From b2da576a165891628d1f9c1c135a0aaed7e94882 Mon Sep 17 00:00:00 2001 From: Mohid Sheraz Date: Mon, 6 Jul 2026 19:08:27 +0530 Subject: [PATCH] fix: Pass resolved token to OPA policy checks Signed-off-by: Mohid Sheraz --- crates/keystone/src/api/v3/auth/token/delete.rs | 5 ++++- crates/keystone/src/api/v3/auth/token/show.rs | 8 ++++---- 2 files changed, 8 insertions(+), 5 deletions(-) diff --git a/crates/keystone/src/api/v3/auth/token/delete.rs b/crates/keystone/src/api/v3/auth/token/delete.rs index b56bee13f..df6c6d268 100644 --- a/crates/keystone/src/api/v3/auth/token/delete.rs +++ b/crates/keystone/src/api/v3/auth/token/delete.rs @@ -21,6 +21,7 @@ use axum::{ use serde_json::{Value, json, to_value}; use tracing::error; +use openstack_keystone_api_types::v3::auth::token::TokenBuilder; use openstack_keystone_core::auth::ExecutionContext; use crate::api::{auth::Auth, error::KeystoneApiError}; @@ -76,13 +77,15 @@ pub(super) async fn delete( identifier: String::new(), })?; + let token = TokenBuilder::try_from(&vsc)?.build()?; + state .policy_enforcer .enforce( "identity/auth/token/revoke", &user_auth, Value::Null, - Some(to_value(json!({"token": &vsc.token()?}))?), + Some(to_value(json!({"token": &token}))?), ) .await?; diff --git a/crates/keystone/src/api/v3/auth/token/show.rs b/crates/keystone/src/api/v3/auth/token/show.rs index 58870998b..09d0ececc 100644 --- a/crates/keystone/src/api/v3/auth/token/show.rs +++ b/crates/keystone/src/api/v3/auth/token/show.rs @@ -93,19 +93,19 @@ pub(super) async fn show( identifier: String::new(), })?; + let token = TokenBuilder::try_from(&vsc)?.build()?; + state .policy_enforcer .enforce( "identity/auth/token/show", &user_auth, Value::Null, - Some(to_value(json!({"token": &vsc.token()?}))?), + Some(to_value(json!({"token": &token}))?), ) .await?; - let mut response_token = TokenResponse { - token: TokenBuilder::try_from(&vsc)?.build()?, - }; + let mut response_token = TokenResponse { token }; if !query.nocatalog.is_some_and(|x| x) { let catalog: Catalog = Catalog(