Merge pull request #3169 from swordqiu/hotfix/qj-user-scope-convert-error

fix: string2scope ignore user scope

cmd/climc/shell/policies.go

@@ -23,6 +23,7 @@ import (
 	"time"
 
 	"yunion.io/x/jsonutils"
+	"yunion.io/x/log"
 
 	"yunion.io/x/onecloud/pkg/cloudcommon/consts"
 	"yunion.io/x/onecloud/pkg/cloudcommon/policy"
@@ -293,6 +294,10 @@ func init() {
 		Ip            string   `help:"login IP"`
 	}
 	R(&PolicyExplainOptions{}, "policy-explain", "Explain policy result", func(s *mcclient.ClientSession, args *PolicyExplainOptions) error {
+		err := log.SetLogLevelByString(log.Logger(), "debug")
+		if err != nil {
+			log.Fatalf("Set log level %q: %v", "debug", err)
+		}
 		auth.InitFromClientSession(s)
 		policy.EnableGlobalRbac(15*time.Second, 15*time.Second, false)
 		if args.Debug {

pkg/cloudcommon/policy/policy.go

@@ -289,6 +289,9 @@ func (manager *SPolicyManager) allow(scope rbacutils.TRbacScope, userCred mcclie
 		key := queryKey(scope, userCred, service, resource, action, extra...)
 		val := manager.cache.Get(key)
 		if val != nil {
+			if consts.IsRbacDebug() {
+				log.Debugf("query %s:%s:%s:%s from cache %s", service, resource, action, extra, val)
+			}
 			return val.(rbacutils.TRbacResult)
 		}
 		result := manager.allowWithoutCache(scope, userCred, service, resource, action, extra...)
@@ -410,7 +413,7 @@ func (manager *SPolicyManager) allowWithoutCache(scope rbacutils.TRbacScope, use
 	}
 
 	if consts.IsRbacDebug() {
-		log.Debugf("[RBAC: %s] %s %s %s %#v permission %s userCred: %s MatchRules: %d(%s) %s", scope, service, resource, action, extra, result, userCred, len(matchRules), jsonutils.Marshal(matchRules), jsonutils.Marshal(policies))
+		log.Debugf("[RBAC: %s] %s %s %s %#v permission %s userCred: %s MatchRules: %d(%s)", scope, service, resource, action, extra, result, userCred, len(matchRules), jsonutils.Marshal(matchRules))
 	}
 	return result
 }

pkg/util/rbacutils/rbac.go

@@ -643,6 +643,8 @@ func String2ScopeDefault(str string, defScope TRbacScope) TRbacScope {
 		return ScopeDomain
 	case string(ScopeProject):
 		return ScopeProject
+	case string(ScopeUser):
+		return ScopeUser
 	case "true":
 		return ScopeSystem
 	default: