From 3e88e3093d0249539651ee1758d5b75dfaedd0a0 Mon Sep 17 00:00:00 2001
From: Qu Xuan <quxuan@yunionyun.com>
Date: Wed, 7 Apr 2021 21:00:34 +0800
Subject: [PATCH] fix: validate secgroup references

---
 cmd/climc/shell/compute/secgroups.go |  1 +
 pkg/cloudprovider/securitygroup.go   |  3 ++-
 pkg/compute/models/secgroups.go      | 38 ++++++++++++++++++++++++++++
 3 files changed, 41 insertions(+), 1 deletion(-)

diff --git a/cmd/climc/shell/compute/secgroups.go b/cmd/climc/shell/compute/secgroups.go
index 1fdc219b05..0dc31d36bf 100644
--- a/cmd/climc/shell/compute/secgroups.go
+++ b/cmd/climc/shell/compute/secgroups.go
@@ -36,4 +36,5 @@ func init() {
 	cmd.Perform("purge", &options.SecgroupIdOptions{})
 	cmd.Perform("change-owner", &options.SecgroupChangeOwnerOptions{})
 	cmd.Perform("import-rules", &options.SecgroupImportRulesOptions{})
+	cmd.Get("references", &options.SecgroupIdOptions{})
 }
diff --git a/pkg/cloudprovider/securitygroup.go b/pkg/cloudprovider/securitygroup.go
index beffb7274d..c63554b521 100644
--- a/pkg/cloudprovider/securitygroup.go
+++ b/pkg/cloudprovider/securitygroup.go
@@ -27,7 +27,8 @@ import (
 )
 
 type SecurityGroupReference struct {
-	Id string
+	Id   string
+	Name string
 }
 
 type SecDriver interface {
diff --git a/pkg/compute/models/secgroups.go b/pkg/compute/models/secgroups.go
index 09f477d5f8..fcd9b67399 100644
--- a/pkg/compute/models/secgroups.go
+++ b/pkg/compute/models/secgroups.go
@@ -1222,6 +1222,17 @@ func (manager *SSecurityGroupManager) InitializeData() error {
 	return nil
 }
 
+func (self *SSecurityGroup) GetSecurityGroupReferences() ([]SSecurityGroup, error) {
+	sq := SecurityGroupRuleManager.Query("secgroup_id").Equals("peer_secgroup_id", self.Id).Distinct().SubQuery()
+	q := SecurityGroupManager.Query().In("id", sq)
+	groups := []SSecurityGroup{}
+	err := db.FetchModelObjects(SecurityGroupManager, q, &groups)
+	if err != nil {
+		return nil, errors.Wrapf(err, "db.FetchModelObjects")
+	}
+	return groups, nil
+}
+
 func (self *SSecurityGroup) ValidateDeleteCondition(ctx context.Context) error {
 	cnt, err := self.GetGuestsCount()
 	if err != nil {
@@ -1233,6 +1244,13 @@ func (self *SSecurityGroup) ValidateDeleteCondition(ctx context.Context) error {
 	if self.Id == "default" {
 		return httperrors.NewProtectedResourceError("not allow to delete default security group")
 	}
+	references, err := self.GetSecurityGroupReferences()
+	if err != nil {
+		return httperrors.NewGeneralError(err)
+	}
+	if len(references) > 0 {
+		return httperrors.NewNotEmptyError("the other security group is in use")
+	}
 	return self.SSharableVirtualResourceBase.ValidateDeleteCondition(ctx)
 }
 
@@ -1302,6 +1320,26 @@ func (sg *SSecurityGroup) GetUsages() []db.IUsage {
 	}
 }
 
+func (self *SSecurityGroup) AllowGetDetailsReferences(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool {
+	return db.IsProjectAllowGetSpec(userCred, self, "references")
+}
+
+// 获取引用信息
+func (self *SSecurityGroup) GetDetailsReferences(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) ([]cloudprovider.SecurityGroupReference, error) {
+	groups, err := self.GetSecurityGroupReferences()
+	if err != nil {
+		return nil, errors.Wrapf(err, "GetSecurityGroupReferences")
+	}
+	ret := []cloudprovider.SecurityGroupReference{}
+	for i := range groups {
+		ret = append(ret, cloudprovider.SecurityGroupReference{
+			Id:   groups[i].Id,
+			Name: groups[i].Name,
+		})
+	}
+	return ret, nil
+}
+
 func (self *SSecurityGroup) AllowPerformImportRules(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
 	return self.IsOwner(userCred) || db.IsAdminAllowPerform(userCred, self, "import-rules")
 }