diff --git a/pkg/cloudcommon/db/infraresource.go b/pkg/cloudcommon/db/infraresource.go index 92c632adc7..f9fad62bb7 100644 --- a/pkg/cloudcommon/db/infraresource.go +++ b/pkg/cloudcommon/db/infraresource.go @@ -265,3 +265,10 @@ func (model *SInfrasResourceBase) GetSharableTargetDomainIds() []string { func (model *SInfrasResourceBase) GetRequiredSharedDomainIds() []string { return []string{model.DomainId} } + +func (model *SInfrasResourceBase) ValidateDeleteCondition(ctx context.Context) error { + if model.IsShared() { + return httperrors.NewForbiddenError("%s %s is shared", model.Keyword(), model.Name) + } + return model.SDomainLevelResourceBase.ValidateDeleteCondition(ctx) +} diff --git a/pkg/cloudcommon/db/sharablebase.go b/pkg/cloudcommon/db/sharablebase.go index 9d0e50e8c8..54d3ed04f4 100644 --- a/pkg/cloudcommon/db/sharablebase.go +++ b/pkg/cloudcommon/db/sharablebase.go @@ -531,6 +531,14 @@ func SharableModelIsShared(model ISharableBaseModel) bool { if cnt > 0 { return true } + switch model.GetPublicScope() { + case rbacutils.ScopeSystem: + return true + case rbacutils.ScopeDomain: + if model.GetModelManager().ResourceScope() == rbacutils.ScopeProject { + return true + } + } return false } diff --git a/pkg/cloudcommon/db/sharablevirtual.go b/pkg/cloudcommon/db/sharablevirtual.go index 0177d8789a..be4e6e2429 100644 --- a/pkg/cloudcommon/db/sharablevirtual.go +++ b/pkg/cloudcommon/db/sharablevirtual.go @@ -252,3 +252,10 @@ func (model *SSharableVirtualResourceBase) GetSharableTargetDomainIds() []string func (model *SSharableVirtualResourceBase) GetRequiredSharedDomainIds() []string { return []string{model.DomainId} } + +func (model *SSharableVirtualResourceBase) ValidateDeleteCondition(ctx context.Context) error { + if model.IsShared() { + return httperrors.NewForbiddenError("%s %s is shared", model.Keyword(), model.Name) + } + return model.SVirtualResourceBase.ValidateDeleteCondition(ctx) +} diff --git a/pkg/compute/models/vpcs.go b/pkg/compute/models/vpcs.go index 26ed16de1d..00b7d40e7d 100644 --- a/pkg/compute/models/vpcs.go +++ b/pkg/compute/models/vpcs.go @@ -145,7 +145,7 @@ func (self *SVpc) ValidateDeleteCondition(ctx context.Context) error { if self.Id == api.DEFAULT_VPC_ID { return httperrors.NewProtectedResourceError("not allow to delete default vpc") } - return self.SStandaloneResourceBase.ValidateDeleteCondition(ctx) + return self.SEnabledStatusInfrasResourceBase.ValidateDeleteCondition(ctx) } func (self *SVpc) getWireQuery() *sqlchemy.SQuery { @@ -845,7 +845,7 @@ func (manager *SVpcManager) ListItemFilter( q, err = manager.SEnabledStatusInfrasResourceBaseManager.ListItemFilter(ctx, q, userCred, query.EnabledStatusInfrasResourceBaseListInput) if err != nil { - return nil, errors.Wrap(err, "SStatusStandaloneResourceBaseManager.ListItemFilter") + return nil, errors.Wrap(err, "SEnabledStatusInfrasResourceBaseManager.ListItemFilter") } q, err = manager.SExternalizedResourceBaseManager.ListItemFilter(ctx, q, userCred, query.ExternalizedResourceBaseListInput) diff --git a/pkg/image/models/image_guest.go b/pkg/image/models/image_guest.go index d31e230201..6ee6312b62 100644 --- a/pkg/image/models/image_guest.go +++ b/pkg/image/models/image_guest.go @@ -91,7 +91,7 @@ func (manager *SGuestImageManager) ValidateCreateData(ctx context.Context, userC func (gi *SGuestImage) CustomizeCreate(ctx context.Context, userCred mcclient.TokenCredential, ownerId mcclient.IIdentityProvider, query jsonutils.JSONObject, data jsonutils.JSONObject) error { - err := gi.SVirtualResourceBase.CustomizeCreate(ctx, userCred, ownerId, query, data) + err := gi.SSharableVirtualResourceBase.CustomizeCreate(ctx, userCred, ownerId, query, data) if err != nil { return err } @@ -188,7 +188,7 @@ func (gi *SGuestImage) RealDelete(ctx context.Context, userCred mcclient.TokenCr for i := range guestJoints { guestJoints[i].Delete(ctx, userCred) } - return gi.SVirtualResourceBase.Delete(ctx, userCred) + return gi.SSharableVirtualResourceBase.Delete(ctx, userCred) } func (gi *SGuestImage) CustomizeDelete(ctx context.Context, userCred mcclient.TokenCredential, @@ -262,7 +262,7 @@ func (gi *SGuestImage) DoCancelPendingDelete(ctx context.Context, userCred mccli return errors.Wrapf(err, "subimage %s cancel delete error", subImages[i].GetId()) } } - err = gi.SVirtualResourceBase.DoCancelPendingDelete(ctx, userCred) + err = gi.SSharableVirtualResourceBase.DoCancelPendingDelete(ctx, userCred) if err != nil { return err } diff --git a/pkg/image/models/images.go b/pkg/image/models/images.go index dd8965b0f0..066517f512 100644 --- a/pkg/image/models/images.go +++ b/pkg/image/models/images.go @@ -141,7 +141,7 @@ type SImage struct { } func (manager *SImageManager) CustomizeHandlerInfo(info *appsrv.SHandlerInfo) { - manager.SVirtualResourceBaseManager.CustomizeHandlerInfo(info) + manager.SSharableVirtualResourceBaseManager.CustomizeHandlerInfo(info) switch info.GetName(nil) { case "get_details", "create", "update": @@ -373,12 +373,12 @@ func (self *SImage) GetExtraDetailsHeaders(ctx context.Context, userCred mcclien } func (manager *SImageManager) ValidateCreateData(ctx context.Context, userCred mcclient.TokenCredential, ownerId mcclient.IIdentityProvider, query jsonutils.JSONObject, data *jsonutils.JSONDict) (*jsonutils.JSONDict, error) { - input := apis.VirtualResourceCreateInput{} + input := apis.SharableVirtualResourceCreateInput{} err := data.Unmarshal(&input) if err != nil { return nil, httperrors.NewInternalServerError("unmarshal StandaloneResourceCreateInput fail %s", err) } - input, err = manager.SVirtualResourceBaseManager.ValidateCreateData(ctx, userCred, ownerId, query, input) + input, err = manager.SSharableVirtualResourceBaseManager.ValidateCreateData(ctx, userCred, ownerId, query, input) if err != nil { return nil, err } @@ -400,7 +400,7 @@ func (manager *SImageManager) ValidateCreateData(ctx context.Context, userCred m } func (self *SImage) CustomizeCreate(ctx context.Context, userCred mcclient.TokenCredential, ownerId mcclient.IIdentityProvider, query jsonutils.JSONObject, data jsonutils.JSONObject) error { - err := self.SVirtualResourceBase.CustomizeCreate(ctx, userCred, ownerId, query, data) + err := self.SSharableVirtualResourceBase.CustomizeCreate(ctx, userCred, ownerId, query, data) if err != nil { return err } @@ -532,7 +532,7 @@ func (self *SImage) SaveImageFromStream(reader io.Reader, calChecksum bool) erro } func (self *SImage) PostCreate(ctx context.Context, userCred mcclient.TokenCredential, ownerId mcclient.IIdentityProvider, query jsonutils.JSONObject, data jsonutils.JSONObject) { - self.SVirtualResourceBase.PostCreate(ctx, userCred, ownerId, query, data) + self.SSharableVirtualResourceBase.PostCreate(ctx, userCred, ownerId, query, data) // if SImage belong to a guest image, pending quota will not be set. if self.IsGuestImage.IsFalse() { @@ -651,14 +651,14 @@ func (self *SImage) ValidateUpdateData(ctx context.Context, userCred mcclient.To } } } - input := apis.VirtualResourceBaseUpdateInput{} + input := apis.SharableVirtualResourceBaseUpdateInput{} err := data.Unmarshal(&input) if err != nil { return nil, errors.Wrap(err, "Unmarshal") } - input, err = self.SVirtualResourceBase.ValidateUpdateData(ctx, userCred, query, input) + input, err = self.SSharableVirtualResourceBase.ValidateUpdateData(ctx, userCred, query, input) if err != nil { - return nil, errors.Wrap(err, "SVirtualResourceBase.ValidateUpdateData") + return nil, errors.Wrap(err, "SSharableVirtualResourceBase.ValidateUpdateData") } data.Update(jsonutils.Marshal(input)) @@ -666,11 +666,11 @@ func (self *SImage) ValidateUpdateData(ctx context.Context, userCred mcclient.To } func (self *SImage) PreUpdate(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) { - self.SVirtualResourceBase.PreUpdate(ctx, userCred, query, data) + self.SSharableVirtualResourceBase.PreUpdate(ctx, userCred, query, data) } func (self *SImage) PostUpdate(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) { - self.SVirtualResourceBase.PostUpdate(ctx, userCred, query, data) + self.SSharableVirtualResourceBase.PostUpdate(ctx, userCred, query, data) if data.Contains("properties") { // update properties @@ -702,10 +702,10 @@ func (self *SImage) ValidateDeleteCondition(ctx context.Context) error { if self.IsGuestImage.IsTrue() { return httperrors.NewForbiddenError("image is the part of guest image") } - if self.IsShared() { - return httperrors.NewForbiddenError("image is shared") - } - return self.SVirtualResourceBase.ValidateDeleteCondition(ctx) + // if self.IsShared() { + // return httperrors.NewForbiddenError("image is shared") + // } + return self.SSharableVirtualResourceBase.ValidateDeleteCondition(ctx) } func (self *SImage) Delete(ctx context.Context, userCred mcclient.TokenCredential) error { @@ -714,7 +714,7 @@ func (self *SImage) Delete(ctx context.Context, userCred mcclient.TokenCredentia } func (self *SImage) RealDelete(ctx context.Context, userCred mcclient.TokenCredential) error { - return self.SVirtualResourceBase.Delete(ctx, userCred) + return self.SSharableVirtualResourceBase.Delete(ctx, userCred) } func (self *SImage) CustomizeDelete(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) error { @@ -838,7 +838,7 @@ func (manager *SImageManager) CleanPendingDeleteImages(ctx context.Context, user } func (self *SImage) DoPendingDelete(ctx context.Context, userCred mcclient.TokenCredential) error { - err := self.SVirtualResourceBase.DoPendingDelete(ctx, userCred) + err := self.SSharableVirtualResourceBase.DoPendingDelete(ctx, userCred) if err != nil { return err } @@ -850,7 +850,7 @@ func (self *SImage) DoPendingDelete(ctx context.Context, userCred mcclient.Token } func (self *SImage) DoCancelPendingDelete(ctx context.Context, userCred mcclient.TokenCredential) error { - err := self.SVirtualResourceBase.DoCancelPendingDelete(ctx, userCred) + err := self.SSharableVirtualResourceBase.DoCancelPendingDelete(ctx, userCred) if err != nil { return err }