Merge pull request #634 in YUNIONIO/onecloud from ~WANYAOQI/onecloud:bugfix/wyq/resolve-conflict-20181201 to release/2.4.0

* commit 'ecc750107b4f25c738ad8f15fa9ab615e9cc36de':
  remove inframanager.go
  recode
  allow zone_id empty for hosts
  Remove SInfrastructureManager & SInfrasture
  minor fixes
  fix userCred.IsSystemAdmin() for set/del extra option
  1. 取消userCred.IsSystemAdmin()，在使用policy的应用中，通过userCred.IsAdminAllow判断是否是管理员且具备相应的权限。获取token时，需要传入policy.FilterPolicyCredential，将普通userCred转换成支持rbac的userCred 2. 在应用启动时候，必须设置 SetServiceType，否则退出

pkg/cloudcommon/auth.go

@@ -3,13 +3,14 @@ package cloudcommon
 import (
 	"fmt"
 	"os"
-
 	"time"
+
 	"yunion.io/x/onecloud/pkg/cloudcommon/policy"
 	"yunion.io/x/onecloud/pkg/mcclient/auth"
 )
 
 func InitAuth(options *Options, authComplete auth.AuthCompletedCallback) {
+
 	if len(options.AuthURL) == 0 {
 		fmt.Println("Missing AuthURL")
 		os.Exit(1)

pkg/cloudcommon/db/db_dispatcher.go

@@ -65,7 +65,7 @@ func (dispatcher *DBModelDispatcher) Filter(f appsrv.FilterHandler) appsrv.Filte
 }
 
 func fetchUserCredential(ctx context.Context) mcclient.TokenCredential {
-	token := auth.FetchUserCredential(ctx)
+	token := auth.FetchUserCredential(ctx, policy.FilterPolicyCredential)
 	if token == nil && !consts.IsRbacEnabled() {
 		log.Fatalf("user token credential not found?")
 	}
@@ -113,7 +113,7 @@ func listFields(manager IModelManager, userCred mcclient.TokenCredential) []stri
 		if !utils.IsInStringArray(list, []string{"user", "admin", ""}) {
 			log.Warningf("Invalid list value %s for field %s", list, col.Name())
 		}
-		if list == "user" || (list == "admin" && userCred.IsSystemAdmin()) {
+		if list == "user" || (list == "admin" && IsAdminAllowList(userCred, manager)) {
 			ret = append(ret, col.Name())
 		}
 	}
@@ -127,7 +127,7 @@ func searchFields(manager IModelManager, userCred mcclient.TokenCredential) []st
 		tags := col.Tags()
 		list := tags["list"]
 		search := tags["search"]
-		if list == "user" || search == "user" || ((list == "admin" || search == "admin") && userCred.IsSystemAdmin()) {
+		if list == "user" || search == "user" || ((list == "admin" || search == "admin") && IsAdminAllowList(userCred, manager)) {
 			ret = append(ret, col.Name())
 		}
 	}
@@ -140,7 +140,7 @@ func getDetailFields(manager IModelManager, userCred mcclient.TokenCredential) [
 		tags := col.Tags()
 		list := tags["list"]
 		get := tags["get"]
-		if list == "user" || get == "user" || ((list == "admin" || get == "admin") && userCred.IsSystemAdmin()) {
+		if list == "user" || get == "user" || ((list == "admin" || get == "admin") && userCred.IsAdminAllow(consts.GetServiceType(), manager.KeywordPlural(), policy.PolicyActionGet)) {
 			ret = append(ret, col.Name())
 		}
 	}
@@ -152,7 +152,7 @@ func createRequireFields(manager IModelManager, userCred mcclient.TokenCredentia
 	for _, col := range manager.TableSpec().Columns() {
 		tags := col.Tags()
 		create, _ := tags["create"]
-		if create == "required" || (create == "admin_required" && userCred.IsSystemAdmin()) {
+		if create == "required" || (create == "admin_required" && IsAdminAllowCreate(userCred, manager)) {
 			ret = append(ret, col.Name())
 		}
 	}
@@ -166,7 +166,7 @@ func createFields(manager IModelManager, userCred mcclient.TokenCredential) []st
 		tags := col.Tags()
 		create, _ := tags["create"]
 		update := tags["update"]
-		if update == "user" || (update == "admin" && userCred.IsSystemAdmin()) || create == "required" || create == "optional" || ((create == "admin_required" || create == "admin_optional") && userCred.IsSystemAdmin()) {
+		if update == "user" || (update == "admin" && IsAdminAllowCreate(userCred, manager)) || create == "required" || create == "optional" || ((create == "admin_required" || create == "admin_optional") && IsAdminAllowCreate(userCred, manager)) {
 			ret = append(ret, col.Name())
 		}
 	}
@@ -179,7 +179,7 @@ func updateFields(manager IModelManager, userCred mcclient.TokenCredential) []st
 	for _, col := range manager.TableSpec().Columns() {
 		tags := col.Tags()
 		update := tags["update"]
-		if update == "user" || (update == "admin" && userCred.IsSystemAdmin()) {
+		if update == "user" || (update == "admin" && userCred.IsAdminAllow(consts.GetServiceType(), manager.KeywordPlural(), policy.PolicyActionUpdate)) {
 			ret = append(ret, col.Name())
 		}
 	}
@@ -315,7 +315,7 @@ func query2List(manager IModelManager, ctx context.Context, userCred mcclient.To
 	}
 	listF := listFields(manager, userCred)
 	fieldFilter := jsonutils.GetQueryStringArray(query, "field")
-	if len(fieldFilter) > 0 && userCred.IsSystemAdmin() {
+	if len(fieldFilter) > 0 && IsAdminAllowList(userCred, manager) {
 		// only sysadmin can specify list Fields
 		listF = fieldFilter
 	}
@@ -733,7 +733,7 @@ func fetchOwnerProjectId(ctx context.Context, manager IModelManager, userCred mc
 			isAllow = true
 		}
 	} else {
-		isAllow = userCred.IsSystemAdmin()
+		isAllow = userCred.IsAdminAllow(consts.GetServiceType(), policy.PolicyDelegation, "")
 	}
 	if !isAllow {
 		return "", httperrors.NewForbiddenError("Delegation not allowed")

pkg/cloudcommon/db/enabledstatusstandalone.go

@@ -23,7 +23,7 @@ func NewEnabledStatusStandaloneResourceBaseManager(dt interface{}, tableName str
 }
 
 func (self *SEnabledStatusStandaloneResourceBase) AllowPerformEnable(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
-	return userCred.IsSystemAdmin()
+	return IsAdminAllowPerform(userCred, self, "enable")
 }
 
 func (self *SEnabledStatusStandaloneResourceBase) PerformEnable(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) {
@@ -42,7 +42,7 @@ func (self *SEnabledStatusStandaloneResourceBase) PerformEnable(ctx context.Cont
 }
 
 func (self *SEnabledStatusStandaloneResourceBase) AllowPerformDisable(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
-	return userCred.IsSystemAdmin()
+	return IsAdminAllowPerform(userCred, self, "disable")
 }
 
 func (self *SEnabledStatusStandaloneResourceBase) PerformDisable(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) {

pkg/cloudcommon/db/interface.go

@@ -22,6 +22,7 @@ type IModelManager interface {
 	KeywordPlural() string
 	Alias() string
 	AliasPlural() string
+	SetAlias(alias string, aliasPlural string)
 
 	ValidateName(name string) error
 
@@ -69,6 +70,8 @@ type IModel interface {
 
 	GetName() string
 
+	KeywordPlural() string
+
 	GetModelManager() IModelManager
 	SetModelManager(IModelManager)
 
@@ -164,7 +167,7 @@ type IVirtualModel interface {
 	IStandaloneModel
 
 	IsOwner(userCred mcclient.TokenCredential) bool
-	IsAdmin(userCred mcclient.TokenCredential) bool
+	// IsAdmin(userCred mcclient.TokenCredential) bool
 }
 
 type ISharableVirtualModelManager interface {

pkg/cloudcommon/db/jointbase.go

@@ -191,7 +191,7 @@ func (self *SJointResourceBase) AllowGetJointDetails(ctx context.Context, userCr
 	master := item.Master()
 	switch master.(type) {
 	case IVirtualModel:
-		return master.(IVirtualModel).IsOwner(userCred)
+		return master.(IVirtualModel).IsOwner(userCred) || IsAdminAllowGet(userCred, master)
 	default: // case item implemented customized AllowGetDetails, eg hostjoints
 		return item.AllowGetDetails(ctx, userCred, query)
 	}
@@ -201,7 +201,7 @@ func (self *SJointResourceBase) AllowUpdateJointItem(ctx context.Context, userCr
 	master := item.Master()
 	switch master.(type) {
 	case IVirtualModel:
-		return master.(IVirtualModel).IsOwner(userCred)
+		return master.(IVirtualModel).IsOwner(userCred) || IsAdminAllowUpdate(userCred, master)
 	default: // case item implemented customized AllowGetDetails, eg hostjoints
 		return item.AllowUpdateItem(ctx, userCred)
 	}

pkg/cloudcommon/db/keystonecache.go

@@ -64,7 +64,7 @@ func NewKeystoneCacheObject(id string, name string, domainId string, domain stri
 }*/
 
 func (manager *SKeystoneCacheObjectManager) BatchFetchNames(idStrs []string) []string {
-	t := manager.tableSpec.Instance()
+	t := manager.TableSpec().Instance()
 	results, err := t.Query(t.Field("name")).In("id", idStrs).AllStringMap()
 	if err != nil {
 		return nil

pkg/cloudcommon/db/metadata.go

@@ -65,7 +65,7 @@ raise Exception('get_object_idstr: failed to generate obj ID')
 return idstr */
 
 func (manager *SMetadataManager) GetStringValue(model IModel, key string, userCred mcclient.TokenCredential) string {
-	if strings.HasPrefix(key, SYSTEM_ADMIN_PREFIX) && (userCred == nil || !userCred.IsSystemAdmin()) {
+	if strings.HasPrefix(key, SYSTEM_ADMIN_PREFIX) && (userCred == nil || !IsAdminAllowGetSpec(userCred, model, "metadata")) {
 		return ""
 	}
 	idStr := GetObjectIdstr(model)
@@ -78,7 +78,7 @@ func (manager *SMetadataManager) GetStringValue(model IModel, key string, userCr
 }
 
 func (manager *SMetadataManager) GetJsonValue(model IModel, key string, userCred mcclient.TokenCredential) jsonutils.JSONObject {
-	if strings.HasPrefix(key, SYSTEM_ADMIN_PREFIX) && (userCred == nil || !userCred.IsSystemAdmin()) {
+	if strings.HasPrefix(key, SYSTEM_ADMIN_PREFIX) && (userCred == nil || !IsAdminAllowGetSpec(userCred, model, "metadata")) {
 		return nil
 	}
 	idStr := GetObjectIdstr(model)
@@ -194,7 +194,7 @@ func (manager *SMetadataManager) GetAll(obj IModel, keys []string, userCred mccl
 	for _, rec := range records {
 		if len(rec.Value) > 0 {
 			if strings.HasPrefix(rec.Key, SYSTEM_ADMIN_PREFIX) {
-				if userCred != nil && userCred.IsSystemAdmin() {
+				if userCred != nil && IsAdminAllowGetSpec(userCred, obj, "metadata") {
 					key := rec.Key[len(SYSTEM_ADMIN_PREFIX):]
 					ret[key] = rec.Value
 				}

pkg/cloudcommon/db/modelbase.go

@@ -151,7 +151,7 @@ func (manager *SModelBaseManager) PerformAction(ctx context.Context, userCred mc
 }
 
 func (manager *SModelBaseManager) AllowPerformCheckCreateData(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
-	return userCred.IsSystemAdmin()
+	return IsAdminAllowClassPerform(userCred, manager, "check-create-data")
 }
 
 func (manager *SModelBaseManager) InitializeData() error {
@@ -178,6 +178,10 @@ func (model *SModelBase) Keyword() string {
 	return model.GetModelManager().Keyword()
 }
 
+func (model *SModelBase) KeywordPlural() string {
+	return model.GetModelManager().KeywordPlural()
+}
+
 func (model *SModelBase) GetName() string {
 	return ""
 }

pkg/cloudcommon/db/opslog.go

@@ -185,13 +185,6 @@ var _ IModel = (*SOpsLog)(nil)
 
 func init() {
 	OpsLog = &SOpsLogManager{NewModelBaseManager(SOpsLog{}, "opslog_tbl", "event", "events")}
-
-}
-
-func (manager *SOpsLogManager) SetKeyword(kw, kwPlural string) *SOpsLogManager {
-	manager.keyword = kw
-	manager.keywordPlural = kwPlural
-	return manager
 }
 
 func (opslog *SOpsLog) GetId() string {
@@ -304,7 +297,7 @@ func (manager *SOpsLogManager) ListItemFilter(ctx context.Context, q *sqlchemy.S
 		queryDict.RemoveIgnoreCase("action")
 		q = q.Filter(sqlchemy.In(q.Field("action"), action))
 	}
-	if !userCred.IsSystemAdmin() {
+	if !IsAdminAllowList(userCred, manager) {
 		q = q.Filter(sqlchemy.OR(sqlchemy.AND(sqlchemy.IsNotNull(q.Field("owner_tenant_id")), sqlchemy.Equals(q.Field("owner_tenant_id"), userCred.GetProjectId())), sqlchemy.Equals(q.Field("tenant_id"), userCred.GetProjectId())))
 	}
 	since, _ := query.GetTime("since")
@@ -335,7 +328,7 @@ func (manager *SOpsLogManager) AllowCreateItem(ctx context.Context, userCred mcc
 }
 
 func (self *SOpsLog) AllowGetDetails(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool {
-	return userCred.IsSystemAdmin() || userCred.GetProjectId() == self.ProjectId || userCred.GetProjectId() == self.OwnerProjectId
+	return IsAdminAllowGet(userCred, self) || userCred.GetProjectId() == self.ProjectId || userCred.GetProjectId() == self.OwnerProjectId
 }
 
 func (self *SOpsLog) AllowUpdateItem(ctx context.Context, userCred mcclient.TokenCredential) bool {

pkg/cloudcommon/db/quotas/handler.go

@@ -72,7 +72,7 @@ func queryQuota(ctx context.Context, projectId string) (*jsonutils.JSONDict, err
 }
 
 func getQuotaHanlder(ctx context.Context, w http.ResponseWriter, r *http.Request) {
-	userCred := auth.FetchUserCredential(ctx)
+	userCred := auth.FetchUserCredential(ctx, policy.FilterPolicyCredential)
 	params := appctx.AppContextParams(ctx)
 
 	projectId := params["<tenantid>"]
@@ -93,7 +93,7 @@ func getQuotaHanlder(ctx context.Context, w http.ResponseWriter, r *http.Request
 				policy.PolicyDelegation, policy.PolicyActionGet)
 			isAllow = result == rbacutils.AdminAllow
 		} else {
-			isAllow = userCred.IsSystemAdmin()
+			isAllow = userCred.IsAdminAllow(consts.GetServiceType(), policy.PolicyDelegation, policy.PolicyActionGet)
 		}
 		if !isAllow {
 			httperrors.ForbiddenError(w, "not allow to delegate query quota")
@@ -133,14 +133,15 @@ func getQuotaHanlder(ctx context.Context, w http.ResponseWriter, r *http.Request
 }
 
 func setQuotaHanlder(ctx context.Context, w http.ResponseWriter, r *http.Request) {
-	userCred := auth.FetchUserCredential(ctx)
+	userCred := auth.FetchUserCredential(ctx, policy.FilterPolicyCredential)
 
 	var isAllow bool
 	if consts.IsRbacEnabled() {
 		isAllow = policy.PolicyManager.Allow(true, userCred, consts.GetServiceType(),
 			"quotas", policy.PolicyActionUpdate) == rbacutils.AdminAllow
 	} else {
-		isAllow = userCred.IsSystemAdmin()
+		isAllow = userCred.IsAdminAllow(consts.GetServiceType(),
+			"quotas", policy.PolicyActionUpdate)
 	}
 	if !isAllow {
 		httperrors.ForbiddenError(w, "not allow to set quota")
@@ -196,14 +197,15 @@ func setQuotaHanlder(ctx context.Context, w http.ResponseWriter, r *http.Request
 }
 
 func checkQuotaHanlder(ctx context.Context, w http.ResponseWriter, r *http.Request) {
-	userCred := auth.FetchUserCredential(ctx)
+	userCred := auth.FetchUserCredential(ctx, policy.FilterPolicyCredential)
 
 	isAllow := false
 	if consts.IsRbacEnabled() {
 		isAllow = policy.PolicyManager.Allow(true, userCred, consts.GetServiceType(),
 			policy.PolicyDelegation, policy.PolicyActionGet) == rbacutils.AdminAllow
 	} else {
-		isAllow = userCred.IsSystemAdmin()
+		isAllow = userCred.IsAdminAllow(consts.GetServiceType(),
+			policy.PolicyDelegation, policy.PolicyActionGet)
 	}
 	if !isAllow {
 		httperrors.ForbiddenError(w, "not allow to delegate check quota")

pkg/cloudcommon/db/rbac.go

@@ -122,3 +122,35 @@ func isObjectRbacAllowed(manager IModelManager, model IModel, userCred mcclient.
 func isJointObjectRbacAllowed(manager IJointModelManager, item IJointModel, userCred mcclient.TokenCredential, action string, extra ...string) bool {
 	return isObjectRbacAllowed(manager, item.Master(), userCred, action, extra...)
 }
+
+func IsAdminAllowList(userCred mcclient.TokenCredential, manager IModelManager) bool {
+	return userCred.IsAdminAllow(consts.GetServiceType(), manager.KeywordPlural(), policy.PolicyActionList)
+}
+
+func IsAdminAllowCreate(userCred mcclient.TokenCredential, manager IModelManager) bool {
+	return userCred.IsAdminAllow(consts.GetServiceType(), manager.KeywordPlural(), policy.PolicyActionCreate)
+}
+
+func IsAdminAllowClassPerform(userCred mcclient.TokenCredential, manager IModelManager, action string) bool {
+	return userCred.IsAdminAllow(consts.GetServiceType(), manager.KeywordPlural(), policy.PolicyActionPerform, action)
+}
+
+func IsAdminAllowGet(userCred mcclient.TokenCredential, obj IModel) bool {
+	return userCred.IsAdminAllow(consts.GetServiceType(), obj.KeywordPlural(), policy.PolicyActionGet)
+}
+
+func IsAdminAllowGetSpec(userCred mcclient.TokenCredential, obj IModel, spec string) bool {
+	return userCred.IsAdminAllow(consts.GetServiceType(), obj.KeywordPlural(), policy.PolicyActionGet, spec)
+}
+
+func IsAdminAllowPerform(userCred mcclient.TokenCredential, obj IModel, action string) bool {
+	return userCred.IsAdminAllow(consts.GetServiceType(), obj.KeywordPlural(), policy.PolicyActionPerform, action)
+}
+
+func IsAdminAllowUpdate(userCred mcclient.TokenCredential, obj IModel) bool {
+	return userCred.IsAdminAllow(consts.GetServiceType(), obj.KeywordPlural(), policy.PolicyActionUpdate)
+}
+
+func IsAdminAllowDelete(userCred mcclient.TokenCredential, obj IModel) bool {
+	return userCred.IsAdminAllow(consts.GetServiceType(), obj.KeywordPlural(), policy.PolicyActionDelete)
+}

pkg/cloudcommon/db/sharablevirtual.go

@@ -30,7 +30,7 @@ func (manager *SSharableVirtualResourceBaseManager) FilterByOwner(q *sqlchemy.SQ
 }
 
 func (model *SSharableVirtualResourceBase) AllowGetDetails(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool {
-	return model.IsOwner(userCred) || model.IsPublic
+	return model.IsOwner(userCred) || model.IsPublic || IsAdminAllowGet(userCred, model)
 }
 
 func (model *SSharableVirtualResourceBase) IsSharable() bool {
@@ -38,11 +38,11 @@ func (model *SSharableVirtualResourceBase) IsSharable() bool {
 }
 
 func (model *SSharableVirtualResourceBase) AllowPerformPublic(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
-	return userCred.IsSystemAdmin()
+	return IsAdminAllowPerform(userCred, model, "public")
 }
 
 func (model *SSharableVirtualResourceBase) AllowPerformPrivate(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
-	return userCred.IsSystemAdmin()
+	return IsAdminAllowPerform(userCred, model, "private")
 }
 
 func (model *SSharableVirtualResourceBase) PerformPublic(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) {

pkg/cloudcommon/db/standalone.go

@@ -146,7 +146,7 @@ func (model *SStandaloneResourceBase) GetMetadataJson(key string, userCred mccli
 }
 
 func (model *SStandaloneResourceBase) SetMetadata(ctx context.Context, key string, value interface{}, userCred mcclient.TokenCredential) error {
-	if Metadata.IsSystemAdminKey(key) && !userCred.IsSystemAdmin() {
+	if Metadata.IsSystemAdminKey(key) && !IsAdminAllowPerform(userCred, model, "metadata") {
 		return httperrors.NewNotSufficientPrivilegeError("cannot set system key")
 	}
 	return Metadata.SetValue(ctx, model, key, value, userCred)
@@ -154,7 +154,7 @@ func (model *SStandaloneResourceBase) SetMetadata(ctx context.Context, key strin
 
 func (model *SStandaloneResourceBase) SetAllMetadata(ctx context.Context, dictstore map[string]interface{}, userCred mcclient.TokenCredential) error {
 	for k := range dictstore {
-		if Metadata.IsSystemAdminKey(k) && !userCred.IsSystemAdmin() {
+		if Metadata.IsSystemAdminKey(k) && !IsAdminAllowPerform(userCred, model, "metadata") {
 			return httperrors.NewNotSufficientPrivilegeError("not allow to set system key %s", k)
 		}
 	}
@@ -174,7 +174,7 @@ func (model *SStandaloneResourceBase) GetAllMetadata(userCred mcclient.TokenCred
 }
 
 func (model *SStandaloneResourceBase) AllowGetDetailsMetadata(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool {
-	return userCred.IsSystemAdmin()
+	return IsAdminAllowGetSpec(userCred, model, "metadata")
 }
 
 func (model *SStandaloneResourceBase) GetDetailsMetadata(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) (jsonutils.JSONObject, error) {
@@ -187,7 +187,7 @@ func (model *SStandaloneResourceBase) GetDetailsMetadata(ctx context.Context, us
 }
 
 func (model *SStandaloneResourceBase) AllowPerformMetadata(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
-	return userCred.IsSystemAdmin()
+	return IsAdminAllowPerform(userCred, model, "metadata")
 }
 
 func (model *SStandaloneResourceBase) PerformMetadata(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) {

pkg/cloudcommon/db/statusstandalone.go

@@ -50,7 +50,7 @@ func (model *SStatusStandaloneResourceBase) SetStatus(userCred mcclient.TokenCre
 }
 
 func (model *SStatusStandaloneResourceBase) AllowPerformStatus(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
-	return userCred.IsSystemAdmin()
+	return IsAdminAllowPerform(userCred, model, "status")
 }
 
 func (model *SStatusStandaloneResourceBase) PerformStatus(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) {

pkg/cloudcommon/db/taskman/tasks.go

@@ -70,7 +70,7 @@ type STask struct {
 }
 
 func (manager *STaskManager) AllowListItems(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool {
-	return userCred.IsSystemAdmin()
+	return true
 }
 
 func (manager *STaskManager) AllowCreateItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
@@ -115,7 +115,7 @@ func (manager *STaskManager) FilterByOwner(q *sqlchemy.SQuery, owner string) *sq
 }
 
 func (self *STask) AllowGetDetails(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool {
-	return userCred.IsSystemAdmin() || userCred.GetProjectId() == self.UserCred.GetProjectId()
+	return db.IsAdminAllowGet(userCred, self) || userCred.GetProjectId() == self.UserCred.GetProjectId()
 }
 
 func (self *STask) AllowUpdateItem(ctx context.Context, userCred mcclient.TokenCredential) bool {

pkg/cloudcommon/db/tenantcache.go

@@ -90,8 +90,8 @@ func (manager *STenantCacheManager) fetchTenantFromKeystone(ctx context.Context,
 }
 
 func (manager *STenantCacheManager) Save(ctx context.Context, idStr string, name string, domainId string, domain string) (*STenant, error) {
-	lockman.LockRawObject(ctx, manager.keyword, idStr)
-	defer lockman.ReleaseRawObject(ctx, manager.keyword, idStr)
+	lockman.LockRawObject(ctx, manager.KeywordPlural(), idStr)
+	defer lockman.ReleaseRawObject(ctx, manager.KeywordPlural(), idStr)
 
 	objo, err := manager.FetchById(idStr)
 	if err != nil && err != sql.ErrNoRows {

pkg/cloudcommon/db/usercache.go

@@ -53,8 +53,8 @@ func (manager *SUserCacheManager) FetchUserByName(idStr string) (*SUser, error)
 }
 
 func (manager *SUserCacheManager) Save(ctx context.Context, idStr string, name string, domainId string, domain string) (*SUser, error) {
-	lockman.LockRawObject(ctx, manager.keyword, idStr)
-	defer lockman.ReleaseRawObject(ctx, manager.keyword, idStr)
+	lockman.LockRawObject(ctx, manager.KeywordPlural(), idStr)
+	defer lockman.ReleaseRawObject(ctx, manager.KeywordPlural(), idStr)
 
 	obj, err := manager.FetchUserById(idStr)
 	if err != nil && err != sql.ErrNoRows {

pkg/cloudcommon/db/virtualjointbase.go

@@ -27,7 +27,7 @@ func NewVirtualJointResourceBaseManager(dt interface{}, tableName string, keywor
 }
 
 func (manager *SVirtualJointResourceBaseManager) AllowListItems(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool {
-	if jsonutils.QueryBoolean(query, "admin", false) && !userCred.IsSystemAdmin() {
+	if jsonutils.QueryBoolean(query, "admin", false) && !IsAdminAllowList(userCred, manager) {
 		return false
 	}
 	return true
@@ -36,7 +36,7 @@ func (manager *SVirtualJointResourceBaseManager) AllowListItems(ctx context.Cont
 
 func (manager *SVirtualJointResourceBaseManager) AllowListDescendent(ctx context.Context, userCred mcclient.TokenCredential, master IStandaloneModel, query jsonutils.JSONObject) bool {
 	masterVirtual := master.(IVirtualModel)
-	if masterVirtual.IsOwner(userCred) {
+	if masterVirtual.IsOwner(userCred) || IsAdminAllowList(userCred, manager) {
 		return true
 	}
 	return false
@@ -62,12 +62,12 @@ func (manager *SVirtualJointResourceBaseManager) AllowAttach(ctx context.Context
 
 func (self *SVirtualJointResourceBase) AllowGetDetails(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool {
 	masterVirtual := self.Master().(IVirtualModel)
-	return masterVirtual.IsOwner(userCred)
+	return masterVirtual.IsOwner(userCred) || IsAdminAllowGet(userCred, self)
 }
 
 func (self *SVirtualJointResourceBase) AllowUpdateItem(ctx context.Context, userCred mcclient.TokenCredential) bool {
 	masterVirtual := self.Master().(IVirtualModel)
-	return masterVirtual.IsOwner(userCred)
+	return masterVirtual.IsOwner(userCred) || IsAdminAllowUpdate(userCred, self)
 }
 
 func (manager *SVirtualJointResourceBaseManager) ListItemFilter(ctx context.Context, q *sqlchemy.SQuery, userCred mcclient.TokenCredential, query jsonutils.JSONObject) (*sqlchemy.SQuery, error) {
@@ -96,7 +96,7 @@ func (manager *SVirtualJointResourceBaseManager) ListItemFilter(ctx context.Cont
 		sqlchemy.IsFalse(masterTable.Field("deleted"))))
 	q = q.Join(slaveTable, sqlchemy.AND(sqlchemy.Equals(slaveField, slaveTable.Field("id")),
 		sqlchemy.IsFalse(slaveTable.Field("deleted"))))
-	if jsonutils.QueryBoolean(query, "admin", false) && userCred.IsSystemAdmin() {
+	if jsonutils.QueryBoolean(query, "admin", false) && IsAdminAllowList(userCred, manager) {
 		isSystem := jsonutils.QueryBoolean(query, "system", false)
 		if !isSystem {
 			if len(slaveQueryId) == 0 {

pkg/cloudcommon/db/virtualresource.go

@@ -37,12 +37,12 @@ type SVirtualResourceBase struct {
 }
 
 func (model *SVirtualResourceBase) IsOwner(userCred mcclient.TokenCredential) bool {
-	return userCred.IsSystemAdmin() || userCred.GetProjectId() == model.ProjectId
+	return userCred.GetProjectId() == model.ProjectId
 }
 
-func (model *SVirtualResourceBase) IsAdmin(userCred mcclient.TokenCredential) bool {
+/*func (model *SVirtualResourceBase) IsAdmin(userCred mcclient.TokenCredential) bool {
 	return userCred.IsSystemAdmin() || (userCred.GetProjectId() == model.ProjectId && userCred.IsAdmin())
-}
+}*/
 
 func (model *SVirtualResourceBase) GetOwnerProjectId() string {
 	return model.ProjectId
@@ -110,7 +110,7 @@ func (manager *SVirtualResourceBaseManager) ListItemFilter(ctx context.Context,
 
 func (manager *SVirtualResourceBaseManager) ValidateCreateData(ctx context.Context, userCred mcclient.TokenCredential, ownerProjId string, query jsonutils.JSONObject, data *jsonutils.JSONDict) (*jsonutils.JSONDict, error) {
 	isSystem, err := data.Bool("is_system")
-	if err == nil && isSystem && !userCred.IsSystemAdmin() {
+	if err == nil && isSystem && !IsAdminAllowCreate(userCred, manager) {
 		return nil, httperrors.NewNotSufficientPrivilegeError("non-admin user not allowed to create system object")
 	}
 	return manager.SStandaloneResourceBaseManager.ValidateCreateData(ctx, userCred, ownerProjId, query, data)
@@ -129,14 +129,14 @@ func (model *SVirtualResourceBase) CustomizeCreate(ctx context.Context, userCred
 
 func (manager *SVirtualResourceBaseManager) AllowListItems(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool {
 	isAdmin, err := query.Bool("admin")
-	if err == nil && isAdmin && !userCred.IsSystemAdmin() {
+	if err == nil && isAdmin && !IsAdminAllowList(userCred, manager) {
 		return false
 	}
 	return true
 }
 
 func (model *SVirtualResourceBase) AllowGetDetails(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool {
-	return model.IsOwner(userCred)
+	return model.IsOwner(userCred) || IsAdminAllowGet(userCred, model)
 }
 
 func (manager *SVirtualResourceBaseManager) AllowCreateItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
@@ -144,19 +144,19 @@ func (manager *SVirtualResourceBaseManager) AllowCreateItem(ctx context.Context,
 }
 
 func (model *SVirtualResourceBase) AllowUpdateItem(ctx context.Context, userCred mcclient.TokenCredential) bool {
-	return model.IsOwner(userCred)
+	return model.IsOwner(userCred) || IsAdminAllowUpdate(userCred, model)
 }
 
 func (model *SVirtualResourceBase) AllowDeleteItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
-	return model.IsOwner(userCred)
+	return model.IsOwner(userCred) || IsAdminAllowDelete(userCred, model)
 }
 
 func (model *SVirtualResourceBase) AllowGetDetailsMetadata(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool {
-	return model.IsOwner(userCred)
+	return model.IsOwner(userCred) || IsAdminAllowGetSpec(userCred, model, "metadata")
 }
 
 func (model *SVirtualResourceBase) AllowPerformMetadata(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
-	return model.IsOwner(userCred)
+	return model.IsOwner(userCred) || IsAdminAllowPerform(userCred, model, "metadata")
 }
 
 func (model *SVirtualResourceBase) GetTenantCache(ctx context.Context) (*STenant, error) {
@@ -165,7 +165,7 @@ func (model *SVirtualResourceBase) GetTenantCache(ctx context.Context) (*STenant
 }
 
 func (model *SVirtualResourceBase) getMoreDetails(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, extra *jsonutils.JSONDict) *jsonutils.JSONDict {
-	if userCred.IsSystemAdmin() {
+	if IsAdminAllowGet(userCred, model) {
 		// log.Debugf("GetCustomizeColumns")
 		tobj, err := model.GetTenantCache(ctx)
 		if err == nil {
@@ -197,7 +197,7 @@ func (model *SVirtualResourceBase) GetExtraDetails(ctx context.Context, userCred
 }
 
 func (model *SVirtualResourceBase) AllowPerformChangeOwner(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
-	return userCred.IsSystemAdmin()
+	return IsAdminAllowPerform(userCred, model, "change-owner")
 }
 
 func (model *SVirtualResourceBase) PerformChangeOwner(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) {

pkg/cloudcommon/options.go

@@ -63,6 +63,10 @@ func (this *DBOptions) GetDBConnection() (dialect, connstr string, err error) {
 }
 
 func ParseOptions(optStruct interface{}, optionsRef *Options, args []string, configFileName string) {
+	if len(consts.GetServiceType()) == 0 {
+		log.Fatalf("ServiceType not initialized!")
+	}
+
 	serviceName := path.Base(args[0])
 	parser, err := structarg.NewArgumentParser(optStruct,
 		serviceName,

pkg/cloudcommon/policy/policy.go

@@ -48,6 +48,30 @@ var (
 			Action:   PolicyActionGet,
 			Result:   rbacutils.UserAllow,
 		},
+		{
+			Service:  "compute",
+			Resource: "storages",
+			Action:   PolicyActionList,
+			Result:   rbacutils.UserAllow,
+		},
+		{
+			Service:  "compute",
+			Resource: "storages",
+			Action:   PolicyActionGet,
+			Result:   rbacutils.UserAllow,
+		},
+		{
+			Service:  "compute",
+			Resource: "schedtags",
+			Action:   PolicyActionList,
+			Result:   rbacutils.UserAllow,
+		},
+		{
+			Service:  "compute",
+			Resource: "schedtags",
+			Action:   PolicyActionGet,
+			Result:   rbacutils.UserAllow,
+		},
 		{
 			Service:  "compute",
 			Resource: "cloudregions",
@@ -90,6 +114,12 @@ var (
 			Action:   PolicyActionCreate,
 			Result:   rbacutils.UserAllow,
 		},
+		{
+			Service:  "yunionconf",
+			Resource: "parameters",
+			Action:   PolicyActionGet,
+			Result:   rbacutils.OwnerAllow,
+		},
 	}
 )
 
@@ -278,7 +308,7 @@ func (manager *SPolicyManager) explainPolicy(userCred mcclient.TokenCredential,
 	if !consts.IsRbacEnabled() {
 		if !isAdmin {
 			return reqStrs, rbacutils.OwnerAllow, nil
-		} else if isAdmin && userCred.IsSystemAdmin() {
+		} else if isAdmin && userCred.HasSystemAdminPrivelege() {
 			return reqStrs, rbacutils.AdminAllow, nil
 		} else {
 			return reqStrs, rbacutils.Deny, httperrors.NewForbiddenError("operation not allowed")
@@ -305,7 +335,7 @@ func (manager *SPolicyManager) ExplainRpc(userCred mcclient.TokenCredential, par
 }
 
 func (manager *SPolicyManager) IsAdminCapable(userCred mcclient.TokenCredential) bool {
-	if !consts.IsRbacEnabled() && userCred.IsSystemAdmin() {
+	if !consts.IsRbacEnabled() && userCred.HasSystemAdminPrivelege() {
 		return true
 	}
 

pkg/cloudcommon/policy/token.go

@@ -0,0 +1,145 @@
+package policy
+
+import (
+	"time"
+
+	"yunion.io/x/jsonutils"
+	"yunion.io/x/pkg/gotypes"
+
+	"yunion.io/x/onecloud/pkg/cloudcommon/consts"
+	"yunion.io/x/onecloud/pkg/mcclient"
+	"yunion.io/x/onecloud/pkg/util/rbacutils"
+)
+
+type SPolicyTokenCredential struct {
+	Token mcclient.TokenCredential
+}
+
+func (self *SPolicyTokenCredential) String() string {
+	return self.Token.String()
+}
+
+func (self *SPolicyTokenCredential) IsZero() bool {
+	return self.Token.IsZero()
+}
+
+func (self *SPolicyTokenCredential) GetProjectId() string {
+	return self.Token.GetProjectId()
+}
+
+func (self *SPolicyTokenCredential) GetTenantId() string {
+	return self.Token.GetTenantId()
+}
+
+func (self *SPolicyTokenCredential) GetUserId() string {
+	return self.Token.GetUserId()
+}
+
+func (self *SPolicyTokenCredential) GetServiceURL(service, region, zone, endpointType string) (string, error) {
+	return self.Token.GetServiceURL(service, region, zone, endpointType)
+}
+
+func (self *SPolicyTokenCredential) GetServiceURLs(service, region, zone, endpointType string) ([]string, error) {
+	return self.Token.GetServiceURLs(service, region, zone, endpointType)
+}
+
+func (self *SPolicyTokenCredential) GetTokenString() string {
+	return self.Token.GetTokenString()
+}
+
+func (self *SPolicyTokenCredential) GetDomainId() string {
+	return self.Token.GetDomainId()
+}
+
+func (self *SPolicyTokenCredential) GetDomainName() string {
+	return self.Token.GetDomainName()
+}
+
+func (self *SPolicyTokenCredential) GetTenantName() string {
+	return self.Token.GetTenantName()
+}
+
+func (self *SPolicyTokenCredential) GetProjectName() string {
+	return self.Token.GetProjectName()
+}
+
+func (self *SPolicyTokenCredential) GetUserName() string {
+	return self.Token.GetUserName()
+}
+
+func (self *SPolicyTokenCredential) GetRoles() []string {
+	return self.Token.GetRoles()
+}
+
+func (self *SPolicyTokenCredential) GetExpires() time.Time {
+	return self.Token.GetExpires()
+}
+
+func (self *SPolicyTokenCredential) IsValid() bool {
+	return self.Token.IsValid()
+}
+
+func (self *SPolicyTokenCredential) ValidDuration() time.Duration {
+	return self.Token.ValidDuration()
+}
+
+func (self *SPolicyTokenCredential) GetRegions() []string {
+	return self.Token.GetRegions()
+}
+
+func (self *SPolicyTokenCredential) GetServiceCatalog() mcclient.IServiceCatalog {
+	return self.Token.GetServiceCatalog()
+}
+
+func (self *SPolicyTokenCredential) GetCatalogData(serviceTypes []string, region string) jsonutils.JSONObject {
+	return self.Token.GetCatalogData(serviceTypes, region)
+}
+
+func (self *SPolicyTokenCredential) GetInternalServices(region string) []string {
+	return self.Token.GetInternalServices(region)
+}
+
+func (self *SPolicyTokenCredential) GetExternalServices(region string) []mcclient.ExternalService {
+	return self.Token.GetExternalServices(region)
+}
+
+func (self *SPolicyTokenCredential) GetEndpoints(region string, endpointType string) []mcclient.Endpoint {
+	return self.Token.GetEndpoints(region, endpointType)
+}
+
+func (self *SPolicyTokenCredential) ToJson() jsonutils.JSONObject {
+	return self.Token.ToJson()
+}
+
+func (self *SPolicyTokenCredential) HasSystemAdminPrivelege() bool {
+	if consts.IsRbacEnabled() {
+		return PolicyManager.IsAdminCapable(self.Token)
+	}
+	return self.Token.HasSystemAdminPrivelege()
+}
+
+func (self *SPolicyTokenCredential) IsAdminAllow(service string, resource string, action string, extra ...string) bool {
+	if consts.IsRbacEnabled() {
+		result := PolicyManager.Allow(true, self.Token, service, resource, action, extra...)
+		return result == rbacutils.AdminAllow
+	}
+	return self.Token.IsAdminAllow(service, resource, action, extra...)
+}
+
+func init() {
+	gotypes.RegisterSerializable(mcclient.TokenCredentialType, func() gotypes.ISerializable {
+		return &SPolicyTokenCredential{}
+	})
+}
+
+func FilterPolicyCredential(token mcclient.TokenCredential) mcclient.TokenCredential {
+	if !consts.IsRbacEnabled() {
+		return token
+	}
+	switch token.(type) {
+	case *SPolicyTokenCredential:
+		return token
+	default:
+		return &SPolicyTokenCredential{Token: token}
+	}
+}

pkg/compute/capabilities/handler.go

@@ -8,6 +8,7 @@ import (
 	"yunion.io/x/jsonutils"
 
 	"yunion.io/x/onecloud/pkg/appsrv"
+	"yunion.io/x/onecloud/pkg/cloudcommon/policy"
 	"yunion.io/x/onecloud/pkg/compute/models"
 	"yunion.io/x/onecloud/pkg/httperrors"
 	"yunion.io/x/onecloud/pkg/mcclient/auth"
@@ -18,7 +19,7 @@ func AddCapabilityHandler(prefix string, app *appsrv.Application) {
 }
 
 func capaHandler(ctx context.Context, w http.ResponseWriter, r *http.Request) {
-	userCred := auth.FetchUserCredential(ctx)
+	userCred := auth.FetchUserCredential(ctx, policy.FilterPolicyCredential)
 	query, err := jsonutils.ParseQueryString(r.URL.RawQuery)
 	if err != nil {
 		httperrors.GeneralServerError(w, err)

pkg/compute/misc/handler.go

@@ -7,6 +7,7 @@ import (
 
 	"yunion.io/x/log"
 	"yunion.io/x/onecloud/pkg/appsrv"
+	"yunion.io/x/onecloud/pkg/cloudcommon/policy"
 	"yunion.io/x/onecloud/pkg/compute/models"
 	"yunion.io/x/onecloud/pkg/compute/options"
 	"yunion.io/x/onecloud/pkg/httperrors"
@@ -58,7 +59,7 @@ func getBmPrepareScript(ctx context.Context, w http.ResponseWriter, r *http.Requ
 		httperrors.InternalServerError(w, err.Error())
 		return
 	}
-	userCred := auth.FetchUserCredential(ctx)
+	userCred := auth.FetchUserCredential(ctx, policy.FilterPolicyCredential)
 	var script string
 	script += fmt.Sprintf("curl -fsSL -k -o ./baremetal_prepare.tar.gz %s;",
 		options.Options.BaremetalPreparePackageUrl)

pkg/compute/models/baremetalagents.go

@@ -19,12 +19,10 @@ const (
 
 type SBaremetalagentManager struct {
 	db.SStandaloneResourceBaseManager
-	SInfrastructureManager
 }
 
 type SBaremetalagent struct {
 	db.SStandaloneResourceBase
-	SInfrastructure
 
 	Status     string `width:"36" charset:"ascii" nullable:"false" default:"disable" list:"user" create:"optional"`
 	AccessIp   string `width:"16" charset:"ascii" nullable:"false" list:"admin" update:"admin" create:"admin_required"`
@@ -38,6 +36,26 @@ func init() {
 	BaremetalagentManager = &SBaremetalagentManager{SStandaloneResourceBaseManager: db.NewStandaloneResourceBaseManager(SBaremetalagent{}, "baremetalagents_tbl", "baremetalagent", "baremetalagents")}
 }
 
+func (self *SBaremetalagentManager) AllowListItems(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool {
+	return db.IsAdminAllowList(userCred, self)
+}
+
+func (self *SBaremetalagentManager) AllowCreateItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
+	return db.IsAdminAllowCreate(userCred, self)
+}
+
+func (self *SBaremetalagent) AllowGetDetails(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool {
+	return db.IsAdminAllowGet(userCred, self)
+}
+
+func (self *SBaremetalagent) AllowUpdateItem(ctx context.Context, userCred mcclient.TokenCredential) bool {
+	return db.IsAdminAllowUpdate(userCred, self)
+}
+
+func (self *SBaremetalagent) AllowDeleteItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
+	return db.IsAdminAllowDelete(userCred, self)
+}
+
 func (self *SBaremetalagent) ValidateDeleteCondition(ctx context.Context) error {
 	if self.Status == BAREMETAL_AGENT_ENABLED {
 		return fmt.Errorf("Cannot delete in status %s", self.Status)
@@ -80,7 +98,7 @@ func (manager *SBaremetalagentManager) ValidateCreateData(ctx context.Context, u
 }
 
 func (self *SBaremetalagent) AllowPerformEnable(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
-	return userCred.IsSystemAdmin()
+	return db.IsAdminAllowPerform(userCred, self, "enable")
 }
 
 func (self *SBaremetalagent) PerformEnable(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) {
@@ -95,7 +113,7 @@ func (self *SBaremetalagent) PerformEnable(ctx context.Context, userCred mcclien
 }
 
 func (self *SBaremetalagent) AllowPerformDisable(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
-	return userCred.IsSystemAdmin()
+	return db.IsAdminAllowPerform(userCred, self, "disable")
 }
 
 func (self *SBaremetalagent) PerformDisable(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) {
@@ -110,7 +128,7 @@ func (self *SBaremetalagent) PerformDisable(ctx context.Context, userCred mcclie
 }
 
 func (self *SBaremetalagent) AllowPerformOnline(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
-	return userCred.IsSystemAdmin()
+	return db.IsAdminAllowPerform(userCred, self, "online")
 }
 
 func (self *SBaremetalagent) PerformOnline(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) {
@@ -125,7 +143,7 @@ func (self *SBaremetalagent) PerformOnline(ctx context.Context, userCred mcclien
 }
 
 func (self *SBaremetalagent) AllowPerformOffline(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
-	return userCred.IsSystemAdmin()
+	return db.IsAdminAllowPerform(userCred, self, "offline")
 }
 
 func (self *SBaremetalagent) PerformOffline(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) {

pkg/compute/models/cachedimages.go

@@ -28,7 +28,6 @@ const (
 
 type SCachedimageManager struct {
 	db.SStandaloneResourceBaseManager
-	SInfrastructureManager
 }
 
 var CachedimageManager *SCachedimageManager
@@ -46,7 +45,6 @@ func init() {
 
 type SCachedimage struct {
 	db.SStandaloneResourceBase
-	SInfrastructure
 
 	Size int64 `nullable:"false" list:"admin" update:"admin" create:"admin_required"` // = Column(BigInteger, nullable=False) # in Byte
 	// virtual_size = Column(BigInteger, nullable=False) # in Byte
@@ -56,6 +54,26 @@ type SCachedimage struct {
 	RefCount int                  `default:"0" list:"admin"`                                           // = Column(Integer, default=0, server_default='0')
 }
 
+func (self *SCachedimageManager) AllowListItems(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool {
+	return db.IsAdminAllowList(userCred, self)
+}
+
+func (self *SCachedimageManager) AllowCreateItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
+	return db.IsAdminAllowCreate(userCred, self)
+}
+
+func (self *SCachedimage) AllowGetDetails(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool {
+	return db.IsAdminAllowGet(userCred, self)
+}
+
+func (self *SCachedimage) AllowUpdateItem(ctx context.Context, userCred mcclient.TokenCredential) bool {
+	return db.IsAdminAllowUpdate(userCred, self)
+}
+
+func (self *SCachedimage) AllowDeleteItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
+	return db.IsAdminAllowDelete(userCred, self)
+}
+
 func (self *SCachedimage) ValidateDeleteCondition(ctx context.Context) error {
 	if self.getStoragecacheCount() > 0 {
 		return httperrors.NewNotEmptyError("The image has been cached on storages")
@@ -240,7 +258,7 @@ func (self *SCachedimage) GetCustomizeColumns(ctx context.Context, userCred mccl
 }
 
 func (self *SCachedimage) AllowPerformRefresh(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
-	return userCred.IsSystemAdmin()
+	return db.IsAdminAllowPerform(userCred, self, "refresh")
 }
 
 func (self *SCachedimage) PerformRefresh(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) {

pkg/compute/models/cloudaccounts.go

@@ -25,7 +25,6 @@ import (
 
 type SCloudaccountManager struct {
 	db.SEnabledStatusStandaloneResourceBaseManager
-	SInfrastructureManager
 }
 
 var CloudaccountManager *SCloudaccountManager
@@ -43,7 +42,6 @@ func init() {
 
 type SCloudaccount struct {
 	db.SEnabledStatusStandaloneResourceBase
-	SInfrastructure
 
 	AccessUrl string `width:"64" charset:"ascii" nullable:"true" list:"admin" update:"admin" create:"admin_optional"`
 
@@ -60,6 +58,26 @@ type SCloudaccount struct {
 	Provider string `width:"64" charset:"ascii" list:"admin" create:"admin_required"`
 }
 
+func (self *SCloudaccountManager) AllowListItems(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool {
+	return db.IsAdminAllowList(userCred, self)
+}
+
+func (self *SCloudaccountManager) AllowCreateItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
+	return db.IsAdminAllowCreate(userCred, self)
+}
+
+func (self *SCloudaccount) AllowGetDetails(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool {
+	return db.IsAdminAllowGet(userCred, self)
+}
+
+func (self *SCloudaccount) AllowUpdateItem(ctx context.Context, userCred mcclient.TokenCredential) bool {
+	return db.IsAdminAllowUpdate(userCred, self)
+}
+
+func (self *SCloudaccount) AllowDeleteItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
+	return db.IsAdminAllowDelete(userCred, self)
+}
+
 func (self *SCloudaccount) GetCloudproviders() []SCloudprovider {
 	cloudproviders := []SCloudprovider{}
 	q := CloudproviderManager.Query().Equals("cloudaccount_id", self.Id)
@@ -202,7 +220,7 @@ func (self *SCloudaccount) CanSync() bool {
 }
 
 func (self *SCloudaccount) AllowPerformSync(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
-	return userCred.IsSystemAdmin()
+	return db.IsAdminAllowPerform(userCred, self, "sync")
 }
 
 func (self *SCloudaccount) PerformSync(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) {
@@ -221,7 +239,7 @@ func (self *SCloudaccount) PerformSync(ctx context.Context, userCred mcclient.To
 }
 
 func (self *SCloudaccount) AllowPerformUpdateCredential(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
-	return userCred.IsSystemAdmin()
+	return db.IsAdminAllowPerform(userCred, self, "update-credential")
 }
 
 func (self *SCloudaccount) PerformUpdateCredential(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) {
@@ -447,7 +465,7 @@ func (self *SCloudaccount) ImportSubAccount(ctx context.Context, userCred mcclie
 }
 
 func (self *SCloudaccount) AllowPerformImport(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
-	return userCred.IsSystemAdmin()
+	return db.IsAdminAllowPerform(userCred, self, "import")
 }
 
 func (self *SCloudaccount) PerformImport(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) {
@@ -623,7 +641,7 @@ func (self *SCloudaccount) GetBalance() (float64, error) {
 }
 
 func (self *SCloudaccount) AllowGetDetailsBalance(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool {
-	return userCred.IsSystemAdmin()
+	return db.IsAdminAllowGetSpec(userCred, self, "balance")
 }
 
 func (self *SCloudaccount) GetDetailsBalance(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) (jsonutils.JSONObject, error) {

pkg/compute/models/cloudproviders.go

@@ -38,7 +38,6 @@ const (
 
 type SCloudproviderManager struct {
 	db.SEnabledStatusStandaloneResourceBaseManager
-	SInfrastructureManager
 }
 
 var CloudproviderManager *SCloudproviderManager
@@ -56,7 +55,6 @@ func init() {
 
 type SCloudprovider struct {
 	db.SEnabledStatusStandaloneResourceBase
-	SInfrastructure
 
 	AccessUrl string `width:"64" charset:"ascii" nullable:"true" list:"admin" update:"admin" create:"admin_optional"`
 	// Hostname string `width:"64" charset:"ascii" nullable:"true"` // Column(VARCHAR(64, charset='ascii'), nullable=False)
@@ -85,6 +83,26 @@ func (self *SCloudprovider) GetOwnerProjectId() string {
 	return self.ProjectId
 }
 
+func (self *SCloudproviderManager) AllowListItems(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool {
+	return db.IsAdminAllowList(userCred, self)
+}
+
+func (self *SCloudproviderManager) AllowCreateItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
+	return db.IsAdminAllowCreate(userCred, self)
+}
+
+func (self *SCloudprovider) AllowGetDetails(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool {
+	return db.IsAdminAllowGet(userCred, self)
+}
+
+func (self *SCloudprovider) AllowUpdateItem(ctx context.Context, userCred mcclient.TokenCredential) bool {
+	return db.IsAdminAllowUpdate(userCred, self)
+}
+
+func (self *SCloudprovider) AllowDeleteItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
+	return db.IsAdminAllowDelete(userCred, self)
+}
+
 func (self *SCloudprovider) ValidateDeleteCondition(ctx context.Context) error {
 	if self.Enabled {
 		return httperrors.NewInvalidStatusError("provider is enabled")
@@ -309,7 +327,7 @@ func (sr *SSyncRange) Normalize() error {
 }
 
 func (self *SCloudprovider) AllowPerformSync(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
-	return userCred.IsSystemAdmin()
+	return db.IsAdminAllowPerform(userCred, self, "sync")
 }
 
 func (self *SCloudprovider) PerformSync(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) {
@@ -342,7 +360,7 @@ func (self *SCloudprovider) StartSyncCloudProviderInfoTask(ctx context.Context,
 }
 
 func (self *SCloudprovider) AllowPerformChangeProject(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
-	return userCred.IsSystemAdmin()
+	return db.IsAdminAllowPerform(userCred, self, "change-project")
 }
 
 func (self *SCloudprovider) PerformChangeProject(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) {
@@ -594,7 +612,7 @@ func (self *SCloudprovider) GetBalance() (float64, error) {
 }
 
 func (self *SCloudprovider) AllowGetDetailsBalance(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool {
-	return userCred.IsSystemAdmin()
+	return db.IsAdminAllowGetSpec(userCred, self, "balance")
 }
 
 func (self *SCloudprovider) GetDetailsBalance(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) (jsonutils.JSONObject, error) {

pkg/compute/models/cloudregions.go

@@ -25,7 +25,6 @@ const (
 
 type SCloudregionManager struct {
 	db.SEnabledStatusStandaloneResourceBaseManager
-	SInfrastructureManager
 }
 
 var CloudregionManager *SCloudregionManager
@@ -43,7 +42,6 @@ func init() {
 
 type SCloudregion struct {
 	db.SEnabledStatusStandaloneResourceBase
-	SInfrastructure
 
 	Latitude  float32 `list:"user"`
 	Longitude float32 `list:"user"`
@@ -54,6 +52,22 @@ func (manager *SCloudregionManager) AllowListItems(ctx context.Context, userCred
 	return true
 }
 
+func (self *SCloudregionManager) AllowCreateItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
+	return db.IsAdminAllowCreate(userCred, self)
+}
+
+func (self *SCloudregion) AllowGetDetails(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool {
+	return db.IsAdminAllowGet(userCred, self)
+}
+
+func (self *SCloudregion) AllowUpdateItem(ctx context.Context, userCred mcclient.TokenCredential) bool {
+	return db.IsAdminAllowUpdate(userCred, self)
+}
+
+func (self *SCloudregion) AllowDeleteItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
+	return db.IsAdminAllowDelete(userCred, self)
+}
+
 func (self *SCloudregion) CustomizeCreate(ctx context.Context, userCred mcclient.TokenCredential, ownerProjId string, query jsonutils.JSONObject, data jsonutils.JSONObject) error {
 	idstr, _ := data.GetString("id")
 	if len(idstr) > 0 {
@@ -250,7 +264,7 @@ func (manager *SCloudregionManager) newFromCloudRegion(cloudRegion cloudprovider
 }
 
 func (self *SCloudregion) AllowPerformDefaultVpc(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
-	return userCred.IsSystemAdmin()
+	return db.IsAdminAllowPerform(userCred, self, "default-vpc")
 }
 
 func (self *SCloudregion) PerformDefaultVpc(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) {

pkg/compute/models/disks.go

@@ -445,7 +445,7 @@ func (self *SDisk) StartAllocate(ctx context.Context, host *SHost, storage *SSto
 }
 
 func (self *SDisk) AllowGetDetailsConvertSnapshot(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool {
-	return self.IsOwner(userCred)
+	return self.IsOwner(userCred) || db.IsAdminAllowPerform(userCred, self, "convert-snapshot")
 }
 
 func (self *SDisk) GetDetailsConvertSnapshot(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) (jsonutils.JSONObject, error) {
@@ -502,7 +502,7 @@ func (self *SDisk) CleanUpDiskSnapshots(ctx context.Context, userCred mcclient.T
 }
 
 func (self *SDisk) AllowPerformCreateSnapshot(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
-	return self.IsOwner(userCred)
+	return self.IsOwner(userCred) || db.IsAdminAllowPerform(userCred, self, "create-snapshot")
 }
 
 func (self *SDisk) PerformCreateSnapshot(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) {
@@ -516,7 +516,7 @@ func (self *SDisk) PerformCreateSnapshot(ctx context.Context, userCred mcclient.
 }
 
 func (self *SDisk) AllowPerformDiskReset(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
-	return self.IsOwner(userCred)
+	return self.IsOwner(userCred) || db.IsAdminAllowPerform(userCred, self, "disk-reset")
 }
 
 func (self *SDisk) PerformDiskReset(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) {
@@ -563,7 +563,7 @@ func (self *SDisk) StartResetDisk(ctx context.Context, userCred mcclient.TokenCr
 }
 
 func (self *SDisk) AllowPerformResize(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
-	return self.IsOwner(userCred)
+	return self.IsOwner(userCred) || db.IsAdminAllowPerform(userCred, self, "resize")
 }
 
 func (self *SDisk) PerformResize(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) {
@@ -656,7 +656,7 @@ func (self *SDisk) PrepareSaveImage(ctx context.Context, userCred mcclient.Token
 }
 
 func (self *SDisk) AllowPerformSave(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
-	return self.IsOwner(userCred)
+	return self.IsOwner(userCred) || db.IsAdminAllowPerform(userCred, self, "save")
 }
 
 func (self *SDisk) PerformSave(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) {
@@ -1151,7 +1151,7 @@ func (self *SDisk) RealDelete(ctx context.Context, userCred mcclient.TokenCreden
 }
 
 func (self *SDisk) AllowPerformPurge(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
-	return self.IsOwner(userCred)
+	return self.IsOwner(userCred) || db.IsAdminAllowPerform(userCred, self, "purge")
 }
 
 func (self *SDisk) PerformPurge(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) {
@@ -1339,7 +1339,7 @@ func (self *SDisk) isInit() bool {
 }
 
 func (self *SDisk) AllowPerformCancelDelete(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
-	return userCred.IsSystemAdmin()
+	return db.IsAdminAllowPerform(userCred, self, "cancel-delete")
 }
 
 func (self *SDisk) PerformCancelDelete(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) {

pkg/compute/models/dnsrecords.go

@@ -383,7 +383,7 @@ func (rec *SDnsRecord) AddInfo(userCred mcclient.TokenCredential, data jsonutils
 }
 
 func (rec *SDnsRecord) AllowPerformAddRecords(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
-	return rec.IsOwner(userCred)
+	return rec.IsOwner(userCred) || db.IsAdminAllowPerform(userCred, rec, "add-records")
 }
 
 func (rec *SDnsRecord) PerformAddRecords(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) {
@@ -402,7 +402,7 @@ func (rec *SDnsRecord) PerformAddRecords(ctx context.Context, userCred mcclient.
 }
 
 func (rec *SDnsRecord) AllowPerformRemoveRecords(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
-	return rec.IsOwner(userCred)
+	return rec.IsOwner(userCred) || db.IsAdminAllowPerform(userCred, rec, "remove-records")
 }
 
 func (rec *SDnsRecord) PerformRemoveRecords(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) {
@@ -411,7 +411,7 @@ func (rec *SDnsRecord) PerformRemoveRecords(ctx context.Context, userCred mcclie
 }
 
 func (rec *SDnsRecord) AllowPerformEnable(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
-	return rec.IsOwner(userCred) || userCred.IsSystemAdmin()
+	return rec.IsOwner(userCred) || db.IsAdminAllowPerform(userCred, rec, "enable")
 }
 
 func (rec *SDnsRecord) PerformEnable(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) {
@@ -429,7 +429,7 @@ func (rec *SDnsRecord) PerformEnable(ctx context.Context, userCred mcclient.Toke
 }
 
 func (rec *SDnsRecord) AllowPerformDisable(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
-	return rec.IsOwner(userCred) || userCred.IsSystemAdmin()
+	return rec.IsOwner(userCred) || db.IsAdminAllowPerform(userCred, rec, "disable")
 }
 
 func (rec *SDnsRecord) PerformDisable(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) {

pkg/compute/models/dynamicschedtags.go

@@ -15,7 +15,6 @@ import (
 
 type SDynamicschedtagManager struct {
 	db.SStandaloneResourceBaseManager
-	SInfrastructureManager
 }
 
 var DynamicschedtagManager *SDynamicschedtagManager
@@ -37,7 +36,6 @@ func init() {
 //
 type SDynamicschedtag struct {
 	db.SStandaloneResourceBase
-	SInfrastructure
 
 	Condition  string `width:"256" charset:"ascii" nullable:"false" list:"user" create:"required" update:"admin"`
 	SchedtagId string `width:"36" charset:"ascii" nullable:"false" list:"user" create:"required" update:"admin"`
@@ -45,6 +43,26 @@ type SDynamicschedtag struct {
 	Enabled bool `nullable:"false" default:"true" create:"optional" list:"user" update:"user"`
 }
 
+func (self *SDynamicschedtagManager) AllowListItems(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool {
+	return db.IsAdminAllowList(userCred, self)
+}
+
+func (self *SDynamicschedtagManager) AllowCreateItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
+	return db.IsAdminAllowCreate(userCred, self)
+}
+
+func (self *SDynamicschedtag) AllowGetDetails(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool {
+	return db.IsAdminAllowGet(userCred, self)
+}
+
+func (self *SDynamicschedtag) AllowUpdateItem(ctx context.Context, userCred mcclient.TokenCredential) bool {
+	return db.IsAdminAllowUpdate(userCred, self)
+}
+
+func (self *SDynamicschedtag) AllowDeleteItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
+	return db.IsAdminAllowDelete(userCred, self)
+}
+
 func validateDynamicSchedtagInputData(data *jsonutils.JSONDict, create bool) error {
 	condStr := jsonutils.GetAnyString(data, []string{"condition"})
 	if len(condStr) == 0 && create {
@@ -132,7 +150,7 @@ func (manager *SDynamicschedtagManager) getAllEnabledDynamicSchedtags() []SDynam
 }
 
 func (self *SDynamicschedtag) AllowPerformEvaluate(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
-	return userCred.IsSystemAdmin()
+	return db.IsAdminAllowPerform(userCred, self, "evaluate")
 }
 
 func (self *SDynamicschedtag) PerformEvaluate(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) {

pkg/compute/models/elasticips.go

@@ -493,7 +493,7 @@ func (self *SElasticip) StartEipDeallocateTask(ctx context.Context, userCred mcc
 }
 
 func (self *SElasticip) AllowPerformAssociate(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
-	return self.IsOwner(userCred)
+	return self.IsOwner(userCred) || db.IsAdminAllowPerform(userCred, self, "associate")
 }
 
 func (self *SElasticip) PerformAssociate(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) {
@@ -593,7 +593,7 @@ func (self *SElasticip) StartEipAssociateTask(ctx context.Context, userCred mccl
 }
 
 func (self *SElasticip) AllowPerformDissociate(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
-	return self.IsOwner(userCred)
+	return self.IsOwner(userCred) || db.IsAdminAllowPerform(userCred, self, "dissociate")
 }
 
 func (self *SElasticip) PerformDissociate(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) {
@@ -647,7 +647,7 @@ func (self *SElasticip) GetIEip() (cloudprovider.ICloudEIP, error) {
 }
 
 func (self *SElasticip) AllowPerformSync(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
-	return self.IsOwner(userCred)
+	return self.IsOwner(userCred) || db.IsAdminAllowPerform(userCred, self, "sync")
 }
 
 func (self *SElasticip) PerformSync(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) {
@@ -731,7 +731,7 @@ func (manager *SElasticipManager) allocateEipAndAssociateVM(ctx context.Context,
 }
 
 func (self *SElasticip) AllowPerformChangeBandwidth(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
-	return self.IsOwner(userCred)
+	return self.IsOwner(userCred) || db.IsAdminAllowPerform(userCred, self, "change-bandwidth")
 }
 
 func (self *SElasticip) PerformChangeBandwidth(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) {
@@ -834,7 +834,7 @@ func (manager *SElasticipManager) TotalCount(projectId string, rangeObj db.IStan
 }
 
 func (self *SElasticip) AllowPerformPurge(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
-	return userCred.IsSystemAdmin()
+	return db.IsAdminAllowPerform(userCred, self, "purge")
 }
 
 func (self *SElasticip) PerformPurge(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) {

pkg/compute/models/guests.go

@@ -218,7 +218,7 @@ type SGuest struct {
 
 func (manager *SGuestManager) AllowListItems(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool {
 	if query.Contains("host") || query.Contains("wire") || query.Contains("zone") {
-		if !userCred.IsSystemAdmin() {
+		if !db.IsAdminAllowList(userCred, manager) {
 			return false
 		}
 	}
@@ -988,7 +988,7 @@ func (self *SGuest) getExtBandwidth() int {
 func (self *SGuest) GetCustomizeColumns(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) *jsonutils.JSONDict {
 	extra := self.SVirtualResourceBase.GetCustomizeColumns(ctx, userCred, query)
 
-	if userCred.IsSystemAdmin() {
+	if db.IsAdminAllowGet(userCred, self) {
 		host := self.GetHost()
 		if host != nil {
 			extra.Add(jsonutils.NewString(host.Name), "host")
@@ -1081,7 +1081,7 @@ func (self *SGuest) GetExtraDetails(ctx context.Context, userCred mcclient.Token
 	if metaData, err := self.GetAllMetadata(userCred); err == nil {
 		extra.Add(jsonutils.Marshal(metaData), "metadata")
 	}
-	if userCred.IsSystemAdmin() {
+	if db.IsAdminAllowGet(userCred, self) {
 		host := self.GetHost()
 		if host != nil {
 			extra.Add(jsonutils.NewString(host.GetName()), "host")
@@ -2337,10 +2337,10 @@ func (self *SGuest) AllowDeleteItem(ctx context.Context, userCred mcclient.Token
 		overridePendingDelete = jsonutils.QueryBoolean(data, "override_pending_delete", false)
 		purge = jsonutils.QueryBoolean(data, "purge", false)
 	}
-	if (overridePendingDelete || purge) && !userCred.IsSystemAdmin() {
+	if (overridePendingDelete || purge) && !db.IsAdminAllowDelete(userCred, self) {
 		return false
 	}
-	return self.IsOwner(userCred)
+	return self.IsOwner(userCred) || db.IsAdminAllowDelete(userCred, self)
 }
 
 func (self *SGuest) CustomizeDelete(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) error {

pkg/compute/models/helper.go

@@ -10,8 +10,10 @@ import (
 	"yunion.io/x/log"
 	"yunion.io/x/pkg/utils"
 
+	"yunion.io/x/onecloud/pkg/cloudcommon/consts"
 	"yunion.io/x/onecloud/pkg/cloudcommon/db"
 	"yunion.io/x/onecloud/pkg/cloudcommon/db/taskman"
+	"yunion.io/x/onecloud/pkg/cloudcommon/policy"
 	"yunion.io/x/onecloud/pkg/httperrors"
 	"yunion.io/x/onecloud/pkg/mcclient"
 )
@@ -47,7 +49,7 @@ func ValidateScheduleCreateData(ctx context.Context, userCred mcclient.TokenCred
 	// base validate_create_data
 	if (data.Contains("prefer_baremetal") || data.Contains("prefer_host")) && hypervisor != HYPERVISOR_CONTAINER {
 
-		if !userCred.IsSystemAdmin() {
+		if !userCred.IsAdminAllow(consts.GetServiceType(), GuestManager.KeywordPlural(), policy.PolicyActionPerform, "assign-host") {
 			return nil, httperrors.NewNotSufficientPrivilegeError("Only system admin can specify preferred host")
 		}
 		bmName, _ := data.GetString("prefer_host")

pkg/compute/models/hostjoints.go

@@ -31,29 +31,29 @@ type SHostJointsBase struct {
 }
 
 func (manager *SHostJointsManager) AllowListItems(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool {
-	return userCred.IsSystemAdmin()
+	return db.IsAdminAllowList(userCred, manager)
 }
 
 func (manager *SHostJointsManager) AllowCreateItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
-	return userCred.IsSystemAdmin()
+	return db.IsAdminAllowCreate(userCred, manager)
 }
 
 func (manager *SHostJointsManager) AllowListDescendent(ctx context.Context, userCred mcclient.TokenCredential, model db.IStandaloneModel, query jsonutils.JSONObject) bool {
-	return userCred.IsSystemAdmin()
+	return db.IsAdminAllowList(userCred, manager)
 }
 
 func (manager *SHostJointsManager) AllowAttach(ctx context.Context, userCred mcclient.TokenCredential, master db.IStandaloneModel, slave db.IStandaloneModel) bool {
-	return userCred.IsSystemAdmin()
+	return db.IsAdminAllowCreate(userCred, manager)
 }
 
 func (self *SHostJointsBase) AllowGetDetails(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool {
-	return userCred.IsSystemAdmin()
+	return db.IsAdminAllowGet(userCred, self)
 }
 
 func (self *SHostJointsBase) AllowUpdateItem(ctx context.Context, userCred mcclient.TokenCredential) bool {
-	return userCred.IsSystemAdmin()
+	return db.IsAdminAllowUpdate(userCred, self)
 }
 
 func (self *SHostJointsBase) AllowDeleteItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
-	return userCred.IsSystemAdmin()
+	return db.IsAdminAllowDelete(userCred, self)
 }

pkg/compute/models/hosts.go

@@ -91,7 +91,6 @@ var NIC_TYPES = []string{NIC_TYPE_IPMI, NIC_TYPE_ADMIN}
 
 type SHostManager struct {
 	db.SEnabledStatusStandaloneResourceBaseManager
-	SInfrastructureManager
 }
 
 var HostManager *SHostManager
@@ -110,7 +109,6 @@ func init() {
 
 type SHost struct {
 	db.SEnabledStatusStandaloneResourceBase
-	SInfrastructure
 	SManagedResourceBase
 
 	Rack  string `width:"16" charset:"ascii" nullable:"true" get:"admin" update:"admin" create:"admin_optional"` // Column(VARCHAR(16, charset='ascii'), nullable=True)
@@ -145,7 +143,7 @@ type SHost struct {
 	// Status  string = Column(VARCHAR(16, charset='ascii'), nullable=False, default=baremetalstatus.INIT) # status
 	HostStatus string `width:"16" charset:"ascii" nullable:"false" default:"offline" list:"admin"` // Column(VARCHAR(16, charset='ascii'), nullable=False, server_default=HOST_OFFLINE, default=HOST_OFFLINE)
 
-	ZoneId string `width:"128" charset:"ascii" nullable:"false" list:"admin" create:"admin_required"` // Column(VARCHAR(ID_LENGTH, charset='ascii'), nullable=False)
+	ZoneId string `width:"128" charset:"ascii" nullable:"false" list:"admin" create:"admin_optional"` // Column(VARCHAR(ID_LENGTH, charset='ascii'), nullable=False)
 
 	HostType string `width:"36" charset:"ascii" nullable:"false" list:"admin" update:"admin" create:"admin_required"` // Column(VARCHAR(36, charset='ascii'), nullable=False)
 
@@ -162,16 +160,24 @@ func (manager *SHostManager) GetContextManager() []db.IModelManager {
 	return []db.IModelManager{ZoneManager}
 }
 
-func (manager *SHostManager) AllowCreateItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
-	zoneId, err := data.GetString("zone_id")
-	if err != nil {
-		return false
-	}
-	_, err = ZoneManager.FetchById(zoneId)
-	if err != nil {
-		return false
-	}
-	return userCred.IsSystemAdmin()
+func (self *SHostManager) AllowListItems(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool {
+	return db.IsAdminAllowList(userCred, self)
+}
+
+func (self *SHostManager) AllowCreateItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
+	return db.IsAdminAllowCreate(userCred, self)
+}
+
+func (self *SHost) AllowGetDetails(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool {
+	return db.IsAdminAllowGet(userCred, self)
+}
+
+func (self *SHost) AllowUpdateItem(ctx context.Context, userCred mcclient.TokenCredential) bool {
+	return db.IsAdminAllowUpdate(userCred, self)
+}
+
+func (self *SHost) AllowDeleteItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
+	return db.IsAdminAllowDelete(userCred, self)
 }
 
 func (manager *SHostManager) ListItemFilter(ctx context.Context, q *sqlchemy.SQuery, userCred mcclient.TokenCredential, query jsonutils.JSONObject) (*sqlchemy.SQuery, error) {
@@ -264,6 +270,9 @@ func (manager *SHostManager) ListItemFilter(ctx context.Context, q *sqlchemy.SQu
 }
 
 func (self *SHost) GetZone() *SZone {
+	if len(self.ZoneId) == 0 {
+		return nil
+	}
 	zone, _ := ZoneManager.FetchById(self.ZoneId)
 	if zone != nil {
 		return zone.(*SZone)
@@ -1852,7 +1861,7 @@ func (self *SHost) GetExtraDetails(ctx context.Context, userCred mcclient.TokenC
 }
 
 func (self *SHost) AllowGetDetailsVnc(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool {
-	return userCred.IsSystemAdmin()
+	return db.IsAdminAllowGetSpec(userCred, self, "vnc")
 }
 
 func (self *SHost) GetDetailsVnc(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) (jsonutils.JSONObject, error) {
@@ -1867,7 +1876,7 @@ func (self *SHost) GetDetailsVnc(ctx context.Context, userCred mcclient.TokenCre
 }
 
 func (self *SHost) AllowGetDetailsIpmi(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool {
-	return userCred.IsSystemAdmin()
+	return db.IsAdminAllowGetSpec(userCred, self, "ipmi")
 }
 
 func (self *SHost) GetDetailsIpmi(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) (jsonutils.JSONObject, error) {
@@ -2003,7 +2012,7 @@ func (manager *SHostManager) ValidateSizeParams(data *jsonutils.JSONDict) (*json
 
 func (manager *SHostManager) ValidateCreateData(ctx context.Context, userCred mcclient.TokenCredential, ownerProjId string, query jsonutils.JSONObject, data *jsonutils.JSONDict) (*jsonutils.JSONDict, error) {
 	zoneId, _ := data.GetString("zone_id")
-	if len(zoneId) == 0 || ZoneManager.Query().Equals("id", zoneId).Count() == 0 {
+	if len(zoneId) > 0 && ZoneManager.Query().Equals("id", zoneId).Count() == 0 {
 		return nil, httperrors.NewInputParameterError("Zone id %s not found", zoneId)
 	}
 	mangerUri, err := data.GetString("manager_uri")
@@ -2158,7 +2167,7 @@ func (self *SHost) AllowPerformStart(ctx context.Context,
 	userCred mcclient.TokenCredential,
 	query jsonutils.JSONObject,
 	data jsonutils.JSONObject) bool {
-	return userCred.IsSystemAdmin()
+	return db.IsAdminAllowPerform(userCred, self, "start")
 }
 
 func (self *SHost) PerformStart(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject,
@@ -2193,7 +2202,7 @@ func (self *SHost) AllowPerformStop(ctx context.Context,
 	userCred mcclient.TokenCredential,
 	query jsonutils.JSONObject,
 	data jsonutils.JSONObject) bool {
-	return userCred.IsSystemAdmin()
+	return db.IsAdminAllowPerform(userCred, self, "stop")
 }
 
 func (self *SHost) PerformStop(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject,
@@ -2243,7 +2252,8 @@ func (self *SHost) AllowPerformMaintenance(ctx context.Context,
 	userCred mcclient.TokenCredential,
 	query jsonutils.JSONObject,
 	data jsonutils.JSONObject) bool {
-	return userCred.IsSystemAdmin()
+	return db.IsAdminAllowPerform(userCred, self, "maintenance")
+
 }
 
 func (self *SHost) PerformMaintenance(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) {
@@ -2282,7 +2292,7 @@ func (self *SHost) AllowPerformUnmaintenance(ctx context.Context,
 	userCred mcclient.TokenCredential,
 	query jsonutils.JSONObject,
 	data jsonutils.JSONObject) bool {
-	return userCred.IsSystemAdmin()
+	return db.IsAdminAllowPerform(userCred, self, "unmaintenance")
 }
 
 func (self *SHost) PerformUnmaintenance(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) {
@@ -2344,7 +2354,7 @@ func (self *SHost) AllowPerformOffline(ctx context.Context,
 	userCred mcclient.TokenCredential,
 	query jsonutils.JSONObject,
 	data jsonutils.JSONObject) bool {
-	return userCred.IsSystemAdmin()
+	return db.IsAdminAllowPerform(userCred, self, "offline")
 }
 
 func (self *SHost) PerformOffline(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) {
@@ -2363,7 +2373,7 @@ func (self *SHost) AllowPerformOnline(ctx context.Context,
 	userCred mcclient.TokenCredential,
 	query jsonutils.JSONObject,
 	data jsonutils.JSONObject) bool {
-	return userCred.IsSystemAdmin()
+	return db.IsAdminAllowPerform(userCred, self, "online")
 }
 
 func (self *SHost) PerformOnline(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) {
@@ -2399,7 +2409,7 @@ func (self *SHost) AllowPerformPing(ctx context.Context,
 	userCred mcclient.TokenCredential,
 	query jsonutils.JSONObject,
 	data jsonutils.JSONObject) bool {
-	return userCred.IsSystemAdmin()
+	return db.IsAdminAllowPerform(userCred, self, "ping")
 }
 
 func (self *SHost) PerformPing(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) {
@@ -2426,7 +2436,7 @@ func (self *SHost) AllowPerformPrepare(ctx context.Context,
 	userCred mcclient.TokenCredential,
 	query jsonutils.JSONObject,
 	data jsonutils.JSONObject) bool {
-	return userCred.IsSystemAdmin()
+	return db.IsAdminAllowPerform(userCred, self, "prepare")
 }
 
 func (self *SHost) PerformPrepare(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) {
@@ -2462,7 +2472,7 @@ func (self *SHost) AllowPerformAddNetif(ctx context.Context,
 	userCred mcclient.TokenCredential,
 	query jsonutils.JSONObject,
 	data jsonutils.JSONObject) bool {
-	return userCred.IsSystemAdmin()
+	return db.IsAdminAllowPerform(userCred, self, "add-netif")
 }
 
 func (self *SHost) PerformAddNetif(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) {
@@ -2623,7 +2633,7 @@ func (self *SHost) AllowPerformEnableNetif(ctx context.Context,
 	userCred mcclient.TokenCredential,
 	query jsonutils.JSONObject,
 	data jsonutils.JSONObject) bool {
-	return userCred.IsSystemAdmin()
+	return db.IsAdminAllowPerform(userCred, self, "enable-netif")
 }
 
 func (self *SHost) PerformEnableNetif(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) {
@@ -2697,7 +2707,7 @@ func (self *SHost) AllowPerformDisableNetif(ctx context.Context,
 	userCred mcclient.TokenCredential,
 	query jsonutils.JSONObject,
 	data jsonutils.JSONObject) bool {
-	return userCred.IsSystemAdmin()
+	return db.IsAdminAllowPerform(userCred, self, "disable-netif")
 }
 
 func (self *SHost) PerformDisableNetif(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) {
@@ -2751,7 +2761,7 @@ func (self *SHost) AllowPerformRemoveNetif(ctx context.Context,
 	userCred mcclient.TokenCredential,
 	query jsonutils.JSONObject,
 	data jsonutils.JSONObject) bool {
-	return userCred.IsSystemAdmin()
+	return db.IsAdminAllowPerform(userCred, self, "remove-netif")
 }
 
 func (self *SHost) PerformRemoveNetif(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) {
@@ -2805,7 +2815,7 @@ func (self *SHost) AllowPerformSyncstatus(ctx context.Context,
 	userCred mcclient.TokenCredential,
 	query jsonutils.JSONObject,
 	data jsonutils.JSONObject) bool {
-	return userCred.IsSystemAdmin()
+	return db.IsAdminAllowPerform(userCred, self, "syncstatus")
 }
 
 func (self *SHost) PerformSyncstatus(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) {
@@ -2817,7 +2827,7 @@ func (self *SHost) AllowPerformReset(ctx context.Context,
 	userCred mcclient.TokenCredential,
 	query jsonutils.JSONObject,
 	data jsonutils.JSONObject) bool {
-	return userCred.IsSystemAdmin()
+	return db.IsAdminAllowPerform(userCred, self, "reset")
 }
 
 func (self *SHost) PerformReset(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) {
@@ -2847,7 +2857,7 @@ func (self *SHost) AllowPerformRemoveAllNetifs(ctx context.Context,
 	userCred mcclient.TokenCredential,
 	query jsonutils.JSONObject,
 	data jsonutils.JSONObject) bool {
-	return userCred.IsSystemAdmin()
+	return db.IsAdminAllowPerform(userCred, self, "remove-all-netifs")
 }
 
 func (self *SHost) PerformRemoveAllNetifs(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) {
@@ -2864,7 +2874,7 @@ func (self *SHost) AllowPerformDisable(ctx context.Context,
 	userCred mcclient.TokenCredential,
 	query jsonutils.JSONObject,
 	data jsonutils.JSONObject) bool {
-	return userCred.IsSystemAdmin()
+	return db.IsAdminAllowPerform(userCred, self, "disable")
 }
 
 func (self *SHost) PerformDisable(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) {
@@ -2887,7 +2897,7 @@ func (self *SHost) AllowPerformCacheImage(ctx context.Context,
 	userCred mcclient.TokenCredential,
 	query jsonutils.JSONObject,
 	data jsonutils.JSONObject) bool {
-	return userCred.IsSystemAdmin()
+	return db.IsAdminAllowPerform(userCred, self, "cache-image")
 }
 
 func (self *SHost) PerformCacheImage(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) {
@@ -2919,7 +2929,7 @@ func (self *SHost) AllowPerformConvertHypervisor(ctx context.Context,
 	userCred mcclient.TokenCredential,
 	query jsonutils.JSONObject,
 	data jsonutils.JSONObject) bool {
-	return userCred.IsSystemAdmin()
+	return db.IsAdminAllowPerform(userCred, self, "convert-hypervisor")
 }
 
 func (self *SHost) isAlterNameUnique(name string) bool {
@@ -2985,7 +2995,7 @@ func (self *SHost) AllowPerformUndoConvert(ctx context.Context,
 	userCred mcclient.TokenCredential,
 	query jsonutils.JSONObject,
 	data jsonutils.JSONObject) bool {
-	return userCred.IsSystemAdmin()
+	return db.IsAdminAllowPerform(userCred, self, "undo-convert")
 }
 
 func (self *SHost) PerformUndoConvert(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) {

pkg/compute/models/inframanagers.go

@@ -1,33 +0,0 @@
-package models
-
-import (
-	"context"
-	"yunion.io/x/jsonutils"
-	"yunion.io/x/onecloud/pkg/mcclient"
-)
-
-type SInfrastructureManager struct {
-}
-
-type SInfrastructure struct {
-}
-
-func (self *SInfrastructureManager) AllowListItems(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool {
-	return userCred.IsSystemAdmin()
-}
-
-func (self *SInfrastructureManager) AllowCreateItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
-	return userCred.IsSystemAdmin()
-}
-
-func (self *SInfrastructure) AllowGetDetails(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool {
-	return userCred.IsSystemAdmin()
-}
-
-func (self *SInfrastructure) AllowUpdateItem(ctx context.Context, userCred mcclient.TokenCredential) bool {
-	return userCred.IsSystemAdmin()
-}
-
-func (self *SInfrastructure) AllowDeleteItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
-	return userCred.IsSystemAdmin()
-}

pkg/compute/models/isolated_devices.go

@@ -80,7 +80,7 @@ type SIsolatedDevice struct {
 
 func (manager *SIsolatedDeviceManager) AllowListItems(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool {
 	host, _ := query.GetString("host")
-	if len(host) > 0 && !userCred.IsSystemAdmin() {
+	if len(host) > 0 && !db.IsAdminAllowList(userCred, manager) {
 		return false
 	}
 	return true
@@ -92,7 +92,7 @@ func (manager *SIsolatedDeviceManager) ExtraSearchConditions(ctx context.Context
 }
 
 func (manager *SIsolatedDeviceManager) AllowCreateItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
-	return userCred.IsSystemAdmin()
+	return db.IsAdminAllowCreate(userCred, manager)
 }
 
 func (manager *SIsolatedDeviceManager) ListItemFilter(ctx context.Context, q *sqlchemy.SQuery, userCred mcclient.TokenCredential, query jsonutils.JSONObject) (*sqlchemy.SQuery, error) {

pkg/compute/models/keypairs.go

@@ -47,7 +47,7 @@ func (manager *SKeypairManager) ListItemFilter(ctx context.Context, q *sqlchemy.
 	if err != nil {
 		return nil, err
 	}
-	if userCred.IsSystemAdmin() && jsonutils.QueryBoolean(query, "admin", false) {
+	if jsonutils.QueryBoolean(query, "admin", false) && db.IsAdminAllowList(userCred, manager) {
 		user, _ := query.GetString("user")
 		if len(user) > 0 {
 			uc, _ := db.UserCacheManager.FetchUserByIdOrName(user)
@@ -71,7 +71,7 @@ func (self *SKeypair) IsOwner(userCred mcclient.TokenCredential) bool {
 }
 
 func (self *SKeypair) AllowGetDetails(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool {
-	return self.IsOwner(userCred) || userCred.IsSystemAdmin()
+	return self.IsOwner(userCred) || db.IsAdminAllowGet(userCred, self)
 }
 
 func (self *SKeypair) GetCustomizeColumns(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) *jsonutils.JSONDict {
@@ -85,7 +85,7 @@ func (self *SKeypair) GetExtraDetails(ctx context.Context, userCred mcclient.Tok
 	extra := self.SStandaloneResourceBase.GetExtraDetails(ctx, userCred, query)
 	extra.Add(jsonutils.NewInt(int64(len(self.PrivateKey))), "private_key_len")
 	extra.Add(jsonutils.NewInt(int64(self.GetLinkedGuestsCount())), "linked_guest_count")
-	if userCred.IsSystemAdmin() {
+	if db.IsAdminAllowGet(userCred, self) {
 		extra.Add(jsonutils.NewString(self.OwnerId), "owner_id")
 		uc, _ := db.UserCacheManager.FetchUserById(self.OwnerId)
 		if uc != nil {
@@ -100,11 +100,11 @@ func (manager *SKeypairManager) AllowCreateItem(ctx context.Context, userCred mc
 }
 
 func (self *SKeypair) AllowUpdateItem(ctx context.Context, userCred mcclient.TokenCredential) bool {
-	return self.IsOwner(userCred)
+	return self.IsOwner(userCred) || db.IsAdminAllowUpdate(userCred, self)
 }
 
 func (self *SKeypair) AllowDeleteItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
-	return self.IsOwner(userCred) || userCred.IsSystemAdmin()
+	return self.IsOwner(userCred) || db.IsAdminAllowDelete(userCred, self)
 }
 
 func (self *SKeypair) GetLinkedGuestsCount() int {

pkg/compute/models/loadbalanceracls.go

@@ -136,7 +136,7 @@ func (lbacl *SLoadbalancerAcl) ValidateUpdateData(ctx context.Context, userCred
 }
 
 func (lbacl *SLoadbalancerAcl) AllowPerformPatch(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data *jsonutils.JSONDict) bool {
-	return lbacl.IsOwner(userCred) || userCred.IsSystemAdmin()
+	return lbacl.IsOwner(userCred) || db.IsAdminAllowPerform(userCred, lbacl, "patch")
 }
 
 // PerformPatch patches acl entries by adding then deleting the specified acls.

pkg/compute/models/loadbalanceragents.go

@@ -20,7 +20,6 @@ import (
 
 type SLoadbalancerAgentManager struct {
 	db.SStandaloneResourceBaseManager
-	SInfrastructureManager
 }
 
 var LoadbalancerAgentManager *SLoadbalancerAgentManager
@@ -46,7 +45,6 @@ func init() {
 //
 type SLoadbalancerAgent struct {
 	db.SStandaloneResourceBase
-	SInfrastructure
 
 	HbLastSeen time.Time                 `nullable:"true" list:"admin" update:"admin"`
 	HbTimeout  int                       `nullable:"true" list:"admin" update:"admin" create:"optional" default:"3600"`
@@ -237,6 +235,27 @@ func (p *SLoadbalancerAgentParams) IsZero() bool {
 	return false
 }
 
+
+func (self *SLoadbalancerAgentManager) AllowListItems(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool {
+	return db.IsAdminAllowList(userCred, self)
+}
+
+func (self *SLoadbalancerAgentManager) AllowCreateItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
+	return db.IsAdminAllowCreate(userCred, self)
+}
+
+func (self *SLoadbalancerAgent) AllowGetDetails(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool {
+	return db.IsAdminAllowGet(userCred, self)
+}
+
+func (self *SLoadbalancerAgent) AllowUpdateItem(ctx context.Context, userCred mcclient.TokenCredential) bool {
+	return db.IsAdminAllowUpdate(userCred, self)
+}
+
+func (self *SLoadbalancerAgent) AllowDeleteItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
+	return db.IsAdminAllowDelete(userCred, self)
+}
+
 func (man *SLoadbalancerAgentManager) ValidateCreateData(ctx context.Context, userCred mcclient.TokenCredential, ownerProjId string, query jsonutils.JSONObject, data *jsonutils.JSONDict) (*jsonutils.JSONDict, error) {
 	{
 		keyV := map[string]validators.IValidator{
@@ -353,10 +372,6 @@ func (man *SLoadbalancerAgentManager) CleanPendingDeleteLoadbalancers(ctx contex
 	}
 }
 
-func (man *SLoadbalancerAgentManager) AllowCreateItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
-	return userCred.IsSystemAdmin()
-}
-
 func (lbagent *SLoadbalancerAgent) ValidateUpdateData(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data *jsonutils.JSONDict) (*jsonutils.JSONDict, error) {
 	{
 		keyV := map[string]validators.IValidator{
@@ -400,7 +415,7 @@ func (lbagent *SLoadbalancerAgent) ValidateUpdateData(ctx context.Context, userC
 }
 
 func (lbagent *SLoadbalancerAgent) AllowPerformHb(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data *jsonutils.JSONDict) bool {
-	return userCred.IsSystemAdmin()
+	return db.IsAdminAllowPerform(userCred, lbagent, "hb")
 }
 
 func (lbagent *SLoadbalancerAgent) PerformHb(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data *jsonutils.JSONDict) (*jsonutils.JSONDict, error) {
@@ -426,7 +441,7 @@ func (lbagent *SLoadbalancerAgent) IsActive() bool {
 }
 
 func (lbagent *SLoadbalancerAgent) AllowPerformParamsPatch(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data *jsonutils.JSONDict) bool {
-	return userCred.IsSystemAdmin()
+	return db.IsAdminAllowPerform(userCred, lbagent, "params-patch")
 }
 
 func (lbagent *SLoadbalancerAgent) PerformParamsPatch(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data *jsonutils.JSONDict) (*jsonutils.JSONDict, error) {

pkg/compute/models/loadbalancerbackends.go

@@ -137,7 +137,7 @@ func (man *SLoadbalancerBackendManager) ValidateCreateData(ctx context.Context,
 		}
 		baseName = guest.Name
 	case LB_BACKEND_HOST:
-		if !userCred.IsSystemAdmin() {
+		if !db.IsAdminAllowCreate(userCred, man) {
 			return nil, fmt.Errorf("only sysadmin can specify host as backend")
 		}
 		backendV := validators.NewModelIdOrNameValidator("backend", "host", userCred.GetProjectId())

pkg/compute/models/loadbalancerlistenerrules.go

@@ -126,7 +126,7 @@ func (man *SLoadbalancerListenerRuleManager) ValidateCreateData(ctx context.Cont
 }
 
 func (lbr *SLoadbalancerListenerRule) AllowPerformStatus(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
-	return lbr.IsOwner(userCred) || userCred.IsSystemAdmin()
+	return lbr.IsOwner(userCred) || db.IsAdminAllowPerform(userCred, lbr, "status")
 }
 
 func (lbr *SLoadbalancerListenerRule) ValidateUpdateData(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data *jsonutils.JSONDict) (*jsonutils.JSONDict, error) {

pkg/compute/models/loadbalancerlisteners.go

@@ -295,7 +295,7 @@ func (man *SLoadbalancerListenerManager) validateAcl(aclStatusV *validators.Vali
 }
 
 func (lblis *SLoadbalancerListener) AllowPerformStatus(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
-	return lblis.IsOwner(userCred) || userCred.IsSystemAdmin()
+	return lblis.IsOwner(userCred) || db.IsAdminAllowPerform(userCred, lblis, "status")
 }
 
 func (lblis *SLoadbalancerListener) ValidateUpdateData(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data *jsonutils.JSONDict) (*jsonutils.JSONDict, error) {

pkg/compute/models/loadbalancers.go

@@ -132,7 +132,7 @@ func (man *SLoadbalancerManager) ValidateCreateData(ctx context.Context, userCre
 }
 
 func (lb *SLoadbalancer) AllowPerformStatus(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
-	return lb.IsOwner(userCred) || userCred.IsSystemAdmin()
+	return lb.IsOwner(userCred) || db.IsAdminAllowPerform(userCred, lb, "status")
 }
 
 func (lb *SLoadbalancer) PostCreate(ctx context.Context, userCred mcclient.TokenCredential, ownerProjId string, query jsonutils.JSONObject, data jsonutils.JSONObject) {

pkg/compute/models/networks.go

@@ -134,7 +134,7 @@ func (self *SNetwork) GetVpc() *SVpc {
 }
 
 func (manager *SNetworkManager) AllowCreateItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
-	return userCred.IsSystemAdmin()
+	return db.IsAdminAllowCreate(userCred, manager)
 }
 
 func (self *SNetwork) ValidateDeleteCondition(ctx context.Context) error {
@@ -627,7 +627,7 @@ func (manager *SNetworkManager) allNetworksQ(rangeObj db.IStandaloneModel) *sqlc
 func (manager *SNetworkManager) totalPortCountQ(userCred mcclient.TokenCredential, rangeObj db.IStandaloneModel) *sqlchemy.SQuery {
 	q := manager.allNetworksQ(rangeObj)
 	networks := manager.Query().SubQuery()
-	if userCred != nil && !userCred.IsSystemAdmin() {
+	if userCred != nil && !db.IsAdminAllowList(userCred, manager) {
 		q = q.Filter(sqlchemy.OR(
 			sqlchemy.Equals(networks.Field("tenant_id"), userCred.GetProjectId()),
 			sqlchemy.IsTrue(networks.Field("is_public"))))
@@ -759,7 +759,8 @@ func isValidNetworkInfo(userCred mcclient.TokenCredential, netConfig *SNetworkCo
 				return httperrors.NewInputParameterError("Address %s not in range", netConfig.Address)
 			}
 			if netConfig.Reserved {
-				if !userCred.IsSystemAdmin() {
+				// the privilege to access reserved ip
+				if !db.IsAdminAllowList(userCred, ReservedipManager) {
 					return httperrors.NewForbiddenError("Only system admin allowed to use reserved ip")
 				}
 				if ReservedipManager.GetReservedIP(net, netConfig.Address) == nil {
@@ -876,7 +877,7 @@ func (self *SNetwork) GetCustomizeColumns(ctx context.Context, userCred mcclient
 }
 
 func (self *SNetwork) AllowPerformReserveIp(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
-	return self.IsOwner(userCred)
+	return self.IsOwner(userCred) || db.IsAdminAllowPerform(userCred, self, "reserve-ip")
 }
 
 func (self *SNetwork) PerformReserveIp(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) {
@@ -903,7 +904,7 @@ func (self *SNetwork) PerformReserveIp(ctx context.Context, userCred mcclient.To
 }
 
 func (self *SNetwork) AllowPerformReleaseReservedIp(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
-	return self.IsOwner(userCred)
+	return self.IsOwner(userCred) || db.IsAdminAllowPerform(userCred, self, "release-reserved-ip")
 }
 
 func (self *SNetwork) PerformReleaseReservedIp(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) {
@@ -920,7 +921,7 @@ func (self *SNetwork) PerformReleaseReservedIp(ctx context.Context, userCred mcc
 }
 
 func (self *SNetwork) AllowGetDetailsReservedIps(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool {
-	return self.IsOwner(userCred)
+	return self.IsOwner(userCred) || db.IsAdminAllowGetSpec(userCred, self, "reserved-ips")
 }
 
 func (self *SNetwork) GetDetailsReservedIps(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) (jsonutils.JSONObject, error) {
@@ -1211,7 +1212,7 @@ func isOverlapNetworks(nets []SNetwork, startIp netutils.IPV4Addr, endIp netutil
 }
 
 func (self *SNetwork) CustomizeCreate(ctx context.Context, userCred mcclient.TokenCredential, ownerProjId string, query jsonutils.JSONObject, data jsonutils.JSONObject) error {
-	if userCred.IsSystemAdmin() && ownerProjId == userCred.GetProjectId() {
+	if db.IsAdminAllowCreate(userCred, self.GetModelManager()) && ownerProjId == userCred.GetProjectId() {
 		self.IsPublic = true
 	} else {
 		self.IsPublic = false
@@ -1396,7 +1397,7 @@ func (self *SNetwork) ValidateUpdateCondition(ctx context.Context) error {
 }
 
 func (self *SNetwork) AllowPerformPurge(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
-	return userCred.IsSystemAdmin()
+	return db.IsAdminAllowPerform(userCred, self, "purge")
 }
 
 func (self *SNetwork) PerformPurge(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) {

pkg/compute/models/reservedips.go

@@ -38,7 +38,7 @@ type SReservedip struct {
 }
 
 func (manager *SReservedipManager) AllowListItems(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool {
-	return userCred.IsSystemAdmin()
+	return db.IsAdminAllowList(userCred, manager)
 }
 
 func (manager *SReservedipManager) AllowCreateItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {

pkg/compute/models/routetables.go

@@ -159,7 +159,7 @@ func (rt *SRouteTable) ValidateUpdateData(ctx context.Context, userCred mcclient
 }
 
 func (rt *SRouteTable) AllowPerformAddRoutes(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data *jsonutils.JSONDict) bool {
-	return rt.IsOwner(userCred) || userCred.IsSystemAdmin()
+	return rt.IsOwner(userCred) || db.IsAdminAllowPerform(userCred, rt, "add-routes")
 }
 
 func (rt *SRouteTable) AllowPerformDelRoutes(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data *jsonutils.JSONDict) bool {

pkg/compute/models/schedpolicies.go

@@ -16,7 +16,6 @@ import (
 
 type SSchedpolicyManager struct {
 	db.SStandaloneResourceBaseManager
-	SInfrastructureManager
 }
 
 var SchedpolicyManager *SSchedpolicyManager
@@ -35,7 +34,6 @@ func init() {
 // sched policy is called before calling scheduler, add additional preferences for schedtags
 type SSchedpolicy struct {
 	db.SStandaloneResourceBase
-	SInfrastructure
 
 	Condition  string `width:"256" charset:"ascii" nullable:"false" list:"user" create:"required" update:"user"`
 	SchedtagId string `width:"36" charset:"ascii" nullable:"false" list:"user" create:"required" update:"user"`
@@ -62,6 +60,26 @@ func validateSchedpolicyInputData(data *jsonutils.JSONDict, create bool) error {
 	return nil
 }
 
+func (self *SSchedpolicyManager) AllowListItems(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool {
+	return db.IsAdminAllowList(userCred, self)
+}
+
+func (self *SSchedpolicyManager) AllowCreateItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
+	return db.IsAdminAllowCreate(userCred, self)
+}
+
+func (self *SSchedpolicy) AllowGetDetails(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool {
+	return db.IsAdminAllowGet(userCred, self)
+}
+
+func (self *SSchedpolicy) AllowUpdateItem(ctx context.Context, userCred mcclient.TokenCredential) bool {
+	return db.IsAdminAllowUpdate(userCred, self)
+}
+
+func (self *SSchedpolicy) AllowDeleteItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
+	return db.IsAdminAllowDelete(userCred, self)
+}
+
 func (manager *SSchedpolicyManager) ValidateCreateData(ctx context.Context, userCred mcclient.TokenCredential, ownerProjId string, query jsonutils.JSONObject, data *jsonutils.JSONDict) (*jsonutils.JSONDict, error) {
 	err := validateSchedpolicyInputData(data, true)
 	if err != nil {
@@ -121,7 +139,7 @@ func (manager *SSchedpolicyManager) getAllEnabledPolicies() []SSchedpolicy {
 }
 
 func (self *SSchedpolicy) AllowPerformEvaluate(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
-	return userCred.IsSystemAdmin()
+	return db.IsAdminAllowPerform(userCred, self, "evaluate")
 }
 
 func (self *SSchedpolicy) PerformEvaluate(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) {

pkg/compute/models/schedtags.go

@@ -30,7 +30,6 @@ var STRATEGY_LIST = []string{STRATEGY_REQUIRE, STRATEGY_EXCLUDE, STRATEGY_PREFER
 
 type SSchedtagManager struct {
 	db.SStandaloneResourceBaseManager
-	SInfrastructureManager
 }
 
 var SchedtagManager *SSchedtagManager
@@ -48,7 +47,6 @@ func init() {
 
 type SSchedtag struct {
 	db.SStandaloneResourceBase
-	SInfrastructure
 
 	DefaultStrategy string `width:"16" charset:"ascii" nullable:"true" default:"" list:"user" update:"admin" create:"admin_optional"` // Column(VARCHAR(16, charset='ascii'), nullable=True, default='')
 }
@@ -61,6 +59,18 @@ func (self *SSchedtag) AllowGetDetails(ctx context.Context, userCred mcclient.To
 	return true
 }
 
+func (self *SSchedtagManager) AllowCreateItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
+	return db.IsAdminAllowCreate(userCred, self)
+}
+
+func (self *SSchedtag) AllowUpdateItem(ctx context.Context, userCred mcclient.TokenCredential) bool {
+	return db.IsAdminAllowUpdate(userCred, self)
+}
+
+func (self *SSchedtag) AllowDeleteItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
+	return db.IsAdminAllowDelete(userCred, self)
+}
+
 func (manager *SSchedtagManager) ValidateSchedtags(userCred mcclient.TokenCredential, schedtags map[string]string) (map[string]string, error) {
 	ret := make(map[string]string)
 	for tag, act := range schedtags {

pkg/compute/models/secgrouprules.go

@@ -78,14 +78,14 @@ func (manager *SSecurityGroupRuleManager) AllowListItems(ctx context.Context, us
 
 func (self *SSecurityGroupRule) AllowUpdateItem(ctx context.Context, userCred mcclient.TokenCredential) bool {
 	if secgroup := self.GetSecGroup(); secgroup != nil {
-		return secgroup.IsOwner(userCred)
+		return secgroup.IsOwner(userCred) || db.IsAdminAllowUpdate(userCred, self)
 	}
 	return false
 }
 
 func (self *SSecurityGroupRule) AllowDeleteItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
 	if secgroup := self.GetSecGroup(); secgroup != nil {
-		return secgroup.IsOwner(userCred)
+		return secgroup.IsOwner(userCred) || db.IsAdminAllowDelete(userCred, self)
 	}
 	return false
 }
@@ -201,7 +201,7 @@ func (manager *SSecurityGroupRuleManager) ValidateCreateData(ctx context.Context
 	if err != nil {
 		return nil, httperrors.NewInputParameterError(err.Error())
 	}
-	return manager.SModelBaseManager.ValidateCreateData(ctx, userCred, ownerProjId, query, data)
+	return manager.SResourceBaseManager.ValidateCreateData(ctx, userCred, ownerProjId, query, data)
 }
 
 func (self *SSecurityGroupRule) ValidateUpdateData(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data *jsonutils.JSONDict) (*jsonutils.JSONDict, error) {

pkg/compute/models/skus.go

@@ -3,6 +3,7 @@ package models
 import (
 	"context"
 	"database/sql"
+
 	"yunion.io/x/sqlchemy"
 
 	"yunion.io/x/jsonutils"
@@ -24,7 +25,6 @@ const (
 
 type SServerSkuManager struct {
 	db.SStandaloneResourceBaseManager
-	SInfrastructureManager
 }
 
 var ServerSkuManager *SServerSkuManager
@@ -44,7 +44,6 @@ func init() {
 // SServerSku 实际对应的是instance type清单. 这里的Sku实际指的是instance type。
 type SServerSku struct {
 	db.SStandaloneResourceBase
-	SInfrastructure
 
 	// SkuId       string `width:"64" charset:"ascii" nullable:"false" list:"user" create:"admin_required"`                 // x2.large
 	InstanceTypeFamily   string `width:"32" charset:"ascii" nullable:"false" list:"user" create:"admin_optional" update:"admin"` // x2

pkg/compute/models/snapshots.go

@@ -86,8 +86,8 @@ func ValidateSnapshotName(hypervisor, name, owner string) error {
 	return nil
 }
 
-func (self *SSnapshot) AllowListItems(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool {
-	return self.IsOwner(userCred)
+func (self *SSnapshotManager) AllowListItems(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool {
+	return true
 }
 
 func (manager *SSnapshotManager) ListItemFilter(ctx context.Context, q *sqlchemy.SQuery, userCred mcclient.TokenCredential, query jsonutils.JSONObject) (*sqlchemy.SQuery, error) {
@@ -323,7 +323,7 @@ func (self *SSnapshotManager) CreateSnapshot(ctx context.Context, userCred mccli
 }
 
 func (self *SSnapshot) AllowDeleteItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
-	return self.IsOwner(userCred)
+	return self.IsOwner(userCred) || db.IsAdminAllowDelete(userCred, self)
 }
 
 func (self *SSnapshot) StartSnapshotDeleteTask(ctx context.Context, userCred mcclient.TokenCredential, reloadDisk bool, parentTaskId string) error {
@@ -364,7 +364,7 @@ func (self *SSnapshot) CustomizeDelete(ctx context.Context, userCred mcclient.To
 }
 
 func (self *SSnapshot) AllowPerformDeleted(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
-	return self.IsOwner(userCred)
+	return self.IsOwner(userCred) || db.IsAdminAllowPerform(userCred, self, "deleted")
 }
 
 func (self *SSnapshot) PerformDeleted(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) {
@@ -401,7 +401,7 @@ func (self *SSnapshotManager) GetConvertSnapshot(deleteSnapshot *SSnapshot) (*SS
 }
 
 func (self *SSnapshotManager) AllowPerformDeleteDiskSnapshots(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
-	return userCred.IsAdmin()
+	return db.IsAdminAllowClassPerform(userCred, self, "delete-disk-snapshots")
 }
 
 func (self *SSnapshotManager) PerformDeleteDiskSnapshots(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) {
@@ -586,7 +586,7 @@ func (self *SSnapshot) GetISnapshotRegion() (cloudprovider.ICloudRegion, error)
 }
 
 func (self *SSnapshot) AllowPerformPurge(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
-	return userCred.IsSystemAdmin()
+	return db.IsAdminAllowPerform(userCred, self, "purge")
 }
 
 func (self *SSnapshot) PerformPurge(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) {

pkg/compute/models/storagecachedimages.go

@@ -30,7 +30,6 @@ const (
 
 type SStoragecachedimageManager struct {
 	db.SJointResourceBaseManager
-	SInfrastructureManager
 }
 
 var StoragecachedimageManager *SStoragecachedimageManager
@@ -52,7 +51,6 @@ func init() {
 
 type SStoragecachedimage struct {
 	db.SJointResourceBase
-	SInfrastructure
 
 	StoragecacheId string `width:"36" charset:"ascii" nullable:"false" list:"admin" create:"admin_required" key_index:"true"`
 	CachedimageId  string `width:"36" charset:"ascii" nullable:"false" list:"admin" create:"admin_required" key_index:"true"`
@@ -73,6 +71,26 @@ func (joint *SStoragecachedimage) Slave() db.IStandaloneModel {
 	return db.JointSlave(joint)
 }
 
+func (self *SStoragecachedimageManager) AllowListItems(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool {
+	return db.IsAdminAllowList(userCred, self)
+}
+
+func (self *SStoragecachedimageManager) AllowCreateItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
+	return db.IsAdminAllowCreate(userCred, self)
+}
+
+func (self *SStoragecachedimage) AllowGetDetails(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool {
+	return db.IsAdminAllowGet(userCred, self)
+}
+
+func (self *SStoragecachedimage) AllowUpdateItem(ctx context.Context, userCred mcclient.TokenCredential) bool {
+	return db.IsAdminAllowUpdate(userCred, self)
+}
+
+func (self *SStoragecachedimage) AllowDeleteItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
+	return db.IsAdminAllowDelete(userCred, self)
+}
+
 func (self *SStoragecachedimage) getStorageHostId() (string, error) {
 	var s SStorage
 	storage := StorageManager.Query()
@@ -127,7 +145,7 @@ func (self *SStoragecachedimage) GetExtraDetails(ctx context.Context, userCred m
 }
 
 func (manager *SStoragecachedimageManager) AllowListDescendent(ctx context.Context, userCred mcclient.TokenCredential, model db.IStandaloneModel, query jsonutils.JSONObject) bool {
-	return userCred.IsSystemAdmin()
+	return db.IsAdminAllowList(userCred, manager)
 }
 
 func (self *SStoragecachedimage) GetCachedimage() *SCachedimage {

pkg/compute/models/storagecaches.go

@@ -20,7 +20,6 @@ import (
 
 type SStoragecacheManager struct {
 	db.SStandaloneResourceBaseManager
-	SInfrastructureManager
 }
 
 var StoragecacheManager *SStoragecacheManager
@@ -38,12 +37,31 @@ func init() {
 
 type SStoragecache struct {
 	db.SStandaloneResourceBase
-	SInfrastructure
 	SManagedResourceBase
 
 	Path string `width:"256" charset:"utf8" nullable:"true" list:"user" update:"admin" create:"admin_optional"` // = Column(VARCHAR(256, charset='utf8'), nullable=True)
 }
 
+func (self *SStoragecacheManager) AllowListItems(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool {
+	return db.IsAdminAllowList(userCred, self)
+}
+
+func (self *SStoragecacheManager) AllowCreateItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
+	return db.IsAdminAllowCreate(userCred, self)
+}
+
+func (self *SStoragecache) AllowGetDetails(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool {
+	return db.IsAdminAllowGet(userCred, self)
+}
+
+func (self *SStoragecache) AllowUpdateItem(ctx context.Context, userCred mcclient.TokenCredential) bool {
+	return db.IsAdminAllowUpdate(userCred, self)
+}
+
+func (self *SStoragecache) AllowDeleteItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
+	return db.IsAdminAllowDelete(userCred, self)
+}
+
 func (self *SStoragecache) getStorages() []SStorage {
 	storages := make([]SStorage, 0)
 	q := StorageManager.Query().Equals("storagecache_id", self.Id)
@@ -315,7 +333,7 @@ func (self *SStoragecache) ValidateDeleteCondition(ctx context.Context) error {
 }
 
 func (self *SStoragecache) AllowPerformUncacheImage(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
-	return userCred.IsSystemAdmin()
+	return db.IsAdminAllowPerform(userCred, self, "uncache-image")
 }
 
 func (self *SStoragecache) PerformUncacheImage(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) {
@@ -352,7 +370,7 @@ func (self *SStoragecache) PerformUncacheImage(ctx context.Context, userCred mcc
 }
 
 func (self *SStoragecache) AllowPerformCacheImage(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
-	return userCred.IsSystemAdmin()
+	return db.IsAdminAllowPerform(userCred, self, "cache-image")
 }
 
 func (self *SStoragecache) PerformCacheImage(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) {

pkg/compute/models/storages.go

@@ -91,7 +91,6 @@ var (
 
 type SStorageManager struct {
 	db.SStandaloneResourceBaseManager
-	SInfrastructureManager
 }
 
 var StorageManager *SStorageManager
@@ -109,7 +108,6 @@ func init() {
 
 type SStorage struct {
 	db.SStandaloneResourceBase
-	SInfrastructure
 	SManagedResourceBase
 
 	Capacity    int                  `nullable:"false" list:"admin" update:"admin" create:"admin_required"`                           // Column(Integer, nullable=False) # capacity of disk in MB
@@ -131,6 +129,26 @@ func (manager *SStorageManager) GetContextManager() []db.IModelManager {
 	return []db.IModelManager{ZoneManager, StoragecacheManager}
 }
 
+func (manager *SStorageManager) AllowListItems(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool {
+	return true
+}
+
+func (self *SStorageManager) AllowCreateItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
+	return db.IsAdminAllowCreate(userCred, self)
+}
+
+func (self *SStorage) AllowGetDetails(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool {
+	return db.IsAdminAllowGet(userCred, self)
+}
+
+func (self *SStorage) AllowUpdateItem(ctx context.Context, userCred mcclient.TokenCredential) bool {
+	return db.IsAdminAllowUpdate(userCred, self)
+}
+
+func (self *SStorage) AllowDeleteItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
+	return db.IsAdminAllowDelete(userCred, self)
+}
+
 func (manager *SStorageManager) ValidateCreateData(ctx context.Context, userCred mcclient.TokenCredential, ownerProjId string, query jsonutils.JSONObject, data *jsonutils.JSONDict) (*jsonutils.JSONDict, error) {
 	storageType, _ := data.GetString("storage_type")
 	mediumType, _ := data.GetString("medium_type")
@@ -321,7 +339,7 @@ func (self *SStorage) SetStatus(userCred mcclient.TokenCredential, status string
 }
 
 func (self *SStorage) AllowPerformEnable(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
-	return userCred.IsSystemAdmin()
+	return db.IsAdminAllowPerform(userCred, self, "enable")
 }
 
 func (self *SStorage) PerformEnable(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) {
@@ -340,7 +358,7 @@ func (self *SStorage) PerformEnable(ctx context.Context, userCred mcclient.Token
 }
 
 func (self *SStorage) AllowPerformDisable(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
-	return userCred.IsSystemAdmin()
+	return db.IsAdminAllowPerform(userCred, self, "disable")
 }
 
 func (self *SStorage) PerformDisable(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) {
@@ -359,7 +377,7 @@ func (self *SStorage) PerformDisable(ctx context.Context, userCred mcclient.Toke
 }
 
 func (self *SStorage) AllowPerformOnline(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
-	return userCred.IsSystemAdmin()
+	return db.IsAdminAllowPerform(userCred, self, "online")
 }
 
 func (self *SStorage) PerformOnline(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) {
@@ -374,7 +392,7 @@ func (self *SStorage) PerformOnline(ctx context.Context, userCred mcclient.Token
 }
 
 func (self *SStorage) AllowPerformOffline(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
-	return userCred.IsSystemAdmin()
+	return db.IsAdminAllowPerform(userCred, self, "offline")
 }
 
 func (self *SStorage) PerformOffline(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) {
@@ -404,10 +422,6 @@ func (self *SStorage) IsLocal() bool {
 	return self.StorageType == STORAGE_LOCAL || self.StorageType == STORAGE_BAREMETAL
 }
 
-func (manager *SStorageManager) AllowListItems(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool {
-	return true
-}
-
 func (self *SStorage) GetStorageCachePath(mountPoint, imageCachePath string) string {
 	if self.StorageType == STORAGE_NFS {
 		return path.Join(mountPoint, imageCachePath)
@@ -933,7 +947,7 @@ func (self *SStorage) SetStoragecache(cache *SStoragecache) error {
 }
 
 func (self *SStorage) AllowPerformCacheImage(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
-	return userCred.IsSystemAdmin()
+	return db.IsAdminAllowPerform(userCred, self, "cache-image")
 }
 
 func (self *SStorage) GetStoragecache() *SStoragecache {
@@ -955,7 +969,7 @@ func (self *SStorage) PerformCacheImage(ctx context.Context, userCred mcclient.T
 }
 
 func (self *SStorage) AllowPerformUncacheImage(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
-	return userCred.IsSystemAdmin()
+	return db.IsAdminAllowPerform(userCred, self, "uncache-image")
 }
 
 func (self *SStorage) PerformUncacheImage(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) {

pkg/compute/models/vcenters.go

@@ -11,7 +11,6 @@ import (
 
 type SVCenterManager struct {
 	db.SEnabledStatusStandaloneResourceBaseManager
-	SInfrastructureManager
 }
 
 var VCenterManager *SVCenterManager
@@ -29,7 +28,6 @@ func init() {
 
 type SVCenter struct {
 	db.SEnabledStatusStandaloneResourceBase
-	SInfrastructure
 
 	Hostname string `width:"64" charset:"ascii" nullable:"false" list:"admin"` // = Column(VARCHAR(64, charset='ascii'), nullable=False)
 	Port     int    `nullable:"false" list:"admin"`                            // = Column(Integer, nullable=False)

pkg/compute/models/vpcs.go

@@ -35,7 +35,6 @@ const (
 
 type SVpcManager struct {
 	db.SEnabledStatusStandaloneResourceBaseManager
-	SInfrastructureManager
 }
 
 var VpcManager *SVpcManager
@@ -53,7 +52,6 @@ func init() {
 
 type SVpc struct {
 	db.SEnabledStatusStandaloneResourceBase
-	SInfrastructure
 	SManagedResourceBase
 
 	IsDefault bool `default:"false" list:"admin" create:"admin_optional"`
@@ -67,6 +65,26 @@ func (manager *SVpcManager) GetContextManager() []db.IModelManager {
 	return []db.IModelManager{CloudregionManager}
 }
 
+func (self *SVpcManager) AllowListItems(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool {
+	return db.IsAdminAllowList(userCred, self)
+}
+
+func (self *SVpcManager) AllowCreateItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
+	return db.IsAdminAllowCreate(userCred, self)
+}
+
+func (self *SVpc) AllowGetDetails(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool {
+	return db.IsAdminAllowGet(userCred, self)
+}
+
+func (self *SVpc) AllowUpdateItem(ctx context.Context, userCred mcclient.TokenCredential) bool {
+	return db.IsAdminAllowUpdate(userCred, self)
+}
+
+func (self *SVpc) AllowDeleteItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
+	return db.IsAdminAllowDelete(userCred, self)
+}
+
 func (self *SVpc) GetCloudRegionId() string {
 	if len(self.CloudregionId) == 0 {
 		return DEFAULT_REGION_ID
@@ -479,7 +497,7 @@ func (self *SVpc) getIPRange() netutils.IPV4AddrRange {
 }
 
 func (self *SVpc) AllowPerformPurge(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
-	return userCred.IsSystemAdmin()
+	return db.IsAdminAllowPerform(userCred, self, "purge")
 }
 
 func (self *SVpc) PerformPurge(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) {

pkg/compute/models/wires.go

@@ -19,7 +19,6 @@ import (
 
 type SWireManager struct {
 	db.SStandaloneResourceBaseManager
-	SInfrastructureManager
 }
 
 var WireManager *SWireManager
@@ -39,7 +38,6 @@ func init() {
 
 type SWire struct {
 	db.SStandaloneResourceBase
-	SInfrastructure
 
 	Bandwidth    int    `list:"admin" update:"admin" nullable:"false" create:"admin_required"`             // = Column(Integer, nullable=False) # bandwidth of network in Mbps
 	ScheduleRank int    `list:"admin" update:"admin"`                                                      // = Column(Integer, default=0, nullable=True)
@@ -51,6 +49,26 @@ func (manager *SWireManager) GetContextManager() []db.IModelManager {
 	return []db.IModelManager{ZoneManager, VpcManager}
 }
 
+func (self *SWireManager) AllowListItems(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool {
+	return db.IsAdminAllowList(userCred, self)
+}
+
+func (self *SWireManager) AllowCreateItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
+	return db.IsAdminAllowCreate(userCred, self)
+}
+
+func (self *SWire) AllowGetDetails(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool {
+	return db.IsAdminAllowGet(userCred, self)
+}
+
+func (self *SWire) AllowUpdateItem(ctx context.Context, userCred mcclient.TokenCredential) bool {
+	return db.IsAdminAllowUpdate(userCred, self)
+}
+
+func (self *SWire) AllowDeleteItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
+	return db.IsAdminAllowDelete(userCred, self)
+}
+
 func (manager *SWireManager) ValidateCreateData(ctx context.Context, userCred mcclient.TokenCredential, ownerProjId string, query jsonutils.JSONObject, data *jsonutils.JSONDict) (*jsonutils.JSONDict, error) {
 	bandwidth, err := data.Int("bandwidth")
 	if err != nil || bandwidth == 0 {

pkg/compute/models/zones.go

@@ -24,7 +24,6 @@ const (
 
 type SZoneManager struct {
 	db.SStatusStandaloneResourceBaseManager
-	SInfrastructureManager
 }
 
 var ZoneManager *SZoneManager
@@ -43,7 +42,6 @@ func init() {
 
 type SZone struct {
 	db.SStatusStandaloneResourceBase
-	SInfrastructure
 
 	Location string `width:"256" charset:"utf8" get:"user" update:"admin"` // = Column(VARCHAR(256, charset='utf8'))
 	Contacts string `width:"256" charset:"utf8" get:"user" update:"admin"` // = Column(VARCHAR(256, charset='utf8'))
@@ -58,6 +56,22 @@ func (manager *SZoneManager) GetContextManager() []db.IModelManager {
 	return []db.IModelManager{CloudregionManager}
 }
 
+func (self *SZoneManager) AllowCreateItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
+	return db.IsAdminAllowCreate(userCred, self)
+}
+
+func (self *SZone) AllowGetDetails(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool {
+	return db.IsAdminAllowGet(userCred, self)
+}
+
+func (self *SZone) AllowUpdateItem(ctx context.Context, userCred mcclient.TokenCredential) bool {
+	return db.IsAdminAllowUpdate(userCred, self)
+}
+
+func (self *SZone) AllowDeleteItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
+	return db.IsAdminAllowDelete(userCred, self)
+}
+
 func (manager *SZoneManager) AllowListItems(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool {
 	return true
 }

pkg/compute/specs/handler.go

@@ -12,6 +12,7 @@ import (
 
 	"yunion.io/x/onecloud/pkg/appctx"
 	"yunion.io/x/onecloud/pkg/appsrv"
+	"yunion.io/x/onecloud/pkg/cloudcommon/policy"
 	"yunion.io/x/onecloud/pkg/compute/models"
 	"yunion.io/x/onecloud/pkg/httperrors"
 	"yunion.io/x/onecloud/pkg/mcclient"
@@ -42,7 +43,7 @@ func AddSpecHandler(prefix string, app *appsrv.Application) {
 
 func processFilter(handleFunc specHandleFunc) appsrv.FilterHandler {
 	return func(ctx context.Context, w http.ResponseWriter, r *http.Request) {
-		userCred := auth.FetchUserCredential(ctx)
+		userCred := auth.FetchUserCredential(ctx, policy.FilterPolicyCredential)
 		query, err := jsonutils.ParseQueryString(r.URL.RawQuery)
 		if err != nil {
 			httperrors.GeneralServerError(w, err)

pkg/compute/sshkeys/handler.go

@@ -9,7 +9,9 @@ import (
 	"yunion.io/x/jsonutils"
 	"yunion.io/x/onecloud/pkg/appctx"
 	"yunion.io/x/onecloud/pkg/appsrv"
+	"yunion.io/x/onecloud/pkg/cloudcommon/consts"
 	"yunion.io/x/onecloud/pkg/cloudcommon/db"
+	"yunion.io/x/onecloud/pkg/cloudcommon/policy"
 	"yunion.io/x/onecloud/pkg/httperrors"
 	"yunion.io/x/onecloud/pkg/mcclient"
 	"yunion.io/x/onecloud/pkg/mcclient/auth"
@@ -22,8 +24,8 @@ func AddSshKeysHandler(prefix string, app *appsrv.Application) {
 
 func adminSshKeysHandler(ctx context.Context, w http.ResponseWriter, r *http.Request) {
 	publicOnly := false
-	userCred := auth.FetchUserCredential(ctx)
-	if !userCred.IsSystemAdmin() {
+	userCred := auth.FetchUserCredential(ctx, policy.FilterPolicyCredential)
+	if !userCred.IsAdminAllow(consts.GetServiceType(), "sshkeypairs", policy.PolicyActionGet) {
 		publicOnly = true
 	}
 	params := appctx.AppContextParams(ctx)
@@ -53,7 +55,7 @@ func adminSshKeysHandler(ctx context.Context, w http.ResponseWriter, r *http.Req
 }
 
 func sshKeysHandler(ctx context.Context, w http.ResponseWriter, r *http.Request) {
-	userCred := auth.FetchUserCredential(ctx)
+	userCred := auth.FetchUserCredential(ctx, policy.FilterPolicyCredential)
 	query, err := jsonutils.ParseQueryString(r.URL.RawQuery)
 	if err != nil {
 		httperrors.GeneralServerError(w, err)
@@ -67,7 +69,7 @@ func sshKeysHandler(ctx context.Context, w http.ResponseWriter, r *http.Request)
 func sendSshKey(ctx context.Context, w http.ResponseWriter, userCred mcclient.TokenCredential, projectId string, isAdmin bool, publicOnly bool) {
 	var privKey, pubKey string
 
-	if isAdmin && userCred.IsSystemAdmin() {
+	if isAdmin && userCred.IsAdminAllow(consts.GetServiceType(), "sshkeypairs", policy.PolicyActionGet) {
 		privKey, pubKey, _ = GetSshAdminKeypair(ctx)
 	} else {
 		privKey, pubKey, _ = GetSshProjectKeypair(ctx, projectId)

pkg/compute/usages/handler.go

@@ -75,7 +75,7 @@ func rangeObjHandler(
 	reporter objUsageFunc,
 ) appsrv.FilterHandler {
 	return func(ctx context.Context, w http.ResponseWriter, r *http.Request) {
-		userCred := auth.FetchUserCredential(ctx)
+		userCred := auth.FetchUserCredential(ctx, policy.FilterPolicyCredential)
 		obj, err := getRangeObj(ctx, manager, userCred)
 		if err != nil {
 			httperrors.NotFoundError(w, err.Error())
@@ -276,7 +276,7 @@ func ReportGeneralUsage(userCred mcclient.TokenCredential, rangeObj db.IStandalo
 			isAdmin = true
 		}
 	} else {
-		isAdmin = userCred.IsSystemAdmin()
+		isAdmin = userCred.IsAdminAllow(consts.GetServiceType(), "usages", policy.PolicyActionGet)
 	}
 
 	if isAdmin {

pkg/mcclient/auth/middleware.go

@@ -53,10 +53,14 @@ func AuthenticateWithDelayDecision(f appsrv.FilterHandler, delayDecision bool) a
 	}
 }
 
-func FetchUserCredential(ctx context.Context) mcclient.TokenCredential {
+func FetchUserCredential(ctx context.Context, filter func(mcclient.TokenCredential) mcclient.TokenCredential) mcclient.TokenCredential {
 	tokenValue := ctx.Value(AUTH_TOKEN)
 	if tokenValue != nil {
-		return tokenValue.(mcclient.TokenCredential)
+		token := tokenValue.(mcclient.TokenCredential)
+		if filter != nil {
+			token = filter(token)
+		}
+		return token
 	}
 	return nil
 }

pkg/mcclient/modules/base.go

@@ -32,7 +32,7 @@ func NewBaseManager(serviceType, endpointType, version string, columns, adminCol
 
 func (this *BaseManager) GetColumns(session *mcclient.ClientSession) []string {
 	cols := this.columns
-	if session.IsSystemAdmin() && len(this.adminColumns) > 0 {
+	if session.HasSystemAdminPrivelege() && len(this.adminColumns) > 0 {
 		cols = append(cols, this.adminColumns...)
 	}
 	return cols

pkg/mcclient/session.go

@@ -9,7 +9,6 @@ import (
 	"regexp"
 	"strings"
 	"time"
-
 	"yunion.io/x/jsonutils"
 	"yunion.io/x/onecloud/pkg/util/httputils"
 	"yunion.io/x/pkg/utils"
@@ -151,8 +150,8 @@ func (this *ClientSession) ParseJSONResponse(resp *http.Response, err error) (ht
 	return httputils.ParseJSONResponse(resp, err, this.client.debug)
 }
 
-func (this *ClientSession) IsSystemAdmin() bool {
-	return this.token.IsSystemAdmin()
+func (this *ClientSession) HasSystemAdminPrivelege() bool {
+	return this.token.HasSystemAdminPrivelege()
 }
 
 func (this *ClientSession) GetRegion() string {

pkg/mcclient/token.go

@@ -44,8 +44,9 @@ type TokenCredential interface {
 	GetExpires() time.Time
 	IsValid() bool
 	ValidDuration() time.Duration
-	IsAdmin() bool
-	IsSystemAdmin() bool
+	// IsAdmin() bool
+	HasSystemAdminPrivelege() bool
+	IsAdminAllow(service string, resource string, action string, extra ...string) bool
 	GetRegions() []string
 
 	GetServiceCatalog() IServiceCatalog

pkg/mcclient/token2.go

@@ -130,10 +130,14 @@ func (this *TokenCredentialV2) GetRegions() []string {
 	return this.ServiceCatalog.getRegions()
 }
 
-func (this *TokenCredentialV2) IsSystemAdmin() bool {
+func (this *TokenCredentialV2) HasSystemAdminPrivelege() bool {
 	return this.IsAdmin() && this.GetTenantName() == "system"
 }
 
+func (this *TokenCredentialV2) IsAdminAllow(service string, resource string, action string, extra ...string) bool {
+	return this.HasSystemAdminPrivelege()
+}
+
 func (this *TokenCredentialV2) GetServiceURL(service, region, zone, endpointType string) (string, error) {
 	return this.ServiceCatalog.GetServiceURL(service, region, zone, endpointType)
 }

pkg/mcclient/token3.go

@@ -135,10 +135,14 @@ func (this *TokenCredentialV3) IsAdmin() bool {
 	return false
 }
 
-func (this *TokenCredentialV3) IsSystemAdmin() bool {
+func (this *TokenCredentialV3) HasSystemAdminPrivelege() bool {
 	return this.IsAdmin() && this.GetTenantName() == "system"
 }
 
+func (this *TokenCredentialV3) IsAdminAllow(service string, resource string, action string, extra ...string) bool {
+	return this.HasSystemAdminPrivelege()
+}
+
 func (this *TokenCredentialV3) GetRegions() []string {
 	return this.Token.Catalog.getRegions()
 }

pkg/mcclient/tokensimple.go

@@ -84,10 +84,14 @@ func (self *SSimpleToken) IsAdmin() bool {
 	return false
 }
 
-func (self *SSimpleToken) IsSystemAdmin() bool {
+func (self *SSimpleToken) HasSystemAdminPrivelege() bool {
 	return self.IsAdmin() && self.Project == "system"
 }
 
+func (this *SSimpleToken) IsAdminAllow(service string, resource string, action string, extra ...string) bool {
+	return this.HasSystemAdminPrivelege()
+}
+
 func (self *SSimpleToken) GetRegions() []string {
 	return nil
 }

pkg/webconsole/handlers.go

@@ -17,6 +17,7 @@ import (
 	"yunion.io/x/onecloud/pkg/webconsole/command"
 	o "yunion.io/x/onecloud/pkg/webconsole/options"
 	"yunion.io/x/onecloud/pkg/webconsole/session"
+	"yunion.io/x/onecloud/pkg/cloudcommon/policy"
 )
 
 const (
@@ -102,7 +103,7 @@ type CloudEnv struct {
 
 func fetchCloudEnv(ctx context.Context, w http.ResponseWriter, r *http.Request) (*CloudEnv, error) {
 	params, query, body := appsrv.FetchEnv(ctx, w, r)
-	userCred := auth.FetchUserCredential(ctx)
+	userCred := auth.FetchUserCredential(ctx, policy.FilterPolicyCredential)
 	if userCred == nil {
 		return nil, httperrors.NewUnauthorizedError("No token founded")
 	}
@@ -141,7 +142,7 @@ func handleK8sLog(ctx context.Context, w http.ResponseWriter, r *http.Request) {
 }
 
 func handleSshShell(ctx context.Context, w http.ResponseWriter, r *http.Request) {
-	userCred := auth.FetchUserCredential(ctx)
+	userCred := auth.FetchUserCredential(ctx, policy.FilterPolicyCredential)
 	env, err := fetchCloudEnv(ctx, w, r)
 	if err != nil {
 		httperrors.GeneralServerError(w, err)

pkg/webconsole/service/service.go

@@ -15,6 +15,7 @@ import (
 	"yunion.io/x/onecloud/pkg/webconsole"
 	o "yunion.io/x/onecloud/pkg/webconsole/options"
 	"yunion.io/x/onecloud/pkg/webconsole/server"
+	"yunion.io/x/onecloud/pkg/cloudcommon/consts"
 )
 
 func ensureBinExists(binPath string) {
@@ -24,6 +25,8 @@ func ensureBinExists(binPath string) {
 }
 
 func StartService() {
+	consts.SetServiceType("webconsole")
+
 	cloudcommon.ParseOptions(&o.Options, &o.Options.Options, os.Args, "webconsole.conf")
 
 	if o.Options.ApiServer == "" {

pkg/yunionconf/models/parameters.go

@@ -11,6 +11,8 @@ import (
 	"yunion.io/x/pkg/util/timeutils"
 	"yunion.io/x/pkg/utils"
 	"yunion.io/x/sqlchemy"
+	"yunion.io/x/onecloud/pkg/cloudcommon/consts"
+	"yunion.io/x/onecloud/pkg/cloudcommon/policy"
 )
 
 const (
@@ -72,7 +74,7 @@ func getNamespaceInContext(userCred mcclient.TokenCredential, query jsonutils.JS
 
 func getNamespace(userCred mcclient.TokenCredential, query jsonutils.JSONObject, data *jsonutils.JSONDict) (string, string, error) {
 	var namespace, namespace_id string
-	if userCred.IsSystemAdmin() {
+	if db.IsAdminAllowGet(userCred, ParameterManager) {
 		if name, nameId, e := getNamespaceInContext(userCred, query, data); e != nil {
 			return "", "", e
 		} else {
@@ -92,7 +94,7 @@ func (manager *SParameterManager) AllowListItems(ctx context.Context, userCred m
 		return true
 	}
 
-	return userCred.IsSystemAdmin()
+	return db.IsAdminAllowList(userCred, manager)
 }
 
 func (manager *SParameterManager) AllowCreateItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
@@ -100,7 +102,7 @@ func (manager *SParameterManager) AllowCreateItem(ctx context.Context, userCred
 		return true
 	}
 
-	return userCred.IsSystemAdmin()
+	return db.IsAdminAllowCreate(userCred, manager)
 }
 
 func (manager *SParameterManager) ValidateCreateData(ctx context.Context, userCred mcclient.TokenCredential, ownerProjId string, query jsonutils.JSONObject, data *jsonutils.JSONDict) (*jsonutils.JSONDict, error) {
@@ -146,7 +148,7 @@ func (manager *SParameterManager) FilterByName(q *sqlchemy.SQuery, name string)
 }
 
 func (manager *SParameterManager) ListItemFilter(ctx context.Context, q *sqlchemy.SQuery, userCred mcclient.TokenCredential, query jsonutils.JSONObject) (*sqlchemy.SQuery, error) {
-	if userCred.IsSystemAdmin() {
+	if db.IsAdminAllowList(userCred, manager) {
 		if id, _ := query.GetString("namespace_id"); len(id) > 0 {
 			q = q.Equals("namespace_id", id)
 		} else if id, _ := query.GetString("service_id"); len(id) > 0 {
@@ -171,7 +173,7 @@ func (model *SParameter) IsOwner(userCred mcclient.TokenCredential) bool {
 }
 
 func (model *SParameter) AllowUpdateItem(ctx context.Context, userCred mcclient.TokenCredential) bool {
-	return model.IsOwner(userCred) || userCred.IsSystemAdmin()
+	return model.IsOwner(userCred) || db.IsAdminAllowUpdate(userCred, model)
 }
 
 func (model *SParameter) ValidateUpdateData(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data *jsonutils.JSONDict) (*jsonutils.JSONDict, error) {
@@ -191,7 +193,7 @@ func (model *SParameter) ValidateUpdateData(ctx context.Context, userCred mcclie
 }
 
 func (model *SParameter) AllowDeleteItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
-	return model.IsOwner(userCred) || userCred.IsSystemAdmin()
+	return model.IsOwner(userCred) || db.IsAdminAllowDelete(userCred, model)
 }
 
 func (model *SParameter) CustomizeDelete(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) error {
@@ -211,5 +213,5 @@ func (model *SParameter) Delete(ctx context.Context, userCred mcclient.TokenCred
 }
 
 func (model *SParameter) AllowGetDetails(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool {
-	return model.IsOwner(userCred) || userCred.IsSystemAdmin()
+	return model.IsOwner(userCred) || db.IsAdminAllowGet(userCred, model)
 }

pkg/yunionconf/service/service.go

@@ -16,6 +16,8 @@ import (
 )
 
 func StartService() {
+	consts.SetServiceType("yunionconf")
+
 	cloudcommon.ParseOptions(&options.Options, &options.Options.Options, os.Args, "yunionconf.conf")
 	cloudcommon.InitAuth(&options.Options.Options, func() {
 		log.Infof("Auth complete!!")