Function get_key

st2common/st2common/util/keyvalue.py:82–125

Retrieve key from KVP store

(key=None, user_db=None, scope=None, decrypt=False)

def get_key(key=None, user_db=None, scope=None, decrypt=False):
    """
    Retrieve key from KVP store
    """
    if not isinstance(key, six.string_types):
        raise TypeError("Given key is not typeof string.")

    if not isinstance(decrypt, bool):
        raise TypeError("Decrypt parameter is not typeof bool.")

    if not user_db:
        # Use system user
        user_db = UserDB(name=cfg.CONF.system_user.user)

    scope, key_id = _derive_scope_and_key(key=key, user=user_db.name, scope=scope)
    scope = get_datastore_full_scope(scope)

    LOG.debug(
        "get_key key_id: %s, scope: %s, user: %s, decrypt: %s"
        % (key_id, scope, str(user_db.name), decrypt)
    )

    _validate_scope(scope=scope)

    # Get the key value pair by scope and name.
    kvp = KeyValuePair.get_by_scope_and_name(scope, key_id)

    # Check that user has permission to the key value pair.
    # If RBAC is enabled, this check will verify if user has system role with all access.
    # If RBAC is enabled, this check guards against a user accessing another user's kvp.
    # If RBAC is enabled, user needs to be explicitly granted permission to view a system kvp.
    # The check is sufficient to allow decryption of the system kvp.
    rbac_utils = get_rbac_backend().get_utils_class()
    rbac_utils.assert_user_has_resource_db_permission(
        user_db=user_db,
        resource_db=kvp,
        permission_type=PermissionType.KEY_VALUE_PAIR_VIEW,
    )

    # Decrypt in deserialize_key_value cannot handle NoneType.
    if kvp.value is None:
        return kvp.value

    return deserialize_key_value(kvp.value, decrypt)