From 14516b08584588acb2902b54e4ab92de96395240 Mon Sep 17 00:00:00 2001
From: Micah Lee <micah.lee@cyberark.com>
Date: Thu, 20 Feb 2020 16:07:19 -0500
Subject: [PATCH] Add API key enabled field

Conjur will use this field to determine whether or not the given rule should have an API key generated for it.

Some roles are not expected to use default API key authentication, but rather are expected to only use a given authenticator, such as `authn-k8s`. When this is the case, the API key becomes a backdoor to allow impersonating this role. This allows a Conjur operator to explicitly disable the API key, preventing this behavior.
---
 CHANGELOG.md                                           | 6 ++++++
 lib/conjur/policy/types/records.rb                     | 6 ++++++
 spec/round-trip/yaml/all-types-all-fields.expected.yml | 1 +
 spec/round-trip/yaml/all-types-all-fields.yml          | 1 +
 4 files changed, 14 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index cc070b2..e49d645 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,3 +1,9 @@
+# Unreleased
+
+## Added
+
+* Added `api_key_enabled` attribute to role record.
+
 # v3.0.3
 * Allow annotations to be set on a policy resource.
 
diff --git a/lib/conjur/policy/types/records.rb b/lib/conjur/policy/types/records.rb
index 281aafc..26f3fd2 100644
--- a/lib/conjur/policy/types/records.rb
+++ b/lib/conjur/policy/types/records.rb
@@ -71,6 +71,12 @@ def immutable_attribute_names
       end
       
       module ActsAsRole
+        def self.included(base)
+          base.module_eval do
+            attribute :api_key_enabled, kind: :boolean, singular: true, dsl_accessor: true
+          end
+        end
+
         def roleid default_account = nil
           [ account || default_account, role_kind, id ].join(":")
         end
diff --git a/spec/round-trip/yaml/all-types-all-fields.expected.yml b/spec/round-trip/yaml/all-types-all-fields.expected.yml
index f05855f..ff4e0f0 100644
--- a/spec/round-trip/yaml/all-types-all-fields.expected.yml
+++ b/spec/round-trip/yaml/all-types-all-fields.expected.yml
@@ -2,6 +2,7 @@
 - !role
   id: team-1
   kind: jenkins-folder
+  api_key_enabled: true
 - !resource
   id: my-secret
   kind: variable
diff --git a/spec/round-trip/yaml/all-types-all-fields.yml b/spec/round-trip/yaml/all-types-all-fields.yml
index 842f9eb..ff5b0e8 100644
--- a/spec/round-trip/yaml/all-types-all-fields.yml
+++ b/spec/round-trip/yaml/all-types-all-fields.yml
@@ -1,6 +1,7 @@
 - !role
   kind: jenkins-folder
   id: team-1
+  api_key_enabled: true
 
 - !resource
   kind: variable