opensource/cloudpods
3
0
Fork 0
mirror of https://github.com/yunionio/cloudpods.git synced 2026-09-24 16:03:43 +08:00
Code Issues Packages Projects Releases Wiki Activity

1.

Browse Source 
取消userCred.IsSystemAdmin()，在使用policy的应用中，通过userCred.IsAdminAllow判断是否是管理员且具备相应的权限。获取token时，需要传入policy.FilterPolicyCredential，将普通userCred转换成支持rbac的userCred
2. 在应用启动时候，必须设置 SetServiceType，否则退出
This commit is contained in:
Qiu Jian
2018-11-30 23:00:11 +08:00
parent bfed7c25c3
commit bc02b3b433
65 changed files with 516 additions and 232 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/cloudcommon/db/taskman/tasks.go
+4 -2
View File
@@ -18,9 +18,11 @@ import (
"yunion.io/x/pkg/utils"
"yunion.io/x/sqlchemy"
"yunion.io/x/onecloud/pkg/cloudcommon/consts"
"yunion.io/x/onecloud/pkg/cloudcommon/db"
"yunion.io/x/onecloud/pkg/cloudcommon/db/lockman"
"yunion.io/x/onecloud/pkg/cloudcommon/db/quotas"
"yunion.io/x/onecloud/pkg/cloudcommon/policy"
)
const (
@@ -70,7 +72,7 @@ type STask struct {
}
func (manager *STaskManager) AllowListItems(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool {
return userCred.IsSystemAdmin()
return true
}
func (manager *STaskManager) AllowCreateItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
@@ -115,7 +117,7 @@ func (manager *STaskManager) FilterByOwner(q *sqlchemy.SQuery, owner string) *sq
}
func (self *STask) AllowGetDetails(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool {
return userCred.IsSystemAdmin() || userCred.GetProjectId() == self.UserCred.GetProjectId()
return userCred.IsAdminAllow(consts.GetServiceType(), self.GetModelManager().KeywordPlural(), policy.PolicyActionGet) || userCred.GetProjectId() == self.UserCred.GetProjectId()
}
func (self *STask) AllowUpdateItem(ctx context.Context, userCred mcclient.TokenCredential) bool {