opensource/cloudpods
3
0
Fork 0
mirror of https://github.com/yunionio/cloudpods.git synced 2026-09-19 02:37:24 +08:00
Code Issues Packages Projects Releases Wiki Activity

1.

Browse Source 
取消userCred.IsSystemAdmin()，在使用policy的应用中，通过userCred.IsAdminAllow判断是否是管理员且具备相应的权限。获取token时，需要传入policy.FilterPolicyCredential，将普通userCred转换成支持rbac的userCred
2. 在应用启动时候，必须设置 SetServiceType，否则退出
This commit is contained in:
Qiu Jian
2018-11-30 23:00:11 +08:00
parent bfed7c25c3
commit bc02b3b433
65 changed files with 516 additions and 232 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/cloudcommon/auth.go
+2 -1
View File
@@ -3,13 +3,14 @@ package cloudcommon
import (
"fmt"
"os"
"time"
"yunion.io/x/onecloud/pkg/cloudcommon/policy"
"yunion.io/x/onecloud/pkg/mcclient/auth"
)
func InitAuth(options *Options, authComplete auth.AuthCompletedCallback) {
if len(options.AuthURL) == 0 {
fmt.Println("Missing AuthURL")
os.Exit(1)
pkg/cloudcommon/db/db_dispatcher.go
+9 -9
View File
@@ -65,7 +65,7 @@ func (dispatcher *DBModelDispatcher) Filter(f appsrv.FilterHandler) appsrv.Filte
}
func fetchUserCredential(ctx context.Context) mcclient.TokenCredential {
token := auth.FetchUserCredential(ctx)
token := auth.FetchUserCredential(ctx, policy.FilterPolicyCredential)
if token == nil && !consts.IsRbacEnabled() {
log.Fatalf("user token credential not found?")
}
@@ -113,7 +113,7 @@ func listFields(manager IModelManager, userCred mcclient.TokenCredential) []stri
if !utils.IsInStringArray(list, []string{"user", "admin", ""}) {
log.Warningf("Invalid list value %s for field %s", list, col.Name())
}
if list == "user" || (list == "admin" && userCred.IsSystemAdmin()) {
if list == "user" || (list == "admin" && userCred.IsAdminAllow(consts.GetServiceType(), manager.KeywordPlural(), policy.PolicyActionList)) {
ret = append(ret, col.Name())
}
}
@@ -127,7 +127,7 @@ func searchFields(manager IModelManager, userCred mcclient.TokenCredential) []st
tags := col.Tags()
list := tags["list"]
search := tags["search"]
if list == "user" || search == "user" || ((list == "admin" || search == "admin") && userCred.IsSystemAdmin()) {
if list == "user" || search == "user" || ((list == "admin" || search == "admin") && userCred.IsAdminAllow(consts.GetServiceType(), manager.KeywordPlural(), policy.PolicyActionList)) {
ret = append(ret, col.Name())
}
}
@@ -140,7 +140,7 @@ func getDetailFields(manager IModelManager, userCred mcclient.TokenCredential) [
tags := col.Tags()
list := tags["list"]
get := tags["get"]
if list == "user" || get == "user" || ((list == "admin" || get == "admin") && userCred.IsSystemAdmin()) {
if list == "user" || get == "user" || ((list == "admin" || get == "admin") && userCred.IsAdminAllow(consts.GetServiceType(), manager.KeywordPlural(), policy.PolicyActionGet)) {
ret = append(ret, col.Name())
}
}
@@ -152,7 +152,7 @@ func createRequireFields(manager IModelManager, userCred mcclient.TokenCredentia
for _, col := range manager.TableSpec().Columns() {
tags := col.Tags()
create, _ := tags["create"]
if create == "required" || (create == "admin_required" && userCred.IsSystemAdmin()) {
if create == "required" || (create == "admin_required" && userCred.IsAdminAllow(consts.GetServiceType(), manager.KeywordPlural(), policy.PolicyActionCreate)) {
ret = append(ret, col.Name())
}
}
@@ -166,7 +166,7 @@ func createFields(manager IModelManager, userCred mcclient.TokenCredential) []st
tags := col.Tags()
create, _ := tags["create"]
update := tags["update"]
if update == "user" || (update == "admin" && userCred.IsSystemAdmin()) || create == "required" || create == "optional" || ((create == "admin_required" || create == "admin_optional") && userCred.IsSystemAdmin()) {
if update == "user" || (update == "admin" && userCred.IsAdminAllow(consts.GetServiceType(), manager.KeywordPlural(), policy.PolicyActionCreate)) || create == "required" || create == "optional" || ((create == "admin_required" || create == "admin_optional") && userCred.IsAdminAllow(consts.GetServiceType(), manager.KeywordPlural(), policy.PolicyActionCreate)) {
ret = append(ret, col.Name())
}
}
@@ -179,7 +179,7 @@ func updateFields(manager IModelManager, userCred mcclient.TokenCredential) []st
for _, col := range manager.TableSpec().Columns() {
tags := col.Tags()
update := tags["update"]
if update == "user" || (update == "admin" && userCred.IsSystemAdmin()) {
if update == "user" || (update == "admin" && userCred.IsAdminAllow(consts.GetServiceType(), manager.KeywordPlural(), policy.PolicyActionUpdate)) {
ret = append(ret, col.Name())
}
}
@@ -315,7 +315,7 @@ func query2List(manager IModelManager, ctx context.Context, userCred mcclient.To
}
listF := listFields(manager, userCred)
fieldFilter := jsonutils.GetQueryStringArray(query, "field")
if len(fieldFilter) > 0 && userCred.IsSystemAdmin() {
if len(fieldFilter) > 0 && userCred.IsAdminAllow(consts.GetServiceType(), manager.KeywordPlural(), policy.PolicyActionList) {
// only sysadmin can specify list Fields
listF = fieldFilter
}
@@ -735,7 +735,7 @@ func fetchOwnerProjectId(ctx context.Context, manager IModelManager, userCred mc
isAllow = true
}
} else {
isAllow = userCred.IsSystemAdmin()
isAllow = userCred.IsAdminAllow(consts.GetServiceType(), policy.PolicyDelegation, "")
}
if !isAllow {
return "", httperrors.NewForbiddenError("Delegation not allowed")
pkg/cloudcommon/db/enabledstatusstandalone.go
+4 -2
View File
@@ -5,6 +5,8 @@ import (
"yunion.io/x/jsonutils"
"yunion.io/x/log"
"yunion.io/x/onecloud/pkg/cloudcommon/consts"
"yunion.io/x/onecloud/pkg/cloudcommon/policy"
"yunion.io/x/onecloud/pkg/mcclient"
)
@@ -23,7 +25,7 @@ func NewEnabledStatusStandaloneResourceBaseManager(dt interface{}, tableName str
}
func (self *SEnabledStatusStandaloneResourceBase) AllowPerformEnable(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
return userCred.IsSystemAdmin()
return userCred.IsAdminAllow(consts.GetServiceType(), self.GetModelManager().KeywordPlural(), policy.PolicyActionPerform, "enable")
}
func (self *SEnabledStatusStandaloneResourceBase) PerformEnable(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) {
@@ -42,7 +44,7 @@ func (self *SEnabledStatusStandaloneResourceBase) PerformEnable(ctx context.Cont
}
func (self *SEnabledStatusStandaloneResourceBase) AllowPerformDisable(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
return userCred.IsSystemAdmin()
return userCred.IsAdminAllow(consts.GetServiceType(), self.GetModelManager().KeywordPlural(), policy.PolicyActionPerform, "disable")
}
func (self *SEnabledStatusStandaloneResourceBase) PerformDisable(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) {
pkg/cloudcommon/db/interface.go
+3 -1
View File
@@ -69,6 +69,8 @@ type IModel interface {
GetName() string
KeywordPlural() string
GetModelManager() IModelManager
SetModelManager(IModelManager)
@@ -164,7 +166,7 @@ type IVirtualModel interface {
IStandaloneModel
IsOwner(userCred mcclient.TokenCredential) bool
IsAdmin(userCred mcclient.TokenCredential) bool
// IsAdmin(userCred mcclient.TokenCredential) bool
}
type ISharableVirtualModelManager interface {
pkg/cloudcommon/db/jointbase.go
+4 -2
View File
@@ -8,6 +8,8 @@ import (
"yunion.io/x/jsonutils"
"yunion.io/x/log"
"yunion.io/x/onecloud/pkg/cloudcommon/consts"
"yunion.io/x/onecloud/pkg/cloudcommon/policy"
"yunion.io/x/onecloud/pkg/mcclient"
"yunion.io/x/pkg/util/reflectutils"
"yunion.io/x/sqlchemy"
@@ -191,7 +193,7 @@ func (self *SJointResourceBase) AllowGetJointDetails(ctx context.Context, userCr
master := item.Master()
switch master.(type) {
case IVirtualModel:
return master.(IVirtualModel).IsOwner(userCred)
return master.(IVirtualModel).IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), master.KeywordPlural(), policy.PolicyActionGet)
default: // case item implemented customized AllowGetDetails, eg hostjoints
return item.AllowGetDetails(ctx, userCred, query)
}
@@ -201,7 +203,7 @@ func (self *SJointResourceBase) AllowUpdateJointItem(ctx context.Context, userCr
master := item.Master()
switch master.(type) {
case IVirtualModel:
return master.(IVirtualModel).IsOwner(userCred)
return master.(IVirtualModel).IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), master.KeywordPlural(), policy.PolicyActionUpdate)
default: // case item implemented customized AllowGetDetails, eg hostjoints
return item.AllowUpdateItem(ctx, userCred)
}
pkg/cloudcommon/db/metadata.go
+5 -3
View File
@@ -11,7 +11,9 @@ import (
"yunion.io/x/onecloud/pkg/mcclient"
"yunion.io/x/pkg/util/stringutils"
"yunion.io/x/onecloud/pkg/cloudcommon/consts"
"yunion.io/x/onecloud/pkg/cloudcommon/db/lockman"
"yunion.io/x/onecloud/pkg/cloudcommon/policy"
)
const (
@@ -65,7 +67,7 @@ raise Exception('get_object_idstr: failed to generate obj ID')
return idstr */
func (manager *SMetadataManager) GetStringValue(model IModel, key string, userCred mcclient.TokenCredential) string {
if strings.HasPrefix(key, SYSTEM_ADMIN_PREFIX) && (userCred == nil || !userCred.IsSystemAdmin()) {
if strings.HasPrefix(key, SYSTEM_ADMIN_PREFIX) && (userCred == nil || !userCred.IsAdminAllow(consts.GetServiceType(), model.GetModelManager().KeywordPlural(), policy.PolicyActionGet, "metadata")) {
return ""
}
idStr := GetObjectIdstr(model)
@@ -78,7 +80,7 @@ func (manager *SMetadataManager) GetStringValue(model IModel, key string, userCr
}
func (manager *SMetadataManager) GetJsonValue(model IModel, key string, userCred mcclient.TokenCredential) jsonutils.JSONObject {
if strings.HasPrefix(key, SYSTEM_ADMIN_PREFIX) && (userCred == nil || !userCred.IsSystemAdmin()) {
if strings.HasPrefix(key, SYSTEM_ADMIN_PREFIX) && (userCred == nil || !userCred.IsAdminAllow(consts.GetServiceType(), model.GetModelManager().KeywordPlural(), policy.PolicyActionGet, "metadata")) {
return nil
}
idStr := GetObjectIdstr(model)
@@ -194,7 +196,7 @@ func (manager *SMetadataManager) GetAll(obj IModel, keys []string, userCred mccl
for _, rec := range records {
if len(rec.Value) > 0 {
if strings.HasPrefix(rec.Key, SYSTEM_ADMIN_PREFIX) {
if userCred != nil && userCred.IsSystemAdmin() {
if userCred != nil && userCred.IsAdminAllow(consts.GetServiceType(), obj.GetModelManager().KeywordPlural(), policy.PolicyActionGet, "metadata") {
key := rec.Key[len(SYSTEM_ADMIN_PREFIX):]
ret[key] = rec.Value
}
pkg/cloudcommon/db/modelbase.go
+7 -1
View File
@@ -6,6 +6,8 @@ import (
"fmt"
"yunion.io/x/jsonutils"
"yunion.io/x/onecloud/pkg/cloudcommon/consts"
"yunion.io/x/onecloud/pkg/cloudcommon/policy"
"yunion.io/x/onecloud/pkg/mcclient"
"yunion.io/x/sqlchemy"
)
@@ -151,7 +153,7 @@ func (manager *SModelBaseManager) PerformAction(ctx context.Context, userCred mc
}
func (manager *SModelBaseManager) AllowPerformCheckCreateData(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
return userCred.IsSystemAdmin()
return userCred.IsAdminAllow(consts.GetServiceType(), manager.KeywordPlural(), policy.PolicyActionPerform, "check-create-data")
}
func (manager *SModelBaseManager) InitializeData() error {
@@ -178,6 +180,10 @@ func (model *SModelBase) Keyword() string {
return model.GetModelManager().Keyword()
}
func (model *SModelBase) KeywordPlural() string {
return model.GetModelManager().KeywordPlural()
}
func (model *SModelBase) GetName() string {
return ""
}
pkg/cloudcommon/db/opslog.go
+4 -2
View File
@@ -9,6 +9,8 @@ import (
"yunion.io/x/jsonutils"
"yunion.io/x/log"
"yunion.io/x/onecloud/pkg/cloudcommon/consts"
"yunion.io/x/onecloud/pkg/cloudcommon/policy"
"yunion.io/x/onecloud/pkg/mcclient"
"yunion.io/x/onecloud/pkg/util/logclient"
"yunion.io/x/pkg/util/stringutils"
@@ -293,7 +295,7 @@ func (manager *SOpsLogManager) ListItemFilter(ctx context.Context, q *sqlchemy.S
queryDict.RemoveIgnoreCase("action")
q = q.Filter(sqlchemy.In(q.Field("action"), action))
}
if !userCred.IsSystemAdmin() {
if !userCred.IsAdminAllow(consts.GetServiceType(), manager.KeywordPlural(), policy.PolicyActionList) {
q = q.Filter(sqlchemy.OR(sqlchemy.AND(sqlchemy.IsNotNull(q.Field("owner_tenant_id")), sqlchemy.Equals(q.Field("owner_tenant_id"), userCred.GetProjectId())), sqlchemy.Equals(q.Field("tenant_id"), userCred.GetProjectId())))
}
since, _ := query.GetTime("since")
@@ -324,7 +326,7 @@ func (manager *SOpsLogManager) AllowCreateItem(ctx context.Context, userCred mcc
}
func (self *SOpsLog) AllowGetDetails(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool {
return userCred.IsSystemAdmin() || userCred.GetProjectId() == self.ProjectId || userCred.GetProjectId() == self.OwnerProjectId
return userCred.IsAdminAllow(consts.GetServiceType(), self.GetModelManager().KeywordPlural(), policy.PolicyActionGet) || userCred.GetProjectId() == self.ProjectId || userCred.GetProjectId() == self.OwnerProjectId
}
func (self *SOpsLog) AllowUpdateItem(ctx context.Context, userCred mcclient.TokenCredential) bool {
pkg/cloudcommon/db/quotas/handler.go
+8 -6
View File
@@ -72,7 +72,7 @@ func queryQuota(ctx context.Context, projectId string) (*jsonutils.JSONDict, err
}
func getQuotaHanlder(ctx context.Context, w http.ResponseWriter, r *http.Request) {
userCred := auth.FetchUserCredential(ctx)
userCred := auth.FetchUserCredential(ctx, policy.FilterPolicyCredential)
params := appctx.AppContextParams(ctx)
projectId := params["<tenantid>"]
@@ -93,7 +93,7 @@ func getQuotaHanlder(ctx context.Context, w http.ResponseWriter, r *http.Request
policy.PolicyDelegation, policy.PolicyActionGet)
isAllow = result == rbacutils.AdminAllow
} else {
isAllow = userCred.IsSystemAdmin()
isAllow = userCred.IsAdminAllow(consts.GetServiceType(), policy.PolicyDelegation, policy.PolicyActionGet)
}
if !isAllow {
httperrors.ForbiddenError(w, "not allow to delegate query quota")
@@ -133,14 +133,15 @@ func getQuotaHanlder(ctx context.Context, w http.ResponseWriter, r *http.Request
}
func setQuotaHanlder(ctx context.Context, w http.ResponseWriter, r *http.Request) {
userCred := auth.FetchUserCredential(ctx)
userCred := auth.FetchUserCredential(ctx, policy.FilterPolicyCredential)
var isAllow bool
if consts.IsRbacEnabled() {
isAllow = policy.PolicyManager.Allow(true, userCred, consts.GetServiceType(),
"quotas", policy.PolicyActionUpdate) == rbacutils.AdminAllow
} else {
isAllow = userCred.IsSystemAdmin()
isAllow = userCred.IsAdminAllow(consts.GetServiceType(),
"quotas", policy.PolicyActionUpdate)
}
if !isAllow {
httperrors.ForbiddenError(w, "not allow to set quota")
@@ -196,14 +197,15 @@ func setQuotaHanlder(ctx context.Context, w http.ResponseWriter, r *http.Request
}
func checkQuotaHanlder(ctx context.Context, w http.ResponseWriter, r *http.Request) {
userCred := auth.FetchUserCredential(ctx)
userCred := auth.FetchUserCredential(ctx, policy.FilterPolicyCredential)
isAllow := false
if consts.IsRbacEnabled() {
isAllow = policy.PolicyManager.Allow(true, userCred, consts.GetServiceType(),
policy.PolicyDelegation, policy.PolicyActionGet) == rbacutils.AdminAllow
} else {
isAllow = userCred.IsSystemAdmin()
isAllow = userCred.IsAdminAllow(consts.GetServiceType(),
policy.PolicyDelegation, policy.PolicyActionGet)
}
if !isAllow {
httperrors.ForbiddenError(w, "not allow to delegate check quota")
pkg/cloudcommon/db/sharablevirtual.go
+5 -3
View File
@@ -4,6 +4,8 @@ import (
"context"
"yunion.io/x/jsonutils"
"yunion.io/x/onecloud/pkg/cloudcommon/consts"
"yunion.io/x/onecloud/pkg/cloudcommon/policy"
"yunion.io/x/onecloud/pkg/mcclient"
"yunion.io/x/sqlchemy"
)
@@ -30,7 +32,7 @@ func (manager *SSharableVirtualResourceBaseManager) FilterByOwner(q *sqlchemy.SQ
}
func (model *SSharableVirtualResourceBase) AllowGetDetails(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool {
return model.IsOwner(userCred) || model.IsPublic
return model.IsOwner(userCred) || model.IsPublic || userCred.IsAdminAllow(consts.GetServiceType(), model.KeywordPlural(), policy.PolicyActionGet)
}
func (model *SSharableVirtualResourceBase) IsSharable() bool {
@@ -38,11 +40,11 @@ func (model *SSharableVirtualResourceBase) IsSharable() bool {
}
func (model *SSharableVirtualResourceBase) AllowPerformPublic(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
return userCred.IsSystemAdmin()
return userCred.IsAdminAllow(consts.GetServiceType(), model.GetModelManager().KeywordPlural(), policy.PolicyActionPerform, "public")
}
func (model *SSharableVirtualResourceBase) AllowPerformPrivate(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
return userCred.IsSystemAdmin()
return userCred.IsAdminAllow(consts.GetServiceType(), model.GetModelManager().KeywordPlural(), policy.PolicyActionPerform, "private")
}
func (model *SSharableVirtualResourceBase) PerformPublic(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) {
pkg/cloudcommon/db/standalone.go
+6 -4
View File
@@ -7,6 +7,8 @@ import (
"yunion.io/x/jsonutils"
"yunion.io/x/log"
"yunion.io/x/onecloud/pkg/cloudcommon/consts"
"yunion.io/x/onecloud/pkg/cloudcommon/policy"
"yunion.io/x/onecloud/pkg/httperrors"
"yunion.io/x/onecloud/pkg/mcclient"
"yunion.io/x/pkg/util/regutils"
@@ -147,7 +149,7 @@ func (model *SStandaloneResourceBase) GetMetadataJson(key string, userCred mccli
}
func (model *SStandaloneResourceBase) SetMetadata(ctx context.Context, key string, value interface{}, userCred mcclient.TokenCredential) error {
if Metadata.IsSystemAdminKey(key) && !userCred.IsSystemAdmin() {
if Metadata.IsSystemAdminKey(key) && !userCred.IsAdminAllow(consts.GetServiceType(), model.GetModelManager().KeywordPlural(), policy.PolicyActionPerform, "metadata") {
return httperrors.NewNotSufficientPrivilegeError("cannot set system key")
}
return Metadata.SetValue(ctx, model, key, value, userCred)
@@ -155,7 +157,7 @@ func (model *SStandaloneResourceBase) SetMetadata(ctx context.Context, key strin
func (model *SStandaloneResourceBase) SetAllMetadata(ctx context.Context, dictstore map[string]interface{}, userCred mcclient.TokenCredential) error {
for k := range dictstore {
if Metadata.IsSystemAdminKey(k) && !userCred.IsSystemAdmin() {
if Metadata.IsSystemAdminKey(k) && !userCred.IsAdminAllow(consts.GetServiceType(), model.GetModelManager().KeywordPlural(), policy.PolicyActionPerform, "metadata") {
return httperrors.NewNotSufficientPrivilegeError(fmt.Sprintf("not allow to set system key %s", k))
}
}
@@ -175,7 +177,7 @@ func (model *SStandaloneResourceBase) GetAllMetadata(userCred mcclient.TokenCred
}
func (model *SStandaloneResourceBase) AllowGetDetailsMetadata(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool {
return userCred.IsSystemAdmin()
return userCred.IsAdminAllow(consts.GetServiceType(), model.GetModelManager().KeywordPlural(), policy.PolicyActionGet, "metadata")
}
func (model *SStandaloneResourceBase) GetDetailsMetadata(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) (jsonutils.JSONObject, error) {
@@ -188,7 +190,7 @@ func (model *SStandaloneResourceBase) GetDetailsMetadata(ctx context.Context, us
}
func (model *SStandaloneResourceBase) AllowPerformMetadata(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
return userCred.IsSystemAdmin()
return userCred.IsAdminAllow(consts.GetServiceType(), model.GetModelManager().KeywordPlural(), policy.PolicyActionPerform, "metadata")
}
func (model *SStandaloneResourceBase) PerformMetadata(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) {
pkg/cloudcommon/db/statusstandalone.go
+3 -1
View File
@@ -6,6 +6,8 @@ import (
"strings"
"yunion.io/x/jsonutils"
"yunion.io/x/onecloud/pkg/cloudcommon/consts"
"yunion.io/x/onecloud/pkg/cloudcommon/policy"
"yunion.io/x/onecloud/pkg/mcclient"
"yunion.io/x/onecloud/pkg/util/logclient"
)
@@ -50,7 +52,7 @@ func (model *SStatusStandaloneResourceBase) SetStatus(userCred mcclient.TokenCre
}
func (model *SStatusStandaloneResourceBase) AllowPerformStatus(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
return userCred.IsSystemAdmin()
return userCred.IsAdminAllow(consts.GetServiceType(), model.GetModelManager().KeywordPlural(), policy.PolicyActionPerform, "status")
}
func (model *SStatusStandaloneResourceBase) PerformStatus(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) {
pkg/cloudcommon/db/taskman/tasks.go
+4 -2
View File
@@ -18,9 +18,11 @@ import (
"yunion.io/x/pkg/utils"
"yunion.io/x/sqlchemy"
"yunion.io/x/onecloud/pkg/cloudcommon/consts"
"yunion.io/x/onecloud/pkg/cloudcommon/db"
"yunion.io/x/onecloud/pkg/cloudcommon/db/lockman"
"yunion.io/x/onecloud/pkg/cloudcommon/db/quotas"
"yunion.io/x/onecloud/pkg/cloudcommon/policy"
)
const (
@@ -70,7 +72,7 @@ type STask struct {
}
func (manager *STaskManager) AllowListItems(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool {
return userCred.IsSystemAdmin()
return true
}
func (manager *STaskManager) AllowCreateItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
@@ -115,7 +117,7 @@ func (manager *STaskManager) FilterByOwner(q *sqlchemy.SQuery, owner string) *sq
}
func (self *STask) AllowGetDetails(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool {
return userCred.IsSystemAdmin() || userCred.GetProjectId() == self.UserCred.GetProjectId()
return userCred.IsAdminAllow(consts.GetServiceType(), self.GetModelManager().KeywordPlural(), policy.PolicyActionGet) || userCred.GetProjectId() == self.UserCred.GetProjectId()
}
func (self *STask) AllowUpdateItem(ctx context.Context, userCred mcclient.TokenCredential) bool {
pkg/cloudcommon/db/virtualjointbase.go
+7 -5
View File
@@ -10,6 +10,8 @@ import (
"yunion.io/x/pkg/util/reflectutils"
"yunion.io/x/sqlchemy"
"yunion.io/x/onecloud/pkg/cloudcommon/consts"
"yunion.io/x/onecloud/pkg/cloudcommon/policy"
"yunion.io/x/onecloud/pkg/httperrors"
"yunion.io/x/onecloud/pkg/mcclient"
)
@@ -27,7 +29,7 @@ func NewVirtualJointResourceBaseManager(dt interface{}, tableName string, keywor
}
func (manager *SVirtualJointResourceBaseManager) AllowListItems(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool {
if jsonutils.QueryBoolean(query, "admin", false) && !userCred.IsSystemAdmin() {
if jsonutils.QueryBoolean(query, "admin", false) && !userCred.IsAdminAllow(consts.GetServiceType(), manager.KeywordPlural(), policy.PolicyActionList) {
return false
}
return true
@@ -36,7 +38,7 @@ func (manager *SVirtualJointResourceBaseManager) AllowListItems(ctx context.Cont
func (manager *SVirtualJointResourceBaseManager) AllowListDescendent(ctx context.Context, userCred mcclient.TokenCredential, master IStandaloneModel, query jsonutils.JSONObject) bool {
masterVirtual := master.(IVirtualModel)
if masterVirtual.IsOwner(userCred) {
if masterVirtual.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), masterVirtual.KeywordPlural(), policy.PolicyActionList) {
return true
}
return false
@@ -62,12 +64,12 @@ func (manager *SVirtualJointResourceBaseManager) AllowAttach(ctx context.Context
func (self *SVirtualJointResourceBase) AllowGetDetails(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool {
masterVirtual := self.Master().(IVirtualModel)
return masterVirtual.IsOwner(userCred)
return masterVirtual.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), masterVirtual.KeywordPlural(), policy.PolicyActionGet)
}
func (self *SVirtualJointResourceBase) AllowUpdateItem(ctx context.Context, userCred mcclient.TokenCredential) bool {
masterVirtual := self.Master().(IVirtualModel)
return masterVirtual.IsOwner(userCred)
return masterVirtual.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), masterVirtual.KeywordPlural(), policy.PolicyActionUpdate)
}
func (manager *SVirtualJointResourceBaseManager) ListItemFilter(ctx context.Context, q *sqlchemy.SQuery, userCred mcclient.TokenCredential, query jsonutils.JSONObject) (*sqlchemy.SQuery, error) {
@@ -96,7 +98,7 @@ func (manager *SVirtualJointResourceBaseManager) ListItemFilter(ctx context.Cont
sqlchemy.IsFalse(masterTable.Field("deleted"))))
q = q.Join(slaveTable, sqlchemy.AND(sqlchemy.Equals(slaveField, slaveTable.Field("id")),
sqlchemy.IsFalse(slaveTable.Field("deleted"))))
if jsonutils.QueryBoolean(query, "admin", false) && userCred.IsSystemAdmin() {
if jsonutils.QueryBoolean(query, "admin", false) && userCred.IsAdminAllow(consts.GetServiceType(), manager.KeywordPlural(), policy.PolicyActionList) {
isSystem := jsonutils.QueryBoolean(query, "system", false)
if !isSystem {
if len(slaveQueryId) == 0 {
pkg/cloudcommon/db/virtualresource.go
+14 -12
View File
@@ -12,7 +12,9 @@ import (
"yunion.io/x/pkg/utils"
"yunion.io/x/sqlchemy"
"yunion.io/x/onecloud/pkg/cloudcommon/consts"
"yunion.io/x/onecloud/pkg/cloudcommon/db/lockman"
"yunion.io/x/onecloud/pkg/cloudcommon/policy"
"yunion.io/x/onecloud/pkg/httperrors"
"yunion.io/x/onecloud/pkg/mcclient"
)
@@ -38,12 +40,12 @@ type SVirtualResourceBase struct {
}
func (model *SVirtualResourceBase) IsOwner(userCred mcclient.TokenCredential) bool {
return userCred.IsSystemAdmin() || userCred.GetProjectId() == model.ProjectId
return userCred.GetProjectId() == model.ProjectId
}
func (model *SVirtualResourceBase) IsAdmin(userCred mcclient.TokenCredential) bool {
/*func (model *SVirtualResourceBase) IsAdmin(userCred mcclient.TokenCredential) bool {
return userCred.IsSystemAdmin() || (userCred.GetProjectId() == model.ProjectId && userCred.IsAdmin())
}
}*/
func (model *SVirtualResourceBase) GetOwnerProjectId() string {
return model.ProjectId
@@ -111,7 +113,7 @@ func (manager *SVirtualResourceBaseManager) ListItemFilter(ctx context.Context,
func (manager *SVirtualResourceBaseManager) ValidateCreateData(ctx context.Context, userCred mcclient.TokenCredential, ownerProjId string, query jsonutils.JSONObject, data *jsonutils.JSONDict) (*jsonutils.JSONDict, error) {
isSystem, err := data.Bool("is_system")
if err == nil && isSystem && !userCred.IsSystemAdmin() {
if err == nil && isSystem && !userCred.IsAdminAllow(consts.GetServiceType(), manager.KeywordPlural(), policy.PolicyActionCreate) {
return nil, httperrors.NewNotSufficientPrivilegeError("non-admin user not allowed to create system object")
}
return manager.SStandaloneResourceBaseManager.ValidateCreateData(ctx, userCred, ownerProjId, query, data)
@@ -130,14 +132,14 @@ func (model *SVirtualResourceBase) CustomizeCreate(ctx context.Context, userCred
func (manager *SVirtualResourceBaseManager) AllowListItems(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool {
isAdmin, err := query.Bool("admin")
if err == nil && isAdmin && !userCred.IsSystemAdmin() {
if err == nil && isAdmin && !userCred.IsAdminAllow(consts.GetServiceType(), manager.KeywordPlural(), policy.PolicyActionList) {
return false
}
return true
}
func (model *SVirtualResourceBase) AllowGetDetails(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool {
return model.IsOwner(userCred)
return model.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), model.KeywordPlural(), policy.PolicyActionGet)
}
func (manager *SVirtualResourceBaseManager) AllowCreateItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
@@ -145,19 +147,19 @@ func (manager *SVirtualResourceBaseManager) AllowCreateItem(ctx context.Context,
}
func (model *SVirtualResourceBase) AllowUpdateItem(ctx context.Context, userCred mcclient.TokenCredential) bool {
return model.IsOwner(userCred)
return model.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), model.KeywordPlural(), policy.PolicyActionUpdate)
}
func (model *SVirtualResourceBase) AllowDeleteItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
return model.IsOwner(userCred)
return model.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), model.KeywordPlural(), policy.PolicyActionDelete)
}
func (model *SVirtualResourceBase) AllowGetDetailsMetadata(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool {
return model.IsOwner(userCred)
return model.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), model.KeywordPlural(), policy.PolicyActionGet, "metadata")
}
func (model *SVirtualResourceBase) AllowPerformMetadata(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
return model.IsOwner(userCred)
return model.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), model.KeywordPlural(), policy.PolicyActionPerform, "metadata")
}
func (model *SVirtualResourceBase) GetTenantCache(ctx context.Context) (*STenant, error) {
@@ -166,7 +168,7 @@ func (model *SVirtualResourceBase) GetTenantCache(ctx context.Context) (*STenant
}
func (model *SVirtualResourceBase) getMoreDetails(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, extra *jsonutils.JSONDict) *jsonutils.JSONDict {
if userCred.IsSystemAdmin() {
if userCred.IsAdminAllow(consts.GetServiceType(), model.GetModelManager().KeywordPlural(), policy.PolicyActionGet) {
// log.Debugf("GetCustomizeColumns")
tobj, err := model.GetTenantCache(ctx)
if err == nil {
@@ -198,7 +200,7 @@ func (model *SVirtualResourceBase) GetExtraDetails(ctx context.Context, userCred
}
func (model *SVirtualResourceBase) AllowPerformChangeOwner(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
return userCred.IsSystemAdmin()
return userCred.IsAdminAllow(consts.GetServiceType(), model.GetModelManager().KeywordPlural(), policy.PolicyActionPerform, "change-owner")
}
func (model *SVirtualResourceBase) PerformChangeOwner(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) {
pkg/cloudcommon/options.go
+4
View File
@@ -63,6 +63,10 @@ func (this *DBOptions) GetDBConnection() (dialect, connstr string, err error) {
}
func ParseOptions(optStruct interface{}, optionsRef *Options, args []string, configFileName string) {
if len(consts.GetServiceType()) == 0 {
log.Fatalf("ServiceType not initialized!")
}
serviceName := path.Base(args[0])
parser, err := structarg.NewArgumentParser(optStruct,
serviceName,
pkg/cloudcommon/policy/policy.go
+8 -2
View File
@@ -90,6 +90,12 @@ var (
Action: PolicyActionCreate,
Result: rbacutils.UserAllow,
},
{
Service: "yunionconf",
Resource: "parameters",
Action: PolicyActionGet,
Result: rbacutils.OwnerAllow,
},
}
)
@@ -278,7 +284,7 @@ func (manager *SPolicyManager) explainPolicy(userCred mcclient.TokenCredential,
if !consts.IsRbacEnabled() {
if !isAdmin {
return reqStrs, rbacutils.OwnerAllow, nil
} else if isAdmin && userCred.IsSystemAdmin() {
} else if isAdmin && userCred.HasSystemAdminPrivelege() {
return reqStrs, rbacutils.AdminAllow, nil
} else {
return reqStrs, rbacutils.Deny, httperrors.NewForbiddenError("operation not allowed")
@@ -305,7 +311,7 @@ func (manager *SPolicyManager) ExplainRpc(userCred mcclient.TokenCredential, par
}
func (manager *SPolicyManager) IsAdminCapable(userCred mcclient.TokenCredential) bool {
if !consts.IsRbacEnabled() && userCred.IsSystemAdmin() {
if !consts.IsRbacEnabled() && userCred.HasSystemAdminPrivelege() {
return true
}
pkg/cloudcommon/policy/token.go
+145
View File
@@ -0,0 +1,145 @@
package policy
import (
"time"
"yunion.io/x/jsonutils"
"yunion.io/x/pkg/gotypes"
"yunion.io/x/onecloud/pkg/cloudcommon/consts"
"yunion.io/x/onecloud/pkg/mcclient"
"yunion.io/x/onecloud/pkg/util/rbacutils"
)
type SPolicyTokenCredential struct {
Token mcclient.TokenCredential
}
func (self *SPolicyTokenCredential) String() string {
return self.Token.String()
}
func (self *SPolicyTokenCredential) IsZero() bool {
return self.Token.IsZero()
}
func (self *SPolicyTokenCredential) GetProjectId() string {
return self.Token.GetProjectId()
}
func (self *SPolicyTokenCredential) GetTenantId() string {
return self.Token.GetTenantId()
}
func (self *SPolicyTokenCredential) GetUserId() string {
return self.Token.GetUserId()
}
func (self *SPolicyTokenCredential) GetServiceURL(service, region, zone, endpointType string) (string, error) {
return self.Token.GetServiceURL(service, region, zone, endpointType)
}
func (self *SPolicyTokenCredential) GetServiceURLs(service, region, zone, endpointType string) ([]string, error) {
return self.Token.GetServiceURLs(service, region, zone, endpointType)
}
func (self *SPolicyTokenCredential) GetTokenString() string {
return self.Token.GetTokenString()
}
func (self *SPolicyTokenCredential) GetDomainId() string {
return self.Token.GetDomainId()
}
func (self *SPolicyTokenCredential) GetDomainName() string {
return self.Token.GetDomainName()
}
func (self *SPolicyTokenCredential) GetTenantName() string {
return self.Token.GetTenantName()
}
func (self *SPolicyTokenCredential) GetProjectName() string {
return self.Token.GetProjectName()
}
func (self *SPolicyTokenCredential) GetUserName() string {
return self.Token.GetUserName()
}
func (self *SPolicyTokenCredential) GetRoles() []string {
return self.Token.GetRoles()
}
func (self *SPolicyTokenCredential) GetExpires() time.Time {
return self.Token.GetExpires()
}
func (self *SPolicyTokenCredential) IsValid() bool {
return self.Token.IsValid()
}
func (self *SPolicyTokenCredential) ValidDuration() time.Duration {
return self.Token.ValidDuration()
}
func (self *SPolicyTokenCredential) GetRegions() []string {
return self.Token.GetRegions()
}
func (self *SPolicyTokenCredential) GetServiceCatalog() mcclient.IServiceCatalog {
return self.Token.GetServiceCatalog()
}
func (self *SPolicyTokenCredential) GetCatalogData(serviceTypes []string, region string) jsonutils.JSONObject {
return self.Token.GetCatalogData(serviceTypes, region)
}
func (self *SPolicyTokenCredential) GetInternalServices(region string) []string {
return self.Token.GetInternalServices(region)
}
func (self *SPolicyTokenCredential) GetExternalServices(region string) []mcclient.ExternalService {
return self.Token.GetExternalServices(region)
}
func (self *SPolicyTokenCredential) GetEndpoints(region string, endpointType string) []mcclient.Endpoint {
return self.Token.GetEndpoints(region, endpointType)
}
func (self *SPolicyTokenCredential) ToJson() jsonutils.JSONObject {
return self.Token.ToJson()
}
func (self *SPolicyTokenCredential) HasSystemAdminPrivelege() bool {
if consts.IsRbacEnabled() {
return PolicyManager.IsAdminCapable(self.Token)
}
return self.Token.HasSystemAdminPrivelege()
}
func (self *SPolicyTokenCredential) IsAdminAllow(service string, resource string, action string, extra ...string) bool {
if consts.IsRbacEnabled() {
result := PolicyManager.Allow(true, self.Token, service, resource, action, extra...)
return result == rbacutils.AdminAllow
}
return self.Token.IsAdminAllow(service, resource, action, extra...)
}
func init() {
gotypes.RegisterSerializable(mcclient.TokenCredentialType, func() gotypes.ISerializable {
return &SPolicyTokenCredential{}
})
}
func FilterPolicyCredential(token mcclient.TokenCredential) mcclient.TokenCredential {
if !consts.IsRbacEnabled() {
return token
}
switch token.(type) {
case *SPolicyTokenCredential:
return token
default:
return &SPolicyTokenCredential{Token: token}
}
}
pkg/compute/capabilities/handler.go
+2 -1
View File
@@ -8,6 +8,7 @@ import (
"yunion.io/x/jsonutils"
"yunion.io/x/onecloud/pkg/appsrv"
"yunion.io/x/onecloud/pkg/cloudcommon/policy"
"yunion.io/x/onecloud/pkg/compute/models"
"yunion.io/x/onecloud/pkg/httperrors"
"yunion.io/x/onecloud/pkg/mcclient/auth"
@@ -18,7 +19,7 @@ func AddCapabilityHandler(prefix string, app *appsrv.Application) {
}
func capaHandler(ctx context.Context, w http.ResponseWriter, r *http.Request) {
userCred := auth.FetchUserCredential(ctx)
userCred := auth.FetchUserCredential(ctx, policy.FilterPolicyCredential)
query, err := jsonutils.ParseQueryString(r.URL.RawQuery)
if err != nil {
httperrors.GeneralServerError(w, err)
pkg/compute/models/baremetalagents.go
+6 -4
View File
@@ -5,7 +5,9 @@ import (
"fmt"
"yunion.io/x/jsonutils"
"yunion.io/x/onecloud/pkg/cloudcommon/consts"
"yunion.io/x/onecloud/pkg/cloudcommon/db"
"yunion.io/x/onecloud/pkg/cloudcommon/policy"
"yunion.io/x/onecloud/pkg/httperrors"
"yunion.io/x/onecloud/pkg/mcclient"
"yunion.io/x/pkg/util/regutils"
@@ -80,7 +82,7 @@ func (manager *SBaremetalagentManager) ValidateCreateData(ctx context.Context, u
}
func (self *SBaremetalagent) AllowPerformEnable(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
return userCred.IsSystemAdmin()
return userCred.IsAdminAllow(consts.GetServiceType(), self.GetModelManager().KeywordPlural(), policy.PolicyActionPerform, "enable")
}
func (self *SBaremetalagent) PerformEnable(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) {
@@ -95,7 +97,7 @@ func (self *SBaremetalagent) PerformEnable(ctx context.Context, userCred mcclien
}
func (self *SBaremetalagent) AllowPerformDisable(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
return userCred.IsSystemAdmin()
return userCred.IsAdminAllow(consts.GetServiceType(), self.GetModelManager().KeywordPlural(), policy.PolicyActionPerform, "disable")
}
func (self *SBaremetalagent) PerformDisable(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) {
@@ -110,7 +112,7 @@ func (self *SBaremetalagent) PerformDisable(ctx context.Context, userCred mcclie
}
func (self *SBaremetalagent) AllowPerformOnline(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
return userCred.IsSystemAdmin()
return userCred.IsAdminAllow(consts.GetServiceType(), self.GetModelManager().KeywordPlural(), policy.PolicyActionPerform, "online")
}
func (self *SBaremetalagent) PerformOnline(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) {
@@ -125,7 +127,7 @@ func (self *SBaremetalagent) PerformOnline(ctx context.Context, userCred mcclien
}
func (self *SBaremetalagent) AllowPerformOffline(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
return userCred.IsSystemAdmin()
return userCred.IsAdminAllow(consts.GetServiceType(), self.GetModelManager().KeywordPlural(), policy.PolicyActionPerform, "offline")
}
func (self *SBaremetalagent) PerformOffline(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) {
pkg/compute/models/cachedimages.go
+3 -1
View File
@@ -16,8 +16,10 @@ import (
"yunion.io/x/pkg/util/timeutils"
"yunion.io/x/sqlchemy"
"yunion.io/x/onecloud/pkg/cloudcommon/consts"
"yunion.io/x/onecloud/pkg/cloudcommon/db"
"yunion.io/x/onecloud/pkg/cloudcommon/db/lockman"
"yunion.io/x/onecloud/pkg/cloudcommon/policy"
"yunion.io/x/onecloud/pkg/compute/options"
)
@@ -240,7 +242,7 @@ func (self *SCachedimage) GetCustomizeColumns(ctx context.Context, userCred mccl
}
func (self *SCachedimage) AllowPerformRefresh(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
return userCred.IsSystemAdmin()
return userCred.IsAdminAllow(consts.GetServiceType(), self.GetModelManager().KeywordPlural(), policy.PolicyActionPerform, "refresh")
}
func (self *SCachedimage) PerformRefresh(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) {
pkg/compute/models/cloudaccounts.go
+6 -4
View File
@@ -13,8 +13,10 @@ import (
"yunion.io/x/pkg/utils"
"yunion.io/x/sqlchemy"
"yunion.io/x/onecloud/pkg/cloudcommon/consts"
"yunion.io/x/onecloud/pkg/cloudcommon/db"
"yunion.io/x/onecloud/pkg/cloudcommon/db/taskman"
"yunion.io/x/onecloud/pkg/cloudcommon/policy"
"yunion.io/x/onecloud/pkg/cloudprovider"
"yunion.io/x/onecloud/pkg/httperrors"
"yunion.io/x/onecloud/pkg/mcclient"
@@ -199,7 +201,7 @@ func (self *SCloudaccount) CanSync() bool {
}
func (self *SCloudaccount) AllowPerformSync(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
return userCred.IsSystemAdmin()
return userCred.IsAdminAllow(consts.GetServiceType(), self.GetModelManager().KeywordPlural(), policy.PolicyActionPerform, "sync")
}
func (self *SCloudaccount) PerformSync(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) {
@@ -218,7 +220,7 @@ func (self *SCloudaccount) PerformSync(ctx context.Context, userCred mcclient.To
}
func (self *SCloudaccount) AllowPerformUpdateCredential(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
return userCred.IsSystemAdmin()
return userCred.IsAdminAllow(consts.GetServiceType(), self.GetModelManager().KeywordPlural(), policy.PolicyActionPerform, "update-credential")
}
func (self *SCloudaccount) PerformUpdateCredential(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) {
@@ -444,7 +446,7 @@ func (self *SCloudaccount) ImportSubAccount(ctx context.Context, userCred mcclie
}
func (self *SCloudaccount) AllowPerformImport(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
return userCred.IsSystemAdmin()
return userCred.IsAdminAllow(consts.GetServiceType(), self.GetModelManager().KeywordPlural(), policy.PolicyActionPerform, "import")
}
func (self *SCloudaccount) PerformImport(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) {
@@ -618,7 +620,7 @@ func (self *SCloudaccount) GetBalance() (float64, error) {
}
func (self *SCloudaccount) AllowGetDetailsBalance(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool {
return userCred.IsSystemAdmin()
return userCred.IsAdminAllow(consts.GetServiceType(), self.GetModelManager().KeywordPlural(), policy.PolicyActionGet, "balance")
}
func (self *SCloudaccount) GetDetailsBalance(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) (jsonutils.JSONObject, error) {
pkg/compute/models/cloudproviders.go
+5 -3
View File
@@ -12,8 +12,10 @@ import (
"yunion.io/x/pkg/utils"
"yunion.io/x/sqlchemy"
"yunion.io/x/onecloud/pkg/cloudcommon/consts"
"yunion.io/x/onecloud/pkg/cloudcommon/db"
"yunion.io/x/onecloud/pkg/cloudcommon/db/taskman"
"yunion.io/x/onecloud/pkg/cloudcommon/policy"
"yunion.io/x/onecloud/pkg/cloudprovider"
"yunion.io/x/onecloud/pkg/compute/options"
"yunion.io/x/onecloud/pkg/httperrors"
@@ -297,7 +299,7 @@ func (sr *SSyncRange) Normalize() error {
}
func (self *SCloudprovider) AllowPerformSync(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
return userCred.IsSystemAdmin()
return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "sync")
}
func (self *SCloudprovider) PerformSync(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) {
@@ -330,7 +332,7 @@ func (self *SCloudprovider) StartSyncCloudProviderInfoTask(ctx context.Context,
}
func (self *SCloudprovider) AllowPerformChangeProject(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
return userCred.IsSystemAdmin()
return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "change-project")
}
func (self *SCloudprovider) PerformChangeProject(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) {
@@ -581,7 +583,7 @@ func (self *SCloudprovider) GetBalance() (float64, error) {
}
func (self *SCloudprovider) AllowGetDetailsBalance(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool {
return userCred.IsSystemAdmin()
return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionGet, "balance")
}
func (self *SCloudprovider) GetDetailsBalance(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) (jsonutils.JSONObject, error) {
pkg/compute/models/cloudregions.go
+3 -1
View File
@@ -12,7 +12,9 @@ import (
"yunion.io/x/pkg/util/compare"
"yunion.io/x/sqlchemy"
"yunion.io/x/onecloud/pkg/cloudcommon/consts"
"yunion.io/x/onecloud/pkg/cloudcommon/db"
"yunion.io/x/onecloud/pkg/cloudcommon/policy"
"yunion.io/x/onecloud/pkg/cloudprovider"
)
@@ -248,7 +250,7 @@ func (manager *SCloudregionManager) newFromCloudRegion(cloudRegion cloudprovider
}
func (self *SCloudregion) AllowPerformDefaultVpc(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
return userCred.IsSystemAdmin()
return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "default-vpc")
}
func (self *SCloudregion) PerformDefaultVpc(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) {
pkg/compute/models/disks.go
+9 -7
View File
@@ -19,9 +19,11 @@ import (
"yunion.io/x/pkg/utils"
"yunion.io/x/sqlchemy"
"yunion.io/x/onecloud/pkg/cloudcommon/consts"
"yunion.io/x/onecloud/pkg/cloudcommon/db"
"yunion.io/x/onecloud/pkg/cloudcommon/db/quotas"
"yunion.io/x/onecloud/pkg/cloudcommon/db/taskman"
"yunion.io/x/onecloud/pkg/cloudcommon/policy"
"yunion.io/x/onecloud/pkg/cloudprovider"
"yunion.io/x/onecloud/pkg/compute/options"
"yunion.io/x/onecloud/pkg/httperrors"
@@ -442,7 +444,7 @@ func (self *SDisk) StartAllocate(ctx context.Context, host *SHost, storage *SSto
}
func (self *SDisk) AllowGetDetailsConvertSnapshot(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool {
return self.IsOwner(userCred)
return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionGet, "convert-snapshot")
}
func (self *SDisk) GetDetailsConvertSnapshot(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) (jsonutils.JSONObject, error) {
@@ -499,7 +501,7 @@ func (self *SDisk) CleanUpDiskSnapshots(ctx context.Context, userCred mcclient.T
}
func (self *SDisk) AllowPerformCreateSnapshot(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
return self.IsOwner(userCred)
return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "create-snapshot")
}
func (self *SDisk) PerformCreateSnapshot(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) {
@@ -513,7 +515,7 @@ func (self *SDisk) PerformCreateSnapshot(ctx context.Context, userCred mcclient.
}
func (self *SDisk) AllowPerformDiskReset(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
return self.IsOwner(userCred)
return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "disk-reset")
}
func (self *SDisk) PerformDiskReset(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) {
@@ -560,7 +562,7 @@ func (self *SDisk) StartResetDisk(ctx context.Context, userCred mcclient.TokenCr
}
func (self *SDisk) AllowPerformResize(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
return self.IsOwner(userCred)
return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "resize")
}
func (self *SDisk) PerformResize(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) {
@@ -651,7 +653,7 @@ func (self *SDisk) PrepareSaveImage(ctx context.Context, userCred mcclient.Token
}
func (self *SDisk) AllowPerformSave(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
return self.IsOwner(userCred)
return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "save")
}
func (self *SDisk) PerformSave(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) {
@@ -1139,7 +1141,7 @@ func (self *SDisk) RealDelete(ctx context.Context, userCred mcclient.TokenCreden
}
func (self *SDisk) AllowPerformPurge(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
return self.IsOwner(userCred)
return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "purge")
}
func (self *SDisk) PerformPurge(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) {
@@ -1315,7 +1317,7 @@ func (self *SDisk) isInit() bool {
}
func (self *SDisk) AllowPerformCancelDelete(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
return userCred.IsSystemAdmin()
return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "cancel-delete")
}
func (self *SDisk) PerformCancelDelete(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) {
pkg/compute/models/dnsrecords.go
+6 -4
View File
@@ -11,7 +11,9 @@ import (
"yunion.io/x/pkg/util/regutils"
"yunion.io/x/sqlchemy"
"yunion.io/x/onecloud/pkg/cloudcommon/consts"
"yunion.io/x/onecloud/pkg/cloudcommon/db"
"yunion.io/x/onecloud/pkg/cloudcommon/policy"
"yunion.io/x/onecloud/pkg/httperrors"
"yunion.io/x/onecloud/pkg/mcclient"
)
@@ -383,7 +385,7 @@ func (rec *SDnsRecord) AddInfo(userCred mcclient.TokenCredential, data jsonutils
}
func (rec *SDnsRecord) AllowPerformAddRecords(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
return rec.IsOwner(userCred)
return rec.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), rec.KeywordPlural(), policy.PolicyActionPerform, "add-records")
}
func (rec *SDnsRecord) PerformAddRecords(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) {
@@ -402,7 +404,7 @@ func (rec *SDnsRecord) PerformAddRecords(ctx context.Context, userCred mcclient.
}
func (rec *SDnsRecord) AllowPerformRemoveRecords(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
return rec.IsOwner(userCred)
return rec.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), rec.KeywordPlural(), policy.PolicyActionPerform, "remove-records")
}
func (rec *SDnsRecord) PerformRemoveRecords(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) {
@@ -411,7 +413,7 @@ func (rec *SDnsRecord) PerformRemoveRecords(ctx context.Context, userCred mcclie
}
func (rec *SDnsRecord) AllowPerformEnable(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
return rec.IsOwner(userCred) || userCred.IsSystemAdmin()
return rec.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), rec.KeywordPlural(), policy.PolicyActionPerform, "enable")
}
func (rec *SDnsRecord) PerformEnable(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) {
@@ -429,7 +431,7 @@ func (rec *SDnsRecord) PerformEnable(ctx context.Context, userCred mcclient.Toke
}
func (rec *SDnsRecord) AllowPerformDisable(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
return rec.IsOwner(userCred) || userCred.IsSystemAdmin()
return rec.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), rec.KeywordPlural(), policy.PolicyActionPerform, "disable")
}
func (rec *SDnsRecord) PerformDisable(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) {
pkg/compute/models/dynamicschedtags.go
+3 -1
View File
@@ -7,7 +7,9 @@ import (
"yunion.io/x/log"
"database/sql"
"yunion.io/x/onecloud/pkg/cloudcommon/consts"
"yunion.io/x/onecloud/pkg/cloudcommon/db"
"yunion.io/x/onecloud/pkg/cloudcommon/policy"
"yunion.io/x/onecloud/pkg/httperrors"
"yunion.io/x/onecloud/pkg/mcclient"
"yunion.io/x/onecloud/pkg/util/conditionparser"
@@ -132,7 +134,7 @@ func (manager *SDynamicschedtagManager) getAllEnabledDynamicSchedtags() []SDynam
}
func (self *SDynamicschedtag) AllowPerformEvaluate(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
return userCred.IsSystemAdmin()
return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "evaluate")
}
func (self *SDynamicschedtag) PerformEvaluate(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) {
pkg/compute/models/elasticips.go
+7 -5
View File
@@ -13,10 +13,12 @@ import (
"yunion.io/x/pkg/utils"
"yunion.io/x/sqlchemy"
"yunion.io/x/onecloud/pkg/cloudcommon/consts"
"yunion.io/x/onecloud/pkg/cloudcommon/db"
"yunion.io/x/onecloud/pkg/cloudcommon/db/lockman"
"yunion.io/x/onecloud/pkg/cloudcommon/db/quotas"
"yunion.io/x/onecloud/pkg/cloudcommon/db/taskman"
"yunion.io/x/onecloud/pkg/cloudcommon/policy"
"yunion.io/x/onecloud/pkg/cloudprovider"
"yunion.io/x/onecloud/pkg/httperrors"
"yunion.io/x/onecloud/pkg/mcclient"
@@ -493,7 +495,7 @@ func (self *SElasticip) StartEipDeallocateTask(ctx context.Context, userCred mcc
}
func (self *SElasticip) AllowPerformAssociate(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
return self.IsOwner(userCred)
return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "associate")
}
func (self *SElasticip) PerformAssociate(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) {
@@ -593,7 +595,7 @@ func (self *SElasticip) StartEipAssociateTask(ctx context.Context, userCred mccl
}
func (self *SElasticip) AllowPerformDissociate(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
return self.IsOwner(userCred)
return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "dissociate")
}
func (self *SElasticip) PerformDissociate(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) {
@@ -647,7 +649,7 @@ func (self *SElasticip) GetIEip() (cloudprovider.ICloudEIP, error) {
}
func (self *SElasticip) AllowPerformSync(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
return self.IsOwner(userCred)
return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "sync")
}
func (self *SElasticip) PerformSync(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) {
@@ -731,7 +733,7 @@ func (manager *SElasticipManager) allocateEipAndAssociateVM(ctx context.Context,
}
func (self *SElasticip) AllowPerformChangeBandwidth(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
return self.IsOwner(userCred)
return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "change-bandwidth")
}
func (self *SElasticip) PerformChangeBandwidth(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) {
@@ -834,7 +836,7 @@ func (manager *SElasticipManager) TotalCount(projectId string, rangeObj db.IStan
}
func (self *SElasticip) AllowPerformPurge(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
return userCred.IsSystemAdmin()
return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionDelete)
}
func (self *SElasticip) PerformPurge(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) {
pkg/compute/models/guest_actions.go
+38 -36
View File
@@ -23,6 +23,8 @@ import (
"yunion.io/x/jsonutils"
"yunion.io/x/log"
"yunion.io/x/onecloud/pkg/cloudcommon/consts"
"yunion.io/x/onecloud/pkg/cloudcommon/policy"
"yunion.io/x/pkg/util/fileutils"
"yunion.io/x/pkg/util/regutils"
"yunion.io/x/pkg/utils"
@@ -30,7 +32,7 @@ import (
)
func (self *SGuest) AllowGetDetailsVnc(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool {
return self.IsOwner(userCred)
return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionGet, "vnc")
}
func (self *SGuest) GetDetailsVnc(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) (jsonutils.JSONObject, error) {
@@ -51,7 +53,7 @@ func (self *SGuest) GetDetailsVnc(ctx context.Context, userCred mcclient.TokenCr
}
func (self *SGuest) AllowGetDetailsMonitor(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool {
return self.IsOwner(userCred)
return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionGet, "monitor")
}
func (self *SGuest) GetDetailsMonitor(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) (jsonutils.JSONObject, error) {
@@ -66,7 +68,7 @@ func (self *SGuest) GetDetailsMonitor(ctx context.Context, userCred mcclient.Tok
}
func (self *SGuest) AllowGetDetailsDesc(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool {
return self.IsOwner(userCred)
return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionGet, "desc")
}
func (self *SGuest) GetDetailsDesc(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) (jsonutils.JSONObject, error) {
@@ -79,7 +81,7 @@ func (self *SGuest) GetDetailsDesc(ctx context.Context, userCred mcclient.TokenC
}
func (self *SGuest) AllowPerformSaveImage(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
return self.IsOwner(userCred)
return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "save-image")
}
func (self *SGuest) PerformSaveImage(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) {
@@ -117,7 +119,7 @@ func (self *SGuest) StartGuestSaveImage(ctx context.Context, userCred mcclient.T
}
func (self *SGuest) AllowPerformSync(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
return self.IsOwner(userCred)
return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "sync")
}
func (self *SGuest) PerformSync(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) {
@@ -159,7 +161,7 @@ func (self *SGuest) CheckQemuVersion(qemuVer, compareVer string) bool {
}
func (self *SGuest) AllowPerformMigrate(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
return self.IsOwner(userCred)
return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "migrate")
}
func (self *SGuest) PerformMigrate(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) {
@@ -186,7 +188,7 @@ func (self *SGuest) PerformMigrate(ctx context.Context, userCred mcclient.TokenC
var preferHostId string
preferHost, _ := data.GetString("prefer_host")
if len(preferHost) > 0 {
if !userCred.IsSystemAdmin() {
if !userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "assign-host") {
return nil, httperrors.NewBadRequestError("Only system admin can assign host")
}
iHost, _ := HostManager.FetchByIdOrName(userCred, preferHost)
@@ -219,7 +221,7 @@ func (self *SGuest) StartMigrateTask(ctx context.Context, userCred mcclient.Toke
}
func (self *SGuest) AllowPerformLiveMigrate(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
return self.IsOwner(userCred)
return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "live-migrate")
}
func (self *SGuest) PerformLiveMigrate(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) {
@@ -249,7 +251,7 @@ func (self *SGuest) PerformLiveMigrate(ctx context.Context, userCred mcclient.To
var preferHostId string
preferHost, _ := data.GetString("prefer_host")
if len(preferHost) > 0 {
if !userCred.IsSystemAdmin() {
if !userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "assign-host") {
return nil, httperrors.NewBadRequestError("Only system admin can assign host")
}
iHost, _ := HostManager.FetchByIdOrName(userCred, preferHost)
@@ -282,7 +284,7 @@ func (self *SGuest) StartGuestLiveMigrateTask(ctx context.Context, userCred mccl
}
func (self *SGuest) AllowPerformDeploy(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
return self.IsOwner(userCred)
return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "deploy")
}
func (self *SGuest) PerformDeploy(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) {
@@ -345,7 +347,7 @@ func (self *SGuest) PerformDeploy(ctx context.Context, userCred mcclient.TokenCr
}
func (self *SGuest) AllowPerformAttachdisk(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
return self.IsOwner(userCred)
return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "attachdisk")
}
func (self *SGuest) ValidateAttachDisk(ctx context.Context, disk *SDisk) error {
@@ -425,7 +427,7 @@ func (self *SGuest) StartSyncTask(ctx context.Context, userCred mcclient.TokenCr
}
func (self *SGuest) AllowPerformSuspend(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
return self.IsOwner(userCred)
return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "suspend")
}
func (self *SGuest) PerformSuspend(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) {
@@ -448,7 +450,7 @@ func (self *SGuest) AllowPerformStart(ctx context.Context,
userCred mcclient.TokenCredential,
query jsonutils.JSONObject,
data jsonutils.JSONObject) bool {
return self.IsOwner(userCred)
return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "start")
}
func (self *SGuest) PerformStart(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject,
@@ -624,11 +626,11 @@ func (self *SGuest) StartDeleteGuestTask(ctx context.Context, userCred mcclient.
}
func (self *SGuest) AllowPerformAssignSecgroup(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
return self.IsOwner(userCred)
return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "assign-secgroup")
}
func (self *SGuest) AllowPerformRevokeSecgroup(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
return self.IsOwner(userCred)
return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "revoke-secgroup")
}
func (self *SGuest) PerformRevokeSecgroup(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) {
@@ -679,7 +681,7 @@ func (self *SGuest) PerformAssignSecgroup(ctx context.Context, userCred mcclient
}
func (self *SGuest) AllowPerformPurge(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
return self.IsAdmin(userCred)
return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionDelete)
}
func (self *SGuest) PerformPurge(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) {
@@ -707,7 +709,7 @@ func (self *SGuest) setKeypairId(userCred mcclient.TokenCredential, keypairId st
}
func (self *SGuest) AllowPerformRebuildRoot(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
return self.IsOwner(userCred)
return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "rebuild-root")
}
func (self *SGuest) PerformRebuildRoot(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) {
@@ -814,7 +816,7 @@ func (self *SGuest) DetachDisk(ctx context.Context, disk *SDisk, userCred mcclie
}
func (self *SGuest) AllowPerformCreatedisk(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
return self.IsOwner(userCred)
return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "createdisk")
}
func (self *SGuest) PerformCreatedisk(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) {
@@ -885,7 +887,7 @@ func (self *SGuest) PerformCreatedisk(ctx context.Context, userCred mcclient.Tok
}
func (self *SGuest) AllowPerformDetachdisk(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
return self.IsOwner(userCred)
return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "detachdisk")
}
func (self *SGuest) PerformDetachdisk(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) {
@@ -931,7 +933,7 @@ func (self *SGuest) PerformDetachdisk(ctx context.Context, userCred mcclient.Tok
}
func (self *SGuest) AllowPerformDetachIsolatedDevice(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
return userCred.IsSystemAdmin()
return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "detach-isolated-device")
}
func (self *SGuest) PerformDetachIsolatedDevice(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) {
@@ -981,7 +983,7 @@ func (self *SGuest) detachIsolateDevice(userCred mcclient.TokenCredential, dev *
}
func (self *SGuest) AllowPerformAttachIsolatedDevice(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
return userCred.IsSystemAdmin()
return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "attach-isolated-device")
}
func (self *SGuest) PerformAttachIsolatedDevice(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) {
@@ -1019,7 +1021,7 @@ func (self *SGuest) PerformAttachIsolatedDevice(ctx context.Context, userCred mc
}
func (self *SGuest) AllowPerformDetachnetwork(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
return self.IsOwner(userCred)
return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "detachnetwork")
}
func (self *SGuest) PerformDetachnetwork(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) {
@@ -1041,7 +1043,7 @@ func (self *SGuest) PerformDetachnetwork(ctx context.Context, userCred mcclient.
}
func (self *SGuest) AllowPerformAttachnetwork(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
return self.IsOwner(userCred)
return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "attachnetwork")
}
func (self *SGuest) PerformAttachnetwork(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) {
@@ -1092,7 +1094,7 @@ func (self *SGuest) PerformAttachnetwork(ctx context.Context, userCred mcclient.
}
func (self *SGuest) AllowPerformChangeBandwidth(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
return self.IsOwner(userCred) || userCred.IsSystemAdmin()
return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "change-bandwidth")
}
func (self *SGuest) PerformChangeBandwidth(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) {
@@ -1126,7 +1128,7 @@ func (self *SGuest) PerformChangeBandwidth(ctx context.Context, userCred mcclien
}
func (self *SGuest) AllowPerformChangeConfig(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
return self.IsOwner(userCred) || self.IsAdmin(userCred)
return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "change-config")
}
func (self *SGuest) PerformChangeConfig(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) {
@@ -1317,7 +1319,7 @@ func (self *SGuest) DoPendingDelete(ctx context.Context, userCred mcclient.Token
}
func (model *SGuest) AllowPerformCancelDelete(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
return userCred.IsSystemAdmin()
return userCred.IsAdminAllow(consts.GetServiceType(), model.KeywordPlural(), policy.PolicyActionPerform, "cancel-delete")
}
func (self *SGuest) PerformCancelDelete(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) {
@@ -1353,7 +1355,7 @@ func (self *SGuest) AllowPerformReset(ctx context.Context,
userCred mcclient.TokenCredential,
query jsonutils.JSONObject,
data jsonutils.JSONObject) bool {
return self.IsOwner(userCred)
return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "reset")
}
func (self *SGuest) PerformReset(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject,
@@ -1367,7 +1369,7 @@ func (self *SGuest) PerformReset(ctx context.Context, userCred mcclient.TokenCre
}
func (self *SGuest) AllowPerformDiskSnapshot(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
return self.IsOwner(userCred)
return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "disk-snapshot")
}
func (self *SGuest) PerformDiskSnapshot(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) {
@@ -1421,7 +1423,7 @@ func (self *SGuest) PerformDiskSnapshot(ctx context.Context, userCred mcclient.T
}
func (self *SGuest) AllowPerformSyncstatus(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
return self.IsOwner(userCred)
return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "syncstatus")
}
func (self *SGuest) PerformSyncstatus(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) {
@@ -1465,7 +1467,7 @@ func (self *SGuest) AllowPerformStop(ctx context.Context,
userCred mcclient.TokenCredential,
query jsonutils.JSONObject,
data jsonutils.JSONObject) bool {
return self.IsOwner(userCred)
return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "stop")
}
func (self *SGuest) PerformStop(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject,
@@ -1482,7 +1484,7 @@ func (self *SGuest) AllowPerformRestart(ctx context.Context,
userCred mcclient.TokenCredential,
query jsonutils.JSONObject,
data jsonutils.JSONObject) bool {
return self.IsOwner(userCred)
return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "restart")
}
func (self *SGuest) PerformRestart(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) {
@@ -1495,7 +1497,7 @@ func (self *SGuest) PerformRestart(ctx context.Context, userCred mcclient.TokenC
}
func (self *SGuest) AllowPerformSendkeys(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
return self.IsOwner(userCred)
return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "sendkeys")
}
func (self *SGuest) PerformSendkeys(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) {
@@ -1569,7 +1571,7 @@ func (self *SGuest) SendMonitorCommand(ctx context.Context, userCred mcclient.To
}
func (self *SGuest) AllowPerformAssociateEip(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
return self.IsOwner(userCred)
return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "associate-eip")
}
func (self *SGuest) PerformAssociateEip(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) {
@@ -1637,7 +1639,7 @@ func (self *SGuest) PerformAssociateEip(ctx context.Context, userCred mcclient.T
}
func (self *SGuest) AllowPerformDissociateEip(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
return self.IsOwner(userCred)
return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "dissociate-eip")
}
func (self *SGuest) PerformDissociateEip(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) {
@@ -1661,7 +1663,7 @@ func (self *SGuest) PerformDissociateEip(ctx context.Context, userCred mcclient.
}
func (self *SGuest) AllowPerformCreateEip(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
return self.IsOwner(userCred)
return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "create-eip")
}
func (self *SGuest) PerformCreateEip(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) {
@@ -1716,7 +1718,7 @@ func (self *SGuest) setUserData(ctx context.Context, userCred mcclient.TokenCred
}
func (self *SGuest) AllowPerformUserData(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
return self.IsOwner(userCred)
return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "userdata")
}
func (self *SGuest) PerformUserData(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) {
pkg/compute/models/guests.go
+7 -5
View File
@@ -22,9 +22,11 @@ import (
"yunion.io/x/pkg/utils"
"yunion.io/x/sqlchemy"
"yunion.io/x/onecloud/pkg/cloudcommon/consts"
"yunion.io/x/onecloud/pkg/cloudcommon/db"
"yunion.io/x/onecloud/pkg/cloudcommon/db/lockman"
"yunion.io/x/onecloud/pkg/cloudcommon/db/quotas"
"yunion.io/x/onecloud/pkg/cloudcommon/policy"
"yunion.io/x/onecloud/pkg/cloudprovider"
"yunion.io/x/onecloud/pkg/compute/options"
"yunion.io/x/onecloud/pkg/compute/sshkeys"
@@ -207,7 +209,7 @@ type SGuest struct {
func (manager *SGuestManager) AllowListItems(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool {
if query.Contains("host") || query.Contains("wire") || query.Contains("zone") {
if !userCred.IsSystemAdmin() {
if !userCred.IsAdminAllow(consts.GetServiceType(), manager.KeywordPlural(), policy.PolicyActionList) {
return false
}
}
@@ -919,7 +921,7 @@ func (self *SGuest) getExtBandwidth() int {
func (self *SGuest) GetCustomizeColumns(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) *jsonutils.JSONDict {
extra := self.SVirtualResourceBase.GetCustomizeColumns(ctx, userCred, query)
if userCred.IsSystemAdmin() {
if userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionGet) {
host := self.GetHost()
if host != nil {
extra.Add(jsonutils.NewString(host.Name), "host")
@@ -1012,7 +1014,7 @@ func (self *SGuest) GetExtraDetails(ctx context.Context, userCred mcclient.Token
if metaData, err := self.GetAllMetadata(userCred); err == nil {
extra.Add(jsonutils.Marshal(metaData), "metadata")
}
if userCred.IsSystemAdmin() {
if userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionGet) {
host := self.GetHost()
if host != nil {
extra.Add(jsonutils.NewString(host.GetName()), "host")
@@ -2211,10 +2213,10 @@ func (self *SGuest) AllowDeleteItem(ctx context.Context, userCred mcclient.Token
overridePendingDelete = jsonutils.QueryBoolean(data, "override_pending_delete", false)
purge = jsonutils.QueryBoolean(data, "purge", false)
}
if (overridePendingDelete || purge) && !userCred.IsSystemAdmin() {
if (overridePendingDelete || purge) && !userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionDelete) {
return false
}
return self.IsOwner(userCred)
return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionDelete)
}
func (self *SGuest) CustomizeDelete(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) error {
pkg/compute/models/helper.go
+3 -1
View File
@@ -10,8 +10,10 @@ import (
"yunion.io/x/log"
"yunion.io/x/pkg/utils"
"yunion.io/x/onecloud/pkg/cloudcommon/consts"
"yunion.io/x/onecloud/pkg/cloudcommon/db"
"yunion.io/x/onecloud/pkg/cloudcommon/db/taskman"
"yunion.io/x/onecloud/pkg/cloudcommon/policy"
"yunion.io/x/onecloud/pkg/httperrors"
"yunion.io/x/onecloud/pkg/mcclient"
)
@@ -47,7 +49,7 @@ func ValidateScheduleCreateData(ctx context.Context, userCred mcclient.TokenCred
// base validate_create_data
if (data.Contains("prefer_baremetal") || data.Contains("prefer_host")) && hypervisor != HYPERVISOR_CONTAINER {
if !userCred.IsSystemAdmin() {
if !userCred.IsAdminAllow(consts.GetServiceType(), GuestManager.KeywordPlural(), policy.PolicyActionPerform, "assign-host") {
return nil, httperrors.NewNotSufficientPrivilegeError("Only system admin can specify preferred host")
}
bmName, _ := data.GetString("prefer_host")
pkg/compute/models/hostjoints.go
+9 -7
View File
@@ -6,7 +6,9 @@ import (
"yunion.io/x/jsonutils"
"yunion.io/x/onecloud/pkg/mcclient"
"yunion.io/x/onecloud/pkg/cloudcommon/consts"
"yunion.io/x/onecloud/pkg/cloudcommon/db"
"yunion.io/x/onecloud/pkg/cloudcommon/policy"
)
type SHostJointsManager struct {
@@ -31,29 +33,29 @@ type SHostJointsBase struct {
}
func (manager *SHostJointsManager) AllowListItems(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool {
return userCred.IsSystemAdmin()
return userCred.IsAdminAllow(consts.GetServiceType(), manager.KeywordPlural(), policy.PolicyActionList)
}
func (manager *SHostJointsManager) AllowCreateItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
return userCred.IsSystemAdmin()
return userCred.IsAdminAllow(consts.GetServiceType(), manager.KeywordPlural(), policy.PolicyActionCreate)
}
func (manager *SHostJointsManager) AllowListDescendent(ctx context.Context, userCred mcclient.TokenCredential, model db.IStandaloneModel, query jsonutils.JSONObject) bool {
return userCred.IsSystemAdmin()
return userCred.IsAdminAllow(consts.GetServiceType(), manager.KeywordPlural(), policy.PolicyActionList)
}
func (manager *SHostJointsManager) AllowAttach(ctx context.Context, userCred mcclient.TokenCredential, master db.IStandaloneModel, slave db.IStandaloneModel) bool {
return userCred.IsSystemAdmin()
return userCred.IsAdminAllow(consts.GetServiceType(), manager.KeywordPlural(), policy.PolicyActionDelete)
}
func (self *SHostJointsBase) AllowGetDetails(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool {
return userCred.IsSystemAdmin()
return userCred.IsAdminAllow(consts.GetServiceType(), self.GetModelManager().KeywordPlural(), policy.PolicyActionGet)
}
func (self *SHostJointsBase) AllowUpdateItem(ctx context.Context, userCred mcclient.TokenCredential) bool {
return userCred.IsSystemAdmin()
return userCred.IsAdminAllow(consts.GetServiceType(), self.GetModelManager().KeywordPlural(), policy.PolicyActionUpdate)
}
func (self *SHostJointsBase) AllowDeleteItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
return userCred.IsSystemAdmin()
return userCred.IsAdminAllow(consts.GetServiceType(), self.GetModelManager().KeywordPlural(), policy.PolicyActionDelete)
}
pkg/compute/models/hosts.go
+32 -25
View File
@@ -20,9 +20,11 @@ import (
"yunion.io/x/pkg/utils"
"yunion.io/x/sqlchemy"
"yunion.io/x/onecloud/pkg/cloudcommon/consts"
"yunion.io/x/onecloud/pkg/cloudcommon/db"
"yunion.io/x/onecloud/pkg/cloudcommon/db/lockman"
"yunion.io/x/onecloud/pkg/cloudcommon/db/taskman"
"yunion.io/x/onecloud/pkg/cloudcommon/policy"
"yunion.io/x/onecloud/pkg/cloudprovider"
"yunion.io/x/onecloud/pkg/compute/baremetal"
"yunion.io/x/onecloud/pkg/compute/options"
@@ -142,7 +144,7 @@ type SHost struct {
// Status string = Column(VARCHAR(16, charset='ascii'), nullable=False, default=baremetalstatus.INIT) # status
HostStatus string `width:"16" charset:"ascii" nullable:"false" default:"offline" list:"admin"` // Column(VARCHAR(16, charset='ascii'), nullable=False, server_default=HOST_OFFLINE, default=HOST_OFFLINE)
ZoneId string `width:"128" charset:"ascii" nullable:"false" list:"admin" create:"admin_required"` // Column(VARCHAR(ID_LENGTH, charset='ascii'), nullable=False)
ZoneId string `width:"128" charset:"ascii" nullable:"false" list:"admin" create:"admin_optional"` // Column(VARCHAR(ID_LENGTH, charset='ascii'), nullable=False)
HostType string `width:"36" charset:"ascii" nullable:"false" list:"admin" update:"admin" create:"admin_required"` // Column(VARCHAR(36, charset='ascii'), nullable=False)
@@ -160,15 +162,16 @@ func (manager *SHostManager) GetContextManager() []db.IModelManager {
}
func (manager *SHostManager) AllowCreateItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
zoneId, err := data.GetString("zone_id")
// allow create host without zone_id
/*zoneId, err := data.GetString("zone_id")
if err != nil {
return false
}
_, err = ZoneManager.FetchById(zoneId)
if err != nil {
return false
}
return userCred.IsSystemAdmin()
}*/
return userCred.IsAdminAllow(consts.GetServiceType(), manager.KeywordPlural(), policy.PolicyActionCreate)
}
func (manager *SHostManager) ListItemFilter(ctx context.Context, q *sqlchemy.SQuery, userCred mcclient.TokenCredential, query jsonutils.JSONObject) (*sqlchemy.SQuery, error) {
@@ -261,6 +264,9 @@ func (manager *SHostManager) ListItemFilter(ctx context.Context, q *sqlchemy.SQu
}
func (self *SHost) GetZone() *SZone {
if len(self.ZoneId) == 0 {
return nil
}
zone, _ := ZoneManager.FetchById(self.ZoneId)
if zone != nil {
return zone.(*SZone)
@@ -1781,7 +1787,7 @@ func (self *SHost) GetExtraDetails(ctx context.Context, userCred mcclient.TokenC
}
func (self *SHost) AllowGetDetailsVnc(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool {
return userCred.IsSystemAdmin()
return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionGet, "vnc")
}
func (self *SHost) GetDetailsVnc(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) (jsonutils.JSONObject, error) {
@@ -1796,7 +1802,7 @@ func (self *SHost) GetDetailsVnc(ctx context.Context, userCred mcclient.TokenCre
}
func (self *SHost) AllowGetDetailsIpmi(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool {
return userCred.IsSystemAdmin()
return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionGet, "ipmi")
}
func (self *SHost) GetDetailsIpmi(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) (jsonutils.JSONObject, error) {
@@ -2087,7 +2093,7 @@ func (self *SHost) AllowPerformStart(ctx context.Context,
userCred mcclient.TokenCredential,
query jsonutils.JSONObject,
data jsonutils.JSONObject) bool {
return userCred.IsSystemAdmin()
return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "start")
}
func (self *SHost) PerformStart(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject,
@@ -2122,7 +2128,7 @@ func (self *SHost) AllowPerformStop(ctx context.Context,
userCred mcclient.TokenCredential,
query jsonutils.JSONObject,
data jsonutils.JSONObject) bool {
return userCred.IsSystemAdmin()
return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "stop")
}
func (self *SHost) PerformStop(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject,
@@ -2172,7 +2178,8 @@ func (self *SHost) AllowPerformMaintenance(ctx context.Context,
userCred mcclient.TokenCredential,
query jsonutils.JSONObject,
data jsonutils.JSONObject) bool {
return userCred.IsSystemAdmin()
return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "maintenance")
}
func (self *SHost) PerformMaintenance(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) {
@@ -2211,7 +2218,7 @@ func (self *SHost) AllowPerformUnmaintenance(ctx context.Context,
userCred mcclient.TokenCredential,
query jsonutils.JSONObject,
data jsonutils.JSONObject) bool {
return userCred.IsSystemAdmin()
return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "unmaintenance")
}
func (self *SHost) PerformUnmaintenance(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) {
@@ -2273,7 +2280,7 @@ func (self *SHost) AllowPerformOffline(ctx context.Context,
userCred mcclient.TokenCredential,
query jsonutils.JSONObject,
data jsonutils.JSONObject) bool {
return userCred.IsSystemAdmin()
return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "offline")
}
func (self *SHost) PerformOffline(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) {
@@ -2292,7 +2299,7 @@ func (self *SHost) AllowPerformOnline(ctx context.Context,
userCred mcclient.TokenCredential,
query jsonutils.JSONObject,
data jsonutils.JSONObject) bool {
return userCred.IsSystemAdmin()
return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "online")
}
func (self *SHost) PerformOnline(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) {
@@ -2325,7 +2332,7 @@ func (self *SHost) AllowPerformPing(ctx context.Context,
userCred mcclient.TokenCredential,
query jsonutils.JSONObject,
data jsonutils.JSONObject) bool {
return userCred.IsSystemAdmin()
return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "ping")
}
func (self *SHost) PerformPing(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) {
@@ -2352,7 +2359,7 @@ func (self *SHost) AllowPerformPrepare(ctx context.Context,
userCred mcclient.TokenCredential,
query jsonutils.JSONObject,
data jsonutils.JSONObject) bool {
return userCred.IsSystemAdmin()
return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "prepare")
}
func (self *SHost) PerformPrepare(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) {
@@ -2388,7 +2395,7 @@ func (self *SHost) AllowPerformAddNetif(ctx context.Context,
userCred mcclient.TokenCredential,
query jsonutils.JSONObject,
data jsonutils.JSONObject) bool {
return userCred.IsSystemAdmin()
return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "add-netif")
}
func (self *SHost) PerformAddNetif(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) {
@@ -2540,7 +2547,7 @@ func (self *SHost) AllowPerformEnableNetif(ctx context.Context,
userCred mcclient.TokenCredential,
query jsonutils.JSONObject,
data jsonutils.JSONObject) bool {
return userCred.IsSystemAdmin()
return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "enable-netif")
}
func (self *SHost) PerformEnableNetif(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) {
@@ -2614,7 +2621,7 @@ func (self *SHost) AllowPerformDisableNetif(ctx context.Context,
userCred mcclient.TokenCredential,
query jsonutils.JSONObject,
data jsonutils.JSONObject) bool {
return userCred.IsSystemAdmin()
return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "disable-netif")
}
func (self *SHost) PerformDisableNetif(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) {
@@ -2668,7 +2675,7 @@ func (self *SHost) AllowPerformRemoveNetif(ctx context.Context,
userCred mcclient.TokenCredential,
query jsonutils.JSONObject,
data jsonutils.JSONObject) bool {
return userCred.IsSystemAdmin()
return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "remove-netif")
}
func (self *SHost) PerformRemoveNetif(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) {
@@ -2722,7 +2729,7 @@ func (self *SHost) AllowPerformSyncstatus(ctx context.Context,
userCred mcclient.TokenCredential,
query jsonutils.JSONObject,
data jsonutils.JSONObject) bool {
return userCred.IsSystemAdmin()
return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "syncstatus")
}
func (self *SHost) PerformSyncstatus(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) {
@@ -2734,7 +2741,7 @@ func (self *SHost) AllowPerformReset(ctx context.Context,
userCred mcclient.TokenCredential,
query jsonutils.JSONObject,
data jsonutils.JSONObject) bool {
return userCred.IsSystemAdmin()
return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "reset")
}
func (self *SHost) PerformReset(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) {
@@ -2764,7 +2771,7 @@ func (self *SHost) AllowPerformRemoveAllNetifs(ctx context.Context,
userCred mcclient.TokenCredential,
query jsonutils.JSONObject,
data jsonutils.JSONObject) bool {
return userCred.IsSystemAdmin()
return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "remove-all-netifs")
}
func (self *SHost) PerformRemoveAllNetifs(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) {
@@ -2781,7 +2788,7 @@ func (self *SHost) AllowPerformDisable(ctx context.Context,
userCred mcclient.TokenCredential,
query jsonutils.JSONObject,
data jsonutils.JSONObject) bool {
return userCred.IsSystemAdmin()
return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "disable")
}
func (self *SHost) PerformDisable(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) {
@@ -2804,7 +2811,7 @@ func (self *SHost) AllowPerformCacheImage(ctx context.Context,
userCred mcclient.TokenCredential,
query jsonutils.JSONObject,
data jsonutils.JSONObject) bool {
return userCred.IsSystemAdmin()
return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "cache-image")
}
func (self *SHost) PerformCacheImage(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) {
@@ -2836,7 +2843,7 @@ func (self *SHost) AllowPerformConvertHypervisor(ctx context.Context,
userCred mcclient.TokenCredential,
query jsonutils.JSONObject,
data jsonutils.JSONObject) bool {
return userCred.IsSystemAdmin()
return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "convert-hypervisor")
}
func (self *SHost) isAlterNameUnique(name string) bool {
@@ -2902,7 +2909,7 @@ func (self *SHost) AllowPerformUndoConvert(ctx context.Context,
userCred mcclient.TokenCredential,
query jsonutils.JSONObject,
data jsonutils.JSONObject) bool {
return userCred.IsSystemAdmin()
return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "undo-convert")
}
func (self *SHost) PerformUndoConvert(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) {
pkg/compute/models/inframanagers.go
+7 -5
View File
@@ -3,6 +3,8 @@ package models
import (
"context"
"yunion.io/x/jsonutils"
"yunion.io/x/onecloud/pkg/cloudcommon/consts"
"yunion.io/x/onecloud/pkg/cloudcommon/policy"
"yunion.io/x/onecloud/pkg/mcclient"
)
@@ -13,21 +15,21 @@ type SInfrastructure struct {
}
func (self *SInfrastructureManager) AllowListItems(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool {
return userCred.IsSystemAdmin()
return userCred.IsAdminAllow(consts.GetServiceType(), "*", policy.PolicyActionList)
}
func (self *SInfrastructureManager) AllowCreateItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
return userCred.IsSystemAdmin()
return userCred.IsAdminAllow(consts.GetServiceType(), "*", policy.PolicyActionCreate)
}
func (self *SInfrastructure) AllowGetDetails(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool {
return userCred.IsSystemAdmin()
return userCred.IsAdminAllow(consts.GetServiceType(), "*", policy.PolicyActionGet)
}
func (self *SInfrastructure) AllowUpdateItem(ctx context.Context, userCred mcclient.TokenCredential) bool {
return userCred.IsSystemAdmin()
return userCred.IsAdminAllow(consts.GetServiceType(), "*", policy.PolicyActionUpdate)
}
func (self *SInfrastructure) AllowDeleteItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
return userCred.IsSystemAdmin()
return userCred.IsAdminAllow(consts.GetServiceType(), "*", policy.PolicyActionDelete)
}
pkg/compute/models/isolated_devices.go
+4 -2
View File
@@ -7,7 +7,9 @@ import (
"yunion.io/x/jsonutils"
"yunion.io/x/log"
"yunion.io/x/onecloud/pkg/cloudcommon/consts"
"yunion.io/x/onecloud/pkg/cloudcommon/db"
"yunion.io/x/onecloud/pkg/cloudcommon/policy"
"yunion.io/x/onecloud/pkg/httperrors"
"yunion.io/x/onecloud/pkg/mcclient"
"yunion.io/x/pkg/util/regutils"
@@ -80,7 +82,7 @@ type SIsolatedDevice struct {
func (manager *SIsolatedDeviceManager) AllowListItems(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool {
host, _ := query.GetString("host")
if len(host) > 0 && !userCred.IsSystemAdmin() {
if len(host) > 0 && !userCred.IsAdminAllow(consts.GetServiceType(), manager.KeywordPlural(), policy.PolicyActionList) {
return false
}
return true
@@ -92,7 +94,7 @@ func (manager *SIsolatedDeviceManager) ExtraSearchConditions(ctx context.Context
}
func (manager *SIsolatedDeviceManager) AllowCreateItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
return userCred.IsSystemAdmin()
return userCred.IsAdminAllow(consts.GetServiceType(), manager.KeywordPlural(), policy.PolicyActionCreate)
}
func (manager *SIsolatedDeviceManager) ListItemFilter(ctx context.Context, q *sqlchemy.SQuery, userCred mcclient.TokenCredential, query jsonutils.JSONObject) (*sqlchemy.SQuery, error) {
pkg/compute/models/keypairs.go
+7 -5
View File
@@ -8,7 +8,9 @@ import (
"yunion.io/x/sqlchemy"
"golang.org/x/crypto/ssh"
"yunion.io/x/onecloud/pkg/cloudcommon/consts"
"yunion.io/x/onecloud/pkg/cloudcommon/db"
"yunion.io/x/onecloud/pkg/cloudcommon/policy"
"yunion.io/x/onecloud/pkg/httperrors"
"yunion.io/x/onecloud/pkg/mcclient"
"yunion.io/x/onecloud/pkg/util/seclib2"
@@ -47,7 +49,7 @@ func (manager *SKeypairManager) ListItemFilter(ctx context.Context, q *sqlchemy.
if err != nil {
return nil, err
}
if userCred.IsSystemAdmin() && jsonutils.QueryBoolean(query, "admin", false) {
if jsonutils.QueryBoolean(query, "admin", false) && userCred.IsAdminAllow(consts.GetServiceType(), manager.KeywordPlural(), policy.PolicyActionList) {
user, _ := query.GetString("user")
if len(user) > 0 {
uc, _ := db.UserCacheManager.FetchUserByIdOrName(user)
@@ -71,7 +73,7 @@ func (self *SKeypair) IsOwner(userCred mcclient.TokenCredential) bool {
}
func (self *SKeypair) AllowGetDetails(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool {
return self.IsOwner(userCred) || userCred.IsSystemAdmin()
return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionGet)
}
func (self *SKeypair) GetCustomizeColumns(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) *jsonutils.JSONDict {
@@ -85,7 +87,7 @@ func (self *SKeypair) GetExtraDetails(ctx context.Context, userCred mcclient.Tok
extra := self.SStandaloneResourceBase.GetExtraDetails(ctx, userCred, query)
extra.Add(jsonutils.NewInt(int64(len(self.PrivateKey))), "private_key_len")
extra.Add(jsonutils.NewInt(int64(self.GetLinkedGuestsCount())), "linked_guest_count")
if userCred.IsSystemAdmin() {
if userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionGet) {
extra.Add(jsonutils.NewString(self.OwnerId), "owner_id")
uc, _ := db.UserCacheManager.FetchUserById(self.OwnerId)
if uc != nil {
@@ -100,11 +102,11 @@ func (manager *SKeypairManager) AllowCreateItem(ctx context.Context, userCred mc
}
func (self *SKeypair) AllowUpdateItem(ctx context.Context, userCred mcclient.TokenCredential) bool {
return self.IsOwner(userCred)
return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionUpdate)
}
func (self *SKeypair) AllowDeleteItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
return self.IsOwner(userCred) || userCred.IsSystemAdmin()
return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionDelete)
}
func (self *SKeypair) GetLinkedGuestsCount() int {
pkg/compute/models/loadbalanceracls.go
+3 -1
View File
@@ -12,7 +12,9 @@ import (
"yunion.io/x/pkg/gotypes"
"yunion.io/x/sqlchemy"
"yunion.io/x/onecloud/pkg/cloudcommon/consts"
"yunion.io/x/onecloud/pkg/cloudcommon/db"
"yunion.io/x/onecloud/pkg/cloudcommon/policy"
"yunion.io/x/onecloud/pkg/cloudcommon/validators"
"yunion.io/x/onecloud/pkg/httperrors"
"yunion.io/x/onecloud/pkg/mcclient"
@@ -136,7 +138,7 @@ func (lbacl *SLoadbalancerAcl) ValidateUpdateData(ctx context.Context, userCred
}
func (lbacl *SLoadbalancerAcl) AllowPerformPatch(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data *jsonutils.JSONDict) bool {
return lbacl.IsOwner(userCred) || userCred.IsSystemAdmin()
return lbacl.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), lbacl.KeywordPlural(), policy.PolicyActionPerform, "patch")
}
// PerformPatch patches acl entries by adding then deleting the specified acls.
pkg/compute/models/loadbalanceragents.go
+5 -3
View File
@@ -12,7 +12,9 @@ import (
"yunion.io/x/log"
"yunion.io/x/pkg/gotypes"
"yunion.io/x/onecloud/pkg/cloudcommon/consts"
"yunion.io/x/onecloud/pkg/cloudcommon/db"
"yunion.io/x/onecloud/pkg/cloudcommon/policy"
"yunion.io/x/onecloud/pkg/cloudcommon/validators"
"yunion.io/x/onecloud/pkg/httperrors"
"yunion.io/x/onecloud/pkg/mcclient"
@@ -354,7 +356,7 @@ func (man *SLoadbalancerAgentManager) CleanPendingDeleteLoadbalancers(ctx contex
}
func (man *SLoadbalancerAgentManager) AllowCreateItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
return userCred.IsSystemAdmin()
return userCred.IsAdminAllow(consts.GetServiceType(), man.KeywordPlural(), policy.PolicyActionCreate)
}
func (lbagent *SLoadbalancerAgent) ValidateUpdateData(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data *jsonutils.JSONDict) (*jsonutils.JSONDict, error) {
@@ -400,7 +402,7 @@ func (lbagent *SLoadbalancerAgent) ValidateUpdateData(ctx context.Context, userC
}
func (lbagent *SLoadbalancerAgent) AllowPerformHb(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data *jsonutils.JSONDict) bool {
return userCred.IsSystemAdmin()
return userCred.IsAdminAllow(consts.GetServiceType(), lbagent.KeywordPlural(), policy.PolicyActionPerform, "hb")
}
func (lbagent *SLoadbalancerAgent) PerformHb(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data *jsonutils.JSONDict) (*jsonutils.JSONDict, error) {
@@ -426,7 +428,7 @@ func (lbagent *SLoadbalancerAgent) IsActive() bool {
}
func (lbagent *SLoadbalancerAgent) AllowPerformParamsPatch(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data *jsonutils.JSONDict) bool {
return userCred.IsSystemAdmin()
return userCred.IsAdminAllow(consts.GetServiceType(), lbagent.KeywordPlural(), policy.PolicyActionPerform, "params-patch")
}
func (lbagent *SLoadbalancerAgent) PerformParamsPatch(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data *jsonutils.JSONDict) (*jsonutils.JSONDict, error) {
pkg/compute/models/loadbalancerbackends.go
+3 -1
View File
@@ -7,7 +7,9 @@ import (
"yunion.io/x/jsonutils"
"yunion.io/x/sqlchemy"
"yunion.io/x/onecloud/pkg/cloudcommon/consts"
"yunion.io/x/onecloud/pkg/cloudcommon/db"
"yunion.io/x/onecloud/pkg/cloudcommon/policy"
"yunion.io/x/onecloud/pkg/cloudcommon/validators"
"yunion.io/x/onecloud/pkg/mcclient"
)
@@ -137,7 +139,7 @@ func (man *SLoadbalancerBackendManager) ValidateCreateData(ctx context.Context,
}
baseName = guest.Name
case LB_BACKEND_HOST:
if !userCred.IsSystemAdmin() {
if !userCred.IsAdminAllow(consts.GetServiceType(), man.KeywordPlural(), policy.PolicyActionCreate) {
return nil, fmt.Errorf("only sysadmin can specify host as backend")
}
backendV := validators.NewModelIdOrNameValidator("backend", "host", userCred.GetProjectId())
pkg/compute/models/loadbalancerlistenerrules.go
+3 -1
View File
@@ -8,7 +8,9 @@ import (
"yunion.io/x/log"
"yunion.io/x/sqlchemy"
"yunion.io/x/onecloud/pkg/cloudcommon/consts"
"yunion.io/x/onecloud/pkg/cloudcommon/db"
"yunion.io/x/onecloud/pkg/cloudcommon/policy"
"yunion.io/x/onecloud/pkg/cloudcommon/validators"
"yunion.io/x/onecloud/pkg/httperrors"
"yunion.io/x/onecloud/pkg/mcclient"
@@ -126,7 +128,7 @@ func (man *SLoadbalancerListenerRuleManager) ValidateCreateData(ctx context.Cont
}
func (lbr *SLoadbalancerListenerRule) AllowPerformStatus(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
return lbr.IsOwner(userCred) || userCred.IsSystemAdmin()
return lbr.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), lbr.KeywordPlural(), policy.PolicyActionPerform, "status")
}
func (lbr *SLoadbalancerListenerRule) ValidateUpdateData(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data *jsonutils.JSONDict) (*jsonutils.JSONDict, error) {
pkg/compute/models/loadbalancerlisteners.go
+3 -1
View File
@@ -9,8 +9,10 @@ import (
"yunion.io/x/log"
"yunion.io/x/sqlchemy"
"yunion.io/x/onecloud/pkg/cloudcommon/consts"
"yunion.io/x/onecloud/pkg/cloudcommon/db"
"yunion.io/x/onecloud/pkg/cloudcommon/db/lockman"
"yunion.io/x/onecloud/pkg/cloudcommon/policy"
"yunion.io/x/onecloud/pkg/cloudcommon/validators"
"yunion.io/x/onecloud/pkg/httperrors"
"yunion.io/x/onecloud/pkg/mcclient"
@@ -295,7 +297,7 @@ func (man *SLoadbalancerListenerManager) validateAcl(aclStatusV *validators.Vali
}
func (lblis *SLoadbalancerListener) AllowPerformStatus(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
return lblis.IsOwner(userCred) || userCred.IsSystemAdmin()
return lblis.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), lblis.KeywordPlural(), policy.PolicyActionPerform, "status")
}
func (lblis *SLoadbalancerListener) ValidateUpdateData(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data *jsonutils.JSONDict) (*jsonutils.JSONDict, error) {
pkg/compute/models/loadbalancers.go
+3 -1
View File
@@ -9,8 +9,10 @@ import (
"yunion.io/x/pkg/util/netutils"
"yunion.io/x/sqlchemy"
"yunion.io/x/onecloud/pkg/cloudcommon/consts"
"yunion.io/x/onecloud/pkg/cloudcommon/db"
"yunion.io/x/onecloud/pkg/cloudcommon/db/lockman"
"yunion.io/x/onecloud/pkg/cloudcommon/policy"
"yunion.io/x/onecloud/pkg/cloudcommon/validators"
"yunion.io/x/onecloud/pkg/httperrors"
"yunion.io/x/onecloud/pkg/mcclient"
@@ -132,7 +134,7 @@ func (man *SLoadbalancerManager) ValidateCreateData(ctx context.Context, userCre
}
func (lb *SLoadbalancer) AllowPerformStatus(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
return lb.IsOwner(userCred) || userCred.IsSystemAdmin()
return lb.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), lb.KeywordPlural(), policy.PolicyActionPerform, "status")
}
func (lb *SLoadbalancer) PostCreate(ctx context.Context, userCred mcclient.TokenCredential, ownerProjId string, query jsonutils.JSONObject, data jsonutils.JSONObject) {
pkg/compute/models/networks.go
+11 -8
View File
@@ -17,8 +17,10 @@ import (
"yunion.io/x/pkg/utils"
"yunion.io/x/sqlchemy"
"yunion.io/x/onecloud/pkg/cloudcommon/consts"
"yunion.io/x/onecloud/pkg/cloudcommon/db"
"yunion.io/x/onecloud/pkg/cloudcommon/db/taskman"
"yunion.io/x/onecloud/pkg/cloudcommon/policy"
"yunion.io/x/onecloud/pkg/cloudprovider"
"yunion.io/x/onecloud/pkg/compute/options"
"yunion.io/x/onecloud/pkg/httperrors"
@@ -134,7 +136,7 @@ func (self *SNetwork) GetVpc() *SVpc {
}
func (manager *SNetworkManager) AllowCreateItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
return userCred.IsSystemAdmin()
return userCred.IsAdminAllow(consts.GetServiceType(), manager.KeywordPlural(), policy.PolicyActionCreate)
}
func (self *SNetwork) ValidateDeleteCondition(ctx context.Context) error {
@@ -627,7 +629,7 @@ func (manager *SNetworkManager) allNetworksQ(rangeObj db.IStandaloneModel) *sqlc
func (manager *SNetworkManager) totalPortCountQ(userCred mcclient.TokenCredential, rangeObj db.IStandaloneModel) *sqlchemy.SQuery {
q := manager.allNetworksQ(rangeObj)
networks := manager.Query().SubQuery()
if userCred != nil && !userCred.IsSystemAdmin() {
if userCred != nil && !userCred.IsAdminAllow(consts.GetServiceType(), manager.KeywordPlural(), policy.PolicyActionList) {
q = q.Filter(sqlchemy.OR(
sqlchemy.Equals(networks.Field("tenant_id"), userCred.GetProjectId()),
sqlchemy.IsTrue(networks.Field("is_public"))))
@@ -759,7 +761,8 @@ func isValidNetworkInfo(userCred mcclient.TokenCredential, netConfig *SNetworkCo
return httperrors.NewInputParameterError("Address %s not in range", netConfig.Address)
}
if netConfig.Reserved {
if !userCred.IsSystemAdmin() {
// the privilege to access reserved ip
if !userCred.IsAdminAllow(consts.GetServiceType(), ReservedipManager.KeywordPlural(), policy.PolicyActionGet) {
return httperrors.NewForbiddenError("Only system admin allowed to use reserved ip")
}
if ReservedipManager.GetReservedIP(net, netConfig.Address) == nil {
@@ -876,7 +879,7 @@ func (self *SNetwork) GetCustomizeColumns(ctx context.Context, userCred mcclient
}
func (self *SNetwork) AllowPerformReserveIp(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
return self.IsOwner(userCred)
return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "reserve-ip")
}
func (self *SNetwork) PerformReserveIp(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) {
@@ -903,7 +906,7 @@ func (self *SNetwork) PerformReserveIp(ctx context.Context, userCred mcclient.To
}
func (self *SNetwork) AllowPerformReleaseReservedIp(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
return self.IsOwner(userCred)
return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "release-reserved-ip")
}
func (self *SNetwork) PerformReleaseReservedIp(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) {
@@ -920,7 +923,7 @@ func (self *SNetwork) PerformReleaseReservedIp(ctx context.Context, userCred mcc
}
func (self *SNetwork) AllowGetDetailsReservedIps(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool {
return self.IsOwner(userCred)
return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionGet, "reserved-ips")
}
func (self *SNetwork) GetDetailsReservedIps(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) (jsonutils.JSONObject, error) {
@@ -1211,7 +1214,7 @@ func isOverlapNetworks(nets []SNetwork, startIp netutils.IPV4Addr, endIp netutil
}
func (self *SNetwork) CustomizeCreate(ctx context.Context, userCred mcclient.TokenCredential, ownerProjId string, query jsonutils.JSONObject, data jsonutils.JSONObject) error {
if userCred.IsSystemAdmin() && ownerProjId == userCred.GetProjectId() {
if userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionCreate) && ownerProjId == userCred.GetProjectId() {
self.IsPublic = true
} else {
self.IsPublic = false
@@ -1396,7 +1399,7 @@ func (self *SNetwork) ValidateUpdateCondition(ctx context.Context) error {
}
func (self *SNetwork) AllowPerformPurge(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
return userCred.IsSystemAdmin()
return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionDelete)
}
func (self *SNetwork) PerformPurge(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) {
pkg/compute/models/reservedips.go
+3 -1
View File
@@ -6,7 +6,9 @@ import (
"yunion.io/x/jsonutils"
"yunion.io/x/log"
"yunion.io/x/onecloud/pkg/cloudcommon/consts"
"yunion.io/x/onecloud/pkg/cloudcommon/db"
"yunion.io/x/onecloud/pkg/cloudcommon/policy"
"yunion.io/x/onecloud/pkg/httperrors"
"yunion.io/x/onecloud/pkg/mcclient"
"yunion.io/x/sqlchemy"
@@ -39,7 +41,7 @@ type SReservedip struct {
}
func (manager *SReservedipManager) AllowListItems(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool {
return userCred.IsSystemAdmin()
return userCred.IsAdminAllow(consts.GetServiceType(), manager.KeywordPlural(), policy.PolicyActionList)
}
func (manager *SReservedipManager) AllowCreateItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
pkg/compute/models/schedpolicies.go
+3 -1
View File
@@ -7,7 +7,9 @@ import (
"database/sql"
"yunion.io/x/log"
"yunion.io/x/onecloud/pkg/cloudcommon/consts"
"yunion.io/x/onecloud/pkg/cloudcommon/db"
"yunion.io/x/onecloud/pkg/cloudcommon/policy"
"yunion.io/x/onecloud/pkg/httperrors"
"yunion.io/x/onecloud/pkg/mcclient"
"yunion.io/x/onecloud/pkg/util/conditionparser"
@@ -121,7 +123,7 @@ func (manager *SSchedpolicyManager) getAllEnabledPolicies() []SSchedpolicy {
}
func (self *SSchedpolicy) AllowPerformEvaluate(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
return userCred.IsSystemAdmin()
return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "evaluate")
}
func (self *SSchedpolicy) PerformEvaluate(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) {
pkg/compute/models/secgrouprules.go
+4 -2
View File
@@ -9,7 +9,9 @@ import (
"yunion.io/x/jsonutils"
"yunion.io/x/log"
"yunion.io/x/onecloud/pkg/cloudcommon/consts"
"yunion.io/x/onecloud/pkg/cloudcommon/db"
"yunion.io/x/onecloud/pkg/cloudcommon/policy"
"yunion.io/x/onecloud/pkg/httperrors"
"yunion.io/x/onecloud/pkg/mcclient"
"yunion.io/x/pkg/util/compare"
@@ -78,14 +80,14 @@ func (manager *SSecurityGroupRuleManager) AllowListItems(ctx context.Context, us
func (self *SSecurityGroupRule) AllowUpdateItem(ctx context.Context, userCred mcclient.TokenCredential) bool {
if secgroup := self.GetSecGroup(); secgroup != nil {
return secgroup.IsOwner(userCred)
return secgroup.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionUpdate)
}
return false
}
func (self *SSecurityGroupRule) AllowDeleteItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
if secgroup := self.GetSecGroup(); secgroup != nil {
return secgroup.IsOwner(userCred)
return secgroup.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionDelete)
}
return false
}
pkg/compute/models/snapshots.go
+8 -6
View File
@@ -11,8 +11,10 @@ import (
"yunion.io/x/pkg/util/compare"
"yunion.io/x/sqlchemy"
"yunion.io/x/onecloud/pkg/cloudcommon/consts"
"yunion.io/x/onecloud/pkg/cloudcommon/db"
"yunion.io/x/onecloud/pkg/cloudcommon/db/taskman"
"yunion.io/x/onecloud/pkg/cloudcommon/policy"
"yunion.io/x/onecloud/pkg/cloudprovider"
"yunion.io/x/onecloud/pkg/compute/options"
"yunion.io/x/onecloud/pkg/httperrors"
@@ -86,8 +88,8 @@ func ValidateSnapshotName(hypervisor, name, owner string) error {
return nil
}
func (self *SSnapshot) AllowListItems(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool {
return self.IsOwner(userCred)
func (self *SSnapshotManager) AllowListItems(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool {
return true
}
func (manager *SSnapshotManager) ListItemFilter(ctx context.Context, q *sqlchemy.SQuery, userCred mcclient.TokenCredential, query jsonutils.JSONObject) (*sqlchemy.SQuery, error) {
@@ -323,7 +325,7 @@ func (self *SSnapshotManager) CreateSnapshot(ctx context.Context, userCred mccli
}
func (self *SSnapshot) AllowDeleteItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
return self.IsOwner(userCred)
return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionDelete)
}
func (self *SSnapshot) StartSnapshotDeleteTask(ctx context.Context, userCred mcclient.TokenCredential, reloadDisk bool, parentTaskId string) error {
@@ -364,7 +366,7 @@ func (self *SSnapshot) CustomizeDelete(ctx context.Context, userCred mcclient.To
}
func (self *SSnapshot) AllowPerformDeleted(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
return self.IsOwner(userCred)
return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionDelete)
}
func (self *SSnapshot) PerformDeleted(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) {
@@ -401,7 +403,7 @@ func (self *SSnapshotManager) GetConvertSnapshot(deleteSnapshot *SSnapshot) (*SS
}
func (self *SSnapshotManager) AllowPerformDeleteDiskSnapshots(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
return userCred.IsAdmin()
return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "delete-disk-snapshots")
}
func (self *SSnapshotManager) PerformDeleteDiskSnapshots(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) {
@@ -586,7 +588,7 @@ func (self *SSnapshot) GetISnapshotRegion() (cloudprovider.ICloudRegion, error)
}
func (self *SSnapshot) AllowPerformPurge(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
return userCred.IsSystemAdmin()
return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionDelete)
}
func (self *SSnapshot) PerformPurge(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) {
pkg/compute/models/storagecachedimages.go
+3 -1
View File
@@ -11,8 +11,10 @@ import (
"yunion.io/x/pkg/utils"
"yunion.io/x/sqlchemy"
"yunion.io/x/onecloud/pkg/cloudcommon/consts"
"yunion.io/x/onecloud/pkg/cloudcommon/db"
"yunion.io/x/onecloud/pkg/cloudcommon/db/lockman"
"yunion.io/x/onecloud/pkg/cloudcommon/policy"
"yunion.io/x/onecloud/pkg/httperrors"
"yunion.io/x/onecloud/pkg/mcclient"
)
@@ -127,7 +129,7 @@ func (self *SStoragecachedimage) GetExtraDetails(ctx context.Context, userCred m
}
func (manager *SStoragecachedimageManager) AllowListDescendent(ctx context.Context, userCred mcclient.TokenCredential, model db.IStandaloneModel, query jsonutils.JSONObject) bool {
return userCred.IsSystemAdmin()
return userCred.IsAdminAllow(consts.GetServiceType(), manager.KeywordPlural(), policy.PolicyActionList)
}
func (self *SStoragecachedimage) GetCachedimage() *SCachedimage {
pkg/compute/models/storagecaches.go
+4 -2
View File
@@ -9,8 +9,10 @@ import (
"yunion.io/x/log"
"yunion.io/x/sqlchemy"
"yunion.io/x/onecloud/pkg/cloudcommon/consts"
"yunion.io/x/onecloud/pkg/cloudcommon/db"
"yunion.io/x/onecloud/pkg/cloudcommon/db/taskman"
"yunion.io/x/onecloud/pkg/cloudcommon/policy"
"yunion.io/x/onecloud/pkg/cloudprovider"
"yunion.io/x/onecloud/pkg/httperrors"
"yunion.io/x/onecloud/pkg/mcclient"
@@ -292,7 +294,7 @@ func (self *SStoragecache) ValidateDeleteCondition(ctx context.Context) error {
}
func (self *SStoragecache) AllowPerformUncacheImage(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
return userCred.IsSystemAdmin()
return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "uncache-image")
}
func (self *SStoragecache) PerformUncacheImage(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) {
@@ -329,7 +331,7 @@ func (self *SStoragecache) PerformUncacheImage(ctx context.Context, userCred mcc
}
func (self *SStoragecache) AllowPerformCacheImage(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
return userCred.IsSystemAdmin()
return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "cache-image")
}
func (self *SStoragecache) PerformCacheImage(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) {
pkg/compute/models/storages.go
+4 -2
View File
@@ -5,7 +5,9 @@ import (
"yunion.io/x/jsonutils"
"yunion.io/x/log"
"yunion.io/x/onecloud/pkg/cloudcommon/consts"
"yunion.io/x/onecloud/pkg/cloudcommon/db"
"yunion.io/x/onecloud/pkg/cloudcommon/policy"
"yunion.io/x/onecloud/pkg/cloudprovider"
"yunion.io/x/onecloud/pkg/compute/options"
"yunion.io/x/onecloud/pkg/httperrors"
@@ -692,7 +694,7 @@ func (self *SStorage) SetStoragecache(cache *SStoragecache) error {
}
func (self *SStorage) AllowPerformCacheImage(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
return userCred.IsSystemAdmin()
return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "cache-image")
}
func (self *SStorage) GetStoragecache() *SStoragecache {
@@ -714,7 +716,7 @@ func (self *SStorage) PerformCacheImage(ctx context.Context, userCred mcclient.T
}
func (self *SStorage) AllowPerformUncacheImage(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
return userCred.IsSystemAdmin()
return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "uncache-image")
}
func (self *SStorage) PerformUncacheImage(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) {
pkg/compute/models/vpcs.go
+3 -1
View File
@@ -11,8 +11,10 @@ import (
"yunion.io/x/pkg/util/netutils"
"yunion.io/x/sqlchemy"
"yunion.io/x/onecloud/pkg/cloudcommon/consts"
"yunion.io/x/onecloud/pkg/cloudcommon/db"
"yunion.io/x/onecloud/pkg/cloudcommon/db/taskman"
"yunion.io/x/onecloud/pkg/cloudcommon/policy"
"yunion.io/x/onecloud/pkg/cloudprovider"
"yunion.io/x/onecloud/pkg/httperrors"
"yunion.io/x/onecloud/pkg/mcclient"
@@ -456,7 +458,7 @@ func (self *SVpc) getIPRange() netutils.IPV4AddrRange {
}
func (self *SVpc) AllowPerformPurge(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
return userCred.IsSystemAdmin()
return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionDelete)
}
func (self *SVpc) PerformPurge(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) {
pkg/compute/specs/handler.go
+2 -1
View File
@@ -12,6 +12,7 @@ import (
"yunion.io/x/onecloud/pkg/appctx"
"yunion.io/x/onecloud/pkg/appsrv"
"yunion.io/x/onecloud/pkg/cloudcommon/policy"
"yunion.io/x/onecloud/pkg/compute/models"
"yunion.io/x/onecloud/pkg/httperrors"
"yunion.io/x/onecloud/pkg/mcclient"
@@ -42,7 +43,7 @@ func AddSpecHandler(prefix string, app *appsrv.Application) {
func processFilter(handleFunc specHandleFunc) appsrv.FilterHandler {
return func(ctx context.Context, w http.ResponseWriter, r *http.Request) {
userCred := auth.FetchUserCredential(ctx)
userCred := auth.FetchUserCredential(ctx, policy.FilterPolicyCredential)
query, err := jsonutils.ParseQueryString(r.URL.RawQuery)
if err != nil {
httperrors.GeneralServerError(w, err)
pkg/compute/sshkeys/handler.go
+6 -4
View File
@@ -9,7 +9,9 @@ import (
"yunion.io/x/jsonutils"
"yunion.io/x/onecloud/pkg/appctx"
"yunion.io/x/onecloud/pkg/appsrv"
"yunion.io/x/onecloud/pkg/cloudcommon/consts"
"yunion.io/x/onecloud/pkg/cloudcommon/db"
"yunion.io/x/onecloud/pkg/cloudcommon/policy"
"yunion.io/x/onecloud/pkg/httperrors"
"yunion.io/x/onecloud/pkg/mcclient"
"yunion.io/x/onecloud/pkg/mcclient/auth"
@@ -22,8 +24,8 @@ func AddSshKeysHandler(prefix string, app *appsrv.Application) {
func adminSshKeysHandler(ctx context.Context, w http.ResponseWriter, r *http.Request) {
publicOnly := false
userCred := auth.FetchUserCredential(ctx)
if !userCred.IsSystemAdmin() {
userCred := auth.FetchUserCredential(ctx, policy.FilterPolicyCredential)
if !userCred.IsAdminAllow(consts.GetServiceType(), "sshkeypairs", policy.PolicyActionGet) {
publicOnly = true
}
params := appctx.AppContextParams(ctx)
@@ -53,7 +55,7 @@ func adminSshKeysHandler(ctx context.Context, w http.ResponseWriter, r *http.Req
}
func sshKeysHandler(ctx context.Context, w http.ResponseWriter, r *http.Request) {
userCred := auth.FetchUserCredential(ctx)
userCred := auth.FetchUserCredential(ctx, policy.FilterPolicyCredential)
query, err := jsonutils.ParseQueryString(r.URL.RawQuery)
if err != nil {
httperrors.GeneralServerError(w, err)
@@ -67,7 +69,7 @@ func sshKeysHandler(ctx context.Context, w http.ResponseWriter, r *http.Request)
func sendSshKey(ctx context.Context, w http.ResponseWriter, userCred mcclient.TokenCredential, projectId string, isAdmin bool, publicOnly bool) {
var privKey, pubKey string
if isAdmin && userCred.IsSystemAdmin() {
if isAdmin && userCred.IsAdminAllow(consts.GetServiceType(), "sshkeypairs", policy.PolicyActionGet) {
privKey, pubKey, _ = GetSshAdminKeypair(ctx)
} else {
privKey, pubKey, _ = GetSshProjectKeypair(ctx, projectId)
pkg/compute/usages/handler.go
+2 -2
View File
@@ -75,7 +75,7 @@ func rangeObjHandler(
reporter objUsageFunc,
) appsrv.FilterHandler {
return func(ctx context.Context, w http.ResponseWriter, r *http.Request) {
userCred := auth.FetchUserCredential(ctx)
userCred := auth.FetchUserCredential(ctx, policy.FilterPolicyCredential)
obj, err := getRangeObj(ctx, manager, userCred)
if err != nil {
httperrors.NotFoundError(w, err.Error())
@@ -276,7 +276,7 @@ func ReportGeneralUsage(userCred mcclient.TokenCredential, rangeObj db.IStandalo
isAdmin = true
}
} else {
isAdmin = userCred.IsSystemAdmin()
isAdmin = userCred.IsAdminAllow(consts.GetServiceType(), "usages", policy.PolicyActionGet)
}
if isAdmin {
pkg/mcclient/auth/middleware.go
+6 -2
View File
@@ -53,10 +53,14 @@ func AuthenticateWithDelayDecision(f appsrv.FilterHandler, delayDecision bool) a
}
}
func FetchUserCredential(ctx context.Context) mcclient.TokenCredential {
func FetchUserCredential(ctx context.Context, filter func(mcclient.TokenCredential) mcclient.TokenCredential) mcclient.TokenCredential {
tokenValue := ctx.Value(AUTH_TOKEN)
if tokenValue != nil {
return tokenValue.(mcclient.TokenCredential)
token := tokenValue.(mcclient.TokenCredential)
if filter != nil {
token = filter(token)
}
return token
}
return nil
}
pkg/mcclient/modules/base.go
+1 -1
View File
@@ -32,7 +32,7 @@ func NewBaseManager(serviceType, endpointType, version string, columns, adminCol
func (this *BaseManager) GetColumns(session *mcclient.ClientSession) []string {
cols := this.columns
if session.IsSystemAdmin() && len(this.adminColumns) > 0 {
if session.HasSystemAdminPrivelege() && len(this.adminColumns) > 0 {
cols = append(cols, this.adminColumns...)
}
return cols
pkg/mcclient/session.go
+2 -3
View File
@@ -9,7 +9,6 @@ import (
"regexp"
"strings"
"time"
"yunion.io/x/jsonutils"
"yunion.io/x/onecloud/pkg/util/httputils"
"yunion.io/x/pkg/utils"
@@ -150,8 +149,8 @@ func (this *ClientSession) ParseJSONResponse(resp *http.Response, err error) (ht
return httputils.ParseJSONResponse(resp, err, this.client.debug)
}
func (this *ClientSession) IsSystemAdmin() bool {
return this.token.IsSystemAdmin()
func (this *ClientSession) HasSystemAdminPrivelege() bool {
return this.token.HasSystemAdminPrivelege()
}
func (this *ClientSession) GetRegion() string {
pkg/mcclient/token.go
+3 -2
View File
@@ -44,8 +44,9 @@ type TokenCredential interface {
GetExpires() time.Time
IsValid() bool
ValidDuration() time.Duration
IsAdmin() bool
IsSystemAdmin() bool
// IsAdmin() bool
HasSystemAdminPrivelege() bool
IsAdminAllow(service string, resource string, action string, extra ...string) bool
GetRegions() []string
GetServiceCatalog() IServiceCatalog
pkg/mcclient/token2.go
+5 -1
View File
@@ -130,10 +130,14 @@ func (this *TokenCredentialV2) GetRegions() []string {
return this.ServiceCatalog.getRegions()
}
func (this *TokenCredentialV2) IsSystemAdmin() bool {
func (this *TokenCredentialV2) HasSystemAdminPrivelege() bool {
return this.IsAdmin() && this.GetTenantName() == "system"
}
func (this *TokenCredentialV2) IsAdminAllow(service string, resource string, action string, extra ...string) bool {
return this.HasSystemAdminPrivelege()
}
func (this *TokenCredentialV2) GetServiceURL(service, region, zone, endpointType string) (string, error) {
return this.ServiceCatalog.GetServiceURL(service, region, zone, endpointType)
}
pkg/mcclient/token3.go
+5 -1
View File
@@ -135,10 +135,14 @@ func (this *TokenCredentialV3) IsAdmin() bool {
return false
}
func (this *TokenCredentialV3) IsSystemAdmin() bool {
func (this *TokenCredentialV3) HasSystemAdminPrivelege() bool {
return this.IsAdmin() && this.GetTenantName() == "system"
}
func (this *TokenCredentialV3) IsAdminAllow(service string, resource string, action string, extra ...string) bool {
return this.HasSystemAdminPrivelege()
}
func (this *TokenCredentialV3) GetRegions() []string {
return this.Token.Catalog.getRegions()
}
pkg/mcclient/tokensimple.go
+5 -1
View File
@@ -84,10 +84,14 @@ func (self *SSimpleToken) IsAdmin() bool {
return false
}
func (self *SSimpleToken) IsSystemAdmin() bool {
func (self *SSimpleToken) HasSystemAdminPrivelege() bool {
return self.IsAdmin() && self.Project == "system"
}
func (this *SSimpleToken) IsAdminAllow(service string, resource string, action string, extra ...string) bool {
return this.HasSystemAdminPrivelege()
}
func (self *SSimpleToken) GetRegions() []string {
return nil
}
pkg/webconsole/handlers.go
+3 -2
View File
@@ -17,6 +17,7 @@ import (
"yunion.io/x/onecloud/pkg/webconsole/command"
o "yunion.io/x/onecloud/pkg/webconsole/options"
"yunion.io/x/onecloud/pkg/webconsole/session"
"yunion.io/x/onecloud/pkg/cloudcommon/policy"
)
const (
@@ -102,7 +103,7 @@ type CloudEnv struct {
func fetchCloudEnv(ctx context.Context, w http.ResponseWriter, r *http.Request) (*CloudEnv, error) {
params, query, body := appsrv.FetchEnv(ctx, w, r)
userCred := auth.FetchUserCredential(ctx)
userCred := auth.FetchUserCredential(ctx, policy.FilterPolicyCredential)
if userCred == nil {
return nil, httperrors.NewUnauthorizedError("No token founded")
}
@@ -141,7 +142,7 @@ func handleK8sLog(ctx context.Context, w http.ResponseWriter, r *http.Request) {
}
func handleSshShell(ctx context.Context, w http.ResponseWriter, r *http.Request) {
userCred := auth.FetchUserCredential(ctx)
userCred := auth.FetchUserCredential(ctx, policy.FilterPolicyCredential)
env, err := fetchCloudEnv(ctx, w, r)
if err != nil {
httperrors.GeneralServerError(w, err)
pkg/webconsole/service/service.go
+3
View File
@@ -15,6 +15,7 @@ import (
"yunion.io/x/onecloud/pkg/webconsole"
o "yunion.io/x/onecloud/pkg/webconsole/options"
"yunion.io/x/onecloud/pkg/webconsole/server"
"yunion.io/x/onecloud/pkg/cloudcommon/consts"
)
func ensureBinExists(binPath string) {
@@ -24,6 +25,8 @@ func ensureBinExists(binPath string) {
}
func StartService() {
consts.SetServiceType("webconsole")
cloudcommon.ParseOptions(&o.Options, &o.Options.Options, os.Args, "webconsole.conf")
if o.Options.ApiServer == "" {
pkg/yunionconf/models/parameters.go
+9 -7
View File
@@ -11,6 +11,8 @@ import (
"yunion.io/x/pkg/util/timeutils"
"yunion.io/x/pkg/utils"
"yunion.io/x/sqlchemy"
"yunion.io/x/onecloud/pkg/cloudcommon/consts"
"yunion.io/x/onecloud/pkg/cloudcommon/policy"
)
const (
@@ -72,7 +74,7 @@ func getNamespaceInContext(userCred mcclient.TokenCredential, query jsonutils.JS
func getNamespace(userCred mcclient.TokenCredential, query jsonutils.JSONObject, data *jsonutils.JSONDict) (string, string, error) {
var namespace, namespace_id string
if userCred.IsSystemAdmin() {
if userCred.IsAdminAllow(consts.GetServiceType(), ParameterManager.KeywordPlural(), policy.PolicyActionGet) {
if name, nameId, e := getNamespaceInContext(userCred, query, data); e != nil {
return "", "", e
} else {
@@ -92,7 +94,7 @@ func (manager *SParameterManager) AllowListItems(ctx context.Context, userCred m
return true
}
return userCred.IsSystemAdmin()
return userCred.IsAdminAllow(consts.GetServiceType(), manager.KeywordPlural(), policy.PolicyActionList)
}
func (manager *SParameterManager) AllowCreateItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
@@ -100,7 +102,7 @@ func (manager *SParameterManager) AllowCreateItem(ctx context.Context, userCred
return true
}
return userCred.IsSystemAdmin()
return userCred.IsAdminAllow(consts.GetServiceType(), manager.KeywordPlural(), policy.PolicyActionCreate)
}
func (manager *SParameterManager) ValidateCreateData(ctx context.Context, userCred mcclient.TokenCredential, ownerProjId string, query jsonutils.JSONObject, data *jsonutils.JSONDict) (*jsonutils.JSONDict, error) {
@@ -146,7 +148,7 @@ func (manager *SParameterManager) FilterByName(q *sqlchemy.SQuery, name string)
}
func (manager *SParameterManager) ListItemFilter(ctx context.Context, q *sqlchemy.SQuery, userCred mcclient.TokenCredential, query jsonutils.JSONObject) (*sqlchemy.SQuery, error) {
if userCred.IsSystemAdmin() {
if userCred.IsAdminAllow(consts.GetServiceType(), manager.KeywordPlural(), policy.PolicyActionList) {
if id, _ := query.GetString("namespace_id"); len(id) > 0 {
q = q.Equals("namespace_id", id)
} else if id, _ := query.GetString("service_id"); len(id) > 0 {
@@ -171,7 +173,7 @@ func (model *SParameter) IsOwner(userCred mcclient.TokenCredential) bool {
}
func (model *SParameter) AllowUpdateItem(ctx context.Context, userCred mcclient.TokenCredential) bool {
return model.IsOwner(userCred) || userCred.IsSystemAdmin()
return model.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), model.KeywordPlural(), policy.PolicyActionUpdate)
}
func (model *SParameter) ValidateUpdateData(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data *jsonutils.JSONDict) (*jsonutils.JSONDict, error) {
@@ -191,7 +193,7 @@ func (model *SParameter) ValidateUpdateData(ctx context.Context, userCred mcclie
}
func (model *SParameter) AllowDeleteItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
return model.IsOwner(userCred) || userCred.IsSystemAdmin()
return model.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), model.KeywordPlural(), policy.PolicyActionDelete)
}
func (model *SParameter) CustomizeDelete(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) error {
@@ -211,5 +213,5 @@ func (model *SParameter) Delete(ctx context.Context, userCred mcclient.TokenCred
}
func (model *SParameter) AllowGetDetails(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool {
return model.IsOwner(userCred) || userCred.IsSystemAdmin()
return model.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), model.KeywordPlural(), policy.PolicyActionGet)
}
pkg/yunionconf/service/service.go
+2
View File
@@ -16,6 +16,8 @@ import (
)
func StartService() {
consts.SetServiceType("yunionconf")
cloudcommon.ParseOptions(&options.Options, &options.Options.Options, os.Args, "yunionconf.conf")
cloudcommon.InitAuth(&options.Options.Options, func() {
log.Infof("Auth complete!!")