
from oslo_policy import policy

from keystone.common.policies import base

token_revocation_policies = [
    policy.DocumentedRuleDefault(
        name=base.IDENTITY % 'revocation_list',
        check_str=base.RULE_SERVICE_OR_ADMIN,
        description='List revoked PKI tokens.',
        operations=[{'path': '/v3/auth/tokens/OS-PKI/revoked',
                     'method': 'GET'}])
]


def list_rules():
    return token_revocation_policies


from oslo_policy import policy

from keystone.common.policies import base

token_revocation_policies = [
    policy.DocumentedRuleDefault(
        name=base.IDENTITY % 'revocation_list',
        check_str=base.RULE_SERVICE_OR_ADMIN,
        # NOTE(lbragstad): Documenting scope_types here doesn't really make a
        # difference since this API is going to return an empty list regardless
        # of the token scope used in the API call. More-or-less just doing this
        # for consistency with other policies.
        scope_types=['system', 'project'],
        description='List revoked PKI tokens.',
        operations=[{'path': '/v3/auth/tokens/OS-PKI/revoked',
                     'method': 'GET'}])
]


def list_rules():
    return token_revocation_policies

Add scope_types to token revocation policies
Add scope_types to token revocation policies

This doesn't seem useful since the API will return an empty list
regardless because PKI support has been removed.

More or less doing this for consistency.

Change-Id: Iaa2925119fa6c9e2324546ed44aa54bac51dba05

  
  from oslo_policy import policy
  
  from keystone.common.policies import base
  
  token_revocation_policies = [
      policy.DocumentedRuleDefault(
          name=base.IDENTITY % 'revocation_list',
          check_str=base.RULE_SERVICE_OR_ADMIN,
+         # NOTE(lbragstad): Documenting scope_types here doesn't really make a
+         # difference since this API is going to return an empty list regardless
+         # of the token scope used in the API call. More-or-less just doing this
+         # for consistency with other policies.
+         scope_types=['system', 'project'],
          description='List revoked PKI tokens.',
          operations=[{'path': '/v3/auth/tokens/OS-PKI/revoked',
                       'method': 'GET'}])
  ]
  
  
  def list_rules():
      return token_revocation_policies
  
Add scope_types to token revocation policies
## Code Before:

from oslo_policy import policy

from keystone.common.policies import base

token_revocation_policies = [
    policy.DocumentedRuleDefault(
        name=base.IDENTITY % 'revocation_list',
        check_str=base.RULE_SERVICE_OR_ADMIN,
        description='List revoked PKI tokens.',
        operations=[{'path': '/v3/auth/tokens/OS-PKI/revoked',
                     'method': 'GET'}])
]


def list_rules():
    return token_revocation_policies

## Instruction:
Add scope_types to token revocation policies
## Code After:

from oslo_policy import policy

from keystone.common.policies import base

token_revocation_policies = [
    policy.DocumentedRuleDefault(
        name=base.IDENTITY % 'revocation_list',
        check_str=base.RULE_SERVICE_OR_ADMIN,
        # NOTE(lbragstad): Documenting scope_types here doesn't really make a
        # difference since this API is going to return an empty list regardless
        # of the token scope used in the API call. More-or-less just doing this
        # for consistency with other policies.
        scope_types=['system', 'project'],
        description='List revoked PKI tokens.',
        operations=[{'path': '/v3/auth/tokens/OS-PKI/revoked',
                     'method': 'GET'}])
]


def list_rules():
    return token_revocation_policies
