fix: validate policy role delete condition (#23816)

Co-authored-by: Qiu Jian <qiujian@yunionyun.com>

pkg/keystone/models/policies.go

@@ -592,6 +592,13 @@ func (policy *SPolicy) ValidateDeleteCondition(ctx context.Context, info jsonuti
 	// if policy.IsShared() {
 	// 	return httperrors.NewInvalidStatusError("cannot delete shared policy")
 	// }
+	rps, err := RolePolicyManager.fetchByPolicyId(policy.Id)
+	if err != nil {
+		return errors.Wrap(err, "FetchByPolicyId")
+	}
+	if len(rps) > 0 {
+		return httperrors.NewNotEmptyError("policy is in associated with %d roles", len(rps))
+	}
 	if policy.IsSystem.IsTrue() {
 		return httperrors.NewForbiddenError("cannot delete system policy")
 	}

pkg/keystone/models/rolepolicies.go

@@ -540,6 +540,10 @@ func (manager *SRolePolicyManager) GetPolicyGroupByIds(policyIds []string, nameO
 			return nil, nil, errors.Wrapf(err, "FetchPolicy %s", id)
 		}
 		policy := policyObj.(*SPolicy)
+		if policy.Enabled.IsFalse() {
+			// skip disabled policy
+			continue
+		}
 		if scopeName, ok := names[policy.Scope]; !ok {
 			names[policy.Scope] = []string{policy.Name}
 		} else {

pkg/keystone/models/roles.go

@@ -211,6 +211,13 @@ func (role *SRole) ValidateDeleteCondition(ctx context.Context, info jsonutils.J
 	if grpCnt > 0 {
 		return httperrors.NewNotEmptyError("role is being assigned to group")
 	}
+	rps, err := RolePolicyManager.fetchByRoleId(role.Id)
+	if err != nil {
+		return errors.Wrap(err, "FetchByRoleId")
+	}
+	if len(rps) > 0 {
+		return httperrors.NewNotEmptyError("role is in associated with %d policies", len(rps))
+	}
 	return role.SIdentityBaseResource.ValidateDeleteCondition(ctx, nil)
 }