Module Expr Str ImportFrom alias identifier ImportFrom alias ImportFrom alias ImportFrom alias ImportFrom alias ImportFrom alias ImportFrom alias identifier ImportFrom alias Assign NameStore Call AttributeLoad NameLoad attr NameLoad Assign NameStore ListLoad Str ClassDef bases NameLoad body Expr Str FunctionDef arguments args NameParam NameParam NameParam defaults body Expr Str Assign NameStore Dict Assign SubscriptStore NameLoad Index Str Call AttributeLoad NameLoad attr NameLoad Assign SubscriptStore NameLoad Index Str Call AttributeLoad NameLoad attr NameLoad Return NameLoad decorator_list FunctionDef arguments args NameParam NameParam defaults body Expr Str Expr Call AttributeLoad NameLoad attr Str Assign NameStore Call AttributeLoad NameLoad attr keyword NameLoad Assign NameStore ListComp AttributeLoad NameLoad attr comprehension NameStore NameLoad Assign NameStore Call NameLoad NameLoad Assign NameStore ListComp AttributeLoad NameLoad attr comprehension NameStore NameLoad Assign NameStore Call NameLoad NameLoad Assign NameStore Call AttributeLoad NameLoad attr NameLoad Assign NameStore Call AttributeLoad NameLoad attr NameLoad Assign NameStore BinOpSub NameLoad NameLoad Expr Call AttributeLoad NameLoad attr BinOpMod Str NameLoad Expr Call AttributeLoad NameLoad attr BinOpMod Str NameLoad Expr Call AttributeLoad NameLoad attr BinOpMod Str NameLoad Assign NameStore Call AttributeLoad NameLoad attr NameLoad Assign NameStore ListComp NameLoad comprehension NameStore NameLoad CompareIn AttributeLoad NameLoad attr NameLoad Assign NameStore Call AttributeLoad NameLoad attr NameLoad Assign NameStore ListComp NameLoad comprehension NameStore NameLoad CompareIn AttributeLoad NameLoad attr NameLoad Assign NameStore ListLoad For NameStore NameLoad body Expr Call AttributeLoad NameLoad attr AttributeLoad NameLoad attr Expr Call AttributeLoad NameLoad attr BinOpMod Str Call NameLoad NameLoad Expr Call AttributeLoad Call AttributeLoad NameLoad attr keyword NameLoad keyword NameLoad attr Expr Call AttributeLoad NameLoad attr BinOpMod Str Call NameLoad NameLoad Assign NameStore ListLoad For NameStore NameLoad body Expr Call AttributeLoad NameLoad attr AttributeLoad NameLoad attr Expr Call AttributeLoad NameLoad attr BinOpMod Str Call NameLoad NameLoad Expr Call AttributeLoad Call AttributeLoad NameLoad attr keyword NameLoad attr Expr Call AttributeLoad NameLoad attr BinOpMod Str Call NameLoad NameLoad Expr Call AttributeLoad NameLoad attr BinOpMod Str Call NameLoad NameLoad Assign NameStore ListLoad For NameStore NameLoad body Assign NameStore Call AttributeLoad NameLoad attr keyword AttributeLoad NameLoad attr keyword AttributeLoad NameLoad attr Assign NameStore Call NameLoad NameLoad Str ListLoad For NameStore NameLoad body Assign NameStore Call AttributeLoad NameLoad attr Str NameLoad If NameLoad body Assign TupleStore NameStore NameStore Call NameLoad NameLoad orelse Assign NameStore NameLoad Assign NameStore SubscriptLoad NameLoad Index Str Assign NameStore Call AttributeLoad NameLoad attr keyword NameLoad keyword NameLoad keyword NameLoad keyword NameLoad Expr Call AttributeLoad AttributeLoad NameLoad attr attr Call NameLoad AttributeLoad NameLoad attr Expr Call AttributeLoad NameLoad attr NameLoad Expr Call AttributeLoad NameLoad attr BinOpMod Str Call NameLoad NameLoad Expr Call AttributeLoad NameLoad attr BinOpMod Str TupleLoad Call NameLoad NameLoad Call NameLoad NameLoad Call NameLoad NameLoad Return ListLoad NameLoad NameLoad decorator_list FunctionDef arguments args NameParam NameParam defaults body Expr Str Expr Call AttributeLoad NameLoad attr Str Assign NameStore Call AttributeLoad NameLoad attr Assign NameStore Call NameLoad ListComp TupleLoad AttributeLoad NameLoad attr NameLoad comprehension NameStore NameLoad Assign NameStore Dict For NameStore NameLoad body Assign NameStore AttributeLoad NameLoad attr Assign NameStore Call AttributeLoad NameLoad attr NameLoad NameLoad If UnaryOpNot NameLoad body Assign NameStore Call NameLoad keyword NameLoad Expr Call AttributeLoad NameLoad attr BinOpMod Str NameLoad Assign NameStore Call AttributeLoad NameLoad attr keyword NameLoad Assign NameStore Call AttributeLoad NameLoad attr keyword NameLoad keyword NameLoad keyword NameLoad Assign SubscriptStore NameLoad Index NameLoad NameLoad Expr Call AttributeLoad NameLoad attr Str Return NameLoad decorator_list FunctionDef arguments args NameParam NameParam NameParam NameParam defaults body Expr Str Assign NameStore ListComp AttributeLoad NameLoad attr comprehension NameStore NameLoad Assign NameStore Call NameLoad NameLoad Assign NameStore IfExp NameLoad AttributeLoad NameLoad attr ListLoad Assign NameStore Call NameLoad NameLoad Assign NameStore Call AttributeLoad NameLoad attr NameLoad Assign NameStore Call AttributeLoad NameLoad attr NameLoad Assign NameStore BinOpSub NameLoad NameLoad Expr Call AttributeLoad NameLoad attr BinOpMod Str TupleLoad AttributeLoad NameLoad attr NameLoad Expr Call AttributeLoad NameLoad attr BinOpMod Str TupleLoad AttributeLoad NameLoad attr NameLoad Expr Call AttributeLoad NameLoad attr BinOpMod Str TupleLoad AttributeLoad NameLoad attr NameLoad Assign NameStore Call AttributeLoad NameLoad attr NameLoad Assign NameStore ListComp NameLoad comprehension NameStore NameLoad CompareIn AttributeLoad NameLoad attr NameLoad Expr Call AttributeLoad Call AttributeLoad NameLoad attr keyword AttributeLoad NameLoad attr keyword NameLoad attr Expr Call AttributeLoad NameLoad attr BinOpMod Str TupleLoad Call NameLoad NameLoad AttributeLoad NameLoad attr Assign NameStore Call AttributeLoad NameLoad attr NameLoad Assign NameStore Call AttributeLoad NameLoad attr keyword NameLoad Assign NameStore ListLoad For NameStore NameLoad body If CompareIn AttributeLoad NameLoad attr AttributeLoad NameLoad attr body Assign NameStore Call NameLoad NameLoad Str NameLoad orelse Assign NameStore NameLoad Assign NameStore Call AttributeLoad NameLoad attr keyword NameLoad keyword NameLoad keyword NameLoad Expr Call AttributeLoad NameLoad attr NameLoad Expr Call AttributeLoad NameLoad attr BinOpMod Str TupleLoad Call NameLoad NameLoad AttributeLoad NameLoad attr Return TupleLoad NameLoad NameLoad decorator_list decorator_list
N/A N/A 
Module for syncing RBAC definitions in the database with the ones from the filesystem.
 st2common log logging st2common.models.db.auth UserDB st2common.persistence.auth User st2common.persistence.rbac Role st2common.persistence.rbac UserRoleAssignment st2common.persistence.rbac PermissionGrant st2common.services rbac rbac_services st2common.util.uid parse_uid N/A LOG N/A N/A logging getLogger __name__ N/A __all__ N/A RBACDefinitionsDBSyncer RBACDefinitionsDBSyncer N/A object N/A N/A 
    A class which makes sure that the role definitions and user role assignments in the database
    match ones specified in the role definition files.

    The class works by simply deleting all the obsolete roles (either removed or updated) and
    creating new roles (either new roles or one which have been updated).

    Note #1: Our current datastore doesn't support transactions or similar which means that with
    the current data model there is a short time frame during sync when the definitions inside the
    DB are out of sync with the ones in the file.

    Note #2: The operation of this class is idempotent meaning that if it's ran multiple time with
    the same dataset, the end result / outcome will be the same.
     sync N/A N/A self role_definition_apis role_assignment_apis N/A N/A N/A 
        Synchronize all the role definitions and user role assignments.
         N/A result N/A N/A N/A result N/A roles N/A N/A self sync_roles role_definition_apis N/A N/A result N/A role_assignments N/A N/A self sync_users_role_assignments role_assignment_apis N/A result N/A sync_roles N/A N/A self role_definition_apis N/A N/A N/A 
        Synchronize all the role definitions in the database.

        :param role_dbs: RoleDB objects for the roles which are currently in the database.
        :type role_dbs: ``list`` of :class:`RoleDB`

        :param role_definition_apis: RoleDefinition API objects for the definitions loaded from
                                     the files.
        :type role_definition_apis: ``list`` of :class:RoleDefinitionFileFormatAPI`

        :rtype: ``tuple``
         N/A N/A N/A LOG info Synchronizing roles... N/A role_dbs N/A N/A rbac_services get_all_roles exclude_system True N/A role_db_names N/A N/A role_db name N/A role_db role_dbs N/A role_db_names N/A set role_db_names N/A role_api_names N/A N/A role_definition_api name N/A role_definition_api role_definition_apis N/A role_api_names N/A set role_api_names N/A new_role_names N/A N/A role_api_names difference role_db_names N/A updated_role_names N/A N/A role_db_names intersection role_api_names N/A removed_role_names N/A role_db_names role_api_names N/A N/A N/A LOG debug N/A New roles: %r new_role_names N/A N/A N/A LOG debug N/A Updated roles: %r updated_role_names N/A N/A N/A LOG debug N/A Removed roles: %r removed_role_names N/A role_names_to_delete N/A N/A updated_role_names union removed_role_names N/A role_dbs_to_delete N/A role_db N/A role_db role_dbs N/A N/A role_db name role_names_to_delete N/A role_names_to_create N/A N/A new_role_names union updated_role_names N/A role_apis_to_create N/A role_definition_api N/A role_definition_api role_definition_apis N/A N/A role_definition_api name role_names_to_create N/A role_ids_to_delete N/A N/A role_db role_dbs_to_delete N/A N/A N/A N/A role_ids_to_delete append N/A role_db id N/A N/A N/A LOG debug N/A Deleting %s stale roles N/A len role_ids_to_delete N/A N/A N/A N/A N/A Role query id__in role_ids_to_delete system False delete N/A N/A N/A LOG debug N/A Deleted %s stale roles N/A len role_ids_to_delete N/A permission_grant_ids_to_delete N/A N/A role_db role_dbs_to_delete N/A N/A N/A N/A permission_grant_ids_to_delete extend N/A role_db permission_grants N/A N/A N/A LOG debug N/A Deleting %s stale permission grants N/A len permission_grant_ids_to_delete N/A N/A N/A N/A N/A PermissionGrant query id__in permission_grant_ids_to_delete delete N/A N/A N/A LOG debug N/A Deleted %s stale permission grants N/A len permission_grant_ids_to_delete N/A N/A N/A LOG debug N/A Creating %s new roles N/A len role_apis_to_create N/A created_role_dbs N/A N/A role_api role_apis_to_create N/A N/A role_db N/A N/A rbac_services create_role name N/A role_api name description N/A role_api description N/A permission_grants N/A getattr role_api permission_grants N/A N/A permission_grant permission_grants N/A N/A resource_uid N/A N/A permission_grant get resource_uid None N/A resource_uid N/A N/A N/A resource_type _ N/A parse_uid resource_uid N/A N/A resource_type None N/A permission_types N/A permission_grant N/A permission_types N/A assignment_db N/A N/A rbac_services create_permission_grant role_db role_db resource_uid resource_uid resource_type resource_type permission_types permission_types N/A N/A N/A N/A role_db permission_grants append N/A str N/A assignment_db id N/A N/A N/A created_role_dbs append role_db N/A N/A N/A LOG debug N/A Created %s new roles N/A len created_role_dbs N/A N/A N/A LOG info N/A Roles synchronized (%s created, %s updated, %s removed) N/A N/A len new_role_names N/A len updated_role_names N/A len removed_role_names N/A N/A created_role_dbs role_dbs_to_delete N/A sync_users_role_assignments N/A N/A self role_assignment_apis N/A N/A N/A 
        Synchronize role assignments for all the users in the database.

        :param role_assignment_apis: Role assignments API objects for the assignments loaded
                                      from the files.
        :type role_assignment_apis: ``list`` of :class:`UserRoleAssignmentFileFormatAPI`

        :return: Dictionary with created and removed role assignments for each user.
        :rtype: ``dict``
         N/A N/A N/A LOG info Synchronizing users role assignments... N/A user_dbs N/A N/A User get_all N/A username_to_user_db_map N/A dict N/A N/A N/A user_db name user_db N/A user_db user_dbs N/A results N/A N/A role_assignment_api role_assignment_apis N/A N/A username N/A role_assignment_api username N/A user_db N/A N/A username_to_user_db_map get username None N/A N/A user_db N/A N/A user_db N/A UserDB name username N/A N/A N/A LOG debug N/A User "%s" doesn't exist in the DB, creating assignment anyway username N/A role_assignment_dbs N/A N/A rbac_services get_role_assignments_for_user user_db user_db N/A result N/A N/A self _sync_user_role_assignments user_db user_db role_assignment_dbs role_assignment_dbs role_assignment_api role_assignment_api N/A N/A results N/A username result N/A N/A N/A LOG info User role assignments synchronized N/A results N/A _sync_user_role_assignments N/A N/A self user_db role_assignment_dbs role_assignment_api N/A N/A N/A 
        Synchronize role assignments for a particular user.

        :param user_db: User to synchronize the assignments for.
        :type user_db: :class:`UserDB`

        :param role_assignment_dbs: Existing user role assignments.
        :type role_assignment_dbs: ``list`` of :class:`UserRoleAssignmentDB`

        :param role_assignment_api: Role assignment API for a particular user.
        :param role_assignment_api: :class:`UserRoleAssignmentFileFormatAPI`

        :rtype: ``tuple``
         N/A db_role_names N/A N/A role_assignment_db role N/A role_assignment_db role_assignment_dbs N/A db_role_names N/A set db_role_names N/A api_role_names N/A role_assignment_api N/A role_assignment_api roles N/A N/A api_role_names N/A set api_role_names N/A new_role_names N/A N/A api_role_names difference db_role_names N/A updated_role_names N/A N/A db_role_names intersection api_role_names N/A removed_role_names N/A db_role_names api_role_names N/A N/A N/A LOG debug N/A New assignments for user "%s": %r N/A N/A user_db name new_role_names N/A N/A N/A LOG debug N/A Updated assignments for user "%s": %r N/A N/A user_db name updated_role_names N/A N/A N/A LOG debug N/A Removed assignments for user "%s": %r N/A N/A user_db name removed_role_names N/A role_names_to_delete N/A N/A updated_role_names union removed_role_names N/A role_assignment_dbs_to_delete N/A role_assignment_db N/A role_assignment_db role_assignment_dbs N/A N/A role_assignment_db role role_names_to_delete N/A N/A N/A N/A N/A UserRoleAssignment query user N/A user_db name role__in role_names_to_delete delete N/A N/A N/A LOG debug N/A Removed %s assignments for user "%s" N/A N/A len role_assignment_dbs_to_delete N/A user_db name N/A role_names_to_create N/A N/A new_role_names union updated_role_names N/A role_dbs_to_assign N/A N/A Role query name__in role_names_to_create N/A created_role_assignment_dbs N/A N/A role_db role_dbs_to_assign N/A N/A N/A N/A role_db name N/A role_assignment_api roles N/A N/A description N/A getattr role_assignment_api description None N/A N/A description None N/A assignment_db N/A N/A rbac_services assign_role_to_user role_db role_db user_db user_db description description N/A N/A N/A created_role_assignment_dbs append assignment_db N/A N/A N/A LOG debug N/A Created %s new assignments for user "%s" N/A N/A len role_dbs_to_assign N/A user_db name N/A N/A created_role_assignment_dbs role_assignment_dbs_to_delete N/A N/A