From 2c5a749bee13e70ea81e544fa19345cd4c8b524c Mon Sep 17 00:00:00 2001 From: Qiu Jian Date: Wed, 26 Jun 2019 00:43:49 +0800 Subject: [PATCH] fix: initialize system project quota --- pkg/cloudcommon/db/quotas/models.go | 4 ++-- pkg/cloudcommon/db/quotas/quotas.go | 2 +- pkg/compute/models/quotas.go | 6 ++++-- pkg/image/models/quotas.go | 5 ++++- pkg/keystone/models/endpoints.go | 2 +- pkg/keystone/models/policies.go | 7 +++++++ pkg/keystone/models/regions.go | 3 ++- pkg/keystone/models/roles.go | 3 +++ pkg/keystone/models/services.go | 7 ++++--- pkg/keystone/models/users.go | 6 ++++++ 10 files changed, 34 insertions(+), 11 deletions(-) diff --git a/pkg/cloudcommon/db/quotas/models.go b/pkg/cloudcommon/db/quotas/models.go index 66a4bcef74..7533fb9f2c 100644 --- a/pkg/cloudcommon/db/quotas/models.go +++ b/pkg/cloudcommon/db/quotas/models.go @@ -89,7 +89,7 @@ func (manager *SQuotaBaseManager) getQuotaInternal(ctx context.Context, scope rb if err != nil && err != sql.ErrNoRows { return err } else if err == sql.ErrNoRows && manager.autoCreate { - quota.FetchSystemQuota(scope) + quota.FetchSystemQuota(scope, ownerId) return manager.setQuotaInternal(ctx, nil, scope, ownerId, platform, quota) } return nil @@ -201,7 +201,7 @@ func (manager *SQuotaBaseManager) InitializeData() error { continue } if quota.IsEmpty() { - quota.FetchSystemQuota(scope) + quota.FetchSystemQuota(scope, ownerId) } baseQuota := SQuotaBase{} baseQuota.DomainId = ownerId.GetProjectDomainId() diff --git a/pkg/cloudcommon/db/quotas/quotas.go b/pkg/cloudcommon/db/quotas/quotas.go index ad226be01d..445be41f34 100644 --- a/pkg/cloudcommon/db/quotas/quotas.go +++ b/pkg/cloudcommon/db/quotas/quotas.go @@ -32,7 +32,7 @@ const ( ) type IQuota interface { - FetchSystemQuota(scope rbacutils.TRbacScope) + FetchSystemQuota(scope rbacutils.TRbacScope, ownerId mcclient.IIdentityProvider) FetchUsage(ctx context.Context, scope rbacutils.TRbacScope, ownerId mcclient.IIdentityProvider, platform []string) error Update(quota IQuota) Add(quota IQuota) diff --git a/pkg/compute/models/quotas.go b/pkg/compute/models/quotas.go index e962e99e67..a0ff171e43 100644 --- a/pkg/compute/models/quotas.go +++ b/pkg/compute/models/quotas.go @@ -19,11 +19,11 @@ import ( "fmt" "yunion.io/x/jsonutils" - // "yunion.io/x/log" "yunion.io/x/pkg/tristate" "yunion.io/x/pkg/util/sets" api "yunion.io/x/onecloud/pkg/apis/compute" + identityapi "yunion.io/x/onecloud/pkg/apis/identity" "yunion.io/x/onecloud/pkg/cloudcommon/db/quotas" "yunion.io/x/onecloud/pkg/compute/options" "yunion.io/x/onecloud/pkg/mcclient" @@ -68,10 +68,12 @@ type SQuota struct { Snapshot int } -func (self *SQuota) FetchSystemQuota(scope rbacutils.TRbacScope) { +func (self *SQuota) FetchSystemQuota(scope rbacutils.TRbacScope, ownerId mcclient.IIdentityProvider) { base := 0 if scope == rbacutils.ScopeDomain { base = 10 + } else if ownerId.GetProjectDomainId() == identityapi.DEFAULT_DOMAIN_ID && ownerId.GetProjectName() == identityapi.SystemAdminProject { + base = 1 } self.Cpu = options.Options.DefaultCpuQuota * base self.Memory = options.Options.DefaultMemoryQuota * base diff --git a/pkg/image/models/quotas.go b/pkg/image/models/quotas.go index b9b03db91c..3bccd4594d 100644 --- a/pkg/image/models/quotas.go +++ b/pkg/image/models/quotas.go @@ -20,6 +20,7 @@ import ( "yunion.io/x/jsonutils" "yunion.io/x/pkg/tristate" + identityapi "yunion.io/x/onecloud/pkg/apis/identity" "yunion.io/x/onecloud/pkg/cloudcommon/db/quotas" "yunion.io/x/onecloud/pkg/image/options" "yunion.io/x/onecloud/pkg/mcclient" @@ -51,10 +52,12 @@ type SQuota struct { Image int } -func (self *SQuota) FetchSystemQuota(scope rbacutils.TRbacScope) { +func (self *SQuota) FetchSystemQuota(scope rbacutils.TRbacScope, ownerId mcclient.IIdentityProvider) { base := 0 if scope == rbacutils.ScopeDomain { base = 10 + } else if ownerId.GetProjectDomainId() == identityapi.DEFAULT_DOMAIN_ID && ownerId.GetProjectName() == identityapi.SystemAdminProject { + base = 1 } self.Image = options.Options.DefaultImageQuota * base } diff --git a/pkg/keystone/models/endpoints.go b/pkg/keystone/models/endpoints.go index 9195a38ebc..535b1bc473 100644 --- a/pkg/keystone/models/endpoints.go +++ b/pkg/keystone/models/endpoints.go @@ -15,6 +15,7 @@ package models import ( + "context" "database/sql" "fmt" @@ -22,7 +23,6 @@ import ( "yunion.io/x/pkg/tristate" "yunion.io/x/sqlchemy" - "context" api "yunion.io/x/onecloud/pkg/apis/identity" "yunion.io/x/onecloud/pkg/cloudcommon/db" "yunion.io/x/onecloud/pkg/httperrors" diff --git a/pkg/keystone/models/policies.go b/pkg/keystone/models/policies.go index 3e171c3ce3..de8a458f4b 100644 --- a/pkg/keystone/models/policies.go +++ b/pkg/keystone/models/policies.go @@ -181,3 +181,10 @@ func (policy *SPolicy) PerformPrivate(ctx context.Context, userCred mcclient.Tok } return res, err } + +func (policy *SPolicy) ValidateDeleteCondition(ctx context.Context) error { + if policy.IsPublic { + return httperrors.NewInvalidStatusError("cannot delete shared policy") + } + return policy.SEnabledIdentityBaseResource.ValidateDeleteCondition(ctx) +} diff --git a/pkg/keystone/models/regions.go b/pkg/keystone/models/regions.go index 44ae6cc3fc..a1541b99e8 100644 --- a/pkg/keystone/models/regions.go +++ b/pkg/keystone/models/regions.go @@ -15,9 +15,10 @@ package models import ( + "context" + "yunion.io/x/jsonutils" - "context" "yunion.io/x/onecloud/pkg/cloudcommon/db" "yunion.io/x/onecloud/pkg/httperrors" "yunion.io/x/onecloud/pkg/mcclient" diff --git a/pkg/keystone/models/roles.go b/pkg/keystone/models/roles.go index 2789b9a45c..c399618d38 100644 --- a/pkg/keystone/models/roles.go +++ b/pkg/keystone/models/roles.go @@ -187,6 +187,9 @@ func (role *SRole) ValidateDeleteCondition(ctx context.Context) error { if grpCnt > 0 { return httperrors.NewNotEmptyError("role is being assigned to group") } + if role.IsPublic { + return httperrors.NewInvalidStatusError("cannot delete shared role") + } if role.IsSystemRole() { return httperrors.NewForbiddenError("cannot delete system role") } diff --git a/pkg/keystone/models/services.go b/pkg/keystone/models/services.go index 92f77d60fd..a21c06f593 100644 --- a/pkg/keystone/models/services.go +++ b/pkg/keystone/models/services.go @@ -15,13 +15,14 @@ package models import ( - "yunion.io/x/jsonutils" - "context" + + "yunion.io/x/jsonutils" + "yunion.io/x/pkg/tristate" + "yunion.io/x/onecloud/pkg/cloudcommon/db" "yunion.io/x/onecloud/pkg/httperrors" "yunion.io/x/onecloud/pkg/mcclient" - "yunion.io/x/pkg/tristate" ) type SServiceManager struct { diff --git a/pkg/keystone/models/users.go b/pkg/keystone/models/users.go index 9eceb5b98c..c5ef4c264b 100644 --- a/pkg/keystone/models/users.go +++ b/pkg/keystone/models/users.go @@ -531,6 +531,9 @@ func (user *SUser) UpdateInContext(ctx context.Context, userCred mcclient.TokenC if user.DomainId != group.DomainId { return nil, httperrors.NewInputParameterError("cannot join user and group in differnt domain") } + if group.IsReadOnly() { + return nil, httperrors.NewForbiddenError("cannot join read-only group") + } return nil, UsergroupManager.add(ctx, userCred, user, group) } @@ -542,6 +545,9 @@ func (user *SUser) DeleteInContext(ctx context.Context, userCred mcclient.TokenC if !ok { return nil, httperrors.NewInputParameterError("not supported update context %s", ctxObjs[0].Keyword()) } + if group.IsReadOnly() { + return nil, httperrors.NewForbiddenError("cannot leave read-only group") + } return nil, UsergroupManager.remove(ctx, userCred, user, group) }