CHEF ACCESS CONTROL" banner "knife user show [USERNAME]" # ui.format_for_display has logic to handle displaying # any attributes set in the config[:attribute] Array. attrs_to_show = [] option :attribute, short: "-a [ATTR]", long: "--attribute [ATTR]", proc: lambda { |val| attrs_to_show << val }, description: "Show attribute ATTR. Use multiple times to show multiple attributes." def run if name_args.length < 1 show_usage ui.fatal "You must specify a username." exit 1 end username = name_args[0] api_endpoint = "users/#{username}" user = rest.get_rest(api_endpoint) ui.output(ui.format_for_display(user)) end end end knife-acl-1.0.6/lib/chef/knife/user_dissociate.rb0000644000004100000410000000230513605271675021674 0ustar www-datawww-data# # Author:: Steven Danna () # Copyright:: Copyright 2011-2016 Chef Software, Inc. # License:: Apache License, Version 2.0 # # Licensed under the Apache License, Version 2.0 (the "License"); # you may not use this file except in compliance with the License. # You may obtain a copy of the License at # # http://www.apache.org/licenses/LICENSE-2.0 # # Unless required by applicable law or agreed to in writing, software # distributed under the License is distributed on an "AS IS" BASIS, # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. # See the License for the specific language governing permissions and # limitations under the License. # module OpscodeAcl class UserDissociate < Chef::Knife category "OPSCODE HOSTED CHEF ACCESS CONTROL" banner "knife user dissociate USERNAMES" def run if name_args.length < 1 show_usage ui.fatal("You must specify a username.") exit 1 end users = name_args ui.confirm("Are you sure you want to dissociate the following users: #{users.join(", ")}") users.each do |u| api_endpoint = "users/#{u}" rest.delete_rest(api_endpoint) end end end end knife-acl-1.0.6/lib/knife-acl/0000755000004100000410000000000013605271675016012 5ustar www-datawww-dataknife-acl-1.0.6/lib/knife-acl/version.rb0000644000004100000410000000005713605271675020026 0ustar www-datawww-datamodule KnifeACL VERSION = "1.0.6".freeze end knife-acl-1.0.6/knife-acl.gemspec0000644000004100000410000000324213605271675016612 0ustar www-datawww-data######################################################### # This file has been automatically generated by gem2tgz # ######################################################### # -*- encoding: utf-8 -*- # stub: knife-acl 1.0.6 ruby lib Gem::Specification.new do |s| s.name = "knife-acl".freeze s.version = "1.0.6" s.required_rubygems_version = Gem::Requirement.new(">= 0".freeze) if s.respond_to? :required_rubygems_version= s.require_paths = ["lib".freeze] s.authors = ["Seth Falcon".freeze, "Jeremiah Snapp".freeze] s.date = "2019-12-30" s.description = "Knife plugin to manupulate Chef server access control lists".freeze s.email = "support@chef.io".freeze s.extra_rdoc_files = ["LICENSE".freeze] s.files = ["LICENSE".freeze, "lib/chef/knife/acl_add.rb".freeze, "lib/chef/knife/acl_base.rb".freeze, "lib/chef/knife/acl_bulk_add.rb".freeze, "lib/chef/knife/acl_bulk_remove.rb".freeze, "lib/chef/knife/acl_remove.rb".freeze, "lib/chef/knife/acl_show.rb".freeze, "lib/chef/knife/group_add.rb".freeze, "lib/chef/knife/group_create.rb".freeze, "lib/chef/knife/group_destroy.rb".freeze, "lib/chef/knife/group_list.rb".freeze, "lib/chef/knife/group_remove.rb".freeze, "lib/chef/knife/group_show.rb".freeze, "lib/chef/knife/user_dissociate.rb".freeze, "lib/chef/knife/user_invite_add.rb".freeze, "lib/chef/knife/user_invite_list.rb".freeze, "lib/chef/knife/user_invite_recind.rb".freeze, "lib/chef/knife/user_list.rb".freeze, "lib/chef/knife/user_show.rb".freeze, "lib/knife-acl/version.rb".freeze] s.homepage = "https://github.com/chef/knife-acl".freeze s.rubygems_version = "2.5.2.1".freeze s.summary = "Knife plugin to manupulate Chef server access control lists".freeze end