From 0ed39ff2c9ff39c71c76e26241bc86f4df3c5166 Mon Sep 17 00:00:00 2001
From: Qiu Jian <qiujian@yunionyun.com>
Date: Wed, 14 Nov 2018 22:30:17 +0800
Subject: [PATCH] =?UTF-8?q?=E4=BF=AE=E6=AD=A3=EF=BC=9A=E6=99=AE=E9=80=9A?=
 =?UTF-8?q?=E7=94=A8=E6=88=B7=E6=97=A0=E6=B3=95=E8=AE=BF=E9=97=AEadmin?=
 =?UTF-8?q?=E6=9D=83=E9=99=90=E7=9A=84=E8=B5=84=E6=BA=90?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 pkg/cloudcommon/db/rbac.go       | 28 ++++++++++++++--------------
 pkg/cloudcommon/policy/policy.go |  8 +++-----
 pkg/compute/usages/handler.go    | 20 ++++++++++++++------
 3 files changed, 31 insertions(+), 25 deletions(-)

diff --git a/pkg/cloudcommon/db/rbac.go b/pkg/cloudcommon/db/rbac.go
index 91ae46f031..15798c9536 100644
--- a/pkg/cloudcommon/db/rbac.go
+++ b/pkg/cloudcommon/db/rbac.go
@@ -54,14 +54,14 @@ func isClassActionRbacAllowed(manager IModelManager, userCred mcclient.TokenCred
 	} else {
 		requireAdmin = true
 	}
-	if !requireAdmin {
-		result := policy.PolicyManager.Allow(false, userCred, consts.GetServiceType(),
-			manager.KeywordPlural(), action, extra...)
-		if result == rbacutils.Allow || result == rbacutils.OwnerAllow {
-			return true
-		}
+	// if !requireAdmin {
+	result := policy.PolicyManager.Allow(false, userCred, consts.GetServiceType(),
+		manager.KeywordPlural(), action, extra...)
+	if result == rbacutils.Allow || (!requireAdmin && result == rbacutils.OwnerAllow) {
+		return true
 	}
-	result := policy.PolicyManager.Allow(true, userCred, consts.GetServiceType(),
+	// }
+	result = policy.PolicyManager.Allow(true, userCred, consts.GetServiceType(),
 		manager.KeywordPlural(), action, extra...)
 	return result == rbacutils.Allow
 }
@@ -85,14 +85,14 @@ func isObjectRbacAllowed(manager IModelManager, model IModel, userCred mcclient.
 		requireAdmin = true
 	}
 
-	if !requireAdmin {
-		result := policy.PolicyManager.Allow(false, userCred, consts.GetServiceType(),
-			manager.KeywordPlural(), action, extra...)
-		if result == rbacutils.Allow || (result == rbacutils.OwnerAllow && isOwner) {
-			return true
-		}
+	//if !requireAdmin {
+	result := policy.PolicyManager.Allow(false, userCred, consts.GetServiceType(),
+		manager.KeywordPlural(), action, extra...)
+	if result == rbacutils.Allow || (!requireAdmin && result == rbacutils.OwnerAllow && isOwner) {
+		return true
 	}
-	result := policy.PolicyManager.Allow(true, userCred, consts.GetServiceType(),
+	//}
+	result = policy.PolicyManager.Allow(true, userCred, consts.GetServiceType(),
 		manager.KeywordPlural(), action, extra...)
 	return result == rbacutils.Allow
 }
diff --git a/pkg/cloudcommon/policy/policy.go b/pkg/cloudcommon/policy/policy.go
index dd426e42b5..623b2a7ee0 100644
--- a/pkg/cloudcommon/policy/policy.go
+++ b/pkg/cloudcommon/policy/policy.go
@@ -52,12 +52,12 @@ func parseJsonPolicy(obj jsonutils.JSONObject) (string, rbacutils.SRbacPolicy, e
 		return "", policy, err
 	}
 
-	blobStr, err := obj.GetString("blob")
+	blobStr, err := obj.GetString("policy")
 	if err != nil {
 		log.Errorf("get blob error %s", err)
 		return "", policy, err
 	}
-	blob, err := jsonutils.ParseString(blobStr)
+	blob, err := jsonutils.ParseYAML(blobStr)
 	if err != nil {
 		log.Errorf("parse blob json error %s", err)
 		return "", policy, err
@@ -77,14 +77,12 @@ func fetchPolicies() (map[string]rbacutils.SRbacPolicy, map[string]rbacutils.SRb
 	policies := make(map[string]rbacutils.SRbacPolicy)
 	adminPolicies := make(map[string]rbacutils.SRbacPolicy)
 
-	modules.Policies.SetEnableFilter(false)
-
 	offset := 0
 	for {
 		params := jsonutils.NewDict()
 		params.Add(jsonutils.NewInt(2048), "limit")
 		params.Add(jsonutils.NewInt(int64(offset)), "offset")
-		result, err := modules.Policies.ResourceManager.List(s, params)
+		result, err := modules.Policies.List(s, params)
 
 		if err != nil {
 			log.Errorf("fetch policy failed")
diff --git a/pkg/compute/usages/handler.go b/pkg/compute/usages/handler.go
index ae74134055..c8b5797364 100644
--- a/pkg/compute/usages/handler.go
+++ b/pkg/compute/usages/handler.go
@@ -286,19 +286,27 @@ func ReportGeneralUsage(userCred mcclient.TokenCredential, rangeObj db.IStandalo
 		}
 	}
 
+	includeCommon := false
 	if consts.IsRbacEnabled() {
 		if policy.PolicyManager.Allow(false, userCred, consts.GetServiceType(),
 			"usages", policy.PolicyActionGet) == rbacutils.Deny {
-			err = httperrors.NewForbiddenError("not allow to get usages")
-			return
+			if !isAdmin {
+				err = httperrors.NewForbiddenError("not allow to get usages")
+				return
+			}
+		} else {
+			includeCommon = true
 		}
 	}
 
-	commonUsage, err := getCommonGeneralUsage(userCred, rangeObj, hostTypes)
-	if err != nil {
-		return
+	if includeCommon {
+		var commonUsage map[string]interface{}
+		commonUsage, err = getCommonGeneralUsage(userCred, rangeObj, hostTypes)
+		if err != nil {
+			return
+		}
+		count.Include(commonUsage)
 	}
-	count.Include(commonUsage)
 	return
 }