Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[KeyVault] Handle Role Definition UUID Name Internally #14218

Merged
merged 5 commits into from
Oct 2, 2020
Merged

[KeyVault] Handle Role Definition UUID Name Internally #14218

Show file tree
Hide file tree
Changes from 3 commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
bb4887d
Make role_assignment_name kwarg for create_role_assignment
mccoyp Oct 2, 2020
dc75603
Fix async client and tests
mccoyp Oct 2, 2020
0f3ad38
Fix default UUID setting, run black
mccoyp Oct 2, 2020
00fad36
Use *correct* black options
mccoyp Oct 2, 2020
0485402
Make pylint happy (wrt ungrouped imports)
mccoyp Oct 2, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
31 changes: 22 additions & 9 deletions ...ult/azure-keyvault-administration/azure/keyvault/administration/_access_control_client.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,7 @@
# Licensed under the MIT License.
# ------------------------------------
from typing import TYPE_CHECKING
from uuid import uuid4

from azure.core.tracing.decorator import distributed_trace

Expand All @@ -27,18 +28,20 @@ class KeyVaultAccessControlClient(KeyVaultClientBase):
# pylint:disable=protected-access

@distributed_trace
def create_role_assignment(self, role_scope, role_assignment_name, role_definition_id, principal_id, **kwargs):
# type: (Union[str, KeyVaultRoleScope], Union[str, UUID], str, str, **Any) -> KeyVaultRoleAssignment
def create_role_assignment(
self, role_scope, role_definition_id, principal_id, **kwargs
mccoyp marked this conversation as resolved.
Show resolved Hide resolved
):
# type: (Union[str, KeyVaultRoleScope], str, str, **Any) -> KeyVaultRoleAssignment
"""Create a role assignment.

:param role_scope: scope the role assignment will apply over. :class:`KeyVaultRoleScope` defines common
broad scopes. Specify a narrower scope as a string.
:type role_scope: str or KeyVaultRoleScope
:param role_assignment_name: a name for the role assignment. Must be a UUID.
:type role_assignment_name: str or uuid.UUID
:param str role_definition_id: ID of the role's definition
:param str principal_id: Azure Active Directory object ID of the principal which will be assigned the role. The
principal can be a user, service principal, or security group.
:keyword role_assignment_name: a name for the role assignment. Must be a UUID.
:type role_assignment_name: str or uuid.UUID
:rtype: KeyVaultRoleAssignment
"""
create_parameters = self._client.role_assignments.models.RoleAssignmentCreateParameters(
Expand All @@ -49,7 +52,7 @@ def create_role_assignment(self, role_scope, role_assignment_name, role_definiti
assignment = self._client.role_assignments.create(
vault_base_url=self._vault_url,
scope=role_scope,
role_assignment_name=role_assignment_name,
role_assignment_name=kwargs.pop("role_assignment_name", None) or uuid4(),
parameters=create_parameters,
**kwargs
)
Expand All @@ -69,7 +72,10 @@ def delete_role_assignment(self, role_scope, role_assignment_name, **kwargs):
:rtype: KeyVaultRoleAssignment
"""
assignment = self._client.role_assignments.delete(
vault_base_url=self._vault_url, scope=role_scope, role_assignment_name=str(role_assignment_name), **kwargs
vault_base_url=self._vault_url,
scope=role_scope,
role_assignment_name=str(role_assignment_name),
**kwargs
)
return KeyVaultRoleAssignment._from_generated(assignment)

Expand All @@ -86,7 +92,10 @@ def get_role_assignment(self, role_scope, role_assignment_name, **kwargs):
:rtype: KeyVaultRoleAssignment
"""
assignment = self._client.role_assignments.get(
vault_base_url=self._vault_url, scope=role_scope, role_assignment_name=str(role_assignment_name), **kwargs
vault_base_url=self._vault_url,
scope=role_scope,
role_assignment_name=str(role_assignment_name),
**kwargs
)
return KeyVaultRoleAssignment._from_generated(assignment)

Expand All @@ -103,7 +112,9 @@ def list_role_assignments(self, role_scope, **kwargs):
return self._client.role_assignments.list_for_scope(
self._vault_url,
role_scope,
cls=lambda result: [KeyVaultRoleAssignment._from_generated(a) for a in result],
cls=lambda result: [
KeyVaultRoleAssignment._from_generated(a) for a in result
],
**kwargs
)

Expand All @@ -120,6 +131,8 @@ def list_role_definitions(self, role_scope, **kwargs):
return self._client.role_definitions.list(
self._vault_url,
role_scope,
cls=lambda result: [KeyVaultRoleDefinition._from_generated(d) for d in result],
cls=lambda result: [
KeyVaultRoleDefinition._from_generated(d) for d in result
],
**kwargs
)
36 changes: 26 additions & 10 deletions ...azure-keyvault-administration/azure/keyvault/administration/aio/_access_control_client.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,7 @@
# Licensed under the MIT License.
# ------------------------------------
from typing import TYPE_CHECKING
from uuid import uuid4

from azure.core.tracing.decorator import distributed_trace
from azure.core.tracing.decorator_async import distributed_trace_async
Expand Down Expand Up @@ -31,7 +32,6 @@ class KeyVaultAccessControlClient(AsyncKeyVaultClientBase):
async def create_role_assignment(
self,
role_scope: "Union[str, KeyVaultRoleScope]",
role_assignment_name: "Union[str, UUID]",
role_definition_id: str,
principal_id: str,
**kwargs: "Any"
Expand All @@ -41,11 +41,11 @@ async def create_role_assignment(
:param role_scope: scope the role assignment will apply over. :class:`KeyVaultRoleScope` defines common broad
scopes. Specify a narrower scope as a string.
:type role_scope: str or KeyVaultRoleScope
:param role_assignment_name: a name for the role assignment. Must be a UUID.
:type role_assignment_name: str or uuid.UUID
:param str role_definition_id: ID of the role's definition
:param str principal_id: Azure Active Directory object ID of the principal which will be assigned the role. The
principal can be a user, service principal, or security group.
:keyword role_assignment_name: a name for the role assignment. Must be a UUID.
:type role_assignment_name: str or uuid.UUID
:rtype: KeyVaultRoleAssignment
"""
create_parameters = self._client.role_assignments.models.RoleAssignmentCreateParameters(
Expand All @@ -56,15 +56,18 @@ async def create_role_assignment(
assignment = await self._client.role_assignments.create(
vault_base_url=self._vault_url,
scope=role_scope,
role_assignment_name=role_assignment_name,
role_assignment_name=kwargs.pop("role_assignment_name", None) or uuid4(),
parameters=create_parameters,
**kwargs
)
return KeyVaultRoleAssignment._from_generated(assignment)

@distributed_trace_async
async def delete_role_assignment(
self, role_scope: "Union[str, KeyVaultRoleScope]", role_assignment_name: "Union[str, UUID]", **kwargs: "Any"
self,
role_scope: "Union[str, KeyVaultRoleScope]",
role_assignment_name: "Union[str, UUID]",
**kwargs: "Any"
) -> KeyVaultRoleAssignment:
"""Delete a role assignment.

Expand All @@ -77,13 +80,19 @@ async def delete_role_assignment(
:rtype: KeyVaultRoleAssignment
"""
assignment = await self._client.role_assignments.delete(
vault_base_url=self._vault_url, scope=role_scope, role_assignment_name=str(role_assignment_name), **kwargs
vault_base_url=self._vault_url,
scope=role_scope,
role_assignment_name=str(role_assignment_name),
**kwargs
)
return KeyVaultRoleAssignment._from_generated(assignment)

@distributed_trace_async
async def get_role_assignment(
self, role_scope: "Union[str, KeyVaultRoleScope]", role_assignment_name: "Union[str, UUID]", **kwargs: "Any"
self,
role_scope: "Union[str, KeyVaultRoleScope]",
role_assignment_name: "Union[str, UUID]",
**kwargs: "Any"
) -> KeyVaultRoleAssignment:
"""Get a role assignment.

Expand All @@ -95,7 +104,10 @@ async def get_role_assignment(
:rtype: KeyVaultRoleAssignment
"""
assignment = await self._client.role_assignments.get(
vault_base_url=self._vault_url, scope=role_scope, role_assignment_name=str(role_assignment_name), **kwargs
vault_base_url=self._vault_url,
scope=role_scope,
role_assignment_name=str(role_assignment_name),
**kwargs
)
return KeyVaultRoleAssignment._from_generated(assignment)

Expand All @@ -113,7 +125,9 @@ def list_role_assignments(
return self._client.role_assignments.list_for_scope(
self._vault_url,
role_scope,
cls=lambda result: [KeyVaultRoleAssignment._from_generated(a) for a in result],
cls=lambda result: [
KeyVaultRoleAssignment._from_generated(a) for a in result
],
**kwargs
)

Expand All @@ -131,6 +145,8 @@ def list_role_definitions(
return self._client.role_definitions.list(
self._vault_url,
role_scope,
cls=lambda result: [KeyVaultRoleDefinition._from_generated(d) for d in result],
cls=lambda result: [
KeyVaultRoleDefinition._from_generated(d) for d in result
],
**kwargs
)
2 changes: 1 addition & 1 deletion sdk/keyvault/azure-keyvault-administration/tests/test_access_control.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -66,7 +66,7 @@ def test_role_assignment(self, client):
principal_id = self.get_service_principal_id()
name = self.get_replayable_uuid("some-uuid")

created = client.create_role_assignment(scope, name, definition.id, principal_id)
created = client.create_role_assignment(scope, definition.id, principal_id, role_assignment_name=name)
assert created.name == name
assert created.principal_id == principal_id
assert created.role_definition_id == definition.id
Expand Down
2 changes: 1 addition & 1 deletion sdk/keyvault/azure-keyvault-administration/tests/test_access_control_async.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -71,7 +71,7 @@ async def test_role_assignment(self, client):
principal_id = self.get_service_principal_id()
name = self.get_replayable_uuid("some-uuid")

created = await client.create_role_assignment(scope, name, definition.id, principal_id)
created = await client.create_role_assignment(scope, definition.id, principal_id, role_assignment_name=name)
assert created.name == name
assert created.principal_id == principal_id
assert created.role_definition_id == definition.id
Expand Down