Making roles more apparent for certificates and authorities. (#327)

lemur/certificates/schemas.py

@@ -11,11 +11,12 @@ from marshmallow import fields, validates_schema, post_load
 from marshmallow.exceptions import ValidationError
 
 from lemur.schemas import AssociatedAuthoritySchema, AssociatedDestinationSchema, AssociatedCertificateSchema, \
-    AssociatedNotificationSchema, PluginInputSchema, ExtensionSchema
+    AssociatedNotificationSchema, PluginInputSchema, ExtensionSchema, AssociatedRoleSchema
 
 from lemur.authorities.schemas import AuthorityNestedOutputSchema
 from lemur.destinations.schemas import DestinationNestedOutputSchema
 from lemur.notifications.schemas import NotificationNestedOutputSchema
+from lemur.roles.schemas import RoleNestedOutputSchema
 # from lemur.domains.schemas import DomainNestedOutputSchema
 from lemur.users.schemas import UserNestedOutputSchema
 
@@ -51,6 +52,7 @@ class CertificateInputSchema(CertificateSchema):
     destinations = fields.Nested(AssociatedDestinationSchema, missing=[], many=True)
     notifications = fields.Nested(AssociatedNotificationSchema, missing=[], many=True)
     replacements = fields.Nested(AssociatedCertificateSchema, missing=[], many=True)
+    roles = fields.Nested(AssociatedRoleSchema, missing=[], many=True)
 
     csr = fields.String(validate=validators.csr)
 
@@ -73,6 +75,7 @@ class CertificateEditInputSchema(CertificateSchema):
     destinations = fields.Nested(AssociatedDestinationSchema, missing=[], many=True)
     notifications = fields.Nested(AssociatedNotificationSchema, missing=[], many=True)
     replacements = fields.Nested(AssociatedCertificateSchema, missing=[], many=True)
+    roles = fields.Nested(AssociatedRoleSchema, missing=[], many=True)
 
 
 class CertificateNestedOutputSchema(LemurOutputSchema):
@@ -117,6 +120,7 @@ class CertificateOutputSchema(LemurOutputSchema):
     notifications = fields.Nested(NotificationNestedOutputSchema, many=True)
     replaces = fields.Nested(CertificateNestedOutputSchema, many=True)
     authority = fields.Nested(AuthorityNestedOutputSchema)
+    roles = fields.Nested(RoleNestedOutputSchema, many=True)
 
 
 class CertificateUploadInputSchema(CertificateSchema):
@@ -130,6 +134,7 @@ class CertificateUploadInputSchema(CertificateSchema):
     destinations = fields.Nested(AssociatedDestinationSchema, missing=[], many=True)
     notifications = fields.Nested(AssociatedNotificationSchema, missing=[], many=True)
     replacements = fields.Nested(AssociatedCertificateSchema, missing=[], many=True)
+    roles = fields.Nested(AssociatedRoleSchema, missing=[], many=True)
 
     @validates_schema
     def keys(self, data):

lemur/certificates/service.py

@@ -91,7 +91,7 @@ def export(cert, export_plugin):
     return plugin.export(cert.body, cert.chain, cert.private_key, export_plugin['pluginOptions'])
 
 
-def update(cert_id, owner, description, active, destinations, notifications, replaces):
+def update(cert_id, owner, description, active, destinations, notifications, replaces, roles):
     """
     Updates a certificate
     :param cert_id:
@@ -107,6 +107,8 @@ def update(cert_id, owner, description, active, destinations, notifications, rep
     cert.active = active
     cert.description = description
     cert.destinations = destinations
+    cert.notifications = notifications
+    cert.roles = roles
     cert.replaces = replaces
     cert.owner = owner
 

lemur/certificates/views.py

@@ -15,7 +15,7 @@ from lemur.common.schema import validate_schema
 from lemur.common.utils import paginated_parser
 
 from lemur.auth.service import AuthenticatedResource
-from lemur.auth.permissions import ViewKeyPermission, AuthorityPermission, UpdateCertificatePermission
+from lemur.auth.permissions import ViewKeyPermission, AuthorityPermission, CertificatePermission
 
 from lemur.certificates import service
 from lemur.certificates.schemas import certificate_input_schema, certificate_output_schema, \
@@ -519,9 +519,8 @@ class Certificates(AuthenticatedResource):
            :statuscode 403: unauthenticated
         """
         cert = service.get(certificate_id)
-        role = role_service.get_by_name(cert.owner)
 
-        permission = UpdateCertificatePermission(certificate_id, getattr(role, 'name', None))
+        permission = CertificatePermission(cert.id, [x.name for x in cert.roles])
 
         if permission.can():
             return service.update(
@@ -531,7 +530,8 @@ class Certificates(AuthenticatedResource):
                 data['active'],
                 data['destinations'],
                 data['notifications'],
-                data['replacements']
+                data['replacements'],
+                data['roles']
             )
 
         return dict(message='You are not authorized to update this certificate'), 403
@@ -742,8 +742,8 @@ class CertificateExport(AuthenticatedResource):
            :statuscode 403: unauthenticated
         """
         cert = service.get(certificate_id)
-        role = role_service.get_by_name(cert.owner)
-        permission = UpdateCertificatePermission(certificate_id, getattr(role, 'name', None))
+
+        permission = CertificatePermission(cert.id, [x.name for x in cert.roles])
 
         options = data['plugin']['plugin_options']
         plugin = data['plugin']['plugin_object']