.reek.yml

---
detectors:
  IrresponsibleModule:
    exclude:
    - CallSql
    - CallSql::Sequel::Model
    - String
    - Test::AuditSink
    - CucumberAuditHelper
    - DummyToken
    - PossumWorld
    - ConjurToken
    - AuthenticatorWorld
    - AuthnK8sWorld
    - FullId
    - RotatorWorld
    - RotatorWorld::Timer
    - Entity
    - Grant
    - Group
    - Permit
    - PolEncoder
    - Policy
    - User
    - Variable
    - AccountsController
    - ApplicationController
    - ApplicationController::Forbidden
    - ApplicationController::RecordExists
    - ApplicationController::RecordNotFound
    - ApplicationController::Unauthorized
    - AuthenticateController
    - Authenticates
    - AuthorizeResource
    - BasicAuthenticator
    - CurrentUser
    - FindResource
    - TokenUser
    - CredentialsController
    - HostFactoriesController
    - HostFactoryTokensController
    - PoliciesController
    - PublicKeysController
    - ResourcesController
    - RestController
    - RolesController
    - SecretsController
    - StatusController
    - Authentication::AuditLog
    - Authentication::AuthenticatorClass
    - Authentication::Authn::Authenticator
    - Authentication::AuthnIam::Authenticator
    - Authentication::AuthnK8s::AuthenticationService
    - Authentication::AuthnK8s::AuthenticationError
    - Authentication::AuthnK8s::Authenticator
    - Authentication::AuthnK8s::CSRVerificationError
    - Authentication::AuthnK8s::ClientCertExpiredError
    - Authentication::AuthnK8s::ClientCertVerificationError
    - Authentication::AuthnK8s::NotFoundError
    - Authentication::AuthnK8s::CA
    - Authentication::AuthnK8s::K8sObjectLookup
    - Authentication::AuthnK8s::K8sObjectLookup::K8sForbiddenError
    - Authentication::AuthnK8s::K8sResolver
    - Authentication::AuthnK8s::K8sResolver::DeploymentConfig
    - Authentication::AuthnK8s::K8sResolver::Pod
    - Authentication::AuthnK8s::K8sResolver::ReplicaSet
    - Authentication::AuthnK8s::K8sResolver::ServiceAccount
    - Authentication::AuthnK8s::K8sResolver::StatefulSet
    - Authentication::AuthnK8s::K8sResolver::ValidationError
    - Authentication::AuthnK8s::KubectlClient
    - Authentication::AuthnK8s::KubectlExec
    - Authentication::AuthnLdap::Authenticator
    - Authentication::AuthnLdap::Server
    - Authentication::InstalledAuthenticators
    - Authentication::MemoizedRole
    - Authentication::Security
    - Authentication::Security::AccessRequest
    - Authentication::Strategy::Input
    - Authentication::Webservice
    - Authentication::Webservices
    - Rotation::InstalledRotators
    - Rotation::MasterRotator
    - Rotation::MasterRotator::ScheduledRotation
    - Rotation::NextExpiration
    - Rotation::RotatorClass
    - Rotation::Rotators::Aws::SecretKey
    - Rotation::Rotators::Aws::SecretKey::AwsCredentials
    - Rotation::Rotators::Postgresql::Password
    - Rotation::Rotators::Postgresql::Password::Database
    - Rotation::Rotators::Postgresql::Password::DbCredentials
    - TokenFactory
    - Types
    - Util::ErrorClass
    - Util::NameAwareModule
    - Util::Submodules
    - Account
    - Audit::Event::Authn
    - Audit::Event::CanFail
    - Audit::Event::CanFail::ClassMethods
    - Audit::Event::Check
    - Audit::Event::Fetch
    - Audit::Event::Policy
    - Audit::Event::Update
    - Audit::Event
    - Audit::Subject
    - Audit::Subject::Annotation
    - Audit::Subject::Permission
    - Audit::Subject::Resource
    - Audit::Subject::Role
    - Audit::Subject::RoleMembership
    - Audit
    - Authenticate
    - AuthnLocal
    - Credentials
    - Exceptions::Forbidden
    - Exceptions::RecordExists
    - Exceptions::RecordNotFound
    - Functions
    - HasId
    - HostBuilder
    - HostFactoryToken
    - Loader::Orchestrate
    - Loader::Types
    - Loader::Types::Base
    - Loader::Types::CreateResource
    - Loader::Types::CreateRole
    - Loader::Types::Delete
    - Loader::Types::Deletion
    - Loader::Types::Deny
    - Loader::Types::Grant
    - Loader::Types::Group
    - Loader::Types::Host
    - Loader::Types::HostFactory
    - Loader::Types::Layer
    - Loader::Types::Permit
    - Loader::Types::Policy
    - Loader::Types::Record
    - Loader::Types::Resource
    - Loader::Types::Revoke
    - Loader::Types::Role
    - Loader::Types::User
    - Loader::Types::Variable
    - Loader::Types::Webservice
    - Permission
    - PolicyLog
    - Resource
    - Role
    - RoleMembership
    - Schemata::Helper
    - Possum::Application
    - FalseClass
    - TrueClass
    - Sequel::Model
    - QueryParameterActionRecognizer
    - ConjurAudit::ApplicationController
    - ConjurAudit::MessagesController
    - ConjurAudit::Message
    - ConjurAudit::Message::Filter
    - ConjurAudit::Engine
    - ConjurAudit
    - Util
    - CAHelpers
  UncommunicativeParameterName:
    exclude:
    - CallSql::Sequel::Model#call_sql
    - CallSql::Sequel::Model#select_from_function
    - PolEncoder#encode_with
    - Policy#initialize
    - ApplicationController#argument_error
    - ApplicationController#forbidden
    - ApplicationController#foreign_key_constraint_violation
    - ApplicationController#no_matching_row
    - ApplicationController#policy_invalid
    - ApplicationController#record_exists
    - ApplicationController#record_not_found
    - ApplicationController#render_record_not_found
    - ApplicationController#unauthorized
    - ApplicationController#validation_failed
    - Rotation::MasterRotator::ScheduledRotation#log_error
    - Resource#find_if_visible
    
  UncommunicativeMethodName:
    exclude:
    - String#decode64
    - String#encode64
    - Authentication::AuthnK8s::Authenticator#URI_from_asn1_seq
    - Rotation::Password#self.base58
  UncommunicativeVariableName:
    enabled: false
    exclude:
    - Delegator#init_with
    - PossumWorld#authn_local_request
    - PossumWorld#current_user_credentials
    - PossumWorld#denormalize
    - PossumWorld#rest_resource
    - AuthenticatorWorld#post
    - PossumWorld#invoke
    - authenticator
    - AuthenticateController#authenticate
    - AuthenticateController#k8s_inject_client_cert
    - CurrentUser#current_user?
    - ResourcesController#permitted_roles
    - SecretsController#batch
    - SecretsController#show
    - Authentication::AuthnIam::Authenticator#response_from_signed_request
    - Authentication::AuthnK8s::Authenticator#URI_from_asn1_seq
    - Authentication::AuthnK8s::Authenticator#cert_spiffe_id
    - Authentication::AuthnK8s::Authenticator#csr_spiffe_id
    - Authentication::AuthnK8s::Authenticator#find_container
    - Authentication::AuthnK8s::Authenticator#k8s_container_name
    - Authentication::AuthnK8s::K8sObjectLookup#find_object_by_name
    - Authentication::AuthnK8s::KubectlExec#exec
    - Authentication::MemoizedRole#self.[]
    - Authentication::Strategy#conjur_token
    - Rotation::MasterRotator::ScheduledRotation#run
    - Rotation::Rotators::Aws::SecretKey#rotate
    - Rotation::Rotators::Aws::SecretKey::AwsCredentials#credentials
    - Util::ErrorClass#self.new
    - Util::Submodules#self.of
    - Account#list
    - Credentials#random_api_key
    - HostBuilder#create
    - HostFactoryToken#format_cidr
    - HostFactoryToken#random_token
    - HostFactoryToken#valid_origin?
    - Loader::Orchestrate#update_changed
    - Loader::Types::Grant#create!
    - Loader::Types::Permit#create!
    - PolicyVersion#create_records
    - PolicyVersion#delete_records
    - Resource#annotations
    - Resource#as_json
    - Secret#current_values
  DuplicateMethodCall:
    exclude:
    - RootLoader#load
    - PossumWorld#current_user_credentials
    - PossumWorld#denormalize
    - PossumWorld#rest_resource
    - login
    - AuthnK8sWorld#pod_certificate
    - AuthnK8sWorld#substitute
    - verify_data
    - ApplicationController#foreign_key_constraint_violation
    - ApplicationController#policy_invalid
    - ApplicationController#validation_failed
    - CredentialsController#accept_id_parameter
    - CredentialsController#authorize_self_or_update
    - CredentialsController#rotate_api_key
    - CredentialsController#update_password
    - HostFactoriesController#create_host
    - HostFactoriesController#verify_token
    - PoliciesController#load_policy
    - ResourcesController#index
    - SecretsController#batch
    - SecretsController#show
    - Authentication::AuthnIam::Authenticator#iam_role_matches?
    - Authentication::AuthnIam::Authenticator#identity_hash
    - Authentication::AuthnIam::Authenticator#response_from_signed_request
    - Authentication::AuthnK8s::AuthenticationService#initialize_ca
    - Authentication::AuthnK8s::Authenticator#URI_from_asn1_seq
    - Authentication::AuthnK8s::Authenticator#authorize_host
    - Authentication::AuthnK8s::Authenticator#cert_spiffe_id
    - Authentication::AuthnK8s::Authenticator#csr_spiffe_id
    - Authentication::AuthnK8s::Authenticator#find_container
    - Authentication::AuthnK8s::Authenticator#find_pod
    - Authentication::AuthnK8s::Authenticator#find_pod_under_controller
    - Authentication::AuthnK8s::Authenticator#install_signed_cert
    - Authentication::AuthnK8s::CA#generate
    - Authentication::AuthnK8s::K8sResolver::Deployment#validate_pod
    - Authentication::AuthnK8s::K8sResolver::DeploymentConfig#validate_pod
    - Authentication::AuthnK8s::K8sResolver::Pod#validate_pod
    - Authentication::AuthnK8s::K8sResolver::ReplicaSet#validate_pod
    - Authentication::AuthnK8s::K8sResolver::ServiceAccount#validate_pod
    - Authentication::AuthnK8s::K8sResolver::StatefulSet#validate_pod
    - Authentication::AuthnK8s::KubectlExec#exec
    - Authentication::AuthnK8s::KubectlExec#exec#message_binary
    - Authentication::Security#validate_user_has_access
    - Rotation::Rotators::Aws::SecretKey#rotate
    - Account#delete
    - Annotation#as_json
    - Credentials#expired?
    - Exceptions::RecordNotFound#initialize
    - HostBuilder#find_and_rotate
    - HostFactoryToken#format_cidr
    - Loader::Orchestrate#delete_removed
    - Loader::Orchestrate#initialize
    - Loader::Orchestrate#load_records
    - Loader::Orchestrate#table_data
    - Loader::Types#create_root_policy
    - Loader::Types::Delete#delete!
    - Loader::Types::Group#create!
    - Loader::Types::User#create!
    - Loader::Types::Variable#create!
    - Resource#as_json
    - Role#api_key
    - Role#as_json
    - Role#make_full_id
    - Role#password=
    - Role#restricted_to
    - Schemata#initialize
    - Secret#current_values
    - connect
    - connect#test_select
    - CertificateAuthorityController#render_certificate
    - RestHelpers
    - CAHelpers::CertificateAuthority
    - CAHelpers::RootCA

  TooManyStatements:
    max_statements: 10
    exclude:
    - initialize
    - RootLoader#load
    - RootLoader#policy_version
    - PossumWorld#authn_local_request
    - PossumWorld#create_user
    - PossumWorld#denormalize
    - PossumWorld#lookup_user
    - PossumWorld#rest_resource
    - PossumWorld#set_result
    - PossumWorld#try_request
    - AuthenticatorWorld#post
    - gen_csr
    - AuthnK8sWorld#detect_request_ip
    - AuthnK8sWorld#pod_certificate
    - PossumWorld#invoke
    - RotatorWorld#current_value
    - RotatorWorld::PollingSession#captured_values
    - app_policy
    - load_policy_update
    - ApplicationController#foreign_key_constraint_violation
    - ApplicationController#validation_failed
    - AuthenticateController#authenticate
    - AuthenticateController#k8s_inject_client_cert
    - HostFactoriesController#create_host
    - HostFactoriesController#verify_token
    - HostFactoryTokensController#create
    - PoliciesController#load_policy
    - ResourcesController#check_permission
    - ResourcesController#index
    - RolesController#add_member
    - RolesController#delete_member
    - SecretsController#batch
    - SecretsController#create
    - SecretsController#show
    - Authentication::AuthnIam::Authenticator#iam_role_matches?
    - Authentication::AuthnIam::Authenticator#response_from_signed_request
    - Authentication::AuthnK8s::Authenticator#cert_spiffe_id
    - Authentication::AuthnK8s::Authenticator#csr_spiffe_id
    - Authentication::AuthnK8s::Authenticator#find_pod
    - Authentication::AuthnK8s::Authenticator#find_pod_under_controller
    - Authentication::AuthnK8s::Authenticator#inject_client_cert
    - Authentication::AuthnK8s::Authenticator#pod_certificate
    - Authentication::AuthnK8s::Authenticator#valid?
    - Authentication::AuthnK8s::CA#generate
    - Authentication::AuthnK8s::K8sResolver::Deployment#validate_pod
    - Authentication::AuthnK8s::K8sResolver::DeploymentConfig#validate_pod
    - Authentication::AuthnK8s::K8sResolver::ReplicaSet#validate_pod
    - Authentication::AuthnK8s::K8sResolver::StatefulSet#validate_pod
    - Authentication::AuthnK8s::KubectlClient#client
    - Authentication::AuthnK8s::KubectlExec#exec
    - Authentication::AuthnK8s::KubectlExec#exec#message_binary
    - Authentication::AuthnLdap::Authenticator#valid?
    - Authentication::AuthnLdap::Server#self.new
    - Authentication::Security#validate_user_has_access
    - Authentication::Strategy#conjur_token
    - Rotation::Rotators::Aws::SecretKey#rotate
    - Rotation::Rotators::Postgresql::Password#rotate
    - Account#create
    - Account#delete
    - Account#find_or_create_accounts_resource
    - Account#list
    - AuthnLocal#issue_token
    - AuthnLocal#run
    - HostBuilder#create
    - HostBuilder#find_and_rotate
    - Loader::Orchestrate#create_schema
    - Loader::Orchestrate#store_policy_in_db
    - Loader::Orchestrate#load_records
    - Loader::Handlers::Password#store_passwords
    - Loader::Orchestrate#table_data
    - Loader::Orchestrate#update_changed
    - Loader::Types::User#create!
    - PolicyVersion#try_load_records
    - PolicyVersion#validate
    - Resource#as_json
    - Resource#search
    - Role#make_full_id
    - Secret#current_values
    - connect
    - CA::CertificateAuthority#sign_csr
    - RestHelpers
    - CAHelpers::CertificateAuthority#sign
    - CAHelpers::RootCA#create_cert

  ControlParameter:
    exclude:
    - PossumWorld#try_request
    - Authentication::AuthnK8s::KubectlExec#exec
    - Authentication::Strategy#validate_authenticator_exists
    - Rotation::ConjurFacade#expires_at
    - Exceptions::RecordNotFound#initialize
    - MembershipSearch#result_set
    - Resource#search
    - RestHelpers#try_request
    - CAHelpers::CertificateAuthority#sign

  DataClump:
    exclude:
    - PossumWorld
    - RestHelpers

  ManualDispatch:
    exclude:
    - PossumWorld#set_result
    - Authentication::AuthenticatorClass#requires_env_arg?
    - Authentication::AuthnK8s::K8sObjectLookup#k8s_client_for_method
    - Loader::Types::Delete#delete!
    - Loader::Types::Record#create!
    - RestHelpers#set_result

  UtilityFunction:
    exclude:
    - PossumWorld#admin_user
    - PossumWorld#foreign_admin_user
    - AuthenticatorWorld#admin_password
    - AuthenticatorWorld#conjur_hostname
    - AuthenticatorWorld#full_username
    - gen_csr
    - app
    - AuthnK8sWorld#authn_k8s_host
    - AuthnK8sWorld#kubectl_client
    - AuthnK8sWorld#test_namespace
    - FullId#make_full_id
    - RotatorWorld#valid_aws_credentials?
    - RotatorWorld#valid_credentials?
    - app_policy
    - tag
    - webservice
    - input
    - expectation_path
    - policy_path
    - db
    - ApplicationController#error_code_of_exception_class
    - ApplicationController#run_with_transaction
    - AuthenticateController#configured_authenticators
    - AuthenticateController#enabled_authenticators
    - TokenUser#token_user
    - TokenUser#token_user?
    - RolesController#count_payload
    - RolesController#filtered_roles
    - Authentication::AuthnIam::Authenticator#iam_role_matches?
    - Authentication::AuthnIam::Authenticator#identity_hash
    - Authentication::AuthnK8s::AuthenticationService#conjur_account
    - Authentication::AuthnK8s::AuthenticationService#master_host
    - Authentication::AuthnK8s::Authenticator#get_subject_hash
    - Authentication::AuthnK8s::K8sObjectLookup#kubectl_client
    - Authentication::AuthnK8s::KubectlExec#generate_file_tar_string
    - Authentication::AuthnLdap::Authenticator#blacklisted_ldap_user?
    - Authentication::Security#default_conjur_authn?
    - Rotation::NextExpiration#time_from_now
    - Account#slosilo_keystore
    - Loader::Orchestrate#db
    - Loader::Orchestrate#delete_removed#comparisons
    - Schemata#db
    - secrets_version_limit
    - Sequel::Model#write_id_to_json
    - conjur_api
    - RestHelpers
    - CAHelpers
    - PoliciesController#create_roles
    - PoliciesController#actor_roles

  LongParameterList:
    exclude:
    - AuthenticatorWorld#authenticate_with_ldap
    - login
    - RotatorWorld#postgres_password_history
    - input
    - Authentication::AuditLog#self.record_authn_event
    - Authentication::AuthnLdap::Server#self.new
    - Loader::Orchestrate#delete_removed#comparisons
    - Resource#search
  FeatureEnvy:
    exclude:
    - AuthnK8sWorld#pod_certificate
    - RotatorWorld::PollingSession#updated_history
    - ApplicationController#foreign_key_constraint_violation
    - ApplicationController#no_matching_row
    - ApplicationController#policy_invalid
    - ApplicationController#record_exists
    - ApplicationController#render_record_not_found
    - ApplicationController#validation_failed
    - PoliciesController#load_policy
    - Authentication::Authn::Authenticator#valid?
    - Authentication::AuthnK8s::Authenticator#URI_from_asn1_seq
    - Authentication::AuthnLdap::Authenticator#initialize
    - Authentication::Strategy#audit_failure
    - Authentication::Strategy#audit_success
    - Authentication::Strategy#new_token
    - Authentication::Strategy#validate_origin
    - Rotation::Rotators::Aws::SecretKey#rotate
    - HostBuilder#find_and_rotate
    - Loader::Handlers::Password#store_passwords
    - CA::CertificateAuthority#sign_csr
    - MembershipSearch#result_set
    - Resource#permit
    - Resource#search
    - Role#grant_to
    - Secret#as_json
    - CAHelpers::CertificateAuthority#sign_ca
    - CAHelpers::CertificateHost#csr
    - CAHelpers::RootCA#create_cert

  NilCheck:
    exclude:
    - AuthnK8sWorld#pod_certificate
    - RotatorWorld#current_value
    - RotatorWorld::PollingSession#stop?
    - SecretsController#batch
    - SecretsController#show
    - Authentication::AuthnK8s::Authenticator#find_container
    - Authentication::AuthnK8s::Authenticator#host_lookup
    - Authentication::AuthnK8s::Authenticator#service_lookup
    - Account#create
    - Authenticate#self?
    - Util::CIDR#mask
    - Schemata#initialize
  NestedIterators:
    exclude:
    - ApplicationController#validation_failed
    - Authentication::AuthnK8s::Authenticator#csr_spiffe_id
    - Authentication::AuthnK8s::KubectlExec#generate_file_tar_string
    - Loader::Orchestrate#delete_removed
    - Loader::Orchestrate#eliminate_shadowed
    - Loader::Orchestrate#update_changed
    - Loader::Types::Grant#create!
    - Loader::Types::Permit#create!
  InstanceVariableAssumption:
    exclude:
    - CredentialsController
    - HostFactoriesController
    - HostFactoryTokensController
    - PoliciesController
    - ResourcesController
    - RolesController
    - SecretsController
    - Authentication::AuthnK8s::Authenticator
    - Authentication::AuthnK8s::KubectlExec
    - Rotation::Rotators::Aws::SecretKey::AwsCredentials
    - Credentials
    - Loader::Orchestrate
    - PolicyVersion
    - Secret
  TooManyMethods:
    exclude:
    - RolesController
    - Authentication::AuthnK8s::Authenticator
    - Loader::Orchestrate
    - Role
  MissingSafeMethod:
    exclude:
    - Authentication::AuthenticatorClass::Validation
    - Rotation::MasterRotator::ScheduledRotation
    - Rotation::RotatorClass::Validation
    - Loader::Types::Delete
    - Loader::Types::Deny
    - Loader::Types::Grant
    - Loader::Types::Group
    - Loader::Types::HostFactory
    - Loader::Types::Permit
    - Loader::Types::Policy
    - Loader::Types::Record
    - Loader::Types::Revoke
    - Loader::Types::User
    - Loader::Types::Host
    - Loader::Types::Variable
  RepeatedConditional:
    exclude:
    - Authentication::AuthnK8s::Authenticator
  TooManyInstanceVariables:
    exclude:
    - Authentication::AuthnK8s::Authenticator
    - Authentication::AuthnK8s::KubectlExec
    - Loader::Orchestrate
  BooleanParameter:
    exclude:
    - Authentication::AuthnK8s::KubectlExec#exec
    - CAHelpers::CertificateAuthority#sign
  UnusedParameters:
    exclude:
    - Rotation::MasterRotator::ScheduledRotation#log_error
  Attribute:
    exclude:
    - Audit#logger
    - Authenticate#authenticated_role
    - Authenticate#basic_user
    - Authenticate#selected_role
    - PolicyVersion#delete_permitted
    - PolicyVersion#parse_error
    - PolicyVersion#perform_automatic_deletion
    - PolicyVersion#policy_filename
    - PolicyVersion#update_permitted