Repository: Netflix/lemur

Issue:
Roles associated with a certificate should be allowed to view key material.
Any role associated with a given certificate should be allowed to view it's key material as an owner. 



Discussion:

Resolving patch:
diff --git a/lemur/auth/permissions.py b/lemur/auth/permissions.py
--- a/lemur/auth/permissions.py
+++ b/lemur/auth/permissions.py
@@ -27,21 +27,9 @@ def __init__(self):
         super(SensitiveDomainPermission, self).__init__(RoleNeed('admin'))
 
 
-class ViewKeyPermission(Permission):
-    def __init__(self, certificate_id, owner):
-        c_need = CertificateCreatorNeed(certificate_id)
-        super(ViewKeyPermission, self).__init__(c_need, RoleNeed(owner), RoleNeed('admin'))
-
-
-class UpdateCertificatePermission(Permission):
-    def __init__(self, certificate_id, owner):
-        c_need = CertificateCreatorNeed(certificate_id)
-        super(UpdateCertificatePermission, self).__init__(c_need, RoleNeed(owner), RoleNeed('admin'))
-
-
 class CertificatePermission(Permission):
-    def __init__(self, certificate_id, roles):
-        needs = [RoleNeed('admin'), CertificateCreatorNeed(certificate_id)]
+    def __init__(self, certificate_id, owner, roles):
+        needs = [RoleNeed('admin'), CertificateCreatorNeed(certificate_id), RoleNeed(owner)]
         for r in roles:
             needs.append(CertificateOwnerNeed(str(r)))
 
diff --git a/lemur/certificates/views.py b/lemur/certificates/views.py
--- a/lemur/certificates/views.py
+++ b/lemur/certificates/views.py
@@ -15,7 +15,7 @@
 from lemur.common.utils import paginated_parser
 
 from lemur.auth.service import AuthenticatedResource
-from lemur.auth.permissions import ViewKeyPermission, AuthorityPermission, CertificatePermission
+from lemur.auth.permissions import AuthorityPermission, CertificatePermission
 
 from lemur.certificates import service
 from lemur.certificates.schemas import certificate_input_schema, certificate_output_schema, \
@@ -399,9 +399,8 @@ def get(self, certificate_id):
         if not cert:
             return dict(message="Cannot find specified certificate"), 404
 
-        role = role_service.get_by_name(cert.owner)
-
-        permission = ViewKeyPermission(certificate_id, getattr(role, 'name', None))
+        owner_role = role_service.get_by_name(cert.owner)
+        permission = CertificatePermission(cert.id, owner_role, [x.name for x in cert.roles])
 
         if permission.can():
             response = make_response(jsonify(key=cert.private_key), 200)
@@ -581,7 +580,8 @@ def put(self, certificate_id, data=None):
         """
         cert = service.get(certificate_id)
 
-        permission = CertificatePermission(cert.id, [x.name for x in cert.roles])
+        owner_role = role_service.get_by_name(cert.owner)
+        permission = CertificatePermission(cert.id, owner_role, [x.name for x in cert.roles])
 
         if permission.can():
             return service.update(
@@ -864,7 +864,8 @@ def post(self, certificate_id, data=None):
         """
         cert = service.get(certificate_id)
 
-        permission = CertificatePermission(cert.id, [x.name for x in cert.roles])
+        owner_role = role_service.get_by_name(cert.owner)
+        permission = CertificatePermission(cert.id, owner_role, [x.name for x in cert.roles])
 
         options = data['plugin']['plugin_options']
         plugin = data['plugin']['plugin_object']


Test patch: