Merge pull request #5411 from swordqiu/hotfix/qj-missing-keystone-glance-list-filter

fix: complete keystone/glance list filter

pkg/apis/identity/input.go

@@ -43,6 +43,12 @@ type EnabledIdentityBaseResourceListInput struct {
 }
 
 type ProjectFilterListInput struct {
+	// 项目归属域
+	ProjectDomain string `json:"project_domain"`
+	// swagger:ignore
+	// Deprecated
+	ProjectDomainId string `json:"project_domain_id" deprecated-by:"project-domain"`
+
 	// 以项目（ID或Name）过滤列表结果
 	Project string `json:"project"`
 	// swagger:ignore
@@ -60,6 +66,12 @@ type ProjectFilterListInput struct {
 }
 
 type UserFilterListInput struct {
+	// 用户归属域
+	UserDomain string `json:"user_domain"`
+	// swagger:ignore
+	// Deprecated
+	UserDomainId string `json:"user_domain_id"`
+
 	// filter by user
 	User string `json:"user"`
 	// swagger:ignore
@@ -69,6 +81,12 @@ type UserFilterListInput struct {
 }
 
 type GroupFilterListInput struct {
+	// 组归属域
+	GroupDomain string `json:"group_domain"`
+	// swagger:ignore
+	// Deprecated
+	GroupDomainId string `json:"group_domain_id"`
+
 	// filter by group
 	Group string `json:"group"`
 	// swagger:ignore
@@ -78,6 +96,12 @@ type GroupFilterListInput struct {
 }
 
 type RoleFilterListInput struct {
+	// 角色归属域
+	RoleDomain string `json:"role_domain"`
+	// swagger:ignore
+	// Deprecated
+	RoleDomainId string `json:"role_domain_id"`
+
 	// filter by role
 	Role string `json:"role"`
 	// swagger:ignore
@@ -87,6 +111,9 @@ type RoleFilterListInput struct {
 }
 
 type ServiceFilterListInput struct {
+	// 服务类型过滤
+	ServiceType string `json:"service_type"`
+
 	// 服务名称或ID过滤
 	Service string `json:"service"`
 	// swagger:ignore
@@ -112,6 +139,9 @@ type GroupListInput struct {
 
 	UserFilterListInput
 	ProjectFilterListInput
+
+	// 名称过滤
+	Displayname string `json:"displayname"`
 }
 
 type ProjectListInput struct {
@@ -123,6 +153,8 @@ type ProjectListInput struct {
 
 type DomainListInput struct {
 	apis.StandaloneResourceListInput
+
+	Enabled *bool `json:"enabled"`
 }
 
 type UserListInput struct {
@@ -131,12 +163,32 @@ type UserListInput struct {
 	GroupFilterListInput
 	ProjectFilterListInput
 	RoleFilterListInput
+
+	// email
+	Email string `json:"email"`
+	// mobile
+	Mobile string `json:"mobile"`
+	// displayname
+	Displayname string `json:"displayname"`
+
+	// 是否允许web控制台登录
+	AllowWebConsole *bool `json:"allow_web_console"`
+
+	// 是否开启MFA认证
+	EnableMfa *bool `json:"enable_mfa"`
 }
 
 type EndpointListInput struct {
 	apis.StandaloneResourceListInput
 
 	ServiceFilterListInput
+	RegionFilterListInput
+
+	// 以Endpoint接口类型过滤，可能值为: internal, internalURL, public, publicURL, admin, adminURL, console
+	Interface string `json:"interface"`
+
+	// 是否启用
+	Enabled *bool `json:"enabled"`
 }
 
 type SJoinProjectsInput struct {
@@ -232,15 +284,42 @@ func (input SProjectRemoveUserGroupInput) Validate() error {
 
 type IdentityProviderListInput struct {
 	apis.EnabledStatusStandaloneResourceListInput
+
+	// 以驱动类型过滤
+	Driver string `json:"driver"`
+
+	// 以模板过滤
+	Template string `json:"template"`
+
+	// 以同步状态过滤
+	SyncStatus string `json:"sync_status"`
 }
 
 type CredentialListInput struct {
 	apis.StandaloneResourceListInput
+
+	UserFilterListInput
+	ProjectFilterListInput
+
+	Type string `json:"type"`
+
+	Enabled *bool `json:"enabled"`
 }
 
 type PolicyListInput struct {
 	EnabledIdentityBaseResourceListInput
 	apis.SharableResourceBaseListInput
+
+	// 以类型查询
+	Type string `json:"type"`
+}
+
+type RegionFilterListInput struct {
+	// 以区域名称或ID过滤
+	Region string `json:"region"`
+	// swagger:ignore
+	// Deprecated
+	RegionId string `json:"region_id" deprecated-by:"region"`
 }
 
 type RegionListInput struct {
@@ -252,4 +331,7 @@ type ServiceListInput struct {
 
 	// 以Service Type过滤
 	Type string `json:"type"`
+
+	// 是否启用/禁用
+	Enabled *bool `json:"enabled"`
 }

pkg/apis/image/image.go

@@ -27,10 +27,25 @@ type ImageListInput struct {
 	DiskFormats []string `json:"disk_formats"`
 	// 列出是否支持UEFI启动的镜像
 	Uefi *bool `json:"uefi"`
+
+	// 是否为标准镜像
+	IsStandard *bool `json:"is_standard"`
+
+	// 是否删除保护
+	Protected *bool `json:"protected"`
+
+	// 是否为主机镜像的子镜像
+	IsGuestImage *bool `json:"is_guest_image"`
+
+	// 是否为数据盘
+	IsData *bool `json:"is_data"`
 }
 
 type GuestImageListInput struct {
 	apis.SharableVirtualResourceListInput
+
+	// 是否删除保护
+	Protected *bool `json:"protected"`
 }
 
 type ImageDetails struct {

pkg/apis/list.go

@@ -141,7 +141,7 @@ type ResourceBaseListInput struct {
 
 type SharableVirtualResourceListInput struct {
 	VirtualResourceListInput
-
+	SharableResourceBaseListInput
 	// 根据资源的共享范围过滤列表，可能值为：system, domain, project
 	PublicScope string `json:"public_scope"`
 }

pkg/cloudcommon/db/sharablevirtual.go

@@ -296,6 +296,16 @@ func (manager *SSharableVirtualResourceBaseManager) ListItemFilter(
 	if err != nil {
 		return nil, errors.Wrap(err, "SVirtualResourceBaseManager.ListItemFilter")
 	}
+	if query.IsPublic != nil {
+		if *query.IsPublic {
+			q = q.IsTrue("is_public")
+		} else {
+			q = q.IsFalse("is_public")
+		}
+	}
+	if len(query.PublicScope) > 0 {
+		q = q.Equals("public_scope", query.PublicScope)
+	}
 	return q, nil
 }
 

pkg/cloudcommon/db/tenantcache.go

@@ -21,10 +21,9 @@ import (
 	"runtime/debug"
 	"time"
 
-	"github.com/pkg/errors"
-
 	"yunion.io/x/jsonutils"
 	"yunion.io/x/log"
+	"yunion.io/x/pkg/errors"
 	"yunion.io/x/sqlchemy"
 
 	identityapi "yunion.io/x/onecloud/pkg/apis/identity"

pkg/image/models/image_guest.go

@@ -562,6 +562,13 @@ func (manager *SGuestImageManager) ListItemFilter(
 	if err != nil {
 		return nil, errors.Wrap(err, "SSharableVirtualResourceBaseManager.ListItemFilter")
 	}
+	if query.Protected != nil {
+		if *query.Protected {
+			q = q.IsTrue("protected")
+		} else {
+			q = q.IsFalse("protected")
+		}
+	}
 	return q, nil
 }
 

pkg/image/models/images.go

@@ -1149,6 +1149,34 @@ func (manager *SImageManager) ListItemFilter(
 			Equals("name", api.IMAGE_UEFI_SUPPORT).Equals("value", "true").SubQuery()
 		q = q.Join(imagePropertyQ, sqlchemy.Equals(q.Field("id"), imagePropertyQ.Field("image_id")))
 	}
+	if query.IsStandard != nil {
+		if *query.IsStandard {
+			q = q.IsTrue("is_standard")
+		} else {
+			q = q.IsFalse("is_standard")
+		}
+	}
+	if query.Protected != nil {
+		if *query.Protected {
+			q = q.IsTrue("protected")
+		} else {
+			q = q.IsFalse("protected")
+		}
+	}
+	if query.IsGuestImage != nil {
+		if *query.IsGuestImage {
+			q = q.IsTrue("is_guest_image")
+		} else {
+			q = q.IsFalse("is_guest_image")
+		}
+	}
+	if query.IsData != nil {
+		if *query.IsData {
+			q = q.IsTrue("is_data")
+		} else {
+			q = q.IsFalse("is_data")
+		}
+	}
 	return q, nil
 }
 

pkg/keystone/models/credentials.go

@@ -37,6 +37,8 @@ import (
 
 type SCredentialManager struct {
 	db.SStandaloneResourceBaseManager
+	SUserResourceBaseManager
+	SProjectResourceBaseManager
 }
 
 var CredentialManager *SCredentialManager
@@ -292,6 +294,24 @@ func (manager *SCredentialManager) ListItemFilter(
 	if err != nil {
 		return nil, errors.Wrap(err, "SStandaloneResourceBaseManager.ListItemFilter")
 	}
+	q, err = manager.SUserResourceBaseManager.ListItemFilter(ctx, q, userCred, query.UserFilterListInput)
+	if err != nil {
+		return nil, errors.Wrap(err, "SUserResourceBaseManager.ListItemFilter")
+	}
+	q, err = manager.SProjectResourceBaseManager.ListItemFilter(ctx, q, userCred, query.ProjectFilterListInput)
+	if err != nil {
+		return nil, errors.Wrap(err, "SProjectResourceBaseManager.ListItemFilter")
+	}
+	if query.Enabled != nil {
+		if *query.Enabled {
+			q = q.IsTrue("enabled")
+		} else {
+			q = q.IsFalse("enabled")
+		}
+	}
+	if len(query.Type) > 0 {
+		q = q.Equals("type", query.Type)
+	}
 	return q, nil
 }
 

pkg/keystone/models/domains.go

@@ -181,6 +181,15 @@ func (manager *SDomainManager) ListItemFilter(
 		return nil, errors.Wrap(err, "SStandaloneResourceBaseManager.ListItemFilter")
 	}
 	q = q.NotEquals("id", api.KeystoneDomainRoot)
+
+	if query.Enabled != nil {
+		if *query.Enabled {
+			q = q.IsTrue("enabled")
+		} else {
+			q = q.IsFalse("enabled")
+		}
+	}
+
 	return q, nil
 }
 

pkg/keystone/models/endpoints.go

@@ -18,6 +18,7 @@ import (
 	"context"
 	"database/sql"
 	"fmt"
+	"strings"
 
 	"yunion.io/x/jsonutils"
 	"yunion.io/x/pkg/errors"
@@ -35,6 +36,8 @@ import (
 
 type SEndpointManager struct {
 	db.SStandaloneResourceBaseManager
+	SServiceResourceBaseManager
+	SRegionResourceBaseManager
 }
 
 var EndpointManager *SEndpointManager
@@ -351,18 +354,27 @@ func (manager *SEndpointManager) ListItemFilter(
 	if err != nil {
 		return nil, errors.Wrap(err, "SStandaloneResourceBaseManager.ListItemFilter")
 	}
-	svcStr := query.Service
-	if len(svcStr) > 0 {
-		svcObj, err := ServiceManager.FetchByIdOrName(userCred, svcStr)
-		if err != nil {
-			if err == sql.ErrNoRows {
-				return nil, httperrors.NewResourceNotFoundError2(ServiceManager.Keyword(), svcStr)
-			} else {
-				return nil, httperrors.NewGeneralError(err)
-			}
+	q, err = manager.SServiceResourceBaseManager.ListItemFilter(ctx, q, userCred, query.ServiceFilterListInput)
+	if err != nil {
+		return nil, errors.Wrap(err, "SServiceResourceBaseManager.ListItemFilter")
+	}
+	q, err = manager.SRegionResourceBaseManager.ListItemFilter(ctx, q, userCred, query.RegionFilterListInput)
+	if err != nil {
+		return nil, errors.Wrap(err, "SRegionResourceBaseManager.ListItemFilter")
+	}
+	if query.Enabled != nil {
+		if *query.Enabled {
+			q = q.IsTrue("enabled")
+		} else {
+			q = q.IsFalse("enabled")
 		}
-		subq := ServiceManager.Query("id").Equals("id", svcObj.GetId())
-		q = q.Equals("service_id", subq.SubQuery())
+	}
+	if len(query.Interface) > 0 {
+		infType := query.Interface
+		if strings.HasSuffix(infType, "URL") {
+			infType = infType[0 : len(infType)-3]
+		}
+		q = q.Equals("interface", infType)
 	}
 	return q, nil
 }

pkg/keystone/models/groupresource.go

@@ -0,0 +1,68 @@
+// Copyright 2019 Yunion
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package models
+
+import (
+	"context"
+	"database/sql"
+
+	"yunion.io/x/pkg/errors"
+	"yunion.io/x/sqlchemy"
+
+	api "yunion.io/x/onecloud/pkg/apis/identity"
+	"yunion.io/x/onecloud/pkg/cloudcommon/db"
+	"yunion.io/x/onecloud/pkg/httperrors"
+	"yunion.io/x/onecloud/pkg/mcclient"
+)
+
+type SGroupResourceBaseManager struct{}
+
+func (manager *SGroupResourceBaseManager) ListItemFilter(
+	ctx context.Context,
+	q *sqlchemy.SQuery,
+	userCred mcclient.TokenCredential,
+	query api.GroupFilterListInput,
+) (*sqlchemy.SQuery, error) {
+	if len(query.Group) > 0 {
+		var ownerId mcclient.IIdentityProvider
+		if len(query.GroupDomain) > 0 {
+			domain, err := DomainManager.FetchDomainByIdOrName(query.GroupDomain)
+			if err != nil {
+				if errors.Cause(err) == sql.ErrNoRows {
+					return nil, httperrors.NewResourceNotFoundError2(DomainManager.Keyword(), query.GroupDomain)
+				} else {
+					return nil, errors.Wrap(err, "DomainManager.FetchDomainByIdOrName")
+				}
+			}
+			ownerId = &db.SOwnerId{
+				Domain:   domain.Name,
+				DomainId: domain.Id,
+			}
+
+		} else {
+			ownerId = userCred
+		}
+		groupObj, err := GroupManager.FetchByIdOrName(ownerId, query.Group)
+		if err != nil {
+			if errors.Cause(err) == sql.ErrNoRows {
+				return nil, httperrors.NewResourceNotFoundError2(GroupManager.Keyword(), query.Group)
+			} else {
+				return nil, errors.Wrap(err, "GroupManager.FetchByIdOrName")
+			}
+		}
+		q = q.Equals("group_id", groupObj.GetId())
+	}
+	return q, nil
+}

pkg/keystone/models/groups.go

@@ -87,6 +87,10 @@ func (manager *SGroupManager) ListItemFilter(
 		return nil, err
 	}
 
+	if len(query.Displayname) > 0 {
+		q = q.Equals("displayname", query.Displayname)
+	}
+
 	userIdStr := query.User
 	if len(userIdStr) > 0 {
 		user, err := UserManager.FetchById(userIdStr)

pkg/keystone/models/identity_provider.go

@@ -842,7 +842,15 @@ func (manager *SIdentityProviderManager) ListItemFilter(
 	if err != nil {
 		return nil, errors.Wrap(err, "SEnabledStatusStandaloneResourceBaseManager.ListItemFilter")
 	}
-
+	if len(query.Driver) > 0 {
+		q = q.Equals("driver", query.Driver)
+	}
+	if len(query.Template) > 0 {
+		q = q.Equals("template", query.Template)
+	}
+	if len(query.SyncStatus) > 0 {
+		q = q.Equals("sync_status", query.SyncStatus)
+	}
 	return q, nil
 }
 

pkg/keystone/models/policies.go

@@ -222,6 +222,9 @@ func (manager *SPolicyManager) ListItemFilter(
 	if err != nil {
 		return nil, errors.Wrap(err, "SSharableBaseResourceManager.ListItemFilter")
 	}
+	if len(query.Type) > 0 {
+		q = q.Equals("type", query.Type)
+	}
 	return q, nil
 }
 

pkg/keystone/models/projectresource.go

@@ -0,0 +1,68 @@
+// Copyright 2019 Yunion
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package models
+
+import (
+	"context"
+	"database/sql"
+
+	"yunion.io/x/pkg/errors"
+	"yunion.io/x/sqlchemy"
+
+	api "yunion.io/x/onecloud/pkg/apis/identity"
+	"yunion.io/x/onecloud/pkg/cloudcommon/db"
+	"yunion.io/x/onecloud/pkg/httperrors"
+	"yunion.io/x/onecloud/pkg/mcclient"
+)
+
+type SProjectResourceBaseManager struct{}
+
+func (manager *SProjectResourceBaseManager) ListItemFilter(
+	ctx context.Context,
+	q *sqlchemy.SQuery,
+	userCred mcclient.TokenCredential,
+	query api.ProjectFilterListInput,
+) (*sqlchemy.SQuery, error) {
+	if len(query.Project) > 0 {
+		var ownerId mcclient.IIdentityProvider
+		if len(query.ProjectDomain) > 0 {
+			domain, err := DomainManager.FetchDomainByIdOrName(query.ProjectDomain)
+			if err != nil {
+				if errors.Cause(err) == sql.ErrNoRows {
+					return nil, httperrors.NewResourceNotFoundError2(DomainManager.Keyword(), query.ProjectDomain)
+				} else {
+					return nil, errors.Wrap(err, "DomainManager.FetchDomainByIdOrName")
+				}
+			}
+			ownerId = &db.SOwnerId{
+				Domain:   domain.Name,
+				DomainId: domain.Id,
+			}
+
+		} else {
+			ownerId = userCred
+		}
+		projObj, err := ProjectManager.FetchByIdOrName(ownerId, query.Project)
+		if err != nil {
+			if errors.Cause(err) == sql.ErrNoRows {
+				return nil, httperrors.NewResourceNotFoundError2(ProjectManager.Keyword(), query.Project)
+			} else {
+				return nil, errors.Wrap(err, "ProjectManager.FetchByIdOrName")
+			}
+		}
+		q = q.Equals("project_id", projObj.GetId())
+	}
+	return q, nil
+}

pkg/keystone/models/regionresource.go

@@ -0,0 +1,49 @@
+// Copyright 2019 Yunion
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package models
+
+import (
+	"context"
+	"database/sql"
+
+	"yunion.io/x/pkg/errors"
+	"yunion.io/x/sqlchemy"
+
+	api "yunion.io/x/onecloud/pkg/apis/identity"
+	"yunion.io/x/onecloud/pkg/httperrors"
+	"yunion.io/x/onecloud/pkg/mcclient"
+)
+
+type SRegionResourceBaseManager struct{}
+
+func (manager *SRegionResourceBaseManager) ListItemFilter(
+	ctx context.Context,
+	q *sqlchemy.SQuery,
+	userCred mcclient.TokenCredential,
+	query api.RegionFilterListInput,
+) (*sqlchemy.SQuery, error) {
+	if len(query.Region) > 0 {
+		regionObj, err := RegionManager.FetchByIdOrName(userCred, query.Region)
+		if err != nil {
+			if errors.Cause(err) == sql.ErrNoRows {
+				return nil, httperrors.NewResourceNotFoundError2(RegionManager.Keyword(), query.Region)
+			} else {
+				return nil, errors.Wrap(err, "RegionManager.FetchByIdOrName")
+			}
+		}
+		q = q.Equals("region_id", regionObj.GetId())
+	}
+	return q, nil
+}

pkg/keystone/models/roleresource.go

@@ -0,0 +1,68 @@
+// Copyright 2019 Yunion
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package models
+
+import (
+	"context"
+	"database/sql"
+
+	"yunion.io/x/pkg/errors"
+	"yunion.io/x/sqlchemy"
+
+	api "yunion.io/x/onecloud/pkg/apis/identity"
+	"yunion.io/x/onecloud/pkg/cloudcommon/db"
+	"yunion.io/x/onecloud/pkg/httperrors"
+	"yunion.io/x/onecloud/pkg/mcclient"
+)
+
+type SRoleResourceBaseManager struct{}
+
+func (manager *SRoleResourceBaseManager) ListItemFilter(
+	ctx context.Context,
+	q *sqlchemy.SQuery,
+	userCred mcclient.TokenCredential,
+	query api.RoleFilterListInput,
+) (*sqlchemy.SQuery, error) {
+	if len(query.Role) > 0 {
+		var ownerId mcclient.IIdentityProvider
+		if len(query.RoleDomain) > 0 {
+			domain, err := DomainManager.FetchDomainByIdOrName(query.RoleDomain)
+			if err != nil {
+				if errors.Cause(err) == sql.ErrNoRows {
+					return nil, httperrors.NewResourceNotFoundError2(DomainManager.Keyword(), query.RoleDomain)
+				} else {
+					return nil, errors.Wrap(err, "DomainManager.FetchDomainByIdOrName")
+				}
+			}
+			ownerId = &db.SOwnerId{
+				Domain:   domain.Name,
+				DomainId: domain.Id,
+			}
+
+		} else {
+			ownerId = userCred
+		}
+		roleObj, err := RoleManager.FetchByIdOrName(ownerId, query.Role)
+		if err != nil {
+			if errors.Cause(err) == sql.ErrNoRows {
+				return nil, httperrors.NewResourceNotFoundError2(RoleManager.Keyword(), query.Role)
+			} else {
+				return nil, errors.Wrap(err, "RoleManager.FetchByIdOrName")
+			}
+		}
+		q = q.Equals("role_id", roleObj.GetId())
+	}
+	return q, nil
+}

pkg/keystone/models/serviceresource.go

@@ -0,0 +1,53 @@
+// Copyright 2019 Yunion
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package models
+
+import (
+	"context"
+	"database/sql"
+
+	"yunion.io/x/pkg/errors"
+	"yunion.io/x/sqlchemy"
+
+	api "yunion.io/x/onecloud/pkg/apis/identity"
+	"yunion.io/x/onecloud/pkg/httperrors"
+	"yunion.io/x/onecloud/pkg/mcclient"
+)
+
+type SServiceResourceBaseManager struct{}
+
+func (manager *SServiceResourceBaseManager) ListItemFilter(
+	ctx context.Context,
+	q *sqlchemy.SQuery,
+	userCred mcclient.TokenCredential,
+	query api.ServiceFilterListInput,
+) (*sqlchemy.SQuery, error) {
+	if len(query.Service) > 0 {
+		serviceObj, err := ServiceManager.FetchByIdOrName(userCred, query.Service)
+		if err != nil {
+			if errors.Cause(err) == sql.ErrNoRows {
+				return nil, httperrors.NewResourceNotFoundError2(ServiceManager.Keyword(), query.Service)
+			} else {
+				return nil, errors.Wrap(err, "ServiceManager.FetchByIdOrName")
+			}
+		}
+		q = q.Equals("service_id", serviceObj.GetId())
+	}
+	if len(query.ServiceType) > 0 {
+		subq := ServiceManager.Query("id").Equals("type", query.ServiceType).SubQuery()
+		q = q.In("service_id", subq)
+	}
+	return q, nil
+}

pkg/keystone/models/services.go

@@ -235,6 +235,13 @@ func (manager *SServiceManager) ListItemFilter(
 	if len(query.Type) > 0 {
 		q = q.Equals("type", query.Type)
 	}
+	if query.Enabled != nil {
+		if *query.Enabled {
+			q = q.IsTrue("enabled")
+		} else {
+			q = q.IsFalse("enabled")
+		}
+	}
 	return q, nil
 }
 

pkg/keystone/models/userresource.go

@@ -0,0 +1,68 @@
+// Copyright 2019 Yunion
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package models
+
+import (
+	"context"
+	"database/sql"
+
+	"yunion.io/x/pkg/errors"
+	"yunion.io/x/sqlchemy"
+
+	api "yunion.io/x/onecloud/pkg/apis/identity"
+	"yunion.io/x/onecloud/pkg/cloudcommon/db"
+	"yunion.io/x/onecloud/pkg/httperrors"
+	"yunion.io/x/onecloud/pkg/mcclient"
+)
+
+type SUserResourceBaseManager struct{}
+
+func (manager *SUserResourceBaseManager) ListItemFilter(
+	ctx context.Context,
+	q *sqlchemy.SQuery,
+	userCred mcclient.TokenCredential,
+	query api.UserFilterListInput,
+) (*sqlchemy.SQuery, error) {
+	if len(query.User) > 0 {
+		var ownerId mcclient.IIdentityProvider
+		if len(query.UserDomain) > 0 {
+			domain, err := DomainManager.FetchDomainByIdOrName(query.UserDomain)
+			if err != nil {
+				if errors.Cause(err) == sql.ErrNoRows {
+					return nil, httperrors.NewResourceNotFoundError2(DomainManager.Keyword(), query.UserDomain)
+				} else {
+					return nil, errors.Wrap(err, "DomainManager.FetchDomainByIdOrName")
+				}
+			}
+			ownerId = &db.SOwnerId{
+				Domain:   domain.Name,
+				DomainId: domain.Id,
+			}
+
+		} else {
+			ownerId = userCred
+		}
+		userObj, err := UserManager.FetchByIdOrName(ownerId, query.User)
+		if err != nil {
+			if errors.Cause(err) == sql.ErrNoRows {
+				return nil, httperrors.NewResourceNotFoundError2(UserManager.Keyword(), query.User)
+			} else {
+				return nil, errors.Wrap(err, "UserManager.FetchByIdOrName")
+			}
+		}
+		q = q.Equals("user_id", userObj.GetId())
+	}
+	return q, nil
+}

pkg/keystone/models/users.go

@@ -324,6 +324,30 @@ func (manager *SUserManager) ListItemFilter(
 		return nil, errors.Wrap(err, "SEnabledIdentityBaseResourceManager.ListItemFilter")
 	}
 
+	if len(query.Email) > 0 {
+		q = q.Equals("email", query.Email)
+	}
+	if len(query.Mobile) > 0 {
+		q = q.Equals("mobile", query.Mobile)
+	}
+	if len(query.Displayname) > 0 {
+		q = q.Equals("displayname", query.Displayname)
+	}
+	if query.AllowWebConsole != nil {
+		if *query.AllowWebConsole {
+			q = q.IsTrue("allow_web_console")
+		} else {
+			q = q.IsFalse("allow_web_console")
+		}
+	}
+	if query.EnableMfa != nil {
+		if *query.EnableMfa {
+			q = q.IsTrue("enable_mfa")
+		} else {
+			q = q.IsFalse("enable_mfa")
+		}
+	}
+
 	groupStr := query.Group
 	if len(groupStr) > 0 {
 		groupObj, err := GroupManager.FetchByIdOrName(userCred, groupStr)