We are currently solving the following issue within our repository. Here is the issue text:
--- BEGIN ISSUE ---
Creating an authority does not allow others with the role to issue certificates
When creating an authority currently only the creator can see the authority, anyone with the owning role should be able to see and use the certificate.

Currently even when a valid role is assigned and the user can see the authority they cannot use it because the cannot access the authorities key.


--- END ISSUE ---

Below are some code segments, each from a relevant file. One or more of these files may contain bugs.
--- BEGIN FILES ---
Path: `lemur/authorities/service.py`
Content:
```
1 """
2 .. module: lemur.authorities.service
3     :platform: Unix
4     :synopsis: This module contains all of the services level functions used to
5     administer authorities in Lemur
6     :copyright: (c) 2015 by Netflix Inc., see AUTHORS for more
7     :license: Apache, see LICENSE for more details.
8 .. moduleauthor:: Kevin Glisson <kglisson@netflix.com>
9 
10 """
11 from flask import g
12 from flask import current_app
13 
14 from lemur import database
15 from lemur.authorities.models import Authority
16 from lemur.roles import service as role_service
17 from lemur.notifications import service as notification_service
18 
19 from lemur.roles.models import Role
20 from lemur.certificates.models import Certificate
21 
22 from lemur.plugins.base import plugins
23 
24 
25 def update(authority_id, description=None, owner=None, active=None, roles=None):
26     """
27     Update a an authority with new values.
28 
29     :param authority_id:
30     :param roles: roles that are allowed to use this authority
31     :return:
32     """
33     authority = get(authority_id)
34     if roles:
35         authority = database.update_list(authority, 'roles', Role, roles)
36 
37     if active:
38         authority.active = active
39 
40     authority.description = description
41     authority.owner = owner
42     return database.update(authority)
43 
44 
45 def create(kwargs):
46     """
47     Create a new authority.
48 
49     :return:
50     """
51 
52     issuer = plugins.get(kwargs.get('pluginName'))
53 
54     kwargs['creator'] = g.current_user.email
55     cert_body, intermediate, issuer_roles = issuer.create_authority(kwargs)
56 
57     cert = Certificate(cert_body, chain=intermediate)
58     cert.owner = kwargs['ownerEmail']
59 
60     if kwargs['caType'] == 'subca':
61         cert.description = "This is the ROOT certificate for the {0} sub certificate authority the parent \
62                                 authority is {1}.".format(kwargs.get('caName'), kwargs.get('caParent'))
63     else:
64         cert.description = "This is the ROOT certificate for the {0} certificate authority.".format(
65             kwargs.get('caName')
66         )
67 
68     cert.user = g.current_user
69 
70     cert.notifications = notification_service.create_default_expiration_notifications(
71         'DEFAULT_SECURITY',
72         current_app.config.get('LEMUR_SECURITY_TEAM_EMAIL')
73     )
74 
75     # we create and attach any roles that the issuer gives us
76     role_objs = []
77     for r in issuer_roles:
78 
79         role = role_service.create(
80             r['name'],
81             password=r['password'],
82             description="{0} auto generated role".format(kwargs.get('pluginName')),
83             username=r['username'])
84 
85         # the user creating the authority should be able to administer it
86         if role.username == 'admin':
87             g.current_user.roles.append(role)
88 
89         role_objs.append(role)
90 
91     authority = Authority(
92         kwargs.get('caName'),
93         kwargs['ownerEmail'],
94         kwargs['pluginName'],
95         cert_body,
96         description=kwargs['caDescription'],
97         chain=intermediate,
98         roles=role_objs
99     )
100 
101     database.update(cert)
102     authority = database.create(authority)
103 
104     g.current_user.authorities.append(authority)
105 
106     return authority
107 
108 
109 def get_all():
110     """
111     Get all authorities that are currently in Lemur.
112 
113     :rtype : List
114     :return:
115     """
116     query = database.session_query(Authority)
117     return database.find_all(query, Authority, {}).all()
118 
119 
120 def get(authority_id):
121     """
122     Retrieves an authority given it's ID
123 
124     :param authority_id:
125     :return:
126     """
127     return database.get(Authority, authority_id)
128 
129 
130 def get_by_name(authority_name):
131     """
132     Retrieves an authority given it's name.
133 
134     :param authority_name:
135     :return:
136     """
137     return database.get(Authority, authority_name, field='name')
138 
139 
140 def get_authority_role(ca_name):
141     """
142     Attempts to get the authority role for a given ca uses current_user
143     as a basis for accomplishing that.
144 
145     :param ca_name:
146     """
147     if g.current_user.is_admin:
148         authority = get_by_name(ca_name)
149         # TODO we should pick admin ca roles for admin
150         return authority.roles[0]
151     else:
152         for role in g.current_user.roles:
153             if role.authority:
154                 if role.authority.name == ca_name:
155                     return role
156 
157 
158 def render(args):
159     """
160     Helper that helps us render the REST Api responses.
161     :param args:
162     :return:
163     """
164     query = database.session_query(Authority)
165     sort_by = args.pop('sort_by')
166     sort_dir = args.pop('sort_dir')
167     page = args.pop('page')
168     count = args.pop('count')
169     filt = args.pop('filter')
170 
171     if filt:
172         terms = filt.split(';')
173         if 'active' in filt:  # this is really weird but strcmp seems to not work here??
174             query = query.filter(Authority.active == terms[1])
175         else:
176             query = database.filter(query, Authority, terms)
177 
178     # we make sure that a user can only use an authority they either own are are a member of - admins can see all
179     if not g.current_user.is_admin:
180         authority_ids = []
181         for role in g.current_user.roles:
182             if role.authority:
183                 authority_ids.append(role.authority.id)
184         query = query.filter(Authority.id.in_(authority_ids))
185 
186     query = database.find_all(query, Authority, args)
187 
188     if sort_by and sort_dir:
189         query = database.sort(query, Authority, sort_by, sort_dir)
190 
191     return database.paginate(query, page, count)
192
```
--- END FILES ---

Please first localize the bug based on the issue statement, and then generate a patch according to the `git diff` format fenced by three backticks.

Here is an example:

```diff
diff --git a/examples/server_async.py b/examples/server_async.py
--- a/examples/server_async.py
+++ b/examples/server_async.py
@@ -313,4 +313,4 @@
 
 
 if __name__ == "__main__":
-    asyncio.run(run_async_server("."), debug=True)
+    asyncio.run(run_async_server(), debug=True)
diff --git a/examples/server_sync.py b/examples/server_sync.py
--- a/examples/server_sync.py
+++ b/examples/server_sync.py
@@ -313,5 +313,5 @@
 
 
 if __name__ == "__main__":
-    server = run_sync_server(".")
+    server = run_sync_server()
     server.shutdown()

```

diff --git a/lemur/authorities/service.py b/lemur/authorities/service.py
--- a/lemur/authorities/service.py
+++ b/lemur/authorities/service.py
@@ -101,6 +101,10 @@
     database.update(cert)
     authority = database.create(authority)
 
+    # the owning dl or role should have this authority associated with it
+    owner_role = role_service.get_by_name(kwargs['ownerEmail'])
+    owner_role.authority = authority
+
     g.current_user.authorities.append(authority)
 
     return authority

{"golden_diff": "diff --git a/lemur/authorities/service.py b/lemur/authorities/service.py\n--- a/lemur/authorities/service.py\n+++ b/lemur/authorities/service.py\n@@ -101,6 +101,10 @@\n     database.update(cert)\n     authority = database.create(authority)\n \n+    # the owning dl or role should have this authority associated with it\n+    owner_role = role_service.get_by_name(kwargs['ownerEmail'])\n+    owner_role.authority = authority\n+\n     g.current_user.authorities.append(authority)\n \n     return authority\n", "issue": "Creating an authority does not allow others with the role to issue certificates\nWhen creating an authority currently only the creator can see the authority, anyone with the owning role should be able to see and use the certificate.\n\nCurrently even when a valid role is assigned and the user can see the authority they cannot use it because the cannot access the authorities key.\n\n", "before_files": [{"content": "\"\"\"\n.. module: lemur.authorities.service\n    :platform: Unix\n    :synopsis: This module contains all of the services level functions used to\n    administer authorities in Lemur\n    :copyright: (c) 2015 by Netflix Inc., see AUTHORS for more\n    :license: Apache, see LICENSE for more details.\n.. moduleauthor:: Kevin Glisson <kglisson@netflix.com>\n\n\"\"\"\nfrom flask import g\nfrom flask import current_app\n\nfrom lemur import database\nfrom lemur.authorities.models import Authority\nfrom lemur.roles import service as role_service\nfrom lemur.notifications import service as notification_service\n\nfrom lemur.roles.models import Role\nfrom lemur.certificates.models import Certificate\n\nfrom lemur.plugins.base import plugins\n\n\ndef update(authority_id, description=None, owner=None, active=None, roles=None):\n    \"\"\"\n    Update a an authority with new values.\n\n    :param authority_id:\n    :param roles: roles that are allowed to use this authority\n    :return:\n    \"\"\"\n    authority = get(authority_id)\n    if roles:\n        authority = database.update_list(authority, 'roles', Role, roles)\n\n    if active:\n        authority.active = active\n\n    authority.description = description\n    authority.owner = owner\n    return database.update(authority)\n\n\ndef create(kwargs):\n    \"\"\"\n    Create a new authority.\n\n    :return:\n    \"\"\"\n\n    issuer = plugins.get(kwargs.get('pluginName'))\n\n    kwargs['creator'] = g.current_user.email\n    cert_body, intermediate, issuer_roles = issuer.create_authority(kwargs)\n\n    cert = Certificate(cert_body, chain=intermediate)\n    cert.owner = kwargs['ownerEmail']\n\n    if kwargs['caType'] == 'subca':\n        cert.description = \"This is the ROOT certificate for the {0} sub certificate authority the parent \\\n                                authority is {1}.\".format(kwargs.get('caName'), kwargs.get('caParent'))\n    else:\n        cert.description = \"This is the ROOT certificate for the {0} certificate authority.\".format(\n            kwargs.get('caName')\n        )\n\n    cert.user = g.current_user\n\n    cert.notifications = notification_service.create_default_expiration_notifications(\n        'DEFAULT_SECURITY',\n        current_app.config.get('LEMUR_SECURITY_TEAM_EMAIL')\n    )\n\n    # we create and attach any roles that the issuer gives us\n    role_objs = []\n    for r in issuer_roles:\n\n        role = role_service.create(\n            r['name'],\n            password=r['password'],\n            description=\"{0} auto generated role\".format(kwargs.get('pluginName')),\n            username=r['username'])\n\n        # the user creating the authority should be able to administer it\n        if role.username == 'admin':\n            g.current_user.roles.append(role)\n\n        role_objs.append(role)\n\n    authority = Authority(\n        kwargs.get('caName'),\n        kwargs['ownerEmail'],\n        kwargs['pluginName'],\n        cert_body,\n        description=kwargs['caDescription'],\n        chain=intermediate,\n        roles=role_objs\n    )\n\n    database.update(cert)\n    authority = database.create(authority)\n\n    g.current_user.authorities.append(authority)\n\n    return authority\n\n\ndef get_all():\n    \"\"\"\n    Get all authorities that are currently in Lemur.\n\n    :rtype : List\n    :return:\n    \"\"\"\n    query = database.session_query(Authority)\n    return database.find_all(query, Authority, {}).all()\n\n\ndef get(authority_id):\n    \"\"\"\n    Retrieves an authority given it's ID\n\n    :param authority_id:\n    :return:\n    \"\"\"\n    return database.get(Authority, authority_id)\n\n\ndef get_by_name(authority_name):\n    \"\"\"\n    Retrieves an authority given it's name.\n\n    :param authority_name:\n    :return:\n    \"\"\"\n    return database.get(Authority, authority_name, field='name')\n\n\ndef get_authority_role(ca_name):\n    \"\"\"\n    Attempts to get the authority role for a given ca uses current_user\n    as a basis for accomplishing that.\n\n    :param ca_name:\n    \"\"\"\n    if g.current_user.is_admin:\n        authority = get_by_name(ca_name)\n        # TODO we should pick admin ca roles for admin\n        return authority.roles[0]\n    else:\n        for role in g.current_user.roles:\n            if role.authority:\n                if role.authority.name == ca_name:\n                    return role\n\n\ndef render(args):\n    \"\"\"\n    Helper that helps us render the REST Api responses.\n    :param args:\n    :return:\n    \"\"\"\n    query = database.session_query(Authority)\n    sort_by = args.pop('sort_by')\n    sort_dir = args.pop('sort_dir')\n    page = args.pop('page')\n    count = args.pop('count')\n    filt = args.pop('filter')\n\n    if filt:\n        terms = filt.split(';')\n        if 'active' in filt:  # this is really weird but strcmp seems to not work here??\n            query = query.filter(Authority.active == terms[1])\n        else:\n            query = database.filter(query, Authority, terms)\n\n    # we make sure that a user can only use an authority they either own are are a member of - admins can see all\n    if not g.current_user.is_admin:\n        authority_ids = []\n        for role in g.current_user.roles:\n            if role.authority:\n                authority_ids.append(role.authority.id)\n        query = query.filter(Authority.id.in_(authority_ids))\n\n    query = database.find_all(query, Authority, args)\n\n    if sort_by and sort_dir:\n        query = database.sort(query, Authority, sort_by, sort_dir)\n\n    return database.paginate(query, page, count)\n", "path": "lemur/authorities/service.py"}], "after_files": [{"content": "\"\"\"\n.. module: lemur.authorities.service\n    :platform: Unix\n    :synopsis: This module contains all of the services level functions used to\n    administer authorities in Lemur\n    :copyright: (c) 2015 by Netflix Inc., see AUTHORS for more\n    :license: Apache, see LICENSE for more details.\n.. moduleauthor:: Kevin Glisson <kglisson@netflix.com>\n\n\"\"\"\nfrom flask import g\nfrom flask import current_app\n\nfrom lemur import database\nfrom lemur.authorities.models import Authority\nfrom lemur.roles import service as role_service\nfrom lemur.notifications import service as notification_service\n\nfrom lemur.roles.models import Role\nfrom lemur.certificates.models import Certificate\n\nfrom lemur.plugins.base import plugins\n\n\ndef update(authority_id, description=None, owner=None, active=None, roles=None):\n    \"\"\"\n    Update a an authority with new values.\n\n    :param authority_id:\n    :param roles: roles that are allowed to use this authority\n    :return:\n    \"\"\"\n    authority = get(authority_id)\n    if roles:\n        authority = database.update_list(authority, 'roles', Role, roles)\n\n    if active:\n        authority.active = active\n\n    authority.description = description\n    authority.owner = owner\n    return database.update(authority)\n\n\ndef create(kwargs):\n    \"\"\"\n    Create a new authority.\n\n    :return:\n    \"\"\"\n\n    issuer = plugins.get(kwargs.get('pluginName'))\n\n    kwargs['creator'] = g.current_user.email\n    cert_body, intermediate, issuer_roles = issuer.create_authority(kwargs)\n\n    cert = Certificate(cert_body, chain=intermediate)\n    cert.owner = kwargs['ownerEmail']\n\n    if kwargs['caType'] == 'subca':\n        cert.description = \"This is the ROOT certificate for the {0} sub certificate authority the parent \\\n                                authority is {1}.\".format(kwargs.get('caName'), kwargs.get('caParent'))\n    else:\n        cert.description = \"This is the ROOT certificate for the {0} certificate authority.\".format(\n            kwargs.get('caName')\n        )\n\n    cert.user = g.current_user\n\n    cert.notifications = notification_service.create_default_expiration_notifications(\n        'DEFAULT_SECURITY',\n        current_app.config.get('LEMUR_SECURITY_TEAM_EMAIL')\n    )\n\n    # we create and attach any roles that the issuer gives us\n    role_objs = []\n    for r in issuer_roles:\n\n        role = role_service.create(\n            r['name'],\n            password=r['password'],\n            description=\"{0} auto generated role\".format(kwargs.get('pluginName')),\n            username=r['username'])\n\n        # the user creating the authority should be able to administer it\n        if role.username == 'admin':\n            g.current_user.roles.append(role)\n\n        role_objs.append(role)\n\n    authority = Authority(\n        kwargs.get('caName'),\n        kwargs['ownerEmail'],\n        kwargs['pluginName'],\n        cert_body,\n        description=kwargs['caDescription'],\n        chain=intermediate,\n        roles=role_objs\n    )\n\n    database.update(cert)\n    authority = database.create(authority)\n\n    # the owning dl or role should have this authority associated with it\n    owner_role = role_service.get_by_name(kwargs['ownerEmail'])\n    owner_role.authority = authority\n\n    g.current_user.authorities.append(authority)\n\n    return authority\n\n\ndef get_all():\n    \"\"\"\n    Get all authorities that are currently in Lemur.\n\n    :rtype : List\n    :return:\n    \"\"\"\n    query = database.session_query(Authority)\n    return database.find_all(query, Authority, {}).all()\n\n\ndef get(authority_id):\n    \"\"\"\n    Retrieves an authority given it's ID\n\n    :param authority_id:\n    :return:\n    \"\"\"\n    return database.get(Authority, authority_id)\n\n\ndef get_by_name(authority_name):\n    \"\"\"\n    Retrieves an authority given it's name.\n\n    :param authority_name:\n    :return:\n    \"\"\"\n    return database.get(Authority, authority_name, field='name')\n\n\ndef get_authority_role(ca_name):\n    \"\"\"\n    Attempts to get the authority role for a given ca uses current_user\n    as a basis for accomplishing that.\n\n    :param ca_name:\n    \"\"\"\n    if g.current_user.is_admin:\n        authority = get_by_name(ca_name)\n        # TODO we should pick admin ca roles for admin\n        return authority.roles[0]\n    else:\n        for role in g.current_user.roles:\n            if role.authority:\n                if role.authority.name == ca_name:\n                    return role\n\n\ndef render(args):\n    \"\"\"\n    Helper that helps us render the REST Api responses.\n    :param args:\n    :return:\n    \"\"\"\n    query = database.session_query(Authority)\n    sort_by = args.pop('sort_by')\n    sort_dir = args.pop('sort_dir')\n    page = args.pop('page')\n    count = args.pop('count')\n    filt = args.pop('filter')\n\n    if filt:\n        terms = filt.split(';')\n        if 'active' in filt:  # this is really weird but strcmp seems to not work here??\n            query = query.filter(Authority.active == terms[1])\n        else:\n            query = database.filter(query, Authority, terms)\n\n    # we make sure that a user can only use an authority they either own are are a member of - admins can see all\n    if not g.current_user.is_admin:\n        authority_ids = []\n        for role in g.current_user.roles:\n            if role.authority:\n                authority_ids.append(role.authority.id)\n        query = query.filter(Authority.id.in_(authority_ids))\n\n    query = database.find_all(query, Authority, args)\n\n    if sort_by and sort_dir:\n        query = database.sort(query, Authority, sort_by, sort_dir)\n\n    return database.paginate(query, page, count)\n", "path": "lemur/authorities/service.py"}]}