opensource/cloudpods
3
0
Fork 0
mirror of https://github.com/yunionio/cloudpods.git synced 2026-09-21 14:19:49 +08:00
Code Issues Packages Projects Releases Wiki Activity

重构代码，将policy从db中分离出来，代码更干净一些

Browse Source
This commit is contained in:
Qiu Jian
2018-10-30 00:12:19 +08:00
parent 926fc3a3dd
commit 33f546aafd
18 changed files with 152 additions and 115 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/cloudcommon/auth.go
+4 -3
View File
@@ -5,7 +5,8 @@ import (
"os"
"time"
"yunion.io/x/onecloud/pkg/cloudcommon/db"
"yunion.io/x/onecloud/pkg/cloudcommon/consts"
"yunion.io/x/onecloud/pkg/cloudcommon/policy"
"yunion.io/x/onecloud/pkg/mcclient/auth"
)
@@ -43,11 +44,11 @@ func InitAuth(options *Options, authComplete auth.AuthCompletedCallback) {
authComplete()
if options.GlobalVirtualResourceNamespace {
db.EnableGlobalVirtualResourceNamespace()
consts.EnableGlobalVirtualResourceNamespace()
}
if options.EnableRbac {
db.EnableGlobalRbac(time.Duration(options.RbacPolicySyncPeriodSeconds)*time.Second,
policy.EnableGlobalRbac(time.Duration(options.RbacPolicySyncPeriodSeconds)*time.Second,
time.Duration(options.RbacPolicySyncFailedRetrySeconds)*time.Second)
}
}
pkg/cloudcommon/consts/consts.go
+23
View File
@@ -0,0 +1,23 @@
package consts
var (
globalRegion = ""
globalServiceType = ""
)
func SetRegion(region string) {
globalRegion = region
}
func GetRegion() string {
return globalRegion
}
func SetServiceType(srvType string) {
globalServiceType = srvType
}
func GetServiceType() string {
return globalServiceType
}
pkg/cloudcommon/consts/db.go
+15
View File
@@ -0,0 +1,15 @@
package consts
/// Global virtual resource namespace
var (
globalVirtualResourceNamespace = false
)
func EnableGlobalVirtualResourceNamespace() {
globalVirtualResourceNamespace = true
}
func IsGlobalVirtualResourceNamespace() bool {
return globalVirtualResourceNamespace
}
pkg/cloudcommon/consts/policy.go
+13
View File
@@ -0,0 +1,13 @@
package consts
var (
globalsRbacEnabled = false
)
func EnableRbac() {
globalsRbacEnabled = true
}
func IsRbacEnabled() bool {
return globalsRbacEnabled
}
pkg/cloudcommon/db/db_dispatcher.go
+24 -21
View File
@@ -15,7 +15,9 @@ import (
"yunion.io/x/sqlchemy"
"yunion.io/x/onecloud/pkg/appsrv"
"yunion.io/x/onecloud/pkg/cloudcommon/consts"
"yunion.io/x/onecloud/pkg/cloudcommon/db/lockman"
"yunion.io/x/onecloud/pkg/cloudcommon/policy"
"yunion.io/x/onecloud/pkg/httperrors"
"yunion.io/x/onecloud/pkg/mcclient"
"yunion.io/x/onecloud/pkg/mcclient/auth"
@@ -490,10 +492,10 @@ func (dispatcher *DBModelDispatcher) List(ctx context.Context, query jsonutils.J
userCred := fetchUserCredential(ctx)
var isAllow bool
if globalsRbacEnabled {
if consts.IsRbacEnabled() {
isAdmin := jsonutils.QueryBoolean(query, "admin", false)
isAllow = PolicyManager.Allow(isAdmin, userCred, GetGlobalServiceType(),
dispatcher.modelManager.KeywordPlural(), PolicyActionList)
isAllow = policy.PolicyManager.Allow(isAdmin, userCred, consts.GetServiceType(),
dispatcher.modelManager.KeywordPlural(), policy.PolicyActionList)
} else {
isAllow = dispatcher.modelManager.AllowListItems(ctx, userCred, query)
}
@@ -602,8 +604,8 @@ func (dispatcher *DBModelDispatcher) Get(ctx context.Context, idStr string, quer
}
// log.Debugf("Get found %s", model)
var isAllow bool
if globalsRbacEnabled {
isAllow = isRbacAllowed(dispatcher.modelManager, model, userCred, PolicyActionGet)
if consts.IsRbacEnabled() {
isAllow = isRbacAllowed(dispatcher.modelManager, model, userCred, policy.PolicyActionGet)
} else {
isAllow = model.AllowGetDetails(ctx, userCred, query)
}
@@ -633,8 +635,8 @@ func (dispatcher *DBModelDispatcher) GetSpecific(ctx context.Context, idStr stri
modelValue := reflect.ValueOf(model)
var isAllow bool
if globalsRbacEnabled {
isAllow = isRbacAllowed(dispatcher.modelManager, model, userCred, PolicyActionGet, spec)
if consts.IsRbacEnabled() {
isAllow = isRbacAllowed(dispatcher.modelManager, model, userCred, policy.PolicyActionGet, spec)
} else {
funcName := fmt.Sprintf("AllowGetDetails%s", specCamel)
@@ -690,8 +692,9 @@ func fetchOwnerProjectId(ctx context.Context, userCred mcclient.TokenCredential,
return userCred.GetProjectId(), nil
}
var isAllow bool
if globalsRbacEnabled {
isAllow = PolicyManager.Allow(true, userCred, GetGlobalServiceType(), PolicyDelegation, "")
if consts.IsRbacEnabled() {
isAllow = policy.PolicyManager.Allow(true, userCred,
consts.GetServiceType(), policy.PolicyDelegation, "")
} else {
isAllow = userCred.IsSystemAdmin()
}
@@ -811,8 +814,8 @@ func (dispatcher *DBModelDispatcher) Create(ctx context.Context, query jsonutils
defer lockman.ReleaseClass(ctx, dispatcher.modelManager, ownerProjId)
var isAllow bool
if globalsRbacEnabled {
isAllow = isRbacAllowed(dispatcher.modelManager, nil, userCred, PolicyActionCreate)
if consts.IsRbacEnabled() {
isAllow = isRbacAllowed(dispatcher.modelManager, nil, userCred, policy.PolicyActionCreate)
} else {
isAllow = dispatcher.modelManager.AllowCreateItem(ctx, userCred, query, data)
}
@@ -875,8 +878,8 @@ func (dispatcher *DBModelDispatcher) BatchCreate(ctx context.Context, query json
defer lockman.ReleaseClass(ctx, dispatcher.modelManager, ownerProjId)
var isAllow bool
if globalsRbacEnabled {
isAllow = isRbacAllowed(dispatcher.modelManager, nil, userCred, PolicyActionCreate)
if consts.IsRbacEnabled() {
isAllow = isRbacAllowed(dispatcher.modelManager, nil, userCred, policy.PolicyActionCreate)
} else {
isAllow = dispatcher.modelManager.AllowCreateItem(ctx, userCred, query, data)
}
@@ -942,8 +945,8 @@ func (dispatcher *DBModelDispatcher) PerformClassAction(ctx context.Context, act
data := body.(*jsonutils.JSONDict)
var isAllow bool
if globalsRbacEnabled {
isAllow = isRbacAllowed(manager, nil, userCred, PolicyActionPerform, action)
if consts.IsRbacEnabled() {
isAllow = isRbacAllowed(manager, nil, userCred, policy.PolicyActionPerform, action)
} else {
isAllow = manager.AllowPerformCheckCreateData(ctx, userCred, query, data)
}
@@ -1020,8 +1023,8 @@ func objectPerformAction(dispatcher *DBModelDispatcher, model IModel, modelValue
}
var isAllow bool
if globalsRbacEnabled {
isAllow = isRbacAllowed(dispatcher.modelManager, model, userCred, PolicyActionPerform, action)
if consts.IsRbacEnabled() {
isAllow = isRbacAllowed(dispatcher.modelManager, model, userCred, policy.PolicyActionPerform, action)
} else {
allowFuncName := "Allow" + funcName
allowFuncValue := modelValue.MethodByName(allowFuncName)
@@ -1132,8 +1135,8 @@ func (dispatcher *DBModelDispatcher) Update(ctx context.Context, idStr string, q
}
var isAllow bool
if globalsRbacEnabled {
isAllow = isRbacAllowed(dispatcher.modelManager, model, userCred, PolicyActionUpdate)
if consts.IsRbacEnabled() {
isAllow = isRbacAllowed(dispatcher.modelManager, model, userCred, policy.PolicyActionUpdate)
} else {
isAllow = model.AllowUpdateItem(ctx, userCred)
}
@@ -1168,8 +1171,8 @@ func deleteItem(manager IModelManager, model IModel, ctx context.Context, userCr
log.Debugf("deleteItem %s", jsonutils.Marshal(model))
var isAllow bool
if globalsRbacEnabled {
isAllow = isRbacAllowed(manager, model, userCred, PolicyActionDelete)
if consts.IsRbacEnabled() {
isAllow = isRbacAllowed(manager, model, userCred, policy.PolicyActionDelete)
} else {
isAllow = model.AllowDeleteItem(ctx, userCred, query, data)
}
pkg/cloudcommon/db/db_joint_dispatcher.go
+9 -7
View File
@@ -11,7 +11,9 @@ import (
"yunion.io/x/onecloud/pkg/mcclient"
"yunion.io/x/onecloud/pkg/mcclient/modules"
"yunion.io/x/onecloud/pkg/cloudcommon/consts"
"yunion.io/x/onecloud/pkg/cloudcommon/db/lockman"
"yunion.io/x/onecloud/pkg/cloudcommon/policy"
)
type DBJointModelDispatcher struct {
@@ -99,10 +101,10 @@ func (dispatcher *DBJointModelDispatcher) ListSlaveDescendent(ctx context.Contex
func (dispatcher *DBJointModelDispatcher) _listJoint(ctx context.Context, userCred mcclient.TokenCredential, ctxModel IModel, queryDict jsonutils.JSONObject) (*modules.ListResult, error) {
var isAllow bool
if IsGlobalRbacEnabled() {
if consts.IsRbacEnabled() {
isAdmin := jsonutils.QueryBoolean(queryDict, "admin", false)
isAllow = PolicyManager.Allow(isAdmin, userCred, GetGlobalServiceType(),
dispatcher.JointModelManager().KeywordPlural(), PolicyActionList)
isAllow = policy.PolicyManager.Allow(isAdmin, userCred, consts.GetServiceType(),
dispatcher.JointModelManager().KeywordPlural(), policy.PolicyActionList)
} else {
isAllow = dispatcher.JointModelManager().AllowListDescendent(ctx, userCred, ctxModel, queryDict)
}
@@ -144,8 +146,8 @@ func (dispatcher *DBJointModelDispatcher) Get(ctx context.Context, id1 string, i
return nil, httperrors.NewGeneralError(err)
}
var isAllow bool
if IsGlobalRbacEnabled() {
isAllow = isJointRbacAllowed(dispatcher.JointModelManager(), item, userCred, PolicyActionGet)
if consts.IsRbacEnabled() {
isAllow = isJointRbacAllowed(dispatcher.JointModelManager(), item, userCred, policy.PolicyActionGet)
} else {
isAllow = item.AllowGetJointDetails(ctx, userCred, query, item)
}
@@ -215,8 +217,8 @@ func (dispatcher *DBJointModelDispatcher) Update(ctx context.Context, id1 string
}
var isAllow bool
if IsGlobalRbacEnabled() {
isAllow = isJointRbacAllowed(dispatcher.JointModelManager(), item, userCred, PolicyActionUpdate)
if consts.IsRbacEnabled() {
isAllow = isJointRbacAllowed(dispatcher.JointModelManager(), item, userCred, policy.PolicyActionUpdate)
} else {
isAllow = item.AllowUpdateJointItem(ctx, userCred, item)
}
pkg/cloudcommon/db/global.go
-44
View File
@@ -1,44 +0,0 @@
package db
import "time"
/// Global virtual resource namespace
var (
globalVirtualResourceNamespace = false
globalRegion = ""
globalServiceType = ""
globalsRbacEnabled = false
)
func EnableGlobalVirtualResourceNamespace() {
globalVirtualResourceNamespace = true
}
func SetGlobalRegion(region string) {
globalRegion = region
}
func GetGlobalRegion() string {
return globalRegion
}
func SetGlobalServiceType(srvType string) {
globalServiceType = srvType
}
func GetGlobalServiceType() string {
return globalServiceType
}
func EnableGlobalRbac(refreshInterval time.Duration, retryInterval time.Duration) {
globalsRbacEnabled = true
PolicyManager.start(refreshInterval, retryInterval)
}
func IsGlobalRbacEnabled() bool {
return globalsRbacEnabled
}
pkg/cloudcommon/db/namevalidator.go
+3 -2
View File
@@ -3,6 +3,7 @@ package db
import (
"fmt"
"yunion.io/x/onecloud/pkg/cloudcommon/consts"
"yunion.io/x/onecloud/pkg/httperrors"
"yunion.io/x/pkg/util/stringutils"
)
@@ -10,7 +11,7 @@ import (
func isNameUnique(manager IModelManager, owner string, name string) bool {
q := manager.Query()
q = manager.FilterByName(q, name)
if !globalVirtualResourceNamespace {
if !consts.IsGlobalVirtualResourceNamespace() {
q = manager.FilterByOwner(q, owner)
}
return q.Count() == 0
@@ -31,7 +32,7 @@ func isAlterNameUnique(model IModel, name string) bool {
manager := model.GetModelManager()
q := manager.Query()
q = manager.FilterByName(q, name)
if !globalVirtualResourceNamespace {
if !consts.IsGlobalVirtualResourceNamespace() {
q = manager.FilterByOwner(q, model.GetOwnerProjectId())
}
q = manager.FilterByNotId(q, model.GetId())
pkg/cloudcommon/db/quotas/handler.go
+20 -18
View File
@@ -11,7 +11,9 @@ import (
"yunion.io/x/onecloud/pkg/appctx"
"yunion.io/x/onecloud/pkg/appsrv"
"yunion.io/x/onecloud/pkg/cloudcommon/consts"
"yunion.io/x/onecloud/pkg/cloudcommon/db"
"yunion.io/x/onecloud/pkg/cloudcommon/policy"
"yunion.io/x/onecloud/pkg/httperrors"
"yunion.io/x/onecloud/pkg/mcclient/auth"
)
@@ -75,18 +77,18 @@ func getQuotaHanlder(ctx context.Context, w http.ResponseWriter, r *http.Request
projectId := params["<tenantid>"]
if len(projectId) == 0 {
projectId = userCred.GetProjectId()
if db.IsGlobalRbacEnabled() {
if !db.PolicyManager.Allow(false, userCred, db.GetGlobalServiceType(),
"quotas", db.PolicyActionGet) {
if consts.IsRbacEnabled() {
if !policy.PolicyManager.Allow(false, userCred, consts.GetServiceType(),
"quotas", policy.PolicyActionGet) {
httperrors.ForbiddenError(w, "not allow to get quota")
return
}
}
} else {
isAllow := false
if db.IsGlobalRbacEnabled() {
isAllow = db.PolicyManager.Allow(true, userCred, db.GetGlobalServiceType(),
db.PolicyDelegation, db.PolicyActionGet)
if consts.IsRbacEnabled() {
isAllow = policy.PolicyManager.Allow(true, userCred, consts.GetServiceType(),
policy.PolicyDelegation, policy.PolicyActionGet)
} else {
isAllow = userCred.IsSystemAdmin()
}
@@ -94,9 +96,9 @@ func getQuotaHanlder(ctx context.Context, w http.ResponseWriter, r *http.Request
httperrors.ForbiddenError(w, "not allow to delegate query quota")
return
}
if db.IsGlobalRbacEnabled() {
if !db.PolicyManager.Allow(true, userCred, db.GetGlobalServiceType(),
"quotas", db.PolicyActionGet) {
if consts.IsRbacEnabled() {
if !policy.PolicyManager.Allow(true, userCred, consts.GetServiceType(),
"quotas", policy.PolicyActionGet) {
httperrors.ForbiddenError(w, "not allow to query quota")
return
}
@@ -131,9 +133,9 @@ func setQuotaHanlder(ctx context.Context, w http.ResponseWriter, r *http.Request
userCred := auth.FetchUserCredential(ctx)
var isAllow bool
if db.IsGlobalRbacEnabled() {
isAllow = db.PolicyManager.Allow(true, userCred, db.GetGlobalServiceType(),
"quotas", db.PolicyActionUpdate)
if consts.IsRbacEnabled() {
isAllow = policy.PolicyManager.Allow(true, userCred, consts.GetServiceType(),
"quotas", policy.PolicyActionUpdate)
} else {
isAllow = userCred.IsSystemAdmin()
}
@@ -194,9 +196,9 @@ func checkQuotaHanlder(ctx context.Context, w http.ResponseWriter, r *http.Reque
userCred := auth.FetchUserCredential(ctx)
isAllow := false
if db.IsGlobalRbacEnabled() {
isAllow = db.PolicyManager.Allow(true, userCred, db.GetGlobalServiceType(),
db.PolicyDelegation, db.PolicyActionGet)
if consts.IsRbacEnabled() {
isAllow = policy.PolicyManager.Allow(true, userCred, consts.GetServiceType(),
policy.PolicyDelegation, policy.PolicyActionGet)
} else {
isAllow = userCred.IsSystemAdmin()
}
@@ -204,9 +206,9 @@ func checkQuotaHanlder(ctx context.Context, w http.ResponseWriter, r *http.Reque
httperrors.ForbiddenError(w, "not allow to delegate check quota")
return
}
if db.IsGlobalRbacEnabled() {
if !db.PolicyManager.Allow(true, userCred, db.GetGlobalServiceType(),
"quotas", db.PolicyActionGet) {
if consts.IsRbacEnabled() {
if !policy.PolicyManager.Allow(true, userCred, consts.GetServiceType(),
"quotas", policy.PolicyActionGet) {
httperrors.ForbiddenError(w, "not allow to query quota")
return
}
pkg/cloudcommon/db/rbac.go
+6 -4
View File
@@ -1,6 +1,8 @@
package db
import (
"yunion.io/x/onecloud/pkg/cloudcommon/consts"
"yunion.io/x/onecloud/pkg/cloudcommon/policy"
"yunion.io/x/onecloud/pkg/mcclient"
)
@@ -25,11 +27,11 @@ func isRbacAllowed(manager IModelManager, model IModel, userCred mcclient.TokenC
}
}
if !isAdmin {
isAllow = PolicyManager.Allow(false, userCred, GetGlobalServiceType(),
isAllow = policy.PolicyManager.Allow(false, userCred, consts.GetServiceType(),
manager.KeywordPlural(), action, extra...)
}
if !isAllow {
isAllow = PolicyManager.Allow(true, userCred, GetGlobalServiceType(),
isAllow = policy.PolicyManager.Allow(true, userCred, consts.GetServiceType(),
manager.KeywordPlural(), action, extra...)
}
return isAllow
@@ -44,11 +46,11 @@ func isJointRbacAllowed(manager IJointModelManager, item IJointModel, userCred m
isAdmin = false
}
if !isAdmin {
isAllow = PolicyManager.Allow(false, userCred, GetGlobalServiceType(),
isAllow = policy.PolicyManager.Allow(false, userCred, consts.GetServiceType(),
manager.KeywordPlural(), action, extra...)
}
if !isAllow {
isAllow = PolicyManager.Allow(true, userCred, GetGlobalServiceType(),
isAllow = policy.PolicyManager.Allow(true, userCred, consts.GetServiceType(),
manager.KeywordPlural(), action, extra...)
}
return isAllow
pkg/cloudcommon/db/tenantcache.go
+2 -1
View File
@@ -8,6 +8,7 @@ import (
"yunion.io/x/onecloud/pkg/mcclient/auth"
"yunion.io/x/onecloud/pkg/mcclient/modules"
"yunion.io/x/onecloud/pkg/cloudcommon/consts"
"yunion.io/x/onecloud/pkg/cloudcommon/db/lockman"
)
@@ -77,7 +78,7 @@ func (manager *STenantCacheManager) FetchTenantByName(ctx context.Context, idStr
}
func (manager *STenantCacheManager) fetchTenantFromKeystone(ctx context.Context, idStr string) (*STenant, error) {
s := auth.GetAdminSession(GetGlobalRegion(), "v1")
s := auth.GetAdminSession(consts.GetRegion(), "v1")
tenant, err := modules.Projects.Get(s, idStr, nil)
if err != nil {
log.Errorf("fetch project fail %s", err)
pkg/cloudcommon/options.go
+3
View File
@@ -6,6 +6,7 @@ import (
"path"
"yunion.io/x/log"
"yunion.io/x/onecloud/pkg/cloudcommon/consts"
"yunion.io/x/pkg/util/version"
"yunion.io/x/pkg/utils"
"yunion.io/x/structarg"
@@ -114,4 +115,6 @@ func ParseOptions(optStruct interface{}, optionsRef *Options, args []string, con
}
log.V(10).Debugf("Parsed options: %#v", optStruct)
consts.SetRegion(optionsRef.Region)
}
pkg/cloudcommon/policy/global.go
+11
View File
@@ -0,0 +1,11 @@
package policy
import (
"time"
"yunion.io/x/onecloud/pkg/cloudcommon/consts"
)
func EnableGlobalRbac(refreshInterval time.Duration, retryInterval time.Duration) {
consts.EnableRbac()
PolicyManager.start(refreshInterval, retryInterval)
}
pkg/cloudcommon/db/policy.go → pkg/cloudcommon/policy/policy.go
+4 -3
View File
@@ -1,10 +1,11 @@
package db
package policy
import (
"yunion.io/x/jsonutils"
"yunion.io/x/log"
"time"
"yunion.io/x/onecloud/pkg/cloudcommon/consts"
"yunion.io/x/onecloud/pkg/httperrors"
"yunion.io/x/onecloud/pkg/mcclient"
"yunion.io/x/onecloud/pkg/mcclient/auth"
@@ -69,7 +70,7 @@ func parseJsonPolicy(obj jsonutils.JSONObject) (string, rbacutils.SRbacPolicy, e
}
func fetchPolicies() (map[string]rbacutils.SRbacPolicy, map[string]rbacutils.SRbacPolicy, error) {
s := auth.GetAdminSession(GetGlobalRegion(), "v1")
s := auth.GetAdminSession(consts.GetRegion(), "v1")
policies := make(map[string]rbacutils.SRbacPolicy)
adminPolicies := make(map[string]rbacutils.SRbacPolicy)
@@ -157,7 +158,7 @@ func (manager *SPolicyManager) explainPolicy(userCred mcclient.TokenCredential,
return false, httperrors.NewInputParameterError("invalid format")
}
isAdmin, _ := policySeq[0].Bool()
if !IsGlobalRbacEnabled() {
if !consts.IsRbacEnabled() {
if !isAdmin || (isAdmin && userCred.IsSystemAdmin()) {
return true, nil
} else {