From a9ed2da0999d353dc95c1781a14b78a8a8397c66 Mon Sep 17 00:00:00 2001
From: Qiu Jian <qiujian@yunionyun.com>
Date: Thu, 5 Mar 2020 20:06:38 +0800
Subject: [PATCH] fix: allow project do user-list, group-list, returns current
 project user and group

---
 pkg/cloudcommon/db/domain.go       |  2 +-
 pkg/cloudcommon/db/fetch.go        | 10 +++++-----
 pkg/cloudcommon/policy/defaults.go | 12 ++++++++++++
 pkg/keystone/models/groups.go      | 10 ++++++++++
 pkg/keystone/models/users.go       | 11 +++++++++++
 5 files changed, 39 insertions(+), 6 deletions(-)

diff --git a/pkg/cloudcommon/db/domain.go b/pkg/cloudcommon/db/domain.go
index 3eed14c827..c0dbbf32f1 100644
--- a/pkg/cloudcommon/db/domain.go
+++ b/pkg/cloudcommon/db/domain.go
@@ -45,7 +45,7 @@ func (manager *SDomainizedResourceBaseManager) ResourceScope() rbacutils.TRbacSc
 func (manager *SDomainizedResourceBaseManager) FilterByOwner(q *sqlchemy.SQuery, owner mcclient.IIdentityProvider, scope rbacutils.TRbacScope) *sqlchemy.SQuery {
 	if owner != nil {
 		switch scope {
-		case rbacutils.ScopeDomain:
+		case rbacutils.ScopeProject, rbacutils.ScopeDomain:
 			q = q.Equals("domain_id", owner.GetProjectDomainId())
 		}
 	}
diff --git a/pkg/cloudcommon/db/fetch.go b/pkg/cloudcommon/db/fetch.go
index 9735eb40a1..d3291f30bd 100644
--- a/pkg/cloudcommon/db/fetch.go
+++ b/pkg/cloudcommon/db/fetch.go
@@ -366,9 +366,7 @@ func FetchCheckQueryOwnerScope(ctx context.Context, userCred mcclient.TokenCrede
 				requireScope = rbacutils.ScopeSystem
 			}
 		}
-	}
-
-	if ownerId == nil {
+	} else {
 		ownerId = userCred
 		reqScopeStr, _ := data.GetString("scope")
 		if len(reqScopeStr) > 0 {
@@ -380,10 +378,12 @@ func FetchCheckQueryOwnerScope(ctx context.Context, userCred mcclient.TokenCrede
 			}
 		} else if action == policy.PolicyActionGet {
 			queryScope = allowScope
-		}
-		if resScope.HigherThan(queryScope) {
+		} else {
 			queryScope = resScope
 		}
+		// if resScope.HigherThan(queryScope) {
+		// 	queryScope = resScope
+		// }
 		requireScope = queryScope
 	}
 	if doCheckRbac && requireScope.HigherThan(allowScope) {
diff --git a/pkg/cloudcommon/policy/defaults.go b/pkg/cloudcommon/policy/defaults.go
index 68d943308e..aabe0b98fb 100644
--- a/pkg/cloudcommon/policy/defaults.go
+++ b/pkg/cloudcommon/policy/defaults.go
@@ -456,6 +456,18 @@ var (
 					Action:   PolicyActionGet,
 					Result:   rbacutils.Allow,
 				},
+				{
+					Service:  identityapi.SERVICE_TYPE,
+					Resource: "users",
+					Action:   PolicyActionList,
+					Result:   rbacutils.Allow,
+				},
+				{
+					Service:  identityapi.SERVICE_TYPE,
+					Resource: "groups",
+					Action:   PolicyActionList,
+					Result:   rbacutils.Allow,
+				},
 			},
 		},
 		{
diff --git a/pkg/keystone/models/groups.go b/pkg/keystone/models/groups.go
index 5ce7ad15a8..21ebb40cc0 100644
--- a/pkg/keystone/models/groups.go
+++ b/pkg/keystone/models/groups.go
@@ -362,3 +362,13 @@ func (group *SGroup) PerformLeave(
 	}
 	return nil, nil
 }
+
+func (manager *SGroupManager) FilterByOwner(q *sqlchemy.SQuery, owner mcclient.IIdentityProvider, scope rbacutils.TRbacScope) *sqlchemy.SQuery {
+	if owner != nil && scope == rbacutils.ScopeProject {
+		// if user has project level privilege, returns all groups in user's project
+		subq := AssignmentManager.fetchProjectGroupIdsQuery(owner.GetProjectId())
+		q = q.In("id", subq.SubQuery())
+		return q
+	}
+	return manager.SIdentityBaseResourceManager.FilterByOwner(q, owner, scope)
+}
diff --git a/pkg/keystone/models/users.go b/pkg/keystone/models/users.go
index 43e95d0d16..dbc2b73b9f 100644
--- a/pkg/keystone/models/users.go
+++ b/pkg/keystone/models/users.go
@@ -937,3 +937,14 @@ func (manager *SUserManager) LockUser(uid string) error {
 	db.OpsLog.LogEvent(usr, db.ACT_UPDATE, diff, GetDefaultAdminCred())
 	return nil
 }
+
+func (manager *SUserManager) FilterByOwner(q *sqlchemy.SQuery, owner mcclient.IIdentityProvider, scope rbacutils.TRbacScope) *sqlchemy.SQuery {
+	log.Debugf("owner: %s scope %s", jsonutils.Marshal(owner), scope)
+	if owner != nil && scope == rbacutils.ScopeProject {
+		// if user has project level privilege, returns all users in user's project
+		subq := AssignmentManager.fetchProjectUserIdsQuery(owner.GetProjectId())
+		q = q.In("id", subq.SubQuery())
+		return q
+	}
+	return manager.SEnabledIdentityBaseResourceManager.FilterByOwner(q, owner, scope)
+}