From cfae818d04d5436dd01abc83d1577cc751dd07eb Mon Sep 17 00:00:00 2001 From: rainzm Date: Mon, 28 Dec 2020 16:25:52 +0800 Subject: [PATCH 1/2] fix(notify): inject domain info in ReceiverManager.FetchOwnerId --- pkg/notify/models/receiver.go | 2 ++ 1 file changed, 2 insertions(+) diff --git a/pkg/notify/models/receiver.go b/pkg/notify/models/receiver.go index ad5dd169ab..821b65f64f 100644 --- a/pkg/notify/models/receiver.go +++ b/pkg/notify/models/receiver.go @@ -533,6 +533,8 @@ func (rm *SReceiverManager) FetchOwnerId(ctx context.Context, data jsonutils.JSO return nil, errors.Wrap(err, "UserCacheManager.FetchUserByIdOrName") } ownerId := db.SOwnerId{ + DomainId: u.DomainId, + Domain: u.Domain, UserDomain: u.Domain, UserDomainId: u.DomainId, UserId: u.Id, From cc11aed9e8a382c224a8263709a6c4ba0b4abd68 Mon Sep 17 00:00:00 2001 From: rainzm Date: Mon, 28 Dec 2020 16:26:09 +0800 Subject: [PATCH 2/2] feat(db): progressive inspection when determining the required scope --- pkg/cloudcommon/db/rbac.go | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/pkg/cloudcommon/db/rbac.go b/pkg/cloudcommon/db/rbac.go index 51f7f839a4..3762d6e707 100644 --- a/pkg/cloudcommon/db/rbac.go +++ b/pkg/cloudcommon/db/rbac.go @@ -51,6 +51,8 @@ func isObjectRbacAllowed(model IModel, userCred mcclient.TokenCredential, action case rbacutils.ScopeUser: if ownerId != nil && objOwnerId != nil && (ownerId.GetUserId() == objOwnerId.GetUserId() || objOwnerId.GetUserId() == "" || (model.IsSharable(ownerId) && action == policy.PolicyActionGet)) { requireScope = rbacutils.ScopeUser + } else if ownerId != nil && objOwnerId != nil && ownerId.GetProjectDomainId() == objOwnerId.GetProjectDomainId() { + requireScope = rbacutils.ScopeDomain } else { requireScope = rbacutils.ScopeSystem } @@ -103,6 +105,8 @@ func isClassRbacAllowed(manager IModelManager, userCred mcclient.TokenCredential case rbacutils.ScopeUser: if ownerId != nil && ownerId.GetUserId() == objOwnerId.GetUserId() { requireScope = rbacutils.ScopeUser + } else if ownerId != nil && ownerId.GetProjectDomainId() == objOwnerId.GetProjectDomainId() { + requireScope = rbacutils.ScopeDomain } else { requireScope = rbacutils.ScopeSystem }