From 2c7c817ddc9f9e5cf6c25ce96be2f770a67ae6a0 Mon Sep 17 00:00:00 2001
From: Qiu Jian <qiujian@yunionyun.com>
Date: Fri, 11 Oct 2019 22:06:05 +0800
Subject: [PATCH] fix: string2scope ignore user scope

---
 cmd/climc/shell/policies.go      | 5 +++++
 pkg/cloudcommon/policy/policy.go | 5 ++++-
 pkg/util/rbacutils/rbac.go       | 2 ++
 3 files changed, 11 insertions(+), 1 deletion(-)

diff --git a/cmd/climc/shell/policies.go b/cmd/climc/shell/policies.go
index a1da51dc84..dc720c04d9 100644
--- a/cmd/climc/shell/policies.go
+++ b/cmd/climc/shell/policies.go
@@ -23,6 +23,7 @@ import (
 	"time"
 
 	"yunion.io/x/jsonutils"
+	"yunion.io/x/log"
 
 	"yunion.io/x/onecloud/pkg/cloudcommon/consts"
 	"yunion.io/x/onecloud/pkg/cloudcommon/policy"
@@ -293,6 +294,10 @@ func init() {
 		Ip            string   `help:"login IP"`
 	}
 	R(&PolicyExplainOptions{}, "policy-explain", "Explain policy result", func(s *mcclient.ClientSession, args *PolicyExplainOptions) error {
+		err := log.SetLogLevelByString(log.Logger(), "debug")
+		if err != nil {
+			log.Fatalf("Set log level %q: %v", "debug", err)
+		}
 		auth.InitFromClientSession(s)
 		policy.EnableGlobalRbac(15*time.Second, 15*time.Second, false)
 		if args.Debug {
diff --git a/pkg/cloudcommon/policy/policy.go b/pkg/cloudcommon/policy/policy.go
index 09154cb462..bdf65cf141 100644
--- a/pkg/cloudcommon/policy/policy.go
+++ b/pkg/cloudcommon/policy/policy.go
@@ -289,6 +289,9 @@ func (manager *SPolicyManager) allow(scope rbacutils.TRbacScope, userCred mcclie
 		key := queryKey(scope, userCred, service, resource, action, extra...)
 		val := manager.cache.Get(key)
 		if val != nil {
+			if consts.IsRbacDebug() {
+				log.Debugf("query %s:%s:%s:%s from cache %s", service, resource, action, extra, val)
+			}
 			return val.(rbacutils.TRbacResult)
 		}
 		result := manager.allowWithoutCache(scope, userCred, service, resource, action, extra...)
@@ -410,7 +413,7 @@ func (manager *SPolicyManager) allowWithoutCache(scope rbacutils.TRbacScope, use
 	}
 
 	if consts.IsRbacDebug() {
-		log.Debugf("[RBAC: %s] %s %s %s %#v permission %s userCred: %s MatchRules: %d(%s) %s", scope, service, resource, action, extra, result, userCred, len(matchRules), jsonutils.Marshal(matchRules), jsonutils.Marshal(policies))
+		log.Debugf("[RBAC: %s] %s %s %s %#v permission %s userCred: %s MatchRules: %d(%s)", scope, service, resource, action, extra, result, userCred, len(matchRules), jsonutils.Marshal(matchRules))
 	}
 	return result
 }
diff --git a/pkg/util/rbacutils/rbac.go b/pkg/util/rbacutils/rbac.go
index e213a97d99..a0da9ff575 100644
--- a/pkg/util/rbacutils/rbac.go
+++ b/pkg/util/rbacutils/rbac.go
@@ -643,6 +643,8 @@ func String2ScopeDefault(str string, defScope TRbacScope) TRbacScope {
 		return ScopeDomain
 	case string(ScopeProject):
 		return ScopeProject
+	case string(ScopeUser):
+		return ScopeUser
 	case "true":
 		return ScopeSystem
 	default: