client: allow ACL to be provided at key creation via -acl flag - #127
Open
AneesPatel wants to merge 1 commit into
Open
client: allow ACL to be provided at key creation via -acl flag#127AneesPatel wants to merge 1 commit into
AneesPatel wants to merge 1 commit into
Conversation
Adds an -acl flag to `knox create` that accepts a JSON file of access rules (same format as `knox access -acl`), so a key can be created with its intended ACL in one step instead of a follow-up `knox access` call. The shared parseACLFile helper is extracted from updateaccess.go and used by both commands. Resolves the TODO in client/create.go.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Currently
knox createalways creates keys with an empty ACL, so applyingaccess controls is a two-step workflow:
knox create, thenknox access -acl <file> <key>. Between those two steps the key existswithout its intended access controls. This PR resolves the
TODO(devinlundberg): allow ACL to be entered as inputinclient/create.goby letting the ACL be supplied at creation time:-acltakes a JSON file containing a list of access rules, in the exactsame format already accepted by
knox access -acl. When the flag isomitted, behavior is unchanged (empty ACL).
Changes
runUpdateAccessinto ashared
parseACLFilehelper, now used by bothknox access -aclandknox create -acl. No behavior change forknox access.-aclflag toknox create. The ACL file is parsed beforekey data is read from stdin, so an unreadable or malformed file fails
fast without first consuming the user's secret. Unreadable files and
invalid JSON return user-facing (non-server) errors, consistent with the
existing input validation in the command.
knox createusage and help text to document the flag.Tests
TestParseACLFile: table-driven coverage of a valid ACL file, a missingfile, and malformed JSON.
TestRunCreateACL: table-driven coverage ofrunCreateagainst a mockserver, verifying that no flag still sends an empty ACL (
[]), that aprovided ACL file is parsed and sent on the wire, and that a missing file
yields a non-server error.
All of
go build ./...,go vet ./...,gofmt -d -s ., andgo test ./...pass.