fix: initialize system project quota

pkg/cloudcommon/db/quotas/models.go

@@ -89,7 +89,7 @@ func (manager *SQuotaBaseManager) getQuotaInternal(ctx context.Context, scope rb
 	if err != nil && err != sql.ErrNoRows {
 		return err
 	} else if err == sql.ErrNoRows && manager.autoCreate {
-		quota.FetchSystemQuota(scope)
+		quota.FetchSystemQuota(scope, ownerId)
 		return manager.setQuotaInternal(ctx, nil, scope, ownerId, platform, quota)
 	}
 	return nil
@@ -201,7 +201,7 @@ func (manager *SQuotaBaseManager) InitializeData() error {
 			continue
 		}
 		if quota.IsEmpty() {
-			quota.FetchSystemQuota(scope)
+			quota.FetchSystemQuota(scope, ownerId)
 		}
 		baseQuota := SQuotaBase{}
 		baseQuota.DomainId = ownerId.GetProjectDomainId()

pkg/cloudcommon/db/quotas/quotas.go

@@ -32,7 +32,7 @@ const (
 )
 
 type IQuota interface {
-	FetchSystemQuota(scope rbacutils.TRbacScope)
+	FetchSystemQuota(scope rbacutils.TRbacScope, ownerId mcclient.IIdentityProvider)
 	FetchUsage(ctx context.Context, scope rbacutils.TRbacScope, ownerId mcclient.IIdentityProvider, platform []string) error
 	Update(quota IQuota)
 	Add(quota IQuota)

pkg/compute/models/quotas.go

@@ -19,11 +19,11 @@ import (
 	"fmt"
 
 	"yunion.io/x/jsonutils"
-	// "yunion.io/x/log"
 	"yunion.io/x/pkg/tristate"
 	"yunion.io/x/pkg/util/sets"
 
 	api "yunion.io/x/onecloud/pkg/apis/compute"
+	identityapi "yunion.io/x/onecloud/pkg/apis/identity"
 	"yunion.io/x/onecloud/pkg/cloudcommon/db/quotas"
 	"yunion.io/x/onecloud/pkg/compute/options"
 	"yunion.io/x/onecloud/pkg/mcclient"
@@ -68,10 +68,12 @@ type SQuota struct {
 	Snapshot       int
 }
 
-func (self *SQuota) FetchSystemQuota(scope rbacutils.TRbacScope) {
+func (self *SQuota) FetchSystemQuota(scope rbacutils.TRbacScope, ownerId mcclient.IIdentityProvider) {
 	base := 0
 	if scope == rbacutils.ScopeDomain {
 		base = 10
+	} else if ownerId.GetProjectDomainId() == identityapi.DEFAULT_DOMAIN_ID && ownerId.GetProjectName() == identityapi.SystemAdminProject {
+		base = 1
 	}
 	self.Cpu = options.Options.DefaultCpuQuota * base
 	self.Memory = options.Options.DefaultMemoryQuota * base

pkg/image/models/quotas.go

@@ -20,6 +20,7 @@ import (
 	"yunion.io/x/jsonutils"
 	"yunion.io/x/pkg/tristate"
 
+	identityapi "yunion.io/x/onecloud/pkg/apis/identity"
 	"yunion.io/x/onecloud/pkg/cloudcommon/db/quotas"
 	"yunion.io/x/onecloud/pkg/image/options"
 	"yunion.io/x/onecloud/pkg/mcclient"
@@ -51,10 +52,12 @@ type SQuota struct {
 	Image int
 }
 
-func (self *SQuota) FetchSystemQuota(scope rbacutils.TRbacScope) {
+func (self *SQuota) FetchSystemQuota(scope rbacutils.TRbacScope, ownerId mcclient.IIdentityProvider) {
 	base := 0
 	if scope == rbacutils.ScopeDomain {
 		base = 10
+	} else if ownerId.GetProjectDomainId() == identityapi.DEFAULT_DOMAIN_ID && ownerId.GetProjectName() == identityapi.SystemAdminProject {
+		base = 1
 	}
 	self.Image = options.Options.DefaultImageQuota * base
 }

pkg/keystone/models/endpoints.go

@@ -15,6 +15,7 @@
 package models
 
 import (
+	"context"
 	"database/sql"
 	"fmt"
 
@@ -22,7 +23,6 @@ import (
 	"yunion.io/x/pkg/tristate"
 	"yunion.io/x/sqlchemy"
 
-	"context"
 	api "yunion.io/x/onecloud/pkg/apis/identity"
 	"yunion.io/x/onecloud/pkg/cloudcommon/db"
 	"yunion.io/x/onecloud/pkg/httperrors"

pkg/keystone/models/policies.go

@@ -181,3 +181,10 @@ func (policy *SPolicy) PerformPrivate(ctx context.Context, userCred mcclient.Tok
 	}
 	return res, err
 }
+
+func (policy *SPolicy) ValidateDeleteCondition(ctx context.Context) error {
+	if policy.IsPublic {
+		return httperrors.NewInvalidStatusError("cannot delete shared policy")
+	}
+	return policy.SEnabledIdentityBaseResource.ValidateDeleteCondition(ctx)
+}

pkg/keystone/models/regions.go

@@ -15,9 +15,10 @@
 package models
 
 import (
+	"context"
+
 	"yunion.io/x/jsonutils"
 
-	"context"
 	"yunion.io/x/onecloud/pkg/cloudcommon/db"
 	"yunion.io/x/onecloud/pkg/httperrors"
 	"yunion.io/x/onecloud/pkg/mcclient"

pkg/keystone/models/roles.go

@@ -187,6 +187,9 @@ func (role *SRole) ValidateDeleteCondition(ctx context.Context) error {
 	if grpCnt > 0 {
 		return httperrors.NewNotEmptyError("role is being assigned to group")
 	}
+	if role.IsPublic {
+		return httperrors.NewInvalidStatusError("cannot delete shared role")
+	}
 	if role.IsSystemRole() {
 		return httperrors.NewForbiddenError("cannot delete system role")
 	}

pkg/keystone/models/services.go

@@ -15,13 +15,14 @@
 package models
 
 import (
-	"yunion.io/x/jsonutils"
-
 	"context"
+
+	"yunion.io/x/jsonutils"
+	"yunion.io/x/pkg/tristate"
+
 	"yunion.io/x/onecloud/pkg/cloudcommon/db"
 	"yunion.io/x/onecloud/pkg/httperrors"
 	"yunion.io/x/onecloud/pkg/mcclient"
-	"yunion.io/x/pkg/tristate"
 )
 
 type SServiceManager struct {

pkg/keystone/models/users.go

@@ -531,6 +531,9 @@ func (user *SUser) UpdateInContext(ctx context.Context, userCred mcclient.TokenC
 	if user.DomainId != group.DomainId {
 		return nil, httperrors.NewInputParameterError("cannot join user and group in differnt domain")
 	}
+	if group.IsReadOnly() {
+		return nil, httperrors.NewForbiddenError("cannot join read-only group")
+	}
 	return nil, UsergroupManager.add(ctx, userCred, user, group)
 }
 
@@ -542,6 +545,9 @@ func (user *SUser) DeleteInContext(ctx context.Context, userCred mcclient.TokenC
 	if !ok {
 		return nil, httperrors.NewInputParameterError("not supported update context %s", ctxObjs[0].Keyword())
 	}
+	if group.IsReadOnly() {
+		return nil, httperrors.NewForbiddenError("cannot leave read-only group")
+	}
 	return nil, UsergroupManager.remove(ctx, userCred, user, group)
 }