opensource/cloudpods
3
0
Fork 0
mirror of https://github.com/yunionio/cloudpods.git synced 2026-08-29 03:51:54 +08:00
Code Issues Packages Projects Releases Wiki Activity

fix(keystone): policy filter by role

Browse Source
This commit is contained in:
Qu Xuan
2021-07-20 14:07:02 +08:00
parent 6ca9ef3e45
commit 7ec42db3ca
7 changed files with 137 additions and 129 deletions
Download Patch File Download Diff File Expand all files Collapse all files
cmd/climc/shell/identity/policies.go
+4 -20
View File
@@ -24,13 +24,14 @@ import (
"yunion.io/x/jsonutils"
"yunion.io/x/log"
"yunion.io/x/onecloud/cmd/climc/shell"
api "yunion.io/x/onecloud/pkg/apis/identity"
"yunion.io/x/onecloud/pkg/cloudcommon/consts"
"yunion.io/x/onecloud/pkg/cloudcommon/policy"
"yunion.io/x/onecloud/pkg/mcclient"
"yunion.io/x/onecloud/pkg/mcclient/auth"
"yunion.io/x/onecloud/pkg/mcclient/modules"
"yunion.io/x/onecloud/pkg/mcclient/options"
"yunion.io/x/onecloud/pkg/mcclient/options/identity"
"yunion.io/x/onecloud/pkg/util/fileutils2"
"yunion.io/x/onecloud/pkg/util/rbacutils"
"yunion.io/x/onecloud/pkg/util/shellutils"
@@ -74,25 +75,8 @@ func createPolicy(s *mcclient.ClientSession, name string, policy string, domain
}
func init() {
type PolicyListOptions struct {
options.BaseListOptions
Type string `help:"filter by type"`
IsSystem *bool `help:"filter by is_system" negative:"is_no_system"`
Format string `help:"policy format, default to yaml" default:"yaml" choices:"yaml|json"`
OrderByDomain string `help:"order by domain name" choices:"asc|desc"`
}
R(&PolicyListOptions{}, "policy-list", "List all policies", func(s *mcclient.ClientSession, args *PolicyListOptions) error {
params, err := options.ListStructToParams(args)
if err != nil {
return err
}
result, err := modules.Policies.List(s, params)
if err != nil {
return err
}
printList(result, modules.Policies.GetColumns(s))
return nil
})
cmd := shell.NewResourceCmd(&modules.Policies)
cmd.List(&identity.PolicyListOptions{})
type PolicyCreateOptions struct {
Domain string `help:"domain of the policy"`
cmd/climc/shell/identity/roles.go
+9 -109
View File
@@ -17,100 +17,21 @@ package identity
import (
"yunion.io/x/jsonutils"
"yunion.io/x/onecloud/cmd/climc/shell"
"yunion.io/x/onecloud/pkg/mcclient"
"yunion.io/x/onecloud/pkg/mcclient/modules"
"yunion.io/x/onecloud/pkg/mcclient/options"
"yunion.io/x/onecloud/pkg/mcclient/options/identity"
)
func init() {
type RoleListOptions struct {
options.BaseListOptions
OrderByDomain string `help:"order by domain name" choices:"asc|desc"`
}
R(&RoleListOptions{}, "role-list", "List keystone Roles", func(s *mcclient.ClientSession, args *RoleListOptions) error {
params, err := options.ListStructToParams(args)
if err != nil {
return err
}
result, err := modules.RolesV3.List(s, params)
if err != nil {
return err
}
printList(result, modules.RolesV3.GetColumns(s))
return nil
})
type RoleDetailOptions struct {
ID string `help:"ID or name of role"`
Domain string `help:"Domain"`
}
R(&RoleDetailOptions{}, "role-show", "Show details of a role", func(s *mcclient.ClientSession, args *RoleDetailOptions) error {
query := jsonutils.NewDict()
if len(args.Domain) > 0 {
domainId, err := modules.Domains.GetId(s, args.Domain, nil)
if err != nil {
return err
}
query.Add(jsonutils.NewString(domainId), "domain_id")
}
role, err := modules.RolesV3.Get(s, args.ID, query)
if err != nil {
return err
}
printObject(role)
return nil
})
R(&RoleDetailOptions{}, "role-delete", "Delete a role", func(s *mcclient.ClientSession, args *RoleDetailOptions) error {
query := jsonutils.NewDict()
if len(args.Domain) > 0 {
domainId, err := modules.Domains.GetId(s, args.Domain, nil)
if err != nil {
return err
}
query.Add(jsonutils.NewString(domainId), "domain_id")
}
rid, err := modules.RolesV3.GetId(s, args.ID, query)
if err != nil {
return err
}
role, err := modules.RolesV3.Delete(s, rid, nil)
if err != nil {
return err
}
printObject(role)
return nil
})
type RoleCreateOptions struct {
NAME string `help:"Role name"`
Domain string `help:"Domain"`
Desc string `help:"Description"`
PublicScope string `help:"public scope" choices:"none|system"`
}
R(&RoleCreateOptions{}, "role-create", "Create a new role", func(s *mcclient.ClientSession, args *RoleCreateOptions) error {
params := jsonutils.NewDict()
params.Add(jsonutils.NewString(args.NAME), "name")
if len(args.Domain) > 0 {
domainId, err := modules.Domains.GetId(s, args.Domain, nil)
if err != nil {
return err
}
params.Add(jsonutils.NewString(domainId), "domain_id")
}
if len(args.Desc) > 0 {
params.Add(jsonutils.NewString(args.Desc), "description")
}
if len(args.PublicScope) > 0 {
params.Add(jsonutils.NewString(args.PublicScope), "public_scope")
}
role, err := modules.RolesV3.Create(s, params)
if err != nil {
return err
}
printObject(role)
return nil
})
cmd := shell.NewResourceCmd(&modules.RolesV3)
cmd.List(&identity.RoleListOptions{})
cmd.Show(&identity.RoleDetailOptions{})
cmd.Delete(&identity.RoleDetailOptions{})
cmd.Create(&identity.RoleCreateOptions{})
cmd.Perform("public", &options.BaseIdOptions{})
cmd.Perform("private", &options.BaseIdOptions{})
type RoleUpdateOptions struct {
ID string `help:"Role ID or Name"`
@@ -145,25 +66,4 @@ func init() {
printObject(role)
return nil
})
type RolePerformOptions struct {
ID string `help:"ID of role to update"`
}
R(&RolePerformOptions{}, "role-public", "Mark a role public", func(s *mcclient.ClientSession, args *RolePerformOptions) error {
result, err := modules.RolesV3.PerformAction(s, args.ID, "public", nil)
if err != nil {
return err
}
printObject(result)
return nil
})
R(&RolePerformOptions{}, "role-private", "Mark a role private", func(s *mcclient.ClientSession, args *RolePerformOptions) error {
result, err := modules.RolesV3.PerformAction(s, args.ID, "private", nil)
if err != nil {
return err
}
printObject(result)
return nil
})
}
pkg/apis/identity/input.go
+6
View File
@@ -346,6 +346,12 @@ type PolicyListInput struct {
// 是否显示系统权限
IsSystem *bool `json:"is_system"`
// filter policies by role id
RoleId string `json:"role_id"`
// swagger: ignore
// Deprecated
Role string `json:"role" yunion-deprecated-by:"role_id"`
}
type RegionFilterListInput struct {
pkg/keystone/models/policies.go
+9
View File
@@ -32,6 +32,7 @@ import (
"yunion.io/x/onecloud/pkg/cloudcommon/db"
"yunion.io/x/onecloud/pkg/cloudcommon/db/quotas"
policyman "yunion.io/x/onecloud/pkg/cloudcommon/policy"
"yunion.io/x/onecloud/pkg/cloudcommon/validators"
"yunion.io/x/onecloud/pkg/httperrors"
"yunion.io/x/onecloud/pkg/keystone/locale"
"yunion.io/x/onecloud/pkg/mcclient"
@@ -467,6 +468,14 @@ func (manager *SPolicyManager) ListItemFilter(
if err != nil {
return nil, errors.Wrap(err, "SSharableBaseResourceManager.ListItemFilter")
}
if len(query.RoleId) > 0 {
_, err := validators.ValidateModel(userCred, RoleManager, &query.RoleId)
if err != nil {
return nil, err
}
sq := RolePolicyManager.Query("policy_id").Equals("role_id", query.RoleId).SubQuery()
q = q.In("id", sq)
}
if len(query.Type) > 0 {
q = q.In("type", query.Type)
}
pkg/mcclient/options/identity/doc.go
+1
View File
@@ -0,0 +1 @@
package identity // import "yunion.io/x/onecloud/pkg/mcclient/options/identity"
pkg/mcclient/options/identity/policy.go
+34
View File
@@ -0,0 +1,34 @@
// Copyright 2019 Yunion
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
// http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
package identity
import (
"yunion.io/x/jsonutils"
"yunion.io/x/onecloud/pkg/mcclient/options"
)
type PolicyListOptions struct {
options.BaseListOptions
Type string `help:"filter by type"`
IsSystem *bool `help:"filter by is_system" negative:"is_no_system"`
Format string `help:"policy format, default to yaml" default:"yaml" choices:"yaml|json"`
OrderByDomain string `help:"order by domain name" choices:"asc|desc"`
Role string `help:"filter by role"`
}
func (opts *PolicyListOptions) Params() (jsonutils.JSONObject, error) {
return options.ListStructToParams(opts)
}
pkg/mcclient/options/identity/roles.go
+74
View File
@@ -0,0 +1,74 @@
// Copyright 2019 Yunion
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
// http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
package identity
import (
"yunion.io/x/jsonutils"
"yunion.io/x/onecloud/pkg/mcclient/options"
)
type RoleListOptions struct {
options.BaseListOptions
OrderByDomain string `help:"order by domain name" choices:"asc|desc"`
}
func (opts *RoleListOptions) Params() (jsonutils.JSONObject, error) {
return options.ListStructToParams(opts)
}
type RoleIdOptions struct {
ID string `help:"ID or name of role"`
}
func (opts *RoleIdOptions) GetId() string {
return opts.ID
}
type RoleDetailOptions struct {
RoleIdOptions
Domain string `help:"Domain"`
}
func (opts *RoleDetailOptions) Params() (jsonutils.JSONObject, error) {
ret := jsonutils.NewDict()
if len(opts.Domain) > 0 {
ret.Add(jsonutils.NewString(opts.Domain), "domain_id")
}
return ret, nil
}
type RoleCreateOptions struct {
NAME string `help:"Role name"`
Domain string `help:"Domain"`
Desc string `help:"Description"`
PublicScope string `help:"public scope" choices:"none|system"`
}
func (opts *RoleCreateOptions) Params() (jsonutils.JSONObject, error) {
params := jsonutils.NewDict()
params.Add(jsonutils.NewString(opts.NAME), "name")
if len(opts.Domain) > 0 {
params.Add(jsonutils.NewString(opts.Domain), "domain_id")
}
if len(opts.Desc) > 0 {
params.Add(jsonutils.NewString(opts.Desc), "description")
}
if len(opts.PublicScope) > 0 {
params.Add(jsonutils.NewString(opts.PublicScope), "public_scope")
}
return params, nil
}