From 4722fae114348fce31c8a48a86e77394786f2386 Mon Sep 17 00:00:00 2001 From: Qu Xuan Date: Tue, 20 Jul 2021 14:07:02 +0800 Subject: [PATCH] fix(keystone): policy filter by role --- cmd/climc/shell/identity/policies.go | 24 +---- cmd/climc/shell/identity/roles.go | 118 ++---------------------- pkg/apis/identity/input.go | 6 ++ pkg/keystone/models/policies.go | 9 ++ pkg/mcclient/options/identity/doc.go | 1 + pkg/mcclient/options/identity/policy.go | 34 +++++++ pkg/mcclient/options/identity/roles.go | 74 +++++++++++++++ 7 files changed, 137 insertions(+), 129 deletions(-) create mode 100644 pkg/mcclient/options/identity/doc.go create mode 100644 pkg/mcclient/options/identity/policy.go create mode 100644 pkg/mcclient/options/identity/roles.go diff --git a/cmd/climc/shell/identity/policies.go b/cmd/climc/shell/identity/policies.go index 10caff1e9f..4d80a0898d 100644 --- a/cmd/climc/shell/identity/policies.go +++ b/cmd/climc/shell/identity/policies.go @@ -24,13 +24,14 @@ import ( "yunion.io/x/jsonutils" "yunion.io/x/log" + "yunion.io/x/onecloud/cmd/climc/shell" api "yunion.io/x/onecloud/pkg/apis/identity" "yunion.io/x/onecloud/pkg/cloudcommon/consts" "yunion.io/x/onecloud/pkg/cloudcommon/policy" "yunion.io/x/onecloud/pkg/mcclient" "yunion.io/x/onecloud/pkg/mcclient/auth" "yunion.io/x/onecloud/pkg/mcclient/modules" - "yunion.io/x/onecloud/pkg/mcclient/options" + "yunion.io/x/onecloud/pkg/mcclient/options/identity" "yunion.io/x/onecloud/pkg/util/fileutils2" "yunion.io/x/onecloud/pkg/util/rbacutils" "yunion.io/x/onecloud/pkg/util/shellutils" @@ -74,25 +75,8 @@ func createPolicy(s *mcclient.ClientSession, name string, policy string, domain } func init() { - type PolicyListOptions struct { - options.BaseListOptions - Type string `help:"filter by type"` - IsSystem *bool `help:"filter by is_system" negative:"is_no_system"` - Format string `help:"policy format, default to yaml" default:"yaml" choices:"yaml|json"` - OrderByDomain string `help:"order by domain name" choices:"asc|desc"` - } - R(&PolicyListOptions{}, "policy-list", "List all policies", func(s *mcclient.ClientSession, args *PolicyListOptions) error { - params, err := options.ListStructToParams(args) - if err != nil { - return err - } - result, err := modules.Policies.List(s, params) - if err != nil { - return err - } - printList(result, modules.Policies.GetColumns(s)) - return nil - }) + cmd := shell.NewResourceCmd(&modules.Policies) + cmd.List(&identity.PolicyListOptions{}) type PolicyCreateOptions struct { Domain string `help:"domain of the policy"` diff --git a/cmd/climc/shell/identity/roles.go b/cmd/climc/shell/identity/roles.go index 585bbc5b6a..0071d6f904 100644 --- a/cmd/climc/shell/identity/roles.go +++ b/cmd/climc/shell/identity/roles.go @@ -17,100 +17,21 @@ package identity import ( "yunion.io/x/jsonutils" + "yunion.io/x/onecloud/cmd/climc/shell" "yunion.io/x/onecloud/pkg/mcclient" "yunion.io/x/onecloud/pkg/mcclient/modules" "yunion.io/x/onecloud/pkg/mcclient/options" + "yunion.io/x/onecloud/pkg/mcclient/options/identity" ) func init() { - type RoleListOptions struct { - options.BaseListOptions - OrderByDomain string `help:"order by domain name" choices:"asc|desc"` - } - R(&RoleListOptions{}, "role-list", "List keystone Roles", func(s *mcclient.ClientSession, args *RoleListOptions) error { - params, err := options.ListStructToParams(args) - if err != nil { - return err - } - result, err := modules.RolesV3.List(s, params) - if err != nil { - return err - } - printList(result, modules.RolesV3.GetColumns(s)) - return nil - }) - - type RoleDetailOptions struct { - ID string `help:"ID or name of role"` - Domain string `help:"Domain"` - } - R(&RoleDetailOptions{}, "role-show", "Show details of a role", func(s *mcclient.ClientSession, args *RoleDetailOptions) error { - query := jsonutils.NewDict() - if len(args.Domain) > 0 { - domainId, err := modules.Domains.GetId(s, args.Domain, nil) - if err != nil { - return err - } - query.Add(jsonutils.NewString(domainId), "domain_id") - } - role, err := modules.RolesV3.Get(s, args.ID, query) - if err != nil { - return err - } - printObject(role) - return nil - }) - R(&RoleDetailOptions{}, "role-delete", "Delete a role", func(s *mcclient.ClientSession, args *RoleDetailOptions) error { - query := jsonutils.NewDict() - if len(args.Domain) > 0 { - domainId, err := modules.Domains.GetId(s, args.Domain, nil) - if err != nil { - return err - } - query.Add(jsonutils.NewString(domainId), "domain_id") - } - rid, err := modules.RolesV3.GetId(s, args.ID, query) - if err != nil { - return err - } - role, err := modules.RolesV3.Delete(s, rid, nil) - if err != nil { - return err - } - printObject(role) - return nil - }) - - type RoleCreateOptions struct { - NAME string `help:"Role name"` - Domain string `help:"Domain"` - Desc string `help:"Description"` - - PublicScope string `help:"public scope" choices:"none|system"` - } - R(&RoleCreateOptions{}, "role-create", "Create a new role", func(s *mcclient.ClientSession, args *RoleCreateOptions) error { - params := jsonutils.NewDict() - params.Add(jsonutils.NewString(args.NAME), "name") - if len(args.Domain) > 0 { - domainId, err := modules.Domains.GetId(s, args.Domain, nil) - if err != nil { - return err - } - params.Add(jsonutils.NewString(domainId), "domain_id") - } - if len(args.Desc) > 0 { - params.Add(jsonutils.NewString(args.Desc), "description") - } - if len(args.PublicScope) > 0 { - params.Add(jsonutils.NewString(args.PublicScope), "public_scope") - } - role, err := modules.RolesV3.Create(s, params) - if err != nil { - return err - } - printObject(role) - return nil - }) + cmd := shell.NewResourceCmd(&modules.RolesV3) + cmd.List(&identity.RoleListOptions{}) + cmd.Show(&identity.RoleDetailOptions{}) + cmd.Delete(&identity.RoleDetailOptions{}) + cmd.Create(&identity.RoleCreateOptions{}) + cmd.Perform("public", &options.BaseIdOptions{}) + cmd.Perform("private", &options.BaseIdOptions{}) type RoleUpdateOptions struct { ID string `help:"Role ID or Name"` @@ -145,25 +66,4 @@ func init() { printObject(role) return nil }) - - type RolePerformOptions struct { - ID string `help:"ID of role to update"` - } - R(&RolePerformOptions{}, "role-public", "Mark a role public", func(s *mcclient.ClientSession, args *RolePerformOptions) error { - result, err := modules.RolesV3.PerformAction(s, args.ID, "public", nil) - if err != nil { - return err - } - printObject(result) - return nil - }) - - R(&RolePerformOptions{}, "role-private", "Mark a role private", func(s *mcclient.ClientSession, args *RolePerformOptions) error { - result, err := modules.RolesV3.PerformAction(s, args.ID, "private", nil) - if err != nil { - return err - } - printObject(result) - return nil - }) } diff --git a/pkg/apis/identity/input.go b/pkg/apis/identity/input.go index 7efdf397d3..3826c07395 100644 --- a/pkg/apis/identity/input.go +++ b/pkg/apis/identity/input.go @@ -346,6 +346,12 @@ type PolicyListInput struct { // 是否显示系统权限 IsSystem *bool `json:"is_system"` + + // filter policies by role id + RoleId string `json:"role_id"` + // swagger: ignore + // Deprecated + Role string `json:"role" yunion-deprecated-by:"role_id"` } type RegionFilterListInput struct { diff --git a/pkg/keystone/models/policies.go b/pkg/keystone/models/policies.go index 4d565a390f..35ba3c3383 100644 --- a/pkg/keystone/models/policies.go +++ b/pkg/keystone/models/policies.go @@ -32,6 +32,7 @@ import ( "yunion.io/x/onecloud/pkg/cloudcommon/db" "yunion.io/x/onecloud/pkg/cloudcommon/db/quotas" policyman "yunion.io/x/onecloud/pkg/cloudcommon/policy" + "yunion.io/x/onecloud/pkg/cloudcommon/validators" "yunion.io/x/onecloud/pkg/httperrors" "yunion.io/x/onecloud/pkg/keystone/locale" "yunion.io/x/onecloud/pkg/mcclient" @@ -467,6 +468,14 @@ func (manager *SPolicyManager) ListItemFilter( if err != nil { return nil, errors.Wrap(err, "SSharableBaseResourceManager.ListItemFilter") } + if len(query.RoleId) > 0 { + _, err := validators.ValidateModel(userCred, RoleManager, &query.RoleId) + if err != nil { + return nil, err + } + sq := RolePolicyManager.Query("policy_id").Equals("role_id", query.RoleId).SubQuery() + q = q.In("id", sq) + } if len(query.Type) > 0 { q = q.In("type", query.Type) } diff --git a/pkg/mcclient/options/identity/doc.go b/pkg/mcclient/options/identity/doc.go new file mode 100644 index 0000000000..f48ddb8651 --- /dev/null +++ b/pkg/mcclient/options/identity/doc.go @@ -0,0 +1 @@ +package identity // import "yunion.io/x/onecloud/pkg/mcclient/options/identity" diff --git a/pkg/mcclient/options/identity/policy.go b/pkg/mcclient/options/identity/policy.go new file mode 100644 index 0000000000..aa53267d2f --- /dev/null +++ b/pkg/mcclient/options/identity/policy.go @@ -0,0 +1,34 @@ +// Copyright 2019 Yunion +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +package identity + +import ( + "yunion.io/x/jsonutils" + + "yunion.io/x/onecloud/pkg/mcclient/options" +) + +type PolicyListOptions struct { + options.BaseListOptions + Type string `help:"filter by type"` + IsSystem *bool `help:"filter by is_system" negative:"is_no_system"` + Format string `help:"policy format, default to yaml" default:"yaml" choices:"yaml|json"` + OrderByDomain string `help:"order by domain name" choices:"asc|desc"` + Role string `help:"filter by role"` +} + +func (opts *PolicyListOptions) Params() (jsonutils.JSONObject, error) { + return options.ListStructToParams(opts) +} diff --git a/pkg/mcclient/options/identity/roles.go b/pkg/mcclient/options/identity/roles.go new file mode 100644 index 0000000000..e3d87825a3 --- /dev/null +++ b/pkg/mcclient/options/identity/roles.go @@ -0,0 +1,74 @@ +// Copyright 2019 Yunion +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +package identity + +import ( + "yunion.io/x/jsonutils" + + "yunion.io/x/onecloud/pkg/mcclient/options" +) + +type RoleListOptions struct { + options.BaseListOptions + OrderByDomain string `help:"order by domain name" choices:"asc|desc"` +} + +func (opts *RoleListOptions) Params() (jsonutils.JSONObject, error) { + return options.ListStructToParams(opts) +} + +type RoleIdOptions struct { + ID string `help:"ID or name of role"` +} + +func (opts *RoleIdOptions) GetId() string { + return opts.ID +} + +type RoleDetailOptions struct { + RoleIdOptions + Domain string `help:"Domain"` +} + +func (opts *RoleDetailOptions) Params() (jsonutils.JSONObject, error) { + ret := jsonutils.NewDict() + if len(opts.Domain) > 0 { + ret.Add(jsonutils.NewString(opts.Domain), "domain_id") + } + return ret, nil +} + +type RoleCreateOptions struct { + NAME string `help:"Role name"` + Domain string `help:"Domain"` + Desc string `help:"Description"` + + PublicScope string `help:"public scope" choices:"none|system"` +} + +func (opts *RoleCreateOptions) Params() (jsonutils.JSONObject, error) { + params := jsonutils.NewDict() + params.Add(jsonutils.NewString(opts.NAME), "name") + if len(opts.Domain) > 0 { + params.Add(jsonutils.NewString(opts.Domain), "domain_id") + } + if len(opts.Desc) > 0 { + params.Add(jsonutils.NewString(opts.Desc), "description") + } + if len(opts.PublicScope) > 0 { + params.Add(jsonutils.NewString(opts.PublicScope), "public_scope") + } + return params, nil +}