Feature/expose app credential by konac-hamza · Pull Request #948 · openstack-experimental/keystone

konac-hamza · 2026-07-07T22:48:20Z

This PR implements the Application Credential API (part of #782).

Changes

Added API type definitions for application_credential and access_rule, along with their converters in the api-types crate.
Followed the Python Keystone implementation to preserve compatibility and prevent known security issues in the endpoints.
Implemented the delete operation in both the core and SQL layers.
Implemented policy enforcement based on the default Keystone policies.

Signed-off-by: Hamza Konac <hamza.konac@tubitak.gov.tr>

+// SPDX-License-Identifier: Apache-2.0
+
+pub mod access_rule;
+pub mod application_credential;


Signed-off-by: Hamza Konac <hamza.konac@tubitak.gov.tr>

gtema

thanks, look good, but there are issues that need to be addressed

gtema · 2026-07-08T10:52:41Z

+    state
+        .provider
+        .get_identity_provider()
+        .get_user(&ExecutionContext::from_auth(&state, &user_auth), &user_id)


you should only create ExecutionContext once. You recreate it few times in every handler

I will define it at begin of the handler and reuse it in the handler if I need to use it.

gtema · 2026-07-08T10:57:10Z

please add docstring to all fields in structures

okey I will add by the help of AI

gtema · 2026-07-08T10:57:20Z

please add docstring to all fields in structures

gtema · 2026-07-08T10:58:06Z

+    pub roles: Vec<RoleRef>,
+
+    /// Only present in create response. Never returned again.
+    pub secret: String,


make this SecretString

gtema · 2026-07-08T10:59:16Z

+
+    pub unrestricted: bool,
+
+    #[cfg_attr(feature = "validate", validate(length(min = 1, max = 64)))]


python keystone does not expose user_id for the application credential, since they are always already bound to the URL. Drop it in all structs

gtema · 2026-07-08T11:31:20Z

+default allow := false
+
+allow if {
+    input.credentials.user_id == input.target.user_id


it would be input.target.application_credential.user_id

gtema · 2026-07-08T11:31:46Z

+
+allow if { input.credentials.is_admin }
+
+allow if { input.credentials.user_id == input.target.user_id }


it's going to be input.target.existing.user_id

gtema · 2026-07-08T11:36:27Z

+    input.credentials.system == "all"
+}
+
+allow if { input.credentials.user_id == input.target.user_id }


target.application_credential.user_id or target.user_id, but depends on how you set pass it from handler. Anyway - please look at the current policies which document the structure of the data - add it to all policies

gtema · 2026-07-08T11:36:54Z

+    input.credentials.system == "all"
+}
+
+allow if { input.credentials.user_id == input.target.user_id }


also here user_id is wrapped under the input.existing.application_credential.user_id

gtema · 2026-07-08T11:38:48Z

+pub async fn get_project_scoped_client() -> Result<Arc<AsyncOpenStack>> {
+    let mut tc = AsyncOpenStack::new(&CloudConfig::from_env()?).await?;
+
+    tc.authorize(


this should not be necessary - the 'tc' already should be project scoped as directed by the env vars.

konac-hamza · 2026-07-08T20:42:07Z

thanks, look good, but there are issues that need to be addressed

Thanks for your review. I'm going to address all issues.

konac-hamza added 3 commits July 7, 2026 22:38

feat: Add api types of App Cred

b88cd31

Signed-off-by: Hamza Konac <hamza.konac@tubitak.gov.tr>

feat: Complete api layer implementtaions

2a37714

Signed-off-by: Hamza Konac <hamza.konac@tubitak.gov.tr>

feat: Implement app cred APIs

b72efcc

Signed-off-by: Hamza Konac <hamza.konac@tubitak.gov.tr>

github-advanced-security AI found potential problems Jul 7, 2026

View reviewed changes

Comment thread crates/api-types/src/v3/application_credential.rs

// SPDX-License-Identifier: Apache-2.0

pub mod access_rule;

pub mod application_credential;

fix: Fix the unit test

2cb70cc

Signed-off-by: Hamza Konac <hamza.konac@tubitak.gov.tr>

gtema requested changes Jul 8, 2026

View reviewed changes


		pub unrestricted: bool,

		#[cfg_attr(feature = "validate", validate(length(min = 1, max = 64)))]


		allow if { input.credentials.is_admin }

		allow if { input.credentials.user_id == input.target.user_id } No newline at end of file

Uh oh!

Conversation

konac-hamza commented Jul 7, 2026

Changes

Uh oh!

gtema left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

konac-hamza commented Jul 8, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants