opensource/cloudpods
3
0
Fork 0
mirror of https://github.com/yunionio/cloudpods.git synced 2026-09-24 16:03:43 +08:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #554 in YUNIONIO/onecloud from ~QIUJIAN/onecloud:hotfix/qj-carray-request-info-with-rbac-explain-result to release/2.3.0

Browse Source 
* commit '2ed294eaa83dba6a19e92ed341030963614359b2':
  RBAC返回值同时携带资源信息
This commit is contained in:
邱剑
2018-11-22 12:30:00 +08:00
parent 941f365945 2ed294eaa8
commit aa88e13f1d
1 changed files with 21 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/cloudcommon/policy/policy.go
+21 -15
View File
@@ -203,20 +203,10 @@ func (manager *SPolicyManager) Allow(isAdmin bool, userCred mcclient.TokenCreden
return currentPriv
}
func (manager *SPolicyManager) explainPolicy(userCred mcclient.TokenCredential, policyReq jsonutils.JSONObject) (rbacutils.TRbacResult, error) {
func (manager *SPolicyManager) explainPolicy(userCred mcclient.TokenCredential, policyReq jsonutils.JSONObject) ([]string, rbacutils.TRbacResult, error) {
policySeq, err := policyReq.GetArray()
if err != nil {
return rbacutils.Deny, httperrors.NewInputParameterError("invalid format")
}
isAdmin, _ := policySeq[0].Bool()
if !consts.IsRbacEnabled() {
if !isAdmin {
return rbacutils.OwnerAllow, nil
} else if isAdmin && userCred.IsSystemAdmin() {
return rbacutils.AdminAllow, nil
} else {
return rbacutils.Deny, httperrors.NewForbiddenError("operation not allowed")
}
return nil, rbacutils.Deny, httperrors.NewInputParameterError("invalid format")
}
service := rbacutils.WILD_MATCH
resource := rbacutils.WILD_MATCH
@@ -238,7 +228,22 @@ func (manager *SPolicyManager) explainPolicy(userCred mcclient.TokenCredential,
}
}
return manager.Allow(isAdmin, userCred, service, resource, action, extra...), nil
reqStrs := []string{service, resource, action}
if len(extra) > 0 {
reqStrs = append(reqStrs, extra...)
}
isAdmin, _ := policySeq[0].Bool()
if !consts.IsRbacEnabled() {
if !isAdmin {
return reqStrs, rbacutils.OwnerAllow, nil
} else if isAdmin && userCred.IsSystemAdmin() {
return reqStrs, rbacutils.AdminAllow, nil
} else {
return reqStrs, rbacutils.Deny, httperrors.NewForbiddenError("operation not allowed")
}
}
return reqStrs, manager.Allow(isAdmin, userCred, service, resource, action, extra...), nil
}
func (manager *SPolicyManager) ExplainRpc(userCred mcclient.TokenCredential, params jsonutils.JSONObject) (jsonutils.JSONObject, error) {
@@ -248,11 +253,12 @@ func (manager *SPolicyManager) ExplainRpc(userCred mcclient.TokenCredential, par
}
ret := jsonutils.NewDict()
for key, policyReq := range paramDict {
result, err := manager.explainPolicy(userCred, policyReq)
reqStrs, result, err := manager.explainPolicy(userCred, policyReq)
if err != nil {
return nil, err
}
ret.Add(jsonutils.NewString(string(result)), key)
reqStrs = append(reqStrs, string(result))
ret.Add(jsonutils.NewStringArray(reqStrs), key)
}
return ret, nil
}