Merge pull request #16108 from ioito/hotfix/qx-user-filter-by-role-assignment

fix(keystone): filter users by role assignment domain

cmd/climc/shell/identity/users.go

@@ -27,11 +27,12 @@ import (
 func init() {
 	type UserListOptions struct {
 		options.BaseListOptions
-		Name          string `help:"Filter by name"`
-		OrderByDomain string `help:"order by domain name" choices:"asc|desc"`
-		Role          string `help:"Filter by role"`
-		IdpId         string `help:"filter by idp_id"`
-		IdpEntityId   string `help:"filter by idp_entity_id"`
+		Name                   string `help:"Filter by name"`
+		OrderByDomain          string `help:"order by domain name" choices:"asc|desc"`
+		Role                   string `help:"Filter by role"`
+		RoleAssignmentDomainId string `help:"filter role assignment domain"`
+		IdpId                  string `help:"filter by idp_id"`
+		IdpEntityId            string `help:"filter by idp_entity_id"`
 	}
 	R(&UserListOptions{}, "user-list", "List users", func(s *mcclient.ClientSession, args *UserListOptions) error {
 		params, err := options.ListStructToParams(args)

pkg/apis/identity/input.go

@@ -189,6 +189,9 @@ type UserListInput struct {
 	ProjectFilterListInput
 	RoleFilterListInput
 
+	// 角色生效所在的域
+	RoleAssignmentDomainId string `json:"role_assignment_domain_id"`
+
 	// email
 	Email string `json:"email"`
 	// mobile

pkg/keystone/models/users.go

@@ -413,8 +413,21 @@ func (manager *SUserManager) ListItemFilter(
 				return nil, httperrors.NewGeneralError(err)
 			}
 		}
-		subq := AssignmentManager.fetchRoleUserIdsQuery(role.GetId())
-		q = q.In("id", subq.SubQuery())
+
+		subq := AssignmentManager.Query("actor_id").Equals("role_id", role.GetId()).Equals("type", api.AssignmentUserProject).Distinct()
+		if len(query.RoleAssignmentDomainId) > 0 {
+			domain, err := DomainManager.FetchByIdOrName(userCred, query.RoleAssignmentDomainId)
+			if err != nil {
+				if err == sql.ErrNoRows {
+					return nil, httperrors.NewResourceNotFoundError2(DomainManager.Keyword(), query.RoleAssignmentDomainId)
+				} else {
+					return nil, httperrors.NewGeneralError(err)
+				}
+			}
+			projects := ProjectManager.Query("id").Equals("domain_id", domain.GetId()).SubQuery()
+			subq = subq.In("target_id", projects.Query())
+		}
+		q = q.In("id", subq.SubQuery().Query())
 	}
 
 	if len(query.IdpId) > 0 {