opensource/cloudpods
3
0
Fork 0
mirror of https://github.com/yunionio/cloudpods.git synced 2026-09-24 16:03:43 +08:00
Code Issues Packages Projects Releases Wiki Activity

fix: scope resource filter by owner

Browse Source
This commit is contained in:
Qiu Jian
2020-09-23 21:21:07 +08:00
parent 02446a2659
commit 4a27d49123
1 changed files with 26 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/cloudcommon/db/scoperesource.go
+26 -2
View File
@@ -116,9 +116,33 @@ func (m *SScopedResourceBaseManager) FilterByOwner(q *sqlchemy.SQuery, userCred
}
switch scope {
case rbacutils.ScopeDomain:
q = q.Equals("domain_id", userCred.GetProjectDomainId())
q = q.Filter(sqlchemy.OR(
// share to system
sqlchemy.AND(
sqlchemy.IsNullOrEmpty(q.Field("domain_id")),
sqlchemy.IsNullOrEmpty(q.Field("tenant_id")),
),
// share to this domain or its sub-projects
sqlchemy.Equals(q.Field("domain_id"), userCred.GetProjectDomainId()),
))
case rbacutils.ScopeProject:
q = q.Equals("tenant_id", userCred.GetProjectId())
q = q.Filter(sqlchemy.OR(
// share to system
sqlchemy.AND(
sqlchemy.IsNullOrEmpty(q.Field("domain_id")),
sqlchemy.IsNullOrEmpty(q.Field("tenant_id")),
),
// share to project's parent domain
sqlchemy.AND(
sqlchemy.Equals(q.Field("domain_id"), userCred.GetProjectDomainId()),
sqlchemy.IsNullOrEmpty(q.Field("tenant_id")),
),
// share to this project
sqlchemy.AND(
sqlchemy.Equals(q.Field("domain_id"), userCred.GetProjectDomainId()),
sqlchemy.Equals(q.Field("tenant_id"), userCred.GetProjectId()),
),
))
}
return q
}