From bc02b3b433c56af54fee254bc6aec3c4fef019bb Mon Sep 17 00:00:00 2001 From: Qiu Jian Date: Fri, 30 Nov 2018 23:00:11 +0800 Subject: [PATCH 01/15] =?UTF-8?q?1.=20=E5=8F=96=E6=B6=88userCred.IsSystemA?= =?UTF-8?q?dmin()=EF=BC=8C=E5=9C=A8=E4=BD=BF=E7=94=A8policy=E7=9A=84?= =?UTF-8?q?=E5=BA=94=E7=94=A8=E4=B8=AD=EF=BC=8C=E9=80=9A=E8=BF=87userCred.?= =?UTF-8?q?IsAdminAllow=E5=88=A4=E6=96=AD=E6=98=AF=E5=90=A6=E6=98=AF?= =?UTF-8?q?=E7=AE=A1=E7=90=86=E5=91=98=E4=B8=94=E5=85=B7=E5=A4=87=E7=9B=B8?= =?UTF-8?q?=E5=BA=94=E7=9A=84=E6=9D=83=E9=99=90=E3=80=82=E8=8E=B7=E5=8F=96?= =?UTF-8?q?token=E6=97=B6=EF=BC=8C=E9=9C=80=E8=A6=81=E4=BC=A0=E5=85=A5poli?= =?UTF-8?q?cy.FilterPolicyCredential=EF=BC=8C=E5=B0=86=E6=99=AE=E9=80=9Aus?= =?UTF-8?q?erCred=E8=BD=AC=E6=8D=A2=E6=88=90=E6=94=AF=E6=8C=81rbac?= =?UTF-8?q?=E7=9A=84userCred=202.=20=E5=9C=A8=E5=BA=94=E7=94=A8=E5=90=AF?= =?UTF-8?q?=E5=8A=A8=E6=97=B6=E5=80=99=EF=BC=8C=E5=BF=85=E9=A1=BB=E8=AE=BE?= =?UTF-8?q?=E7=BD=AE=20SetServiceType=EF=BC=8C=E5=90=A6=E5=88=99=E9=80=80?= =?UTF-8?q?=E5=87=BA?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- pkg/cloudcommon/auth.go | 3 +- pkg/cloudcommon/db/db_dispatcher.go | 18 +-- pkg/cloudcommon/db/enabledstatusstandalone.go | 6 +- pkg/cloudcommon/db/interface.go | 4 +- pkg/cloudcommon/db/jointbase.go | 6 +- pkg/cloudcommon/db/metadata.go | 8 +- pkg/cloudcommon/db/modelbase.go | 8 +- pkg/cloudcommon/db/opslog.go | 6 +- pkg/cloudcommon/db/quotas/handler.go | 14 +- pkg/cloudcommon/db/sharablevirtual.go | 8 +- pkg/cloudcommon/db/standalone.go | 10 +- pkg/cloudcommon/db/statusstandalone.go | 4 +- pkg/cloudcommon/db/taskman/tasks.go | 6 +- pkg/cloudcommon/db/virtualjointbase.go | 12 +- pkg/cloudcommon/db/virtualresource.go | 26 ++-- pkg/cloudcommon/options.go | 4 + pkg/cloudcommon/policy/policy.go | 10 +- pkg/cloudcommon/policy/token.go | 145 ++++++++++++++++++ pkg/compute/capabilities/handler.go | 3 +- pkg/compute/models/baremetalagents.go | 10 +- pkg/compute/models/cachedimages.go | 4 +- pkg/compute/models/cloudaccounts.go | 10 +- pkg/compute/models/cloudproviders.go | 8 +- pkg/compute/models/cloudregions.go | 4 +- pkg/compute/models/disks.go | 16 +- pkg/compute/models/dnsrecords.go | 10 +- pkg/compute/models/dynamicschedtags.go | 4 +- pkg/compute/models/elasticips.go | 12 +- pkg/compute/models/guest_actions.go | 74 ++++----- pkg/compute/models/guests.go | 12 +- pkg/compute/models/helper.go | 4 +- pkg/compute/models/hostjoints.go | 16 +- pkg/compute/models/hosts.go | 57 ++++--- pkg/compute/models/inframanagers.go | 12 +- pkg/compute/models/isolated_devices.go | 6 +- pkg/compute/models/keypairs.go | 12 +- pkg/compute/models/loadbalanceracls.go | 4 +- pkg/compute/models/loadbalanceragents.go | 8 +- pkg/compute/models/loadbalancerbackends.go | 4 +- .../models/loadbalancerlistenerrules.go | 4 +- pkg/compute/models/loadbalancerlisteners.go | 4 +- pkg/compute/models/loadbalancers.go | 4 +- pkg/compute/models/networks.go | 19 ++- pkg/compute/models/reservedips.go | 4 +- pkg/compute/models/schedpolicies.go | 4 +- pkg/compute/models/secgrouprules.go | 6 +- pkg/compute/models/snapshots.go | 14 +- pkg/compute/models/storagecachedimages.go | 4 +- pkg/compute/models/storagecaches.go | 6 +- pkg/compute/models/storages.go | 6 +- pkg/compute/models/vpcs.go | 4 +- pkg/compute/specs/handler.go | 3 +- pkg/compute/sshkeys/handler.go | 10 +- pkg/compute/usages/handler.go | 4 +- pkg/mcclient/auth/middleware.go | 8 +- pkg/mcclient/modules/base.go | 2 +- pkg/mcclient/session.go | 5 +- pkg/mcclient/token.go | 5 +- pkg/mcclient/token2.go | 6 +- pkg/mcclient/token3.go | 6 +- pkg/mcclient/tokensimple.go | 6 +- pkg/webconsole/handlers.go | 5 +- pkg/webconsole/service/service.go | 3 + pkg/yunionconf/models/parameters.go | 16 +- pkg/yunionconf/service/service.go | 2 + 65 files changed, 516 insertions(+), 232 deletions(-) create mode 100644 pkg/cloudcommon/policy/token.go diff --git a/pkg/cloudcommon/auth.go b/pkg/cloudcommon/auth.go index c9661ce977..fab8fa949c 100644 --- a/pkg/cloudcommon/auth.go +++ b/pkg/cloudcommon/auth.go @@ -3,13 +3,14 @@ package cloudcommon import ( "fmt" "os" - "time" + "yunion.io/x/onecloud/pkg/cloudcommon/policy" "yunion.io/x/onecloud/pkg/mcclient/auth" ) func InitAuth(options *Options, authComplete auth.AuthCompletedCallback) { + if len(options.AuthURL) == 0 { fmt.Println("Missing AuthURL") os.Exit(1) diff --git a/pkg/cloudcommon/db/db_dispatcher.go b/pkg/cloudcommon/db/db_dispatcher.go index c2d72e15f2..70ce2f8c91 100644 --- a/pkg/cloudcommon/db/db_dispatcher.go +++ b/pkg/cloudcommon/db/db_dispatcher.go @@ -65,7 +65,7 @@ func (dispatcher *DBModelDispatcher) Filter(f appsrv.FilterHandler) appsrv.Filte } func fetchUserCredential(ctx context.Context) mcclient.TokenCredential { - token := auth.FetchUserCredential(ctx) + token := auth.FetchUserCredential(ctx, policy.FilterPolicyCredential) if token == nil && !consts.IsRbacEnabled() { log.Fatalf("user token credential not found?") } @@ -113,7 +113,7 @@ func listFields(manager IModelManager, userCred mcclient.TokenCredential) []stri if !utils.IsInStringArray(list, []string{"user", "admin", ""}) { log.Warningf("Invalid list value %s for field %s", list, col.Name()) } - if list == "user" || (list == "admin" && userCred.IsSystemAdmin()) { + if list == "user" || (list == "admin" && userCred.IsAdminAllow(consts.GetServiceType(), manager.KeywordPlural(), policy.PolicyActionList)) { ret = append(ret, col.Name()) } } @@ -127,7 +127,7 @@ func searchFields(manager IModelManager, userCred mcclient.TokenCredential) []st tags := col.Tags() list := tags["list"] search := tags["search"] - if list == "user" || search == "user" || ((list == "admin" || search == "admin") && userCred.IsSystemAdmin()) { + if list == "user" || search == "user" || ((list == "admin" || search == "admin") && userCred.IsAdminAllow(consts.GetServiceType(), manager.KeywordPlural(), policy.PolicyActionList)) { ret = append(ret, col.Name()) } } @@ -140,7 +140,7 @@ func getDetailFields(manager IModelManager, userCred mcclient.TokenCredential) [ tags := col.Tags() list := tags["list"] get := tags["get"] - if list == "user" || get == "user" || ((list == "admin" || get == "admin") && userCred.IsSystemAdmin()) { + if list == "user" || get == "user" || ((list == "admin" || get == "admin") && userCred.IsAdminAllow(consts.GetServiceType(), manager.KeywordPlural(), policy.PolicyActionGet)) { ret = append(ret, col.Name()) } } @@ -152,7 +152,7 @@ func createRequireFields(manager IModelManager, userCred mcclient.TokenCredentia for _, col := range manager.TableSpec().Columns() { tags := col.Tags() create, _ := tags["create"] - if create == "required" || (create == "admin_required" && userCred.IsSystemAdmin()) { + if create == "required" || (create == "admin_required" && userCred.IsAdminAllow(consts.GetServiceType(), manager.KeywordPlural(), policy.PolicyActionCreate)) { ret = append(ret, col.Name()) } } @@ -166,7 +166,7 @@ func createFields(manager IModelManager, userCred mcclient.TokenCredential) []st tags := col.Tags() create, _ := tags["create"] update := tags["update"] - if update == "user" || (update == "admin" && userCred.IsSystemAdmin()) || create == "required" || create == "optional" || ((create == "admin_required" || create == "admin_optional") && userCred.IsSystemAdmin()) { + if update == "user" || (update == "admin" && userCred.IsAdminAllow(consts.GetServiceType(), manager.KeywordPlural(), policy.PolicyActionCreate)) || create == "required" || create == "optional" || ((create == "admin_required" || create == "admin_optional") && userCred.IsAdminAllow(consts.GetServiceType(), manager.KeywordPlural(), policy.PolicyActionCreate)) { ret = append(ret, col.Name()) } } @@ -179,7 +179,7 @@ func updateFields(manager IModelManager, userCred mcclient.TokenCredential) []st for _, col := range manager.TableSpec().Columns() { tags := col.Tags() update := tags["update"] - if update == "user" || (update == "admin" && userCred.IsSystemAdmin()) { + if update == "user" || (update == "admin" && userCred.IsAdminAllow(consts.GetServiceType(), manager.KeywordPlural(), policy.PolicyActionUpdate)) { ret = append(ret, col.Name()) } } @@ -315,7 +315,7 @@ func query2List(manager IModelManager, ctx context.Context, userCred mcclient.To } listF := listFields(manager, userCred) fieldFilter := jsonutils.GetQueryStringArray(query, "field") - if len(fieldFilter) > 0 && userCred.IsSystemAdmin() { + if len(fieldFilter) > 0 && userCred.IsAdminAllow(consts.GetServiceType(), manager.KeywordPlural(), policy.PolicyActionList) { // only sysadmin can specify list Fields listF = fieldFilter } @@ -735,7 +735,7 @@ func fetchOwnerProjectId(ctx context.Context, manager IModelManager, userCred mc isAllow = true } } else { - isAllow = userCred.IsSystemAdmin() + isAllow = userCred.IsAdminAllow(consts.GetServiceType(), policy.PolicyDelegation, "") } if !isAllow { return "", httperrors.NewForbiddenError("Delegation not allowed") diff --git a/pkg/cloudcommon/db/enabledstatusstandalone.go b/pkg/cloudcommon/db/enabledstatusstandalone.go index 1528c09200..ad6da79d6f 100644 --- a/pkg/cloudcommon/db/enabledstatusstandalone.go +++ b/pkg/cloudcommon/db/enabledstatusstandalone.go @@ -5,6 +5,8 @@ import ( "yunion.io/x/jsonutils" "yunion.io/x/log" + "yunion.io/x/onecloud/pkg/cloudcommon/consts" + "yunion.io/x/onecloud/pkg/cloudcommon/policy" "yunion.io/x/onecloud/pkg/mcclient" ) @@ -23,7 +25,7 @@ func NewEnabledStatusStandaloneResourceBaseManager(dt interface{}, tableName str } func (self *SEnabledStatusStandaloneResourceBase) AllowPerformEnable(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return userCred.IsAdminAllow(consts.GetServiceType(), self.GetModelManager().KeywordPlural(), policy.PolicyActionPerform, "enable") } func (self *SEnabledStatusStandaloneResourceBase) PerformEnable(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -42,7 +44,7 @@ func (self *SEnabledStatusStandaloneResourceBase) PerformEnable(ctx context.Cont } func (self *SEnabledStatusStandaloneResourceBase) AllowPerformDisable(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return userCred.IsAdminAllow(consts.GetServiceType(), self.GetModelManager().KeywordPlural(), policy.PolicyActionPerform, "disable") } func (self *SEnabledStatusStandaloneResourceBase) PerformDisable(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { diff --git a/pkg/cloudcommon/db/interface.go b/pkg/cloudcommon/db/interface.go index e63c2ac02e..b42c522bb9 100644 --- a/pkg/cloudcommon/db/interface.go +++ b/pkg/cloudcommon/db/interface.go @@ -69,6 +69,8 @@ type IModel interface { GetName() string + KeywordPlural() string + GetModelManager() IModelManager SetModelManager(IModelManager) @@ -164,7 +166,7 @@ type IVirtualModel interface { IStandaloneModel IsOwner(userCred mcclient.TokenCredential) bool - IsAdmin(userCred mcclient.TokenCredential) bool + // IsAdmin(userCred mcclient.TokenCredential) bool } type ISharableVirtualModelManager interface { diff --git a/pkg/cloudcommon/db/jointbase.go b/pkg/cloudcommon/db/jointbase.go index 6dcf2e3c97..14094ae5e4 100644 --- a/pkg/cloudcommon/db/jointbase.go +++ b/pkg/cloudcommon/db/jointbase.go @@ -8,6 +8,8 @@ import ( "yunion.io/x/jsonutils" "yunion.io/x/log" + "yunion.io/x/onecloud/pkg/cloudcommon/consts" + "yunion.io/x/onecloud/pkg/cloudcommon/policy" "yunion.io/x/onecloud/pkg/mcclient" "yunion.io/x/pkg/util/reflectutils" "yunion.io/x/sqlchemy" @@ -191,7 +193,7 @@ func (self *SJointResourceBase) AllowGetJointDetails(ctx context.Context, userCr master := item.Master() switch master.(type) { case IVirtualModel: - return master.(IVirtualModel).IsOwner(userCred) + return master.(IVirtualModel).IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), master.KeywordPlural(), policy.PolicyActionGet) default: // case item implemented customized AllowGetDetails, eg hostjoints return item.AllowGetDetails(ctx, userCred, query) } @@ -201,7 +203,7 @@ func (self *SJointResourceBase) AllowUpdateJointItem(ctx context.Context, userCr master := item.Master() switch master.(type) { case IVirtualModel: - return master.(IVirtualModel).IsOwner(userCred) + return master.(IVirtualModel).IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), master.KeywordPlural(), policy.PolicyActionUpdate) default: // case item implemented customized AllowGetDetails, eg hostjoints return item.AllowUpdateItem(ctx, userCred) } diff --git a/pkg/cloudcommon/db/metadata.go b/pkg/cloudcommon/db/metadata.go index 5c0c98206d..88463b21f9 100644 --- a/pkg/cloudcommon/db/metadata.go +++ b/pkg/cloudcommon/db/metadata.go @@ -11,7 +11,9 @@ import ( "yunion.io/x/onecloud/pkg/mcclient" "yunion.io/x/pkg/util/stringutils" + "yunion.io/x/onecloud/pkg/cloudcommon/consts" "yunion.io/x/onecloud/pkg/cloudcommon/db/lockman" + "yunion.io/x/onecloud/pkg/cloudcommon/policy" ) const ( @@ -65,7 +67,7 @@ raise Exception('get_object_idstr: failed to generate obj ID') return idstr */ func (manager *SMetadataManager) GetStringValue(model IModel, key string, userCred mcclient.TokenCredential) string { - if strings.HasPrefix(key, SYSTEM_ADMIN_PREFIX) && (userCred == nil || !userCred.IsSystemAdmin()) { + if strings.HasPrefix(key, SYSTEM_ADMIN_PREFIX) && (userCred == nil || !userCred.IsAdminAllow(consts.GetServiceType(), model.GetModelManager().KeywordPlural(), policy.PolicyActionGet, "metadata")) { return "" } idStr := GetObjectIdstr(model) @@ -78,7 +80,7 @@ func (manager *SMetadataManager) GetStringValue(model IModel, key string, userCr } func (manager *SMetadataManager) GetJsonValue(model IModel, key string, userCred mcclient.TokenCredential) jsonutils.JSONObject { - if strings.HasPrefix(key, SYSTEM_ADMIN_PREFIX) && (userCred == nil || !userCred.IsSystemAdmin()) { + if strings.HasPrefix(key, SYSTEM_ADMIN_PREFIX) && (userCred == nil || !userCred.IsAdminAllow(consts.GetServiceType(), model.GetModelManager().KeywordPlural(), policy.PolicyActionGet, "metadata")) { return nil } idStr := GetObjectIdstr(model) @@ -194,7 +196,7 @@ func (manager *SMetadataManager) GetAll(obj IModel, keys []string, userCred mccl for _, rec := range records { if len(rec.Value) > 0 { if strings.HasPrefix(rec.Key, SYSTEM_ADMIN_PREFIX) { - if userCred != nil && userCred.IsSystemAdmin() { + if userCred != nil && userCred.IsAdminAllow(consts.GetServiceType(), obj.GetModelManager().KeywordPlural(), policy.PolicyActionGet, "metadata") { key := rec.Key[len(SYSTEM_ADMIN_PREFIX):] ret[key] = rec.Value } diff --git a/pkg/cloudcommon/db/modelbase.go b/pkg/cloudcommon/db/modelbase.go index d4c9a704a9..bd5db2cdb8 100644 --- a/pkg/cloudcommon/db/modelbase.go +++ b/pkg/cloudcommon/db/modelbase.go @@ -6,6 +6,8 @@ import ( "fmt" "yunion.io/x/jsonutils" + "yunion.io/x/onecloud/pkg/cloudcommon/consts" + "yunion.io/x/onecloud/pkg/cloudcommon/policy" "yunion.io/x/onecloud/pkg/mcclient" "yunion.io/x/sqlchemy" ) @@ -151,7 +153,7 @@ func (manager *SModelBaseManager) PerformAction(ctx context.Context, userCred mc } func (manager *SModelBaseManager) AllowPerformCheckCreateData(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return userCred.IsAdminAllow(consts.GetServiceType(), manager.KeywordPlural(), policy.PolicyActionPerform, "check-create-data") } func (manager *SModelBaseManager) InitializeData() error { @@ -178,6 +180,10 @@ func (model *SModelBase) Keyword() string { return model.GetModelManager().Keyword() } +func (model *SModelBase) KeywordPlural() string { + return model.GetModelManager().KeywordPlural() +} + func (model *SModelBase) GetName() string { return "" } diff --git a/pkg/cloudcommon/db/opslog.go b/pkg/cloudcommon/db/opslog.go index 35ef9c13e2..456c617697 100644 --- a/pkg/cloudcommon/db/opslog.go +++ b/pkg/cloudcommon/db/opslog.go @@ -9,6 +9,8 @@ import ( "yunion.io/x/jsonutils" "yunion.io/x/log" + "yunion.io/x/onecloud/pkg/cloudcommon/consts" + "yunion.io/x/onecloud/pkg/cloudcommon/policy" "yunion.io/x/onecloud/pkg/mcclient" "yunion.io/x/onecloud/pkg/util/logclient" "yunion.io/x/pkg/util/stringutils" @@ -293,7 +295,7 @@ func (manager *SOpsLogManager) ListItemFilter(ctx context.Context, q *sqlchemy.S queryDict.RemoveIgnoreCase("action") q = q.Filter(sqlchemy.In(q.Field("action"), action)) } - if !userCred.IsSystemAdmin() { + if !userCred.IsAdminAllow(consts.GetServiceType(), manager.KeywordPlural(), policy.PolicyActionList) { q = q.Filter(sqlchemy.OR(sqlchemy.AND(sqlchemy.IsNotNull(q.Field("owner_tenant_id")), sqlchemy.Equals(q.Field("owner_tenant_id"), userCred.GetProjectId())), sqlchemy.Equals(q.Field("tenant_id"), userCred.GetProjectId()))) } since, _ := query.GetTime("since") @@ -324,7 +326,7 @@ func (manager *SOpsLogManager) AllowCreateItem(ctx context.Context, userCred mcc } func (self *SOpsLog) AllowGetDetails(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() || userCred.GetProjectId() == self.ProjectId || userCred.GetProjectId() == self.OwnerProjectId + return userCred.IsAdminAllow(consts.GetServiceType(), self.GetModelManager().KeywordPlural(), policy.PolicyActionGet) || userCred.GetProjectId() == self.ProjectId || userCred.GetProjectId() == self.OwnerProjectId } func (self *SOpsLog) AllowUpdateItem(ctx context.Context, userCred mcclient.TokenCredential) bool { diff --git a/pkg/cloudcommon/db/quotas/handler.go b/pkg/cloudcommon/db/quotas/handler.go index ed27a32b72..4729168e4f 100644 --- a/pkg/cloudcommon/db/quotas/handler.go +++ b/pkg/cloudcommon/db/quotas/handler.go @@ -72,7 +72,7 @@ func queryQuota(ctx context.Context, projectId string) (*jsonutils.JSONDict, err } func getQuotaHanlder(ctx context.Context, w http.ResponseWriter, r *http.Request) { - userCred := auth.FetchUserCredential(ctx) + userCred := auth.FetchUserCredential(ctx, policy.FilterPolicyCredential) params := appctx.AppContextParams(ctx) projectId := params[""] @@ -93,7 +93,7 @@ func getQuotaHanlder(ctx context.Context, w http.ResponseWriter, r *http.Request policy.PolicyDelegation, policy.PolicyActionGet) isAllow = result == rbacutils.AdminAllow } else { - isAllow = userCred.IsSystemAdmin() + isAllow = userCred.IsAdminAllow(consts.GetServiceType(), policy.PolicyDelegation, policy.PolicyActionGet) } if !isAllow { httperrors.ForbiddenError(w, "not allow to delegate query quota") @@ -133,14 +133,15 @@ func getQuotaHanlder(ctx context.Context, w http.ResponseWriter, r *http.Request } func setQuotaHanlder(ctx context.Context, w http.ResponseWriter, r *http.Request) { - userCred := auth.FetchUserCredential(ctx) + userCred := auth.FetchUserCredential(ctx, policy.FilterPolicyCredential) var isAllow bool if consts.IsRbacEnabled() { isAllow = policy.PolicyManager.Allow(true, userCred, consts.GetServiceType(), "quotas", policy.PolicyActionUpdate) == rbacutils.AdminAllow } else { - isAllow = userCred.IsSystemAdmin() + isAllow = userCred.IsAdminAllow(consts.GetServiceType(), + "quotas", policy.PolicyActionUpdate) } if !isAllow { httperrors.ForbiddenError(w, "not allow to set quota") @@ -196,14 +197,15 @@ func setQuotaHanlder(ctx context.Context, w http.ResponseWriter, r *http.Request } func checkQuotaHanlder(ctx context.Context, w http.ResponseWriter, r *http.Request) { - userCred := auth.FetchUserCredential(ctx) + userCred := auth.FetchUserCredential(ctx, policy.FilterPolicyCredential) isAllow := false if consts.IsRbacEnabled() { isAllow = policy.PolicyManager.Allow(true, userCred, consts.GetServiceType(), policy.PolicyDelegation, policy.PolicyActionGet) == rbacutils.AdminAllow } else { - isAllow = userCred.IsSystemAdmin() + isAllow = userCred.IsAdminAllow(consts.GetServiceType(), + policy.PolicyDelegation, policy.PolicyActionGet) } if !isAllow { httperrors.ForbiddenError(w, "not allow to delegate check quota") diff --git a/pkg/cloudcommon/db/sharablevirtual.go b/pkg/cloudcommon/db/sharablevirtual.go index 8d1cf2db5f..d8c78a98df 100644 --- a/pkg/cloudcommon/db/sharablevirtual.go +++ b/pkg/cloudcommon/db/sharablevirtual.go @@ -4,6 +4,8 @@ import ( "context" "yunion.io/x/jsonutils" + "yunion.io/x/onecloud/pkg/cloudcommon/consts" + "yunion.io/x/onecloud/pkg/cloudcommon/policy" "yunion.io/x/onecloud/pkg/mcclient" "yunion.io/x/sqlchemy" ) @@ -30,7 +32,7 @@ func (manager *SSharableVirtualResourceBaseManager) FilterByOwner(q *sqlchemy.SQ } func (model *SSharableVirtualResourceBase) AllowGetDetails(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { - return model.IsOwner(userCred) || model.IsPublic + return model.IsOwner(userCred) || model.IsPublic || userCred.IsAdminAllow(consts.GetServiceType(), model.KeywordPlural(), policy.PolicyActionGet) } func (model *SSharableVirtualResourceBase) IsSharable() bool { @@ -38,11 +40,11 @@ func (model *SSharableVirtualResourceBase) IsSharable() bool { } func (model *SSharableVirtualResourceBase) AllowPerformPublic(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return userCred.IsAdminAllow(consts.GetServiceType(), model.GetModelManager().KeywordPlural(), policy.PolicyActionPerform, "public") } func (model *SSharableVirtualResourceBase) AllowPerformPrivate(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return userCred.IsAdminAllow(consts.GetServiceType(), model.GetModelManager().KeywordPlural(), policy.PolicyActionPerform, "private") } func (model *SSharableVirtualResourceBase) PerformPublic(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { diff --git a/pkg/cloudcommon/db/standalone.go b/pkg/cloudcommon/db/standalone.go index d1fd803ae7..9d8d11f080 100644 --- a/pkg/cloudcommon/db/standalone.go +++ b/pkg/cloudcommon/db/standalone.go @@ -7,6 +7,8 @@ import ( "yunion.io/x/jsonutils" "yunion.io/x/log" + "yunion.io/x/onecloud/pkg/cloudcommon/consts" + "yunion.io/x/onecloud/pkg/cloudcommon/policy" "yunion.io/x/onecloud/pkg/httperrors" "yunion.io/x/onecloud/pkg/mcclient" "yunion.io/x/pkg/util/regutils" @@ -147,7 +149,7 @@ func (model *SStandaloneResourceBase) GetMetadataJson(key string, userCred mccli } func (model *SStandaloneResourceBase) SetMetadata(ctx context.Context, key string, value interface{}, userCred mcclient.TokenCredential) error { - if Metadata.IsSystemAdminKey(key) && !userCred.IsSystemAdmin() { + if Metadata.IsSystemAdminKey(key) && !userCred.IsAdminAllow(consts.GetServiceType(), model.GetModelManager().KeywordPlural(), policy.PolicyActionPerform, "metadata") { return httperrors.NewNotSufficientPrivilegeError("cannot set system key") } return Metadata.SetValue(ctx, model, key, value, userCred) @@ -155,7 +157,7 @@ func (model *SStandaloneResourceBase) SetMetadata(ctx context.Context, key strin func (model *SStandaloneResourceBase) SetAllMetadata(ctx context.Context, dictstore map[string]interface{}, userCred mcclient.TokenCredential) error { for k := range dictstore { - if Metadata.IsSystemAdminKey(k) && !userCred.IsSystemAdmin() { + if Metadata.IsSystemAdminKey(k) && !userCred.IsAdminAllow(consts.GetServiceType(), model.GetModelManager().KeywordPlural(), policy.PolicyActionPerform, "metadata") { return httperrors.NewNotSufficientPrivilegeError(fmt.Sprintf("not allow to set system key %s", k)) } } @@ -175,7 +177,7 @@ func (model *SStandaloneResourceBase) GetAllMetadata(userCred mcclient.TokenCred } func (model *SStandaloneResourceBase) AllowGetDetailsMetadata(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return userCred.IsAdminAllow(consts.GetServiceType(), model.GetModelManager().KeywordPlural(), policy.PolicyActionGet, "metadata") } func (model *SStandaloneResourceBase) GetDetailsMetadata(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -188,7 +190,7 @@ func (model *SStandaloneResourceBase) GetDetailsMetadata(ctx context.Context, us } func (model *SStandaloneResourceBase) AllowPerformMetadata(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return userCred.IsAdminAllow(consts.GetServiceType(), model.GetModelManager().KeywordPlural(), policy.PolicyActionPerform, "metadata") } func (model *SStandaloneResourceBase) PerformMetadata(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { diff --git a/pkg/cloudcommon/db/statusstandalone.go b/pkg/cloudcommon/db/statusstandalone.go index 4304a37388..7f436d2c4c 100644 --- a/pkg/cloudcommon/db/statusstandalone.go +++ b/pkg/cloudcommon/db/statusstandalone.go @@ -6,6 +6,8 @@ import ( "strings" "yunion.io/x/jsonutils" + "yunion.io/x/onecloud/pkg/cloudcommon/consts" + "yunion.io/x/onecloud/pkg/cloudcommon/policy" "yunion.io/x/onecloud/pkg/mcclient" "yunion.io/x/onecloud/pkg/util/logclient" ) @@ -50,7 +52,7 @@ func (model *SStatusStandaloneResourceBase) SetStatus(userCred mcclient.TokenCre } func (model *SStatusStandaloneResourceBase) AllowPerformStatus(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return userCred.IsAdminAllow(consts.GetServiceType(), model.GetModelManager().KeywordPlural(), policy.PolicyActionPerform, "status") } func (model *SStatusStandaloneResourceBase) PerformStatus(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { diff --git a/pkg/cloudcommon/db/taskman/tasks.go b/pkg/cloudcommon/db/taskman/tasks.go index f16cc14387..177bb0a203 100644 --- a/pkg/cloudcommon/db/taskman/tasks.go +++ b/pkg/cloudcommon/db/taskman/tasks.go @@ -18,9 +18,11 @@ import ( "yunion.io/x/pkg/utils" "yunion.io/x/sqlchemy" + "yunion.io/x/onecloud/pkg/cloudcommon/consts" "yunion.io/x/onecloud/pkg/cloudcommon/db" "yunion.io/x/onecloud/pkg/cloudcommon/db/lockman" "yunion.io/x/onecloud/pkg/cloudcommon/db/quotas" + "yunion.io/x/onecloud/pkg/cloudcommon/policy" ) const ( @@ -70,7 +72,7 @@ type STask struct { } func (manager *STaskManager) AllowListItems(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return true } func (manager *STaskManager) AllowCreateItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { @@ -115,7 +117,7 @@ func (manager *STaskManager) FilterByOwner(q *sqlchemy.SQuery, owner string) *sq } func (self *STask) AllowGetDetails(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() || userCred.GetProjectId() == self.UserCred.GetProjectId() + return userCred.IsAdminAllow(consts.GetServiceType(), self.GetModelManager().KeywordPlural(), policy.PolicyActionGet) || userCred.GetProjectId() == self.UserCred.GetProjectId() } func (self *STask) AllowUpdateItem(ctx context.Context, userCred mcclient.TokenCredential) bool { diff --git a/pkg/cloudcommon/db/virtualjointbase.go b/pkg/cloudcommon/db/virtualjointbase.go index 23565cc777..5a0e571e5d 100644 --- a/pkg/cloudcommon/db/virtualjointbase.go +++ b/pkg/cloudcommon/db/virtualjointbase.go @@ -10,6 +10,8 @@ import ( "yunion.io/x/pkg/util/reflectutils" "yunion.io/x/sqlchemy" + "yunion.io/x/onecloud/pkg/cloudcommon/consts" + "yunion.io/x/onecloud/pkg/cloudcommon/policy" "yunion.io/x/onecloud/pkg/httperrors" "yunion.io/x/onecloud/pkg/mcclient" ) @@ -27,7 +29,7 @@ func NewVirtualJointResourceBaseManager(dt interface{}, tableName string, keywor } func (manager *SVirtualJointResourceBaseManager) AllowListItems(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { - if jsonutils.QueryBoolean(query, "admin", false) && !userCred.IsSystemAdmin() { + if jsonutils.QueryBoolean(query, "admin", false) && !userCred.IsAdminAllow(consts.GetServiceType(), manager.KeywordPlural(), policy.PolicyActionList) { return false } return true @@ -36,7 +38,7 @@ func (manager *SVirtualJointResourceBaseManager) AllowListItems(ctx context.Cont func (manager *SVirtualJointResourceBaseManager) AllowListDescendent(ctx context.Context, userCred mcclient.TokenCredential, master IStandaloneModel, query jsonutils.JSONObject) bool { masterVirtual := master.(IVirtualModel) - if masterVirtual.IsOwner(userCred) { + if masterVirtual.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), masterVirtual.KeywordPlural(), policy.PolicyActionList) { return true } return false @@ -62,12 +64,12 @@ func (manager *SVirtualJointResourceBaseManager) AllowAttach(ctx context.Context func (self *SVirtualJointResourceBase) AllowGetDetails(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { masterVirtual := self.Master().(IVirtualModel) - return masterVirtual.IsOwner(userCred) + return masterVirtual.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), masterVirtual.KeywordPlural(), policy.PolicyActionGet) } func (self *SVirtualJointResourceBase) AllowUpdateItem(ctx context.Context, userCred mcclient.TokenCredential) bool { masterVirtual := self.Master().(IVirtualModel) - return masterVirtual.IsOwner(userCred) + return masterVirtual.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), masterVirtual.KeywordPlural(), policy.PolicyActionUpdate) } func (manager *SVirtualJointResourceBaseManager) ListItemFilter(ctx context.Context, q *sqlchemy.SQuery, userCred mcclient.TokenCredential, query jsonutils.JSONObject) (*sqlchemy.SQuery, error) { @@ -96,7 +98,7 @@ func (manager *SVirtualJointResourceBaseManager) ListItemFilter(ctx context.Cont sqlchemy.IsFalse(masterTable.Field("deleted")))) q = q.Join(slaveTable, sqlchemy.AND(sqlchemy.Equals(slaveField, slaveTable.Field("id")), sqlchemy.IsFalse(slaveTable.Field("deleted")))) - if jsonutils.QueryBoolean(query, "admin", false) && userCred.IsSystemAdmin() { + if jsonutils.QueryBoolean(query, "admin", false) && userCred.IsAdminAllow(consts.GetServiceType(), manager.KeywordPlural(), policy.PolicyActionList) { isSystem := jsonutils.QueryBoolean(query, "system", false) if !isSystem { if len(slaveQueryId) == 0 { diff --git a/pkg/cloudcommon/db/virtualresource.go b/pkg/cloudcommon/db/virtualresource.go index 16a9b44572..a9e31f0263 100644 --- a/pkg/cloudcommon/db/virtualresource.go +++ b/pkg/cloudcommon/db/virtualresource.go @@ -12,7 +12,9 @@ import ( "yunion.io/x/pkg/utils" "yunion.io/x/sqlchemy" + "yunion.io/x/onecloud/pkg/cloudcommon/consts" "yunion.io/x/onecloud/pkg/cloudcommon/db/lockman" + "yunion.io/x/onecloud/pkg/cloudcommon/policy" "yunion.io/x/onecloud/pkg/httperrors" "yunion.io/x/onecloud/pkg/mcclient" ) @@ -38,12 +40,12 @@ type SVirtualResourceBase struct { } func (model *SVirtualResourceBase) IsOwner(userCred mcclient.TokenCredential) bool { - return userCred.IsSystemAdmin() || userCred.GetProjectId() == model.ProjectId + return userCred.GetProjectId() == model.ProjectId } -func (model *SVirtualResourceBase) IsAdmin(userCred mcclient.TokenCredential) bool { +/*func (model *SVirtualResourceBase) IsAdmin(userCred mcclient.TokenCredential) bool { return userCred.IsSystemAdmin() || (userCred.GetProjectId() == model.ProjectId && userCred.IsAdmin()) -} +}*/ func (model *SVirtualResourceBase) GetOwnerProjectId() string { return model.ProjectId @@ -111,7 +113,7 @@ func (manager *SVirtualResourceBaseManager) ListItemFilter(ctx context.Context, func (manager *SVirtualResourceBaseManager) ValidateCreateData(ctx context.Context, userCred mcclient.TokenCredential, ownerProjId string, query jsonutils.JSONObject, data *jsonutils.JSONDict) (*jsonutils.JSONDict, error) { isSystem, err := data.Bool("is_system") - if err == nil && isSystem && !userCred.IsSystemAdmin() { + if err == nil && isSystem && !userCred.IsAdminAllow(consts.GetServiceType(), manager.KeywordPlural(), policy.PolicyActionCreate) { return nil, httperrors.NewNotSufficientPrivilegeError("non-admin user not allowed to create system object") } return manager.SStandaloneResourceBaseManager.ValidateCreateData(ctx, userCred, ownerProjId, query, data) @@ -130,14 +132,14 @@ func (model *SVirtualResourceBase) CustomizeCreate(ctx context.Context, userCred func (manager *SVirtualResourceBaseManager) AllowListItems(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { isAdmin, err := query.Bool("admin") - if err == nil && isAdmin && !userCred.IsSystemAdmin() { + if err == nil && isAdmin && !userCred.IsAdminAllow(consts.GetServiceType(), manager.KeywordPlural(), policy.PolicyActionList) { return false } return true } func (model *SVirtualResourceBase) AllowGetDetails(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { - return model.IsOwner(userCred) + return model.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), model.KeywordPlural(), policy.PolicyActionGet) } func (manager *SVirtualResourceBaseManager) AllowCreateItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { @@ -145,19 +147,19 @@ func (manager *SVirtualResourceBaseManager) AllowCreateItem(ctx context.Context, } func (model *SVirtualResourceBase) AllowUpdateItem(ctx context.Context, userCred mcclient.TokenCredential) bool { - return model.IsOwner(userCred) + return model.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), model.KeywordPlural(), policy.PolicyActionUpdate) } func (model *SVirtualResourceBase) AllowDeleteItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return model.IsOwner(userCred) + return model.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), model.KeywordPlural(), policy.PolicyActionDelete) } func (model *SVirtualResourceBase) AllowGetDetailsMetadata(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { - return model.IsOwner(userCred) + return model.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), model.KeywordPlural(), policy.PolicyActionGet, "metadata") } func (model *SVirtualResourceBase) AllowPerformMetadata(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return model.IsOwner(userCred) + return model.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), model.KeywordPlural(), policy.PolicyActionPerform, "metadata") } func (model *SVirtualResourceBase) GetTenantCache(ctx context.Context) (*STenant, error) { @@ -166,7 +168,7 @@ func (model *SVirtualResourceBase) GetTenantCache(ctx context.Context) (*STenant } func (model *SVirtualResourceBase) getMoreDetails(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, extra *jsonutils.JSONDict) *jsonutils.JSONDict { - if userCred.IsSystemAdmin() { + if userCred.IsAdminAllow(consts.GetServiceType(), model.GetModelManager().KeywordPlural(), policy.PolicyActionGet) { // log.Debugf("GetCustomizeColumns") tobj, err := model.GetTenantCache(ctx) if err == nil { @@ -198,7 +200,7 @@ func (model *SVirtualResourceBase) GetExtraDetails(ctx context.Context, userCred } func (model *SVirtualResourceBase) AllowPerformChangeOwner(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return userCred.IsAdminAllow(consts.GetServiceType(), model.GetModelManager().KeywordPlural(), policy.PolicyActionPerform, "change-owner") } func (model *SVirtualResourceBase) PerformChangeOwner(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { diff --git a/pkg/cloudcommon/options.go b/pkg/cloudcommon/options.go index fa7730c4a9..c3d92e4201 100644 --- a/pkg/cloudcommon/options.go +++ b/pkg/cloudcommon/options.go @@ -63,6 +63,10 @@ func (this *DBOptions) GetDBConnection() (dialect, connstr string, err error) { } func ParseOptions(optStruct interface{}, optionsRef *Options, args []string, configFileName string) { + if len(consts.GetServiceType()) == 0 { + log.Fatalf("ServiceType not initialized!") + } + serviceName := path.Base(args[0]) parser, err := structarg.NewArgumentParser(optStruct, serviceName, diff --git a/pkg/cloudcommon/policy/policy.go b/pkg/cloudcommon/policy/policy.go index d4ab475993..2431c64ea5 100644 --- a/pkg/cloudcommon/policy/policy.go +++ b/pkg/cloudcommon/policy/policy.go @@ -90,6 +90,12 @@ var ( Action: PolicyActionCreate, Result: rbacutils.UserAllow, }, + { + Service: "yunionconf", + Resource: "parameters", + Action: PolicyActionGet, + Result: rbacutils.OwnerAllow, + }, } ) @@ -278,7 +284,7 @@ func (manager *SPolicyManager) explainPolicy(userCred mcclient.TokenCredential, if !consts.IsRbacEnabled() { if !isAdmin { return reqStrs, rbacutils.OwnerAllow, nil - } else if isAdmin && userCred.IsSystemAdmin() { + } else if isAdmin && userCred.HasSystemAdminPrivelege() { return reqStrs, rbacutils.AdminAllow, nil } else { return reqStrs, rbacutils.Deny, httperrors.NewForbiddenError("operation not allowed") @@ -305,7 +311,7 @@ func (manager *SPolicyManager) ExplainRpc(userCred mcclient.TokenCredential, par } func (manager *SPolicyManager) IsAdminCapable(userCred mcclient.TokenCredential) bool { - if !consts.IsRbacEnabled() && userCred.IsSystemAdmin() { + if !consts.IsRbacEnabled() && userCred.HasSystemAdminPrivelege() { return true } diff --git a/pkg/cloudcommon/policy/token.go b/pkg/cloudcommon/policy/token.go new file mode 100644 index 0000000000..c42b846bf4 --- /dev/null +++ b/pkg/cloudcommon/policy/token.go @@ -0,0 +1,145 @@ +package policy + +import ( + "time" + + "yunion.io/x/jsonutils" + "yunion.io/x/pkg/gotypes" + + "yunion.io/x/onecloud/pkg/cloudcommon/consts" + "yunion.io/x/onecloud/pkg/mcclient" + "yunion.io/x/onecloud/pkg/util/rbacutils" +) + +type SPolicyTokenCredential struct { + Token mcclient.TokenCredential +} + +func (self *SPolicyTokenCredential) String() string { + return self.Token.String() +} + +func (self *SPolicyTokenCredential) IsZero() bool { + return self.Token.IsZero() +} + +func (self *SPolicyTokenCredential) GetProjectId() string { + return self.Token.GetProjectId() +} + +func (self *SPolicyTokenCredential) GetTenantId() string { + return self.Token.GetTenantId() +} + +func (self *SPolicyTokenCredential) GetUserId() string { + return self.Token.GetUserId() +} + +func (self *SPolicyTokenCredential) GetServiceURL(service, region, zone, endpointType string) (string, error) { + return self.Token.GetServiceURL(service, region, zone, endpointType) +} + +func (self *SPolicyTokenCredential) GetServiceURLs(service, region, zone, endpointType string) ([]string, error) { + return self.Token.GetServiceURLs(service, region, zone, endpointType) +} + +func (self *SPolicyTokenCredential) GetTokenString() string { + return self.Token.GetTokenString() +} + +func (self *SPolicyTokenCredential) GetDomainId() string { + return self.Token.GetDomainId() +} + +func (self *SPolicyTokenCredential) GetDomainName() string { + return self.Token.GetDomainName() +} + +func (self *SPolicyTokenCredential) GetTenantName() string { + return self.Token.GetTenantName() +} + +func (self *SPolicyTokenCredential) GetProjectName() string { + return self.Token.GetProjectName() +} + +func (self *SPolicyTokenCredential) GetUserName() string { + return self.Token.GetUserName() +} + +func (self *SPolicyTokenCredential) GetRoles() []string { + return self.Token.GetRoles() +} + +func (self *SPolicyTokenCredential) GetExpires() time.Time { + return self.Token.GetExpires() +} + +func (self *SPolicyTokenCredential) IsValid() bool { + return self.Token.IsValid() +} + +func (self *SPolicyTokenCredential) ValidDuration() time.Duration { + return self.Token.ValidDuration() +} + +func (self *SPolicyTokenCredential) GetRegions() []string { + return self.Token.GetRegions() +} + +func (self *SPolicyTokenCredential) GetServiceCatalog() mcclient.IServiceCatalog { + return self.Token.GetServiceCatalog() +} + +func (self *SPolicyTokenCredential) GetCatalogData(serviceTypes []string, region string) jsonutils.JSONObject { + return self.Token.GetCatalogData(serviceTypes, region) +} + +func (self *SPolicyTokenCredential) GetInternalServices(region string) []string { + return self.Token.GetInternalServices(region) +} + +func (self *SPolicyTokenCredential) GetExternalServices(region string) []mcclient.ExternalService { + return self.Token.GetExternalServices(region) +} + +func (self *SPolicyTokenCredential) GetEndpoints(region string, endpointType string) []mcclient.Endpoint { + return self.Token.GetEndpoints(region, endpointType) +} + +func (self *SPolicyTokenCredential) ToJson() jsonutils.JSONObject { + return self.Token.ToJson() +} + +func (self *SPolicyTokenCredential) HasSystemAdminPrivelege() bool { + if consts.IsRbacEnabled() { + return PolicyManager.IsAdminCapable(self.Token) + } + return self.Token.HasSystemAdminPrivelege() +} + +func (self *SPolicyTokenCredential) IsAdminAllow(service string, resource string, action string, extra ...string) bool { + if consts.IsRbacEnabled() { + result := PolicyManager.Allow(true, self.Token, service, resource, action, extra...) + return result == rbacutils.AdminAllow + } + return self.Token.IsAdminAllow(service, resource, action, extra...) +} + +func init() { + gotypes.RegisterSerializable(mcclient.TokenCredentialType, func() gotypes.ISerializable { + return &SPolicyTokenCredential{} + }) +} + +func FilterPolicyCredential(token mcclient.TokenCredential) mcclient.TokenCredential { + if !consts.IsRbacEnabled() { + return token + } + switch token.(type) { + case *SPolicyTokenCredential: + return token + default: + return &SPolicyTokenCredential{Token: token} + } +} diff --git a/pkg/compute/capabilities/handler.go b/pkg/compute/capabilities/handler.go index a6f0aa9378..8df5482467 100644 --- a/pkg/compute/capabilities/handler.go +++ b/pkg/compute/capabilities/handler.go @@ -8,6 +8,7 @@ import ( "yunion.io/x/jsonutils" "yunion.io/x/onecloud/pkg/appsrv" + "yunion.io/x/onecloud/pkg/cloudcommon/policy" "yunion.io/x/onecloud/pkg/compute/models" "yunion.io/x/onecloud/pkg/httperrors" "yunion.io/x/onecloud/pkg/mcclient/auth" @@ -18,7 +19,7 @@ func AddCapabilityHandler(prefix string, app *appsrv.Application) { } func capaHandler(ctx context.Context, w http.ResponseWriter, r *http.Request) { - userCred := auth.FetchUserCredential(ctx) + userCred := auth.FetchUserCredential(ctx, policy.FilterPolicyCredential) query, err := jsonutils.ParseQueryString(r.URL.RawQuery) if err != nil { httperrors.GeneralServerError(w, err) diff --git a/pkg/compute/models/baremetalagents.go b/pkg/compute/models/baremetalagents.go index 780a5645ec..606333ea67 100644 --- a/pkg/compute/models/baremetalagents.go +++ b/pkg/compute/models/baremetalagents.go @@ -5,7 +5,9 @@ import ( "fmt" "yunion.io/x/jsonutils" + "yunion.io/x/onecloud/pkg/cloudcommon/consts" "yunion.io/x/onecloud/pkg/cloudcommon/db" + "yunion.io/x/onecloud/pkg/cloudcommon/policy" "yunion.io/x/onecloud/pkg/httperrors" "yunion.io/x/onecloud/pkg/mcclient" "yunion.io/x/pkg/util/regutils" @@ -80,7 +82,7 @@ func (manager *SBaremetalagentManager) ValidateCreateData(ctx context.Context, u } func (self *SBaremetalagent) AllowPerformEnable(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return userCred.IsAdminAllow(consts.GetServiceType(), self.GetModelManager().KeywordPlural(), policy.PolicyActionPerform, "enable") } func (self *SBaremetalagent) PerformEnable(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -95,7 +97,7 @@ func (self *SBaremetalagent) PerformEnable(ctx context.Context, userCred mcclien } func (self *SBaremetalagent) AllowPerformDisable(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return userCred.IsAdminAllow(consts.GetServiceType(), self.GetModelManager().KeywordPlural(), policy.PolicyActionPerform, "disable") } func (self *SBaremetalagent) PerformDisable(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -110,7 +112,7 @@ func (self *SBaremetalagent) PerformDisable(ctx context.Context, userCred mcclie } func (self *SBaremetalagent) AllowPerformOnline(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return userCred.IsAdminAllow(consts.GetServiceType(), self.GetModelManager().KeywordPlural(), policy.PolicyActionPerform, "online") } func (self *SBaremetalagent) PerformOnline(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -125,7 +127,7 @@ func (self *SBaremetalagent) PerformOnline(ctx context.Context, userCred mcclien } func (self *SBaremetalagent) AllowPerformOffline(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return userCred.IsAdminAllow(consts.GetServiceType(), self.GetModelManager().KeywordPlural(), policy.PolicyActionPerform, "offline") } func (self *SBaremetalagent) PerformOffline(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { diff --git a/pkg/compute/models/cachedimages.go b/pkg/compute/models/cachedimages.go index 3d49d59128..67e0069e25 100644 --- a/pkg/compute/models/cachedimages.go +++ b/pkg/compute/models/cachedimages.go @@ -16,8 +16,10 @@ import ( "yunion.io/x/pkg/util/timeutils" "yunion.io/x/sqlchemy" + "yunion.io/x/onecloud/pkg/cloudcommon/consts" "yunion.io/x/onecloud/pkg/cloudcommon/db" "yunion.io/x/onecloud/pkg/cloudcommon/db/lockman" + "yunion.io/x/onecloud/pkg/cloudcommon/policy" "yunion.io/x/onecloud/pkg/compute/options" ) @@ -240,7 +242,7 @@ func (self *SCachedimage) GetCustomizeColumns(ctx context.Context, userCred mccl } func (self *SCachedimage) AllowPerformRefresh(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return userCred.IsAdminAllow(consts.GetServiceType(), self.GetModelManager().KeywordPlural(), policy.PolicyActionPerform, "refresh") } func (self *SCachedimage) PerformRefresh(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { diff --git a/pkg/compute/models/cloudaccounts.go b/pkg/compute/models/cloudaccounts.go index fa889598f1..93d0bce62d 100644 --- a/pkg/compute/models/cloudaccounts.go +++ b/pkg/compute/models/cloudaccounts.go @@ -13,8 +13,10 @@ import ( "yunion.io/x/pkg/utils" "yunion.io/x/sqlchemy" + "yunion.io/x/onecloud/pkg/cloudcommon/consts" "yunion.io/x/onecloud/pkg/cloudcommon/db" "yunion.io/x/onecloud/pkg/cloudcommon/db/taskman" + "yunion.io/x/onecloud/pkg/cloudcommon/policy" "yunion.io/x/onecloud/pkg/cloudprovider" "yunion.io/x/onecloud/pkg/httperrors" "yunion.io/x/onecloud/pkg/mcclient" @@ -199,7 +201,7 @@ func (self *SCloudaccount) CanSync() bool { } func (self *SCloudaccount) AllowPerformSync(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return userCred.IsAdminAllow(consts.GetServiceType(), self.GetModelManager().KeywordPlural(), policy.PolicyActionPerform, "sync") } func (self *SCloudaccount) PerformSync(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -218,7 +220,7 @@ func (self *SCloudaccount) PerformSync(ctx context.Context, userCred mcclient.To } func (self *SCloudaccount) AllowPerformUpdateCredential(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return userCred.IsAdminAllow(consts.GetServiceType(), self.GetModelManager().KeywordPlural(), policy.PolicyActionPerform, "update-credential") } func (self *SCloudaccount) PerformUpdateCredential(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -444,7 +446,7 @@ func (self *SCloudaccount) ImportSubAccount(ctx context.Context, userCred mcclie } func (self *SCloudaccount) AllowPerformImport(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return userCred.IsAdminAllow(consts.GetServiceType(), self.GetModelManager().KeywordPlural(), policy.PolicyActionPerform, "import") } func (self *SCloudaccount) PerformImport(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -618,7 +620,7 @@ func (self *SCloudaccount) GetBalance() (float64, error) { } func (self *SCloudaccount) AllowGetDetailsBalance(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return userCred.IsAdminAllow(consts.GetServiceType(), self.GetModelManager().KeywordPlural(), policy.PolicyActionGet, "balance") } func (self *SCloudaccount) GetDetailsBalance(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) (jsonutils.JSONObject, error) { diff --git a/pkg/compute/models/cloudproviders.go b/pkg/compute/models/cloudproviders.go index 2a1361eb61..9ba07a5600 100644 --- a/pkg/compute/models/cloudproviders.go +++ b/pkg/compute/models/cloudproviders.go @@ -12,8 +12,10 @@ import ( "yunion.io/x/pkg/utils" "yunion.io/x/sqlchemy" + "yunion.io/x/onecloud/pkg/cloudcommon/consts" "yunion.io/x/onecloud/pkg/cloudcommon/db" "yunion.io/x/onecloud/pkg/cloudcommon/db/taskman" + "yunion.io/x/onecloud/pkg/cloudcommon/policy" "yunion.io/x/onecloud/pkg/cloudprovider" "yunion.io/x/onecloud/pkg/compute/options" "yunion.io/x/onecloud/pkg/httperrors" @@ -297,7 +299,7 @@ func (sr *SSyncRange) Normalize() error { } func (self *SCloudprovider) AllowPerformSync(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "sync") } func (self *SCloudprovider) PerformSync(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -330,7 +332,7 @@ func (self *SCloudprovider) StartSyncCloudProviderInfoTask(ctx context.Context, } func (self *SCloudprovider) AllowPerformChangeProject(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "change-project") } func (self *SCloudprovider) PerformChangeProject(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -581,7 +583,7 @@ func (self *SCloudprovider) GetBalance() (float64, error) { } func (self *SCloudprovider) AllowGetDetailsBalance(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionGet, "balance") } func (self *SCloudprovider) GetDetailsBalance(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) (jsonutils.JSONObject, error) { diff --git a/pkg/compute/models/cloudregions.go b/pkg/compute/models/cloudregions.go index 3e4c931cc8..374682c40e 100644 --- a/pkg/compute/models/cloudregions.go +++ b/pkg/compute/models/cloudregions.go @@ -12,7 +12,9 @@ import ( "yunion.io/x/pkg/util/compare" "yunion.io/x/sqlchemy" + "yunion.io/x/onecloud/pkg/cloudcommon/consts" "yunion.io/x/onecloud/pkg/cloudcommon/db" + "yunion.io/x/onecloud/pkg/cloudcommon/policy" "yunion.io/x/onecloud/pkg/cloudprovider" ) @@ -248,7 +250,7 @@ func (manager *SCloudregionManager) newFromCloudRegion(cloudRegion cloudprovider } func (self *SCloudregion) AllowPerformDefaultVpc(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "default-vpc") } func (self *SCloudregion) PerformDefaultVpc(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { diff --git a/pkg/compute/models/disks.go b/pkg/compute/models/disks.go index e09560fc9e..f2c0e24168 100644 --- a/pkg/compute/models/disks.go +++ b/pkg/compute/models/disks.go @@ -19,9 +19,11 @@ import ( "yunion.io/x/pkg/utils" "yunion.io/x/sqlchemy" + "yunion.io/x/onecloud/pkg/cloudcommon/consts" "yunion.io/x/onecloud/pkg/cloudcommon/db" "yunion.io/x/onecloud/pkg/cloudcommon/db/quotas" "yunion.io/x/onecloud/pkg/cloudcommon/db/taskman" + "yunion.io/x/onecloud/pkg/cloudcommon/policy" "yunion.io/x/onecloud/pkg/cloudprovider" "yunion.io/x/onecloud/pkg/compute/options" "yunion.io/x/onecloud/pkg/httperrors" @@ -442,7 +444,7 @@ func (self *SDisk) StartAllocate(ctx context.Context, host *SHost, storage *SSto } func (self *SDisk) AllowGetDetailsConvertSnapshot(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { - return self.IsOwner(userCred) + return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionGet, "convert-snapshot") } func (self *SDisk) GetDetailsConvertSnapshot(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -499,7 +501,7 @@ func (self *SDisk) CleanUpDiskSnapshots(ctx context.Context, userCred mcclient.T } func (self *SDisk) AllowPerformCreateSnapshot(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) + return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "create-snapshot") } func (self *SDisk) PerformCreateSnapshot(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -513,7 +515,7 @@ func (self *SDisk) PerformCreateSnapshot(ctx context.Context, userCred mcclient. } func (self *SDisk) AllowPerformDiskReset(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) + return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "disk-reset") } func (self *SDisk) PerformDiskReset(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -560,7 +562,7 @@ func (self *SDisk) StartResetDisk(ctx context.Context, userCred mcclient.TokenCr } func (self *SDisk) AllowPerformResize(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) + return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "resize") } func (self *SDisk) PerformResize(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -651,7 +653,7 @@ func (self *SDisk) PrepareSaveImage(ctx context.Context, userCred mcclient.Token } func (self *SDisk) AllowPerformSave(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) + return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "save") } func (self *SDisk) PerformSave(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -1139,7 +1141,7 @@ func (self *SDisk) RealDelete(ctx context.Context, userCred mcclient.TokenCreden } func (self *SDisk) AllowPerformPurge(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) + return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "purge") } func (self *SDisk) PerformPurge(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -1315,7 +1317,7 @@ func (self *SDisk) isInit() bool { } func (self *SDisk) AllowPerformCancelDelete(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "cancel-delete") } func (self *SDisk) PerformCancelDelete(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { diff --git a/pkg/compute/models/dnsrecords.go b/pkg/compute/models/dnsrecords.go index 14c5ec9f2f..74590ae471 100644 --- a/pkg/compute/models/dnsrecords.go +++ b/pkg/compute/models/dnsrecords.go @@ -11,7 +11,9 @@ import ( "yunion.io/x/pkg/util/regutils" "yunion.io/x/sqlchemy" + "yunion.io/x/onecloud/pkg/cloudcommon/consts" "yunion.io/x/onecloud/pkg/cloudcommon/db" + "yunion.io/x/onecloud/pkg/cloudcommon/policy" "yunion.io/x/onecloud/pkg/httperrors" "yunion.io/x/onecloud/pkg/mcclient" ) @@ -383,7 +385,7 @@ func (rec *SDnsRecord) AddInfo(userCred mcclient.TokenCredential, data jsonutils } func (rec *SDnsRecord) AllowPerformAddRecords(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return rec.IsOwner(userCred) + return rec.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), rec.KeywordPlural(), policy.PolicyActionPerform, "add-records") } func (rec *SDnsRecord) PerformAddRecords(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -402,7 +404,7 @@ func (rec *SDnsRecord) PerformAddRecords(ctx context.Context, userCred mcclient. } func (rec *SDnsRecord) AllowPerformRemoveRecords(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return rec.IsOwner(userCred) + return rec.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), rec.KeywordPlural(), policy.PolicyActionPerform, "remove-records") } func (rec *SDnsRecord) PerformRemoveRecords(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -411,7 +413,7 @@ func (rec *SDnsRecord) PerformRemoveRecords(ctx context.Context, userCred mcclie } func (rec *SDnsRecord) AllowPerformEnable(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return rec.IsOwner(userCred) || userCred.IsSystemAdmin() + return rec.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), rec.KeywordPlural(), policy.PolicyActionPerform, "enable") } func (rec *SDnsRecord) PerformEnable(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -429,7 +431,7 @@ func (rec *SDnsRecord) PerformEnable(ctx context.Context, userCred mcclient.Toke } func (rec *SDnsRecord) AllowPerformDisable(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return rec.IsOwner(userCred) || userCred.IsSystemAdmin() + return rec.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), rec.KeywordPlural(), policy.PolicyActionPerform, "disable") } func (rec *SDnsRecord) PerformDisable(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { diff --git a/pkg/compute/models/dynamicschedtags.go b/pkg/compute/models/dynamicschedtags.go index 3911948365..9770802575 100644 --- a/pkg/compute/models/dynamicschedtags.go +++ b/pkg/compute/models/dynamicschedtags.go @@ -7,7 +7,9 @@ import ( "yunion.io/x/log" "database/sql" + "yunion.io/x/onecloud/pkg/cloudcommon/consts" "yunion.io/x/onecloud/pkg/cloudcommon/db" + "yunion.io/x/onecloud/pkg/cloudcommon/policy" "yunion.io/x/onecloud/pkg/httperrors" "yunion.io/x/onecloud/pkg/mcclient" "yunion.io/x/onecloud/pkg/util/conditionparser" @@ -132,7 +134,7 @@ func (manager *SDynamicschedtagManager) getAllEnabledDynamicSchedtags() []SDynam } func (self *SDynamicschedtag) AllowPerformEvaluate(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "evaluate") } func (self *SDynamicschedtag) PerformEvaluate(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { diff --git a/pkg/compute/models/elasticips.go b/pkg/compute/models/elasticips.go index b879e2010e..840f29bd35 100644 --- a/pkg/compute/models/elasticips.go +++ b/pkg/compute/models/elasticips.go @@ -13,10 +13,12 @@ import ( "yunion.io/x/pkg/utils" "yunion.io/x/sqlchemy" + "yunion.io/x/onecloud/pkg/cloudcommon/consts" "yunion.io/x/onecloud/pkg/cloudcommon/db" "yunion.io/x/onecloud/pkg/cloudcommon/db/lockman" "yunion.io/x/onecloud/pkg/cloudcommon/db/quotas" "yunion.io/x/onecloud/pkg/cloudcommon/db/taskman" + "yunion.io/x/onecloud/pkg/cloudcommon/policy" "yunion.io/x/onecloud/pkg/cloudprovider" "yunion.io/x/onecloud/pkg/httperrors" "yunion.io/x/onecloud/pkg/mcclient" @@ -493,7 +495,7 @@ func (self *SElasticip) StartEipDeallocateTask(ctx context.Context, userCred mcc } func (self *SElasticip) AllowPerformAssociate(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) + return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "associate") } func (self *SElasticip) PerformAssociate(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -593,7 +595,7 @@ func (self *SElasticip) StartEipAssociateTask(ctx context.Context, userCred mccl } func (self *SElasticip) AllowPerformDissociate(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) + return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "dissociate") } func (self *SElasticip) PerformDissociate(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -647,7 +649,7 @@ func (self *SElasticip) GetIEip() (cloudprovider.ICloudEIP, error) { } func (self *SElasticip) AllowPerformSync(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) + return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "sync") } func (self *SElasticip) PerformSync(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -731,7 +733,7 @@ func (manager *SElasticipManager) allocateEipAndAssociateVM(ctx context.Context, } func (self *SElasticip) AllowPerformChangeBandwidth(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) + return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "change-bandwidth") } func (self *SElasticip) PerformChangeBandwidth(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -834,7 +836,7 @@ func (manager *SElasticipManager) TotalCount(projectId string, rangeObj db.IStan } func (self *SElasticip) AllowPerformPurge(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionDelete) } func (self *SElasticip) PerformPurge(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { diff --git a/pkg/compute/models/guest_actions.go b/pkg/compute/models/guest_actions.go index 28cfa3fe33..3eab593ff8 100644 --- a/pkg/compute/models/guest_actions.go +++ b/pkg/compute/models/guest_actions.go @@ -23,6 +23,8 @@ import ( "yunion.io/x/jsonutils" "yunion.io/x/log" + "yunion.io/x/onecloud/pkg/cloudcommon/consts" + "yunion.io/x/onecloud/pkg/cloudcommon/policy" "yunion.io/x/pkg/util/fileutils" "yunion.io/x/pkg/util/regutils" "yunion.io/x/pkg/utils" @@ -30,7 +32,7 @@ import ( ) func (self *SGuest) AllowGetDetailsVnc(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { - return self.IsOwner(userCred) + return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionGet, "vnc") } func (self *SGuest) GetDetailsVnc(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -51,7 +53,7 @@ func (self *SGuest) GetDetailsVnc(ctx context.Context, userCred mcclient.TokenCr } func (self *SGuest) AllowGetDetailsMonitor(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { - return self.IsOwner(userCred) + return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionGet, "monitor") } func (self *SGuest) GetDetailsMonitor(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -66,7 +68,7 @@ func (self *SGuest) GetDetailsMonitor(ctx context.Context, userCred mcclient.Tok } func (self *SGuest) AllowGetDetailsDesc(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { - return self.IsOwner(userCred) + return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionGet, "desc") } func (self *SGuest) GetDetailsDesc(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -79,7 +81,7 @@ func (self *SGuest) GetDetailsDesc(ctx context.Context, userCred mcclient.TokenC } func (self *SGuest) AllowPerformSaveImage(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) + return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "save-image") } func (self *SGuest) PerformSaveImage(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -117,7 +119,7 @@ func (self *SGuest) StartGuestSaveImage(ctx context.Context, userCred mcclient.T } func (self *SGuest) AllowPerformSync(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) + return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "sync") } func (self *SGuest) PerformSync(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -159,7 +161,7 @@ func (self *SGuest) CheckQemuVersion(qemuVer, compareVer string) bool { } func (self *SGuest) AllowPerformMigrate(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) + return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "migrate") } func (self *SGuest) PerformMigrate(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -186,7 +188,7 @@ func (self *SGuest) PerformMigrate(ctx context.Context, userCred mcclient.TokenC var preferHostId string preferHost, _ := data.GetString("prefer_host") if len(preferHost) > 0 { - if !userCred.IsSystemAdmin() { + if !userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "assign-host") { return nil, httperrors.NewBadRequestError("Only system admin can assign host") } iHost, _ := HostManager.FetchByIdOrName(userCred, preferHost) @@ -219,7 +221,7 @@ func (self *SGuest) StartMigrateTask(ctx context.Context, userCred mcclient.Toke } func (self *SGuest) AllowPerformLiveMigrate(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) + return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "live-migrate") } func (self *SGuest) PerformLiveMigrate(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -249,7 +251,7 @@ func (self *SGuest) PerformLiveMigrate(ctx context.Context, userCred mcclient.To var preferHostId string preferHost, _ := data.GetString("prefer_host") if len(preferHost) > 0 { - if !userCred.IsSystemAdmin() { + if !userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "assign-host") { return nil, httperrors.NewBadRequestError("Only system admin can assign host") } iHost, _ := HostManager.FetchByIdOrName(userCred, preferHost) @@ -282,7 +284,7 @@ func (self *SGuest) StartGuestLiveMigrateTask(ctx context.Context, userCred mccl } func (self *SGuest) AllowPerformDeploy(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) + return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "deploy") } func (self *SGuest) PerformDeploy(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -345,7 +347,7 @@ func (self *SGuest) PerformDeploy(ctx context.Context, userCred mcclient.TokenCr } func (self *SGuest) AllowPerformAttachdisk(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) + return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "attachdisk") } func (self *SGuest) ValidateAttachDisk(ctx context.Context, disk *SDisk) error { @@ -425,7 +427,7 @@ func (self *SGuest) StartSyncTask(ctx context.Context, userCred mcclient.TokenCr } func (self *SGuest) AllowPerformSuspend(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) + return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "suspend") } func (self *SGuest) PerformSuspend(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -448,7 +450,7 @@ func (self *SGuest) AllowPerformStart(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) + return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "start") } func (self *SGuest) PerformStart(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, @@ -624,11 +626,11 @@ func (self *SGuest) StartDeleteGuestTask(ctx context.Context, userCred mcclient. } func (self *SGuest) AllowPerformAssignSecgroup(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) + return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "assign-secgroup") } func (self *SGuest) AllowPerformRevokeSecgroup(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) + return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "revoke-secgroup") } func (self *SGuest) PerformRevokeSecgroup(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -679,7 +681,7 @@ func (self *SGuest) PerformAssignSecgroup(ctx context.Context, userCred mcclient } func (self *SGuest) AllowPerformPurge(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsAdmin(userCred) + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionDelete) } func (self *SGuest) PerformPurge(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -707,7 +709,7 @@ func (self *SGuest) setKeypairId(userCred mcclient.TokenCredential, keypairId st } func (self *SGuest) AllowPerformRebuildRoot(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) + return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "rebuild-root") } func (self *SGuest) PerformRebuildRoot(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -814,7 +816,7 @@ func (self *SGuest) DetachDisk(ctx context.Context, disk *SDisk, userCred mcclie } func (self *SGuest) AllowPerformCreatedisk(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) + return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "createdisk") } func (self *SGuest) PerformCreatedisk(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -885,7 +887,7 @@ func (self *SGuest) PerformCreatedisk(ctx context.Context, userCred mcclient.Tok } func (self *SGuest) AllowPerformDetachdisk(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) + return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "detachdisk") } func (self *SGuest) PerformDetachdisk(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -931,7 +933,7 @@ func (self *SGuest) PerformDetachdisk(ctx context.Context, userCred mcclient.Tok } func (self *SGuest) AllowPerformDetachIsolatedDevice(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "detach-isolated-device") } func (self *SGuest) PerformDetachIsolatedDevice(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -981,7 +983,7 @@ func (self *SGuest) detachIsolateDevice(userCred mcclient.TokenCredential, dev * } func (self *SGuest) AllowPerformAttachIsolatedDevice(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "attach-isolated-device") } func (self *SGuest) PerformAttachIsolatedDevice(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -1019,7 +1021,7 @@ func (self *SGuest) PerformAttachIsolatedDevice(ctx context.Context, userCred mc } func (self *SGuest) AllowPerformDetachnetwork(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) + return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "detachnetwork") } func (self *SGuest) PerformDetachnetwork(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -1041,7 +1043,7 @@ func (self *SGuest) PerformDetachnetwork(ctx context.Context, userCred mcclient. } func (self *SGuest) AllowPerformAttachnetwork(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) + return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "attachnetwork") } func (self *SGuest) PerformAttachnetwork(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -1092,7 +1094,7 @@ func (self *SGuest) PerformAttachnetwork(ctx context.Context, userCred mcclient. } func (self *SGuest) AllowPerformChangeBandwidth(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) || userCred.IsSystemAdmin() + return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "change-bandwidth") } func (self *SGuest) PerformChangeBandwidth(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -1126,7 +1128,7 @@ func (self *SGuest) PerformChangeBandwidth(ctx context.Context, userCred mcclien } func (self *SGuest) AllowPerformChangeConfig(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) || self.IsAdmin(userCred) + return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "change-config") } func (self *SGuest) PerformChangeConfig(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -1317,7 +1319,7 @@ func (self *SGuest) DoPendingDelete(ctx context.Context, userCred mcclient.Token } func (model *SGuest) AllowPerformCancelDelete(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return userCred.IsAdminAllow(consts.GetServiceType(), model.KeywordPlural(), policy.PolicyActionPerform, "cancel-delete") } func (self *SGuest) PerformCancelDelete(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -1353,7 +1355,7 @@ func (self *SGuest) AllowPerformReset(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) + return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "reset") } func (self *SGuest) PerformReset(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, @@ -1367,7 +1369,7 @@ func (self *SGuest) PerformReset(ctx context.Context, userCred mcclient.TokenCre } func (self *SGuest) AllowPerformDiskSnapshot(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) + return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "disk-snapshot") } func (self *SGuest) PerformDiskSnapshot(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -1421,7 +1423,7 @@ func (self *SGuest) PerformDiskSnapshot(ctx context.Context, userCred mcclient.T } func (self *SGuest) AllowPerformSyncstatus(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) + return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "syncstatus") } func (self *SGuest) PerformSyncstatus(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -1465,7 +1467,7 @@ func (self *SGuest) AllowPerformStop(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) + return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "stop") } func (self *SGuest) PerformStop(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, @@ -1482,7 +1484,7 @@ func (self *SGuest) AllowPerformRestart(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) + return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "restart") } func (self *SGuest) PerformRestart(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -1495,7 +1497,7 @@ func (self *SGuest) PerformRestart(ctx context.Context, userCred mcclient.TokenC } func (self *SGuest) AllowPerformSendkeys(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) + return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "sendkeys") } func (self *SGuest) PerformSendkeys(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -1569,7 +1571,7 @@ func (self *SGuest) SendMonitorCommand(ctx context.Context, userCred mcclient.To } func (self *SGuest) AllowPerformAssociateEip(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) + return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "associate-eip") } func (self *SGuest) PerformAssociateEip(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -1637,7 +1639,7 @@ func (self *SGuest) PerformAssociateEip(ctx context.Context, userCred mcclient.T } func (self *SGuest) AllowPerformDissociateEip(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) + return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "dissociate-eip") } func (self *SGuest) PerformDissociateEip(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -1661,7 +1663,7 @@ func (self *SGuest) PerformDissociateEip(ctx context.Context, userCred mcclient. } func (self *SGuest) AllowPerformCreateEip(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) + return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "create-eip") } func (self *SGuest) PerformCreateEip(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -1716,7 +1718,7 @@ func (self *SGuest) setUserData(ctx context.Context, userCred mcclient.TokenCred } func (self *SGuest) AllowPerformUserData(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) + return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "userdata") } func (self *SGuest) PerformUserData(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { diff --git a/pkg/compute/models/guests.go b/pkg/compute/models/guests.go index 4d513dea9a..011b3ae613 100644 --- a/pkg/compute/models/guests.go +++ b/pkg/compute/models/guests.go @@ -22,9 +22,11 @@ import ( "yunion.io/x/pkg/utils" "yunion.io/x/sqlchemy" + "yunion.io/x/onecloud/pkg/cloudcommon/consts" "yunion.io/x/onecloud/pkg/cloudcommon/db" "yunion.io/x/onecloud/pkg/cloudcommon/db/lockman" "yunion.io/x/onecloud/pkg/cloudcommon/db/quotas" + "yunion.io/x/onecloud/pkg/cloudcommon/policy" "yunion.io/x/onecloud/pkg/cloudprovider" "yunion.io/x/onecloud/pkg/compute/options" "yunion.io/x/onecloud/pkg/compute/sshkeys" @@ -207,7 +209,7 @@ type SGuest struct { func (manager *SGuestManager) AllowListItems(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { if query.Contains("host") || query.Contains("wire") || query.Contains("zone") { - if !userCred.IsSystemAdmin() { + if !userCred.IsAdminAllow(consts.GetServiceType(), manager.KeywordPlural(), policy.PolicyActionList) { return false } } @@ -919,7 +921,7 @@ func (self *SGuest) getExtBandwidth() int { func (self *SGuest) GetCustomizeColumns(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) *jsonutils.JSONDict { extra := self.SVirtualResourceBase.GetCustomizeColumns(ctx, userCred, query) - if userCred.IsSystemAdmin() { + if userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionGet) { host := self.GetHost() if host != nil { extra.Add(jsonutils.NewString(host.Name), "host") @@ -1012,7 +1014,7 @@ func (self *SGuest) GetExtraDetails(ctx context.Context, userCred mcclient.Token if metaData, err := self.GetAllMetadata(userCred); err == nil { extra.Add(jsonutils.Marshal(metaData), "metadata") } - if userCred.IsSystemAdmin() { + if userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionGet) { host := self.GetHost() if host != nil { extra.Add(jsonutils.NewString(host.GetName()), "host") @@ -2211,10 +2213,10 @@ func (self *SGuest) AllowDeleteItem(ctx context.Context, userCred mcclient.Token overridePendingDelete = jsonutils.QueryBoolean(data, "override_pending_delete", false) purge = jsonutils.QueryBoolean(data, "purge", false) } - if (overridePendingDelete || purge) && !userCred.IsSystemAdmin() { + if (overridePendingDelete || purge) && !userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionDelete) { return false } - return self.IsOwner(userCred) + return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionDelete) } func (self *SGuest) CustomizeDelete(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) error { diff --git a/pkg/compute/models/helper.go b/pkg/compute/models/helper.go index 41e680cdf6..83575fd8ac 100644 --- a/pkg/compute/models/helper.go +++ b/pkg/compute/models/helper.go @@ -10,8 +10,10 @@ import ( "yunion.io/x/log" "yunion.io/x/pkg/utils" + "yunion.io/x/onecloud/pkg/cloudcommon/consts" "yunion.io/x/onecloud/pkg/cloudcommon/db" "yunion.io/x/onecloud/pkg/cloudcommon/db/taskman" + "yunion.io/x/onecloud/pkg/cloudcommon/policy" "yunion.io/x/onecloud/pkg/httperrors" "yunion.io/x/onecloud/pkg/mcclient" ) @@ -47,7 +49,7 @@ func ValidateScheduleCreateData(ctx context.Context, userCred mcclient.TokenCred // base validate_create_data if (data.Contains("prefer_baremetal") || data.Contains("prefer_host")) && hypervisor != HYPERVISOR_CONTAINER { - if !userCred.IsSystemAdmin() { + if !userCred.IsAdminAllow(consts.GetServiceType(), GuestManager.KeywordPlural(), policy.PolicyActionPerform, "assign-host") { return nil, httperrors.NewNotSufficientPrivilegeError("Only system admin can specify preferred host") } bmName, _ := data.GetString("prefer_host") diff --git a/pkg/compute/models/hostjoints.go b/pkg/compute/models/hostjoints.go index c6477c1877..b8d7dac8f3 100644 --- a/pkg/compute/models/hostjoints.go +++ b/pkg/compute/models/hostjoints.go @@ -6,7 +6,9 @@ import ( "yunion.io/x/jsonutils" "yunion.io/x/onecloud/pkg/mcclient" + "yunion.io/x/onecloud/pkg/cloudcommon/consts" "yunion.io/x/onecloud/pkg/cloudcommon/db" + "yunion.io/x/onecloud/pkg/cloudcommon/policy" ) type SHostJointsManager struct { @@ -31,29 +33,29 @@ type SHostJointsBase struct { } func (manager *SHostJointsManager) AllowListItems(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return userCred.IsAdminAllow(consts.GetServiceType(), manager.KeywordPlural(), policy.PolicyActionList) } func (manager *SHostJointsManager) AllowCreateItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return userCred.IsAdminAllow(consts.GetServiceType(), manager.KeywordPlural(), policy.PolicyActionCreate) } func (manager *SHostJointsManager) AllowListDescendent(ctx context.Context, userCred mcclient.TokenCredential, model db.IStandaloneModel, query jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return userCred.IsAdminAllow(consts.GetServiceType(), manager.KeywordPlural(), policy.PolicyActionList) } func (manager *SHostJointsManager) AllowAttach(ctx context.Context, userCred mcclient.TokenCredential, master db.IStandaloneModel, slave db.IStandaloneModel) bool { - return userCred.IsSystemAdmin() + return userCred.IsAdminAllow(consts.GetServiceType(), manager.KeywordPlural(), policy.PolicyActionDelete) } func (self *SHostJointsBase) AllowGetDetails(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return userCred.IsAdminAllow(consts.GetServiceType(), self.GetModelManager().KeywordPlural(), policy.PolicyActionGet) } func (self *SHostJointsBase) AllowUpdateItem(ctx context.Context, userCred mcclient.TokenCredential) bool { - return userCred.IsSystemAdmin() + return userCred.IsAdminAllow(consts.GetServiceType(), self.GetModelManager().KeywordPlural(), policy.PolicyActionUpdate) } func (self *SHostJointsBase) AllowDeleteItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return userCred.IsAdminAllow(consts.GetServiceType(), self.GetModelManager().KeywordPlural(), policy.PolicyActionDelete) } diff --git a/pkg/compute/models/hosts.go b/pkg/compute/models/hosts.go index 187ed6e7d0..5edbc95027 100644 --- a/pkg/compute/models/hosts.go +++ b/pkg/compute/models/hosts.go @@ -20,9 +20,11 @@ import ( "yunion.io/x/pkg/utils" "yunion.io/x/sqlchemy" + "yunion.io/x/onecloud/pkg/cloudcommon/consts" "yunion.io/x/onecloud/pkg/cloudcommon/db" "yunion.io/x/onecloud/pkg/cloudcommon/db/lockman" "yunion.io/x/onecloud/pkg/cloudcommon/db/taskman" + "yunion.io/x/onecloud/pkg/cloudcommon/policy" "yunion.io/x/onecloud/pkg/cloudprovider" "yunion.io/x/onecloud/pkg/compute/baremetal" "yunion.io/x/onecloud/pkg/compute/options" @@ -142,7 +144,7 @@ type SHost struct { // Status string = Column(VARCHAR(16, charset='ascii'), nullable=False, default=baremetalstatus.INIT) # status HostStatus string `width:"16" charset:"ascii" nullable:"false" default:"offline" list:"admin"` // Column(VARCHAR(16, charset='ascii'), nullable=False, server_default=HOST_OFFLINE, default=HOST_OFFLINE) - ZoneId string `width:"128" charset:"ascii" nullable:"false" list:"admin" create:"admin_required"` // Column(VARCHAR(ID_LENGTH, charset='ascii'), nullable=False) + ZoneId string `width:"128" charset:"ascii" nullable:"false" list:"admin" create:"admin_optional"` // Column(VARCHAR(ID_LENGTH, charset='ascii'), nullable=False) HostType string `width:"36" charset:"ascii" nullable:"false" list:"admin" update:"admin" create:"admin_required"` // Column(VARCHAR(36, charset='ascii'), nullable=False) @@ -160,15 +162,16 @@ func (manager *SHostManager) GetContextManager() []db.IModelManager { } func (manager *SHostManager) AllowCreateItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - zoneId, err := data.GetString("zone_id") + // allow create host without zone_id + /*zoneId, err := data.GetString("zone_id") if err != nil { return false } _, err = ZoneManager.FetchById(zoneId) if err != nil { return false - } - return userCred.IsSystemAdmin() + }*/ + return userCred.IsAdminAllow(consts.GetServiceType(), manager.KeywordPlural(), policy.PolicyActionCreate) } func (manager *SHostManager) ListItemFilter(ctx context.Context, q *sqlchemy.SQuery, userCred mcclient.TokenCredential, query jsonutils.JSONObject) (*sqlchemy.SQuery, error) { @@ -261,6 +264,9 @@ func (manager *SHostManager) ListItemFilter(ctx context.Context, q *sqlchemy.SQu } func (self *SHost) GetZone() *SZone { + if len(self.ZoneId) == 0 { + return nil + } zone, _ := ZoneManager.FetchById(self.ZoneId) if zone != nil { return zone.(*SZone) @@ -1781,7 +1787,7 @@ func (self *SHost) GetExtraDetails(ctx context.Context, userCred mcclient.TokenC } func (self *SHost) AllowGetDetailsVnc(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionGet, "vnc") } func (self *SHost) GetDetailsVnc(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -1796,7 +1802,7 @@ func (self *SHost) GetDetailsVnc(ctx context.Context, userCred mcclient.TokenCre } func (self *SHost) AllowGetDetailsIpmi(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionGet, "ipmi") } func (self *SHost) GetDetailsIpmi(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -2087,7 +2093,7 @@ func (self *SHost) AllowPerformStart(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "start") } func (self *SHost) PerformStart(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, @@ -2122,7 +2128,7 @@ func (self *SHost) AllowPerformStop(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "stop") } func (self *SHost) PerformStop(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, @@ -2172,7 +2178,8 @@ func (self *SHost) AllowPerformMaintenance(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "maintenance") + } func (self *SHost) PerformMaintenance(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -2211,7 +2218,7 @@ func (self *SHost) AllowPerformUnmaintenance(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "unmaintenance") } func (self *SHost) PerformUnmaintenance(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -2273,7 +2280,7 @@ func (self *SHost) AllowPerformOffline(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "offline") } func (self *SHost) PerformOffline(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -2292,7 +2299,7 @@ func (self *SHost) AllowPerformOnline(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "online") } func (self *SHost) PerformOnline(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -2325,7 +2332,7 @@ func (self *SHost) AllowPerformPing(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "ping") } func (self *SHost) PerformPing(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -2352,7 +2359,7 @@ func (self *SHost) AllowPerformPrepare(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "prepare") } func (self *SHost) PerformPrepare(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -2388,7 +2395,7 @@ func (self *SHost) AllowPerformAddNetif(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "add-netif") } func (self *SHost) PerformAddNetif(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -2540,7 +2547,7 @@ func (self *SHost) AllowPerformEnableNetif(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "enable-netif") } func (self *SHost) PerformEnableNetif(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -2614,7 +2621,7 @@ func (self *SHost) AllowPerformDisableNetif(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "disable-netif") } func (self *SHost) PerformDisableNetif(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -2668,7 +2675,7 @@ func (self *SHost) AllowPerformRemoveNetif(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "remove-netif") } func (self *SHost) PerformRemoveNetif(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -2722,7 +2729,7 @@ func (self *SHost) AllowPerformSyncstatus(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "syncstatus") } func (self *SHost) PerformSyncstatus(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -2734,7 +2741,7 @@ func (self *SHost) AllowPerformReset(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "reset") } func (self *SHost) PerformReset(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -2764,7 +2771,7 @@ func (self *SHost) AllowPerformRemoveAllNetifs(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "remove-all-netifs") } func (self *SHost) PerformRemoveAllNetifs(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -2781,7 +2788,7 @@ func (self *SHost) AllowPerformDisable(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "disable") } func (self *SHost) PerformDisable(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -2804,7 +2811,7 @@ func (self *SHost) AllowPerformCacheImage(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "cache-image") } func (self *SHost) PerformCacheImage(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -2836,7 +2843,7 @@ func (self *SHost) AllowPerformConvertHypervisor(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "convert-hypervisor") } func (self *SHost) isAlterNameUnique(name string) bool { @@ -2902,7 +2909,7 @@ func (self *SHost) AllowPerformUndoConvert(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "undo-convert") } func (self *SHost) PerformUndoConvert(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { diff --git a/pkg/compute/models/inframanagers.go b/pkg/compute/models/inframanagers.go index 962f752369..96c9a5607f 100644 --- a/pkg/compute/models/inframanagers.go +++ b/pkg/compute/models/inframanagers.go @@ -3,6 +3,8 @@ package models import ( "context" "yunion.io/x/jsonutils" + "yunion.io/x/onecloud/pkg/cloudcommon/consts" + "yunion.io/x/onecloud/pkg/cloudcommon/policy" "yunion.io/x/onecloud/pkg/mcclient" ) @@ -13,21 +15,21 @@ type SInfrastructure struct { } func (self *SInfrastructureManager) AllowListItems(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return userCred.IsAdminAllow(consts.GetServiceType(), "*", policy.PolicyActionList) } func (self *SInfrastructureManager) AllowCreateItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return userCred.IsAdminAllow(consts.GetServiceType(), "*", policy.PolicyActionCreate) } func (self *SInfrastructure) AllowGetDetails(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return userCred.IsAdminAllow(consts.GetServiceType(), "*", policy.PolicyActionGet) } func (self *SInfrastructure) AllowUpdateItem(ctx context.Context, userCred mcclient.TokenCredential) bool { - return userCred.IsSystemAdmin() + return userCred.IsAdminAllow(consts.GetServiceType(), "*", policy.PolicyActionUpdate) } func (self *SInfrastructure) AllowDeleteItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return userCred.IsAdminAllow(consts.GetServiceType(), "*", policy.PolicyActionDelete) } diff --git a/pkg/compute/models/isolated_devices.go b/pkg/compute/models/isolated_devices.go index 0c30205d36..7e55afb02b 100644 --- a/pkg/compute/models/isolated_devices.go +++ b/pkg/compute/models/isolated_devices.go @@ -7,7 +7,9 @@ import ( "yunion.io/x/jsonutils" "yunion.io/x/log" + "yunion.io/x/onecloud/pkg/cloudcommon/consts" "yunion.io/x/onecloud/pkg/cloudcommon/db" + "yunion.io/x/onecloud/pkg/cloudcommon/policy" "yunion.io/x/onecloud/pkg/httperrors" "yunion.io/x/onecloud/pkg/mcclient" "yunion.io/x/pkg/util/regutils" @@ -80,7 +82,7 @@ type SIsolatedDevice struct { func (manager *SIsolatedDeviceManager) AllowListItems(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { host, _ := query.GetString("host") - if len(host) > 0 && !userCred.IsSystemAdmin() { + if len(host) > 0 && !userCred.IsAdminAllow(consts.GetServiceType(), manager.KeywordPlural(), policy.PolicyActionList) { return false } return true @@ -92,7 +94,7 @@ func (manager *SIsolatedDeviceManager) ExtraSearchConditions(ctx context.Context } func (manager *SIsolatedDeviceManager) AllowCreateItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return userCred.IsAdminAllow(consts.GetServiceType(), manager.KeywordPlural(), policy.PolicyActionCreate) } func (manager *SIsolatedDeviceManager) ListItemFilter(ctx context.Context, q *sqlchemy.SQuery, userCred mcclient.TokenCredential, query jsonutils.JSONObject) (*sqlchemy.SQuery, error) { diff --git a/pkg/compute/models/keypairs.go b/pkg/compute/models/keypairs.go index 687a21243f..67ae5c7638 100644 --- a/pkg/compute/models/keypairs.go +++ b/pkg/compute/models/keypairs.go @@ -8,7 +8,9 @@ import ( "yunion.io/x/sqlchemy" "golang.org/x/crypto/ssh" + "yunion.io/x/onecloud/pkg/cloudcommon/consts" "yunion.io/x/onecloud/pkg/cloudcommon/db" + "yunion.io/x/onecloud/pkg/cloudcommon/policy" "yunion.io/x/onecloud/pkg/httperrors" "yunion.io/x/onecloud/pkg/mcclient" "yunion.io/x/onecloud/pkg/util/seclib2" @@ -47,7 +49,7 @@ func (manager *SKeypairManager) ListItemFilter(ctx context.Context, q *sqlchemy. if err != nil { return nil, err } - if userCred.IsSystemAdmin() && jsonutils.QueryBoolean(query, "admin", false) { + if jsonutils.QueryBoolean(query, "admin", false) && userCred.IsAdminAllow(consts.GetServiceType(), manager.KeywordPlural(), policy.PolicyActionList) { user, _ := query.GetString("user") if len(user) > 0 { uc, _ := db.UserCacheManager.FetchUserByIdOrName(user) @@ -71,7 +73,7 @@ func (self *SKeypair) IsOwner(userCred mcclient.TokenCredential) bool { } func (self *SKeypair) AllowGetDetails(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { - return self.IsOwner(userCred) || userCred.IsSystemAdmin() + return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionGet) } func (self *SKeypair) GetCustomizeColumns(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) *jsonutils.JSONDict { @@ -85,7 +87,7 @@ func (self *SKeypair) GetExtraDetails(ctx context.Context, userCred mcclient.Tok extra := self.SStandaloneResourceBase.GetExtraDetails(ctx, userCred, query) extra.Add(jsonutils.NewInt(int64(len(self.PrivateKey))), "private_key_len") extra.Add(jsonutils.NewInt(int64(self.GetLinkedGuestsCount())), "linked_guest_count") - if userCred.IsSystemAdmin() { + if userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionGet) { extra.Add(jsonutils.NewString(self.OwnerId), "owner_id") uc, _ := db.UserCacheManager.FetchUserById(self.OwnerId) if uc != nil { @@ -100,11 +102,11 @@ func (manager *SKeypairManager) AllowCreateItem(ctx context.Context, userCred mc } func (self *SKeypair) AllowUpdateItem(ctx context.Context, userCred mcclient.TokenCredential) bool { - return self.IsOwner(userCred) + return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionUpdate) } func (self *SKeypair) AllowDeleteItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) || userCred.IsSystemAdmin() + return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionDelete) } func (self *SKeypair) GetLinkedGuestsCount() int { diff --git a/pkg/compute/models/loadbalanceracls.go b/pkg/compute/models/loadbalanceracls.go index 94fd544b2a..d177401fe9 100644 --- a/pkg/compute/models/loadbalanceracls.go +++ b/pkg/compute/models/loadbalanceracls.go @@ -12,7 +12,9 @@ import ( "yunion.io/x/pkg/gotypes" "yunion.io/x/sqlchemy" + "yunion.io/x/onecloud/pkg/cloudcommon/consts" "yunion.io/x/onecloud/pkg/cloudcommon/db" + "yunion.io/x/onecloud/pkg/cloudcommon/policy" "yunion.io/x/onecloud/pkg/cloudcommon/validators" "yunion.io/x/onecloud/pkg/httperrors" "yunion.io/x/onecloud/pkg/mcclient" @@ -136,7 +138,7 @@ func (lbacl *SLoadbalancerAcl) ValidateUpdateData(ctx context.Context, userCred } func (lbacl *SLoadbalancerAcl) AllowPerformPatch(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data *jsonutils.JSONDict) bool { - return lbacl.IsOwner(userCred) || userCred.IsSystemAdmin() + return lbacl.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), lbacl.KeywordPlural(), policy.PolicyActionPerform, "patch") } // PerformPatch patches acl entries by adding then deleting the specified acls. diff --git a/pkg/compute/models/loadbalanceragents.go b/pkg/compute/models/loadbalanceragents.go index 29269063fd..b7a0a1f455 100644 --- a/pkg/compute/models/loadbalanceragents.go +++ b/pkg/compute/models/loadbalanceragents.go @@ -12,7 +12,9 @@ import ( "yunion.io/x/log" "yunion.io/x/pkg/gotypes" + "yunion.io/x/onecloud/pkg/cloudcommon/consts" "yunion.io/x/onecloud/pkg/cloudcommon/db" + "yunion.io/x/onecloud/pkg/cloudcommon/policy" "yunion.io/x/onecloud/pkg/cloudcommon/validators" "yunion.io/x/onecloud/pkg/httperrors" "yunion.io/x/onecloud/pkg/mcclient" @@ -354,7 +356,7 @@ func (man *SLoadbalancerAgentManager) CleanPendingDeleteLoadbalancers(ctx contex } func (man *SLoadbalancerAgentManager) AllowCreateItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return userCred.IsAdminAllow(consts.GetServiceType(), man.KeywordPlural(), policy.PolicyActionCreate) } func (lbagent *SLoadbalancerAgent) ValidateUpdateData(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data *jsonutils.JSONDict) (*jsonutils.JSONDict, error) { @@ -400,7 +402,7 @@ func (lbagent *SLoadbalancerAgent) ValidateUpdateData(ctx context.Context, userC } func (lbagent *SLoadbalancerAgent) AllowPerformHb(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data *jsonutils.JSONDict) bool { - return userCred.IsSystemAdmin() + return userCred.IsAdminAllow(consts.GetServiceType(), lbagent.KeywordPlural(), policy.PolicyActionPerform, "hb") } func (lbagent *SLoadbalancerAgent) PerformHb(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data *jsonutils.JSONDict) (*jsonutils.JSONDict, error) { @@ -426,7 +428,7 @@ func (lbagent *SLoadbalancerAgent) IsActive() bool { } func (lbagent *SLoadbalancerAgent) AllowPerformParamsPatch(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data *jsonutils.JSONDict) bool { - return userCred.IsSystemAdmin() + return userCred.IsAdminAllow(consts.GetServiceType(), lbagent.KeywordPlural(), policy.PolicyActionPerform, "params-patch") } func (lbagent *SLoadbalancerAgent) PerformParamsPatch(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data *jsonutils.JSONDict) (*jsonutils.JSONDict, error) { diff --git a/pkg/compute/models/loadbalancerbackends.go b/pkg/compute/models/loadbalancerbackends.go index f82dcc65cc..2ebc741a75 100644 --- a/pkg/compute/models/loadbalancerbackends.go +++ b/pkg/compute/models/loadbalancerbackends.go @@ -7,7 +7,9 @@ import ( "yunion.io/x/jsonutils" "yunion.io/x/sqlchemy" + "yunion.io/x/onecloud/pkg/cloudcommon/consts" "yunion.io/x/onecloud/pkg/cloudcommon/db" + "yunion.io/x/onecloud/pkg/cloudcommon/policy" "yunion.io/x/onecloud/pkg/cloudcommon/validators" "yunion.io/x/onecloud/pkg/mcclient" ) @@ -137,7 +139,7 @@ func (man *SLoadbalancerBackendManager) ValidateCreateData(ctx context.Context, } baseName = guest.Name case LB_BACKEND_HOST: - if !userCred.IsSystemAdmin() { + if !userCred.IsAdminAllow(consts.GetServiceType(), man.KeywordPlural(), policy.PolicyActionCreate) { return nil, fmt.Errorf("only sysadmin can specify host as backend") } backendV := validators.NewModelIdOrNameValidator("backend", "host", userCred.GetProjectId()) diff --git a/pkg/compute/models/loadbalancerlistenerrules.go b/pkg/compute/models/loadbalancerlistenerrules.go index 71be2e4b89..a78f271e25 100644 --- a/pkg/compute/models/loadbalancerlistenerrules.go +++ b/pkg/compute/models/loadbalancerlistenerrules.go @@ -8,7 +8,9 @@ import ( "yunion.io/x/log" "yunion.io/x/sqlchemy" + "yunion.io/x/onecloud/pkg/cloudcommon/consts" "yunion.io/x/onecloud/pkg/cloudcommon/db" + "yunion.io/x/onecloud/pkg/cloudcommon/policy" "yunion.io/x/onecloud/pkg/cloudcommon/validators" "yunion.io/x/onecloud/pkg/httperrors" "yunion.io/x/onecloud/pkg/mcclient" @@ -126,7 +128,7 @@ func (man *SLoadbalancerListenerRuleManager) ValidateCreateData(ctx context.Cont } func (lbr *SLoadbalancerListenerRule) AllowPerformStatus(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return lbr.IsOwner(userCred) || userCred.IsSystemAdmin() + return lbr.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), lbr.KeywordPlural(), policy.PolicyActionPerform, "status") } func (lbr *SLoadbalancerListenerRule) ValidateUpdateData(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data *jsonutils.JSONDict) (*jsonutils.JSONDict, error) { diff --git a/pkg/compute/models/loadbalancerlisteners.go b/pkg/compute/models/loadbalancerlisteners.go index 7ce180e9c1..6a115282fa 100644 --- a/pkg/compute/models/loadbalancerlisteners.go +++ b/pkg/compute/models/loadbalancerlisteners.go @@ -9,8 +9,10 @@ import ( "yunion.io/x/log" "yunion.io/x/sqlchemy" + "yunion.io/x/onecloud/pkg/cloudcommon/consts" "yunion.io/x/onecloud/pkg/cloudcommon/db" "yunion.io/x/onecloud/pkg/cloudcommon/db/lockman" + "yunion.io/x/onecloud/pkg/cloudcommon/policy" "yunion.io/x/onecloud/pkg/cloudcommon/validators" "yunion.io/x/onecloud/pkg/httperrors" "yunion.io/x/onecloud/pkg/mcclient" @@ -295,7 +297,7 @@ func (man *SLoadbalancerListenerManager) validateAcl(aclStatusV *validators.Vali } func (lblis *SLoadbalancerListener) AllowPerformStatus(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return lblis.IsOwner(userCred) || userCred.IsSystemAdmin() + return lblis.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), lblis.KeywordPlural(), policy.PolicyActionPerform, "status") } func (lblis *SLoadbalancerListener) ValidateUpdateData(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data *jsonutils.JSONDict) (*jsonutils.JSONDict, error) { diff --git a/pkg/compute/models/loadbalancers.go b/pkg/compute/models/loadbalancers.go index 787a4b3159..00ce2c2219 100644 --- a/pkg/compute/models/loadbalancers.go +++ b/pkg/compute/models/loadbalancers.go @@ -9,8 +9,10 @@ import ( "yunion.io/x/pkg/util/netutils" "yunion.io/x/sqlchemy" + "yunion.io/x/onecloud/pkg/cloudcommon/consts" "yunion.io/x/onecloud/pkg/cloudcommon/db" "yunion.io/x/onecloud/pkg/cloudcommon/db/lockman" + "yunion.io/x/onecloud/pkg/cloudcommon/policy" "yunion.io/x/onecloud/pkg/cloudcommon/validators" "yunion.io/x/onecloud/pkg/httperrors" "yunion.io/x/onecloud/pkg/mcclient" @@ -132,7 +134,7 @@ func (man *SLoadbalancerManager) ValidateCreateData(ctx context.Context, userCre } func (lb *SLoadbalancer) AllowPerformStatus(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return lb.IsOwner(userCred) || userCred.IsSystemAdmin() + return lb.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), lb.KeywordPlural(), policy.PolicyActionPerform, "status") } func (lb *SLoadbalancer) PostCreate(ctx context.Context, userCred mcclient.TokenCredential, ownerProjId string, query jsonutils.JSONObject, data jsonutils.JSONObject) { diff --git a/pkg/compute/models/networks.go b/pkg/compute/models/networks.go index c1ddf8b93d..d6316a8ff1 100644 --- a/pkg/compute/models/networks.go +++ b/pkg/compute/models/networks.go @@ -17,8 +17,10 @@ import ( "yunion.io/x/pkg/utils" "yunion.io/x/sqlchemy" + "yunion.io/x/onecloud/pkg/cloudcommon/consts" "yunion.io/x/onecloud/pkg/cloudcommon/db" "yunion.io/x/onecloud/pkg/cloudcommon/db/taskman" + "yunion.io/x/onecloud/pkg/cloudcommon/policy" "yunion.io/x/onecloud/pkg/cloudprovider" "yunion.io/x/onecloud/pkg/compute/options" "yunion.io/x/onecloud/pkg/httperrors" @@ -134,7 +136,7 @@ func (self *SNetwork) GetVpc() *SVpc { } func (manager *SNetworkManager) AllowCreateItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return userCred.IsAdminAllow(consts.GetServiceType(), manager.KeywordPlural(), policy.PolicyActionCreate) } func (self *SNetwork) ValidateDeleteCondition(ctx context.Context) error { @@ -627,7 +629,7 @@ func (manager *SNetworkManager) allNetworksQ(rangeObj db.IStandaloneModel) *sqlc func (manager *SNetworkManager) totalPortCountQ(userCred mcclient.TokenCredential, rangeObj db.IStandaloneModel) *sqlchemy.SQuery { q := manager.allNetworksQ(rangeObj) networks := manager.Query().SubQuery() - if userCred != nil && !userCred.IsSystemAdmin() { + if userCred != nil && !userCred.IsAdminAllow(consts.GetServiceType(), manager.KeywordPlural(), policy.PolicyActionList) { q = q.Filter(sqlchemy.OR( sqlchemy.Equals(networks.Field("tenant_id"), userCred.GetProjectId()), sqlchemy.IsTrue(networks.Field("is_public")))) @@ -759,7 +761,8 @@ func isValidNetworkInfo(userCred mcclient.TokenCredential, netConfig *SNetworkCo return httperrors.NewInputParameterError("Address %s not in range", netConfig.Address) } if netConfig.Reserved { - if !userCred.IsSystemAdmin() { + // the privilege to access reserved ip + if !userCred.IsAdminAllow(consts.GetServiceType(), ReservedipManager.KeywordPlural(), policy.PolicyActionGet) { return httperrors.NewForbiddenError("Only system admin allowed to use reserved ip") } if ReservedipManager.GetReservedIP(net, netConfig.Address) == nil { @@ -876,7 +879,7 @@ func (self *SNetwork) GetCustomizeColumns(ctx context.Context, userCred mcclient } func (self *SNetwork) AllowPerformReserveIp(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) + return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "reserve-ip") } func (self *SNetwork) PerformReserveIp(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -903,7 +906,7 @@ func (self *SNetwork) PerformReserveIp(ctx context.Context, userCred mcclient.To } func (self *SNetwork) AllowPerformReleaseReservedIp(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) + return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "release-reserved-ip") } func (self *SNetwork) PerformReleaseReservedIp(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -920,7 +923,7 @@ func (self *SNetwork) PerformReleaseReservedIp(ctx context.Context, userCred mcc } func (self *SNetwork) AllowGetDetailsReservedIps(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { - return self.IsOwner(userCred) + return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionGet, "reserved-ips") } func (self *SNetwork) GetDetailsReservedIps(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -1211,7 +1214,7 @@ func isOverlapNetworks(nets []SNetwork, startIp netutils.IPV4Addr, endIp netutil } func (self *SNetwork) CustomizeCreate(ctx context.Context, userCred mcclient.TokenCredential, ownerProjId string, query jsonutils.JSONObject, data jsonutils.JSONObject) error { - if userCred.IsSystemAdmin() && ownerProjId == userCred.GetProjectId() { + if userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionCreate) && ownerProjId == userCred.GetProjectId() { self.IsPublic = true } else { self.IsPublic = false @@ -1396,7 +1399,7 @@ func (self *SNetwork) ValidateUpdateCondition(ctx context.Context) error { } func (self *SNetwork) AllowPerformPurge(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionDelete) } func (self *SNetwork) PerformPurge(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { diff --git a/pkg/compute/models/reservedips.go b/pkg/compute/models/reservedips.go index a03c11e945..80ca7fa632 100644 --- a/pkg/compute/models/reservedips.go +++ b/pkg/compute/models/reservedips.go @@ -6,7 +6,9 @@ import ( "yunion.io/x/jsonutils" "yunion.io/x/log" + "yunion.io/x/onecloud/pkg/cloudcommon/consts" "yunion.io/x/onecloud/pkg/cloudcommon/db" + "yunion.io/x/onecloud/pkg/cloudcommon/policy" "yunion.io/x/onecloud/pkg/httperrors" "yunion.io/x/onecloud/pkg/mcclient" "yunion.io/x/sqlchemy" @@ -39,7 +41,7 @@ type SReservedip struct { } func (manager *SReservedipManager) AllowListItems(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return userCred.IsAdminAllow(consts.GetServiceType(), manager.KeywordPlural(), policy.PolicyActionList) } func (manager *SReservedipManager) AllowCreateItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { diff --git a/pkg/compute/models/schedpolicies.go b/pkg/compute/models/schedpolicies.go index 185f932e6b..edf88f4832 100644 --- a/pkg/compute/models/schedpolicies.go +++ b/pkg/compute/models/schedpolicies.go @@ -7,7 +7,9 @@ import ( "database/sql" "yunion.io/x/log" + "yunion.io/x/onecloud/pkg/cloudcommon/consts" "yunion.io/x/onecloud/pkg/cloudcommon/db" + "yunion.io/x/onecloud/pkg/cloudcommon/policy" "yunion.io/x/onecloud/pkg/httperrors" "yunion.io/x/onecloud/pkg/mcclient" "yunion.io/x/onecloud/pkg/util/conditionparser" @@ -121,7 +123,7 @@ func (manager *SSchedpolicyManager) getAllEnabledPolicies() []SSchedpolicy { } func (self *SSchedpolicy) AllowPerformEvaluate(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "evaluate") } func (self *SSchedpolicy) PerformEvaluate(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { diff --git a/pkg/compute/models/secgrouprules.go b/pkg/compute/models/secgrouprules.go index e107610536..126cc3ca7f 100644 --- a/pkg/compute/models/secgrouprules.go +++ b/pkg/compute/models/secgrouprules.go @@ -9,7 +9,9 @@ import ( "yunion.io/x/jsonutils" "yunion.io/x/log" + "yunion.io/x/onecloud/pkg/cloudcommon/consts" "yunion.io/x/onecloud/pkg/cloudcommon/db" + "yunion.io/x/onecloud/pkg/cloudcommon/policy" "yunion.io/x/onecloud/pkg/httperrors" "yunion.io/x/onecloud/pkg/mcclient" "yunion.io/x/pkg/util/compare" @@ -78,14 +80,14 @@ func (manager *SSecurityGroupRuleManager) AllowListItems(ctx context.Context, us func (self *SSecurityGroupRule) AllowUpdateItem(ctx context.Context, userCred mcclient.TokenCredential) bool { if secgroup := self.GetSecGroup(); secgroup != nil { - return secgroup.IsOwner(userCred) + return secgroup.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionUpdate) } return false } func (self *SSecurityGroupRule) AllowDeleteItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { if secgroup := self.GetSecGroup(); secgroup != nil { - return secgroup.IsOwner(userCred) + return secgroup.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionDelete) } return false } diff --git a/pkg/compute/models/snapshots.go b/pkg/compute/models/snapshots.go index ea57780729..b586fd9bff 100644 --- a/pkg/compute/models/snapshots.go +++ b/pkg/compute/models/snapshots.go @@ -11,8 +11,10 @@ import ( "yunion.io/x/pkg/util/compare" "yunion.io/x/sqlchemy" + "yunion.io/x/onecloud/pkg/cloudcommon/consts" "yunion.io/x/onecloud/pkg/cloudcommon/db" "yunion.io/x/onecloud/pkg/cloudcommon/db/taskman" + "yunion.io/x/onecloud/pkg/cloudcommon/policy" "yunion.io/x/onecloud/pkg/cloudprovider" "yunion.io/x/onecloud/pkg/compute/options" "yunion.io/x/onecloud/pkg/httperrors" @@ -86,8 +88,8 @@ func ValidateSnapshotName(hypervisor, name, owner string) error { return nil } -func (self *SSnapshot) AllowListItems(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { - return self.IsOwner(userCred) +func (self *SSnapshotManager) AllowListItems(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { + return true } func (manager *SSnapshotManager) ListItemFilter(ctx context.Context, q *sqlchemy.SQuery, userCred mcclient.TokenCredential, query jsonutils.JSONObject) (*sqlchemy.SQuery, error) { @@ -323,7 +325,7 @@ func (self *SSnapshotManager) CreateSnapshot(ctx context.Context, userCred mccli } func (self *SSnapshot) AllowDeleteItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) + return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionDelete) } func (self *SSnapshot) StartSnapshotDeleteTask(ctx context.Context, userCred mcclient.TokenCredential, reloadDisk bool, parentTaskId string) error { @@ -364,7 +366,7 @@ func (self *SSnapshot) CustomizeDelete(ctx context.Context, userCred mcclient.To } func (self *SSnapshot) AllowPerformDeleted(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) + return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionDelete) } func (self *SSnapshot) PerformDeleted(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -401,7 +403,7 @@ func (self *SSnapshotManager) GetConvertSnapshot(deleteSnapshot *SSnapshot) (*SS } func (self *SSnapshotManager) AllowPerformDeleteDiskSnapshots(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsAdmin() + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "delete-disk-snapshots") } func (self *SSnapshotManager) PerformDeleteDiskSnapshots(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -586,7 +588,7 @@ func (self *SSnapshot) GetISnapshotRegion() (cloudprovider.ICloudRegion, error) } func (self *SSnapshot) AllowPerformPurge(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionDelete) } func (self *SSnapshot) PerformPurge(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { diff --git a/pkg/compute/models/storagecachedimages.go b/pkg/compute/models/storagecachedimages.go index 4a646c146d..29d5889890 100644 --- a/pkg/compute/models/storagecachedimages.go +++ b/pkg/compute/models/storagecachedimages.go @@ -11,8 +11,10 @@ import ( "yunion.io/x/pkg/utils" "yunion.io/x/sqlchemy" + "yunion.io/x/onecloud/pkg/cloudcommon/consts" "yunion.io/x/onecloud/pkg/cloudcommon/db" "yunion.io/x/onecloud/pkg/cloudcommon/db/lockman" + "yunion.io/x/onecloud/pkg/cloudcommon/policy" "yunion.io/x/onecloud/pkg/httperrors" "yunion.io/x/onecloud/pkg/mcclient" ) @@ -127,7 +129,7 @@ func (self *SStoragecachedimage) GetExtraDetails(ctx context.Context, userCred m } func (manager *SStoragecachedimageManager) AllowListDescendent(ctx context.Context, userCred mcclient.TokenCredential, model db.IStandaloneModel, query jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return userCred.IsAdminAllow(consts.GetServiceType(), manager.KeywordPlural(), policy.PolicyActionList) } func (self *SStoragecachedimage) GetCachedimage() *SCachedimage { diff --git a/pkg/compute/models/storagecaches.go b/pkg/compute/models/storagecaches.go index 240a99782b..78f33ad971 100644 --- a/pkg/compute/models/storagecaches.go +++ b/pkg/compute/models/storagecaches.go @@ -9,8 +9,10 @@ import ( "yunion.io/x/log" "yunion.io/x/sqlchemy" + "yunion.io/x/onecloud/pkg/cloudcommon/consts" "yunion.io/x/onecloud/pkg/cloudcommon/db" "yunion.io/x/onecloud/pkg/cloudcommon/db/taskman" + "yunion.io/x/onecloud/pkg/cloudcommon/policy" "yunion.io/x/onecloud/pkg/cloudprovider" "yunion.io/x/onecloud/pkg/httperrors" "yunion.io/x/onecloud/pkg/mcclient" @@ -292,7 +294,7 @@ func (self *SStoragecache) ValidateDeleteCondition(ctx context.Context) error { } func (self *SStoragecache) AllowPerformUncacheImage(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "uncache-image") } func (self *SStoragecache) PerformUncacheImage(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -329,7 +331,7 @@ func (self *SStoragecache) PerformUncacheImage(ctx context.Context, userCred mcc } func (self *SStoragecache) AllowPerformCacheImage(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "cache-image") } func (self *SStoragecache) PerformCacheImage(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { diff --git a/pkg/compute/models/storages.go b/pkg/compute/models/storages.go index abab9ce61b..7a76c6e995 100644 --- a/pkg/compute/models/storages.go +++ b/pkg/compute/models/storages.go @@ -5,7 +5,9 @@ import ( "yunion.io/x/jsonutils" "yunion.io/x/log" + "yunion.io/x/onecloud/pkg/cloudcommon/consts" "yunion.io/x/onecloud/pkg/cloudcommon/db" + "yunion.io/x/onecloud/pkg/cloudcommon/policy" "yunion.io/x/onecloud/pkg/cloudprovider" "yunion.io/x/onecloud/pkg/compute/options" "yunion.io/x/onecloud/pkg/httperrors" @@ -692,7 +694,7 @@ func (self *SStorage) SetStoragecache(cache *SStoragecache) error { } func (self *SStorage) AllowPerformCacheImage(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "cache-image") } func (self *SStorage) GetStoragecache() *SStoragecache { @@ -714,7 +716,7 @@ func (self *SStorage) PerformCacheImage(ctx context.Context, userCred mcclient.T } func (self *SStorage) AllowPerformUncacheImage(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "uncache-image") } func (self *SStorage) PerformUncacheImage(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { diff --git a/pkg/compute/models/vpcs.go b/pkg/compute/models/vpcs.go index 842f55b98b..532dd2a512 100644 --- a/pkg/compute/models/vpcs.go +++ b/pkg/compute/models/vpcs.go @@ -11,8 +11,10 @@ import ( "yunion.io/x/pkg/util/netutils" "yunion.io/x/sqlchemy" + "yunion.io/x/onecloud/pkg/cloudcommon/consts" "yunion.io/x/onecloud/pkg/cloudcommon/db" "yunion.io/x/onecloud/pkg/cloudcommon/db/taskman" + "yunion.io/x/onecloud/pkg/cloudcommon/policy" "yunion.io/x/onecloud/pkg/cloudprovider" "yunion.io/x/onecloud/pkg/httperrors" "yunion.io/x/onecloud/pkg/mcclient" @@ -456,7 +458,7 @@ func (self *SVpc) getIPRange() netutils.IPV4AddrRange { } func (self *SVpc) AllowPerformPurge(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionDelete) } func (self *SVpc) PerformPurge(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { diff --git a/pkg/compute/specs/handler.go b/pkg/compute/specs/handler.go index 2cf3b80d39..a7bc1a11b8 100644 --- a/pkg/compute/specs/handler.go +++ b/pkg/compute/specs/handler.go @@ -12,6 +12,7 @@ import ( "yunion.io/x/onecloud/pkg/appctx" "yunion.io/x/onecloud/pkg/appsrv" + "yunion.io/x/onecloud/pkg/cloudcommon/policy" "yunion.io/x/onecloud/pkg/compute/models" "yunion.io/x/onecloud/pkg/httperrors" "yunion.io/x/onecloud/pkg/mcclient" @@ -42,7 +43,7 @@ func AddSpecHandler(prefix string, app *appsrv.Application) { func processFilter(handleFunc specHandleFunc) appsrv.FilterHandler { return func(ctx context.Context, w http.ResponseWriter, r *http.Request) { - userCred := auth.FetchUserCredential(ctx) + userCred := auth.FetchUserCredential(ctx, policy.FilterPolicyCredential) query, err := jsonutils.ParseQueryString(r.URL.RawQuery) if err != nil { httperrors.GeneralServerError(w, err) diff --git a/pkg/compute/sshkeys/handler.go b/pkg/compute/sshkeys/handler.go index f6bda5d2cf..85f8777933 100644 --- a/pkg/compute/sshkeys/handler.go +++ b/pkg/compute/sshkeys/handler.go @@ -9,7 +9,9 @@ import ( "yunion.io/x/jsonutils" "yunion.io/x/onecloud/pkg/appctx" "yunion.io/x/onecloud/pkg/appsrv" + "yunion.io/x/onecloud/pkg/cloudcommon/consts" "yunion.io/x/onecloud/pkg/cloudcommon/db" + "yunion.io/x/onecloud/pkg/cloudcommon/policy" "yunion.io/x/onecloud/pkg/httperrors" "yunion.io/x/onecloud/pkg/mcclient" "yunion.io/x/onecloud/pkg/mcclient/auth" @@ -22,8 +24,8 @@ func AddSshKeysHandler(prefix string, app *appsrv.Application) { func adminSshKeysHandler(ctx context.Context, w http.ResponseWriter, r *http.Request) { publicOnly := false - userCred := auth.FetchUserCredential(ctx) - if !userCred.IsSystemAdmin() { + userCred := auth.FetchUserCredential(ctx, policy.FilterPolicyCredential) + if !userCred.IsAdminAllow(consts.GetServiceType(), "sshkeypairs", policy.PolicyActionGet) { publicOnly = true } params := appctx.AppContextParams(ctx) @@ -53,7 +55,7 @@ func adminSshKeysHandler(ctx context.Context, w http.ResponseWriter, r *http.Req } func sshKeysHandler(ctx context.Context, w http.ResponseWriter, r *http.Request) { - userCred := auth.FetchUserCredential(ctx) + userCred := auth.FetchUserCredential(ctx, policy.FilterPolicyCredential) query, err := jsonutils.ParseQueryString(r.URL.RawQuery) if err != nil { httperrors.GeneralServerError(w, err) @@ -67,7 +69,7 @@ func sshKeysHandler(ctx context.Context, w http.ResponseWriter, r *http.Request) func sendSshKey(ctx context.Context, w http.ResponseWriter, userCred mcclient.TokenCredential, projectId string, isAdmin bool, publicOnly bool) { var privKey, pubKey string - if isAdmin && userCred.IsSystemAdmin() { + if isAdmin && userCred.IsAdminAllow(consts.GetServiceType(), "sshkeypairs", policy.PolicyActionGet) { privKey, pubKey, _ = GetSshAdminKeypair(ctx) } else { privKey, pubKey, _ = GetSshProjectKeypair(ctx, projectId) diff --git a/pkg/compute/usages/handler.go b/pkg/compute/usages/handler.go index 7a32ccfddd..edd4300612 100644 --- a/pkg/compute/usages/handler.go +++ b/pkg/compute/usages/handler.go @@ -75,7 +75,7 @@ func rangeObjHandler( reporter objUsageFunc, ) appsrv.FilterHandler { return func(ctx context.Context, w http.ResponseWriter, r *http.Request) { - userCred := auth.FetchUserCredential(ctx) + userCred := auth.FetchUserCredential(ctx, policy.FilterPolicyCredential) obj, err := getRangeObj(ctx, manager, userCred) if err != nil { httperrors.NotFoundError(w, err.Error()) @@ -276,7 +276,7 @@ func ReportGeneralUsage(userCred mcclient.TokenCredential, rangeObj db.IStandalo isAdmin = true } } else { - isAdmin = userCred.IsSystemAdmin() + isAdmin = userCred.IsAdminAllow(consts.GetServiceType(), "usages", policy.PolicyActionGet) } if isAdmin { diff --git a/pkg/mcclient/auth/middleware.go b/pkg/mcclient/auth/middleware.go index fa14ac898c..5c892a33ce 100644 --- a/pkg/mcclient/auth/middleware.go +++ b/pkg/mcclient/auth/middleware.go @@ -53,10 +53,14 @@ func AuthenticateWithDelayDecision(f appsrv.FilterHandler, delayDecision bool) a } } -func FetchUserCredential(ctx context.Context) mcclient.TokenCredential { +func FetchUserCredential(ctx context.Context, filter func(mcclient.TokenCredential) mcclient.TokenCredential) mcclient.TokenCredential { tokenValue := ctx.Value(AUTH_TOKEN) if tokenValue != nil { - return tokenValue.(mcclient.TokenCredential) + token := tokenValue.(mcclient.TokenCredential) + if filter != nil { + token = filter(token) + } + return token } return nil } diff --git a/pkg/mcclient/modules/base.go b/pkg/mcclient/modules/base.go index 3a71f43eac..97becef66b 100644 --- a/pkg/mcclient/modules/base.go +++ b/pkg/mcclient/modules/base.go @@ -32,7 +32,7 @@ func NewBaseManager(serviceType, endpointType, version string, columns, adminCol func (this *BaseManager) GetColumns(session *mcclient.ClientSession) []string { cols := this.columns - if session.IsSystemAdmin() && len(this.adminColumns) > 0 { + if session.HasSystemAdminPrivelege() && len(this.adminColumns) > 0 { cols = append(cols, this.adminColumns...) } return cols diff --git a/pkg/mcclient/session.go b/pkg/mcclient/session.go index fdf29f278d..574878ab3a 100644 --- a/pkg/mcclient/session.go +++ b/pkg/mcclient/session.go @@ -9,7 +9,6 @@ import ( "regexp" "strings" "time" - "yunion.io/x/jsonutils" "yunion.io/x/onecloud/pkg/util/httputils" "yunion.io/x/pkg/utils" @@ -150,8 +149,8 @@ func (this *ClientSession) ParseJSONResponse(resp *http.Response, err error) (ht return httputils.ParseJSONResponse(resp, err, this.client.debug) } -func (this *ClientSession) IsSystemAdmin() bool { - return this.token.IsSystemAdmin() +func (this *ClientSession) HasSystemAdminPrivelege() bool { + return this.token.HasSystemAdminPrivelege() } func (this *ClientSession) GetRegion() string { diff --git a/pkg/mcclient/token.go b/pkg/mcclient/token.go index 6aef27acd7..a2a0ab7ad8 100644 --- a/pkg/mcclient/token.go +++ b/pkg/mcclient/token.go @@ -44,8 +44,9 @@ type TokenCredential interface { GetExpires() time.Time IsValid() bool ValidDuration() time.Duration - IsAdmin() bool - IsSystemAdmin() bool + // IsAdmin() bool + HasSystemAdminPrivelege() bool + IsAdminAllow(service string, resource string, action string, extra ...string) bool GetRegions() []string GetServiceCatalog() IServiceCatalog diff --git a/pkg/mcclient/token2.go b/pkg/mcclient/token2.go index f2a8eb8a43..f64d045014 100644 --- a/pkg/mcclient/token2.go +++ b/pkg/mcclient/token2.go @@ -130,10 +130,14 @@ func (this *TokenCredentialV2) GetRegions() []string { return this.ServiceCatalog.getRegions() } -func (this *TokenCredentialV2) IsSystemAdmin() bool { +func (this *TokenCredentialV2) HasSystemAdminPrivelege() bool { return this.IsAdmin() && this.GetTenantName() == "system" } +func (this *TokenCredentialV2) IsAdminAllow(service string, resource string, action string, extra ...string) bool { + return this.HasSystemAdminPrivelege() +} + func (this *TokenCredentialV2) GetServiceURL(service, region, zone, endpointType string) (string, error) { return this.ServiceCatalog.GetServiceURL(service, region, zone, endpointType) } diff --git a/pkg/mcclient/token3.go b/pkg/mcclient/token3.go index bc172bf78d..38e962b119 100644 --- a/pkg/mcclient/token3.go +++ b/pkg/mcclient/token3.go @@ -135,10 +135,14 @@ func (this *TokenCredentialV3) IsAdmin() bool { return false } -func (this *TokenCredentialV3) IsSystemAdmin() bool { +func (this *TokenCredentialV3) HasSystemAdminPrivelege() bool { return this.IsAdmin() && this.GetTenantName() == "system" } +func (this *TokenCredentialV3) IsAdminAllow(service string, resource string, action string, extra ...string) bool { + return this.HasSystemAdminPrivelege() +} + func (this *TokenCredentialV3) GetRegions() []string { return this.Token.Catalog.getRegions() } diff --git a/pkg/mcclient/tokensimple.go b/pkg/mcclient/tokensimple.go index f10c2b73fa..15a8badbfb 100644 --- a/pkg/mcclient/tokensimple.go +++ b/pkg/mcclient/tokensimple.go @@ -84,10 +84,14 @@ func (self *SSimpleToken) IsAdmin() bool { return false } -func (self *SSimpleToken) IsSystemAdmin() bool { +func (self *SSimpleToken) HasSystemAdminPrivelege() bool { return self.IsAdmin() && self.Project == "system" } +func (this *SSimpleToken) IsAdminAllow(service string, resource string, action string, extra ...string) bool { + return this.HasSystemAdminPrivelege() +} + func (self *SSimpleToken) GetRegions() []string { return nil } diff --git a/pkg/webconsole/handlers.go b/pkg/webconsole/handlers.go index 37b2c47071..67ed8f81f6 100644 --- a/pkg/webconsole/handlers.go +++ b/pkg/webconsole/handlers.go @@ -17,6 +17,7 @@ import ( "yunion.io/x/onecloud/pkg/webconsole/command" o "yunion.io/x/onecloud/pkg/webconsole/options" "yunion.io/x/onecloud/pkg/webconsole/session" + "yunion.io/x/onecloud/pkg/cloudcommon/policy" ) const ( @@ -102,7 +103,7 @@ type CloudEnv struct { func fetchCloudEnv(ctx context.Context, w http.ResponseWriter, r *http.Request) (*CloudEnv, error) { params, query, body := appsrv.FetchEnv(ctx, w, r) - userCred := auth.FetchUserCredential(ctx) + userCred := auth.FetchUserCredential(ctx, policy.FilterPolicyCredential) if userCred == nil { return nil, httperrors.NewUnauthorizedError("No token founded") } @@ -141,7 +142,7 @@ func handleK8sLog(ctx context.Context, w http.ResponseWriter, r *http.Request) { } func handleSshShell(ctx context.Context, w http.ResponseWriter, r *http.Request) { - userCred := auth.FetchUserCredential(ctx) + userCred := auth.FetchUserCredential(ctx, policy.FilterPolicyCredential) env, err := fetchCloudEnv(ctx, w, r) if err != nil { httperrors.GeneralServerError(w, err) diff --git a/pkg/webconsole/service/service.go b/pkg/webconsole/service/service.go index d86ef761c4..cc89ee6122 100644 --- a/pkg/webconsole/service/service.go +++ b/pkg/webconsole/service/service.go @@ -15,6 +15,7 @@ import ( "yunion.io/x/onecloud/pkg/webconsole" o "yunion.io/x/onecloud/pkg/webconsole/options" "yunion.io/x/onecloud/pkg/webconsole/server" + "yunion.io/x/onecloud/pkg/cloudcommon/consts" ) func ensureBinExists(binPath string) { @@ -24,6 +25,8 @@ func ensureBinExists(binPath string) { } func StartService() { + consts.SetServiceType("webconsole") + cloudcommon.ParseOptions(&o.Options, &o.Options.Options, os.Args, "webconsole.conf") if o.Options.ApiServer == "" { diff --git a/pkg/yunionconf/models/parameters.go b/pkg/yunionconf/models/parameters.go index 9f3f56f97f..dbb11026be 100644 --- a/pkg/yunionconf/models/parameters.go +++ b/pkg/yunionconf/models/parameters.go @@ -11,6 +11,8 @@ import ( "yunion.io/x/pkg/util/timeutils" "yunion.io/x/pkg/utils" "yunion.io/x/sqlchemy" + "yunion.io/x/onecloud/pkg/cloudcommon/consts" + "yunion.io/x/onecloud/pkg/cloudcommon/policy" ) const ( @@ -72,7 +74,7 @@ func getNamespaceInContext(userCred mcclient.TokenCredential, query jsonutils.JS func getNamespace(userCred mcclient.TokenCredential, query jsonutils.JSONObject, data *jsonutils.JSONDict) (string, string, error) { var namespace, namespace_id string - if userCred.IsSystemAdmin() { + if userCred.IsAdminAllow(consts.GetServiceType(), ParameterManager.KeywordPlural(), policy.PolicyActionGet) { if name, nameId, e := getNamespaceInContext(userCred, query, data); e != nil { return "", "", e } else { @@ -92,7 +94,7 @@ func (manager *SParameterManager) AllowListItems(ctx context.Context, userCred m return true } - return userCred.IsSystemAdmin() + return userCred.IsAdminAllow(consts.GetServiceType(), manager.KeywordPlural(), policy.PolicyActionList) } func (manager *SParameterManager) AllowCreateItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { @@ -100,7 +102,7 @@ func (manager *SParameterManager) AllowCreateItem(ctx context.Context, userCred return true } - return userCred.IsSystemAdmin() + return userCred.IsAdminAllow(consts.GetServiceType(), manager.KeywordPlural(), policy.PolicyActionCreate) } func (manager *SParameterManager) ValidateCreateData(ctx context.Context, userCred mcclient.TokenCredential, ownerProjId string, query jsonutils.JSONObject, data *jsonutils.JSONDict) (*jsonutils.JSONDict, error) { @@ -146,7 +148,7 @@ func (manager *SParameterManager) FilterByName(q *sqlchemy.SQuery, name string) } func (manager *SParameterManager) ListItemFilter(ctx context.Context, q *sqlchemy.SQuery, userCred mcclient.TokenCredential, query jsonutils.JSONObject) (*sqlchemy.SQuery, error) { - if userCred.IsSystemAdmin() { + if userCred.IsAdminAllow(consts.GetServiceType(), manager.KeywordPlural(), policy.PolicyActionList) { if id, _ := query.GetString("namespace_id"); len(id) > 0 { q = q.Equals("namespace_id", id) } else if id, _ := query.GetString("service_id"); len(id) > 0 { @@ -171,7 +173,7 @@ func (model *SParameter) IsOwner(userCred mcclient.TokenCredential) bool { } func (model *SParameter) AllowUpdateItem(ctx context.Context, userCred mcclient.TokenCredential) bool { - return model.IsOwner(userCred) || userCred.IsSystemAdmin() + return model.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), model.KeywordPlural(), policy.PolicyActionUpdate) } func (model *SParameter) ValidateUpdateData(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data *jsonutils.JSONDict) (*jsonutils.JSONDict, error) { @@ -191,7 +193,7 @@ func (model *SParameter) ValidateUpdateData(ctx context.Context, userCred mcclie } func (model *SParameter) AllowDeleteItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return model.IsOwner(userCred) || userCred.IsSystemAdmin() + return model.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), model.KeywordPlural(), policy.PolicyActionDelete) } func (model *SParameter) CustomizeDelete(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) error { @@ -211,5 +213,5 @@ func (model *SParameter) Delete(ctx context.Context, userCred mcclient.TokenCred } func (model *SParameter) AllowGetDetails(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { - return model.IsOwner(userCred) || userCred.IsSystemAdmin() + return model.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), model.KeywordPlural(), policy.PolicyActionGet) } diff --git a/pkg/yunionconf/service/service.go b/pkg/yunionconf/service/service.go index 8899ce3f1f..9520a5dfba 100644 --- a/pkg/yunionconf/service/service.go +++ b/pkg/yunionconf/service/service.go @@ -16,6 +16,8 @@ import ( ) func StartService() { + consts.SetServiceType("yunionconf") + cloudcommon.ParseOptions(&options.Options, &options.Options.Options, os.Args, "yunionconf.conf") cloudcommon.InitAuth(&options.Options.Options, func() { log.Infof("Auth complete!!") From bc0b5d1e44bce18e560ab1b42a15141eb700aa99 Mon Sep 17 00:00:00 2001 From: Qiu Jian Date: Fri, 30 Nov 2018 23:29:03 +0800 Subject: [PATCH 02/15] fix userCred.IsSystemAdmin() for set/del extra option --- pkg/compute/models/guest_actions.go | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkg/compute/models/guest_actions.go b/pkg/compute/models/guest_actions.go index c696b687e5..83d92064c6 100644 --- a/pkg/compute/models/guest_actions.go +++ b/pkg/compute/models/guest_actions.go @@ -1740,7 +1740,7 @@ func (self *SGuest) PerformUserData(ctx context.Context, userCred mcclient.Token } func (self *SGuest) AllowPerformSetExtraOption(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "set-extra-option") } func (self *SGuest) PerformSetExtraOption(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -1768,7 +1768,7 @@ func (self *SGuest) SetExtraOptions(ctx context.Context, userCred mcclient.Token } func (self *SGuest) AllowPerformDelExtraOption(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "del-extra-option") } func (self *SGuest) PerformDelExtraOption(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { From 334f3605bab8878490a2f67567e9fc8f1deb6319 Mon Sep 17 00:00:00 2001 From: Qiu Jian Date: Sat, 1 Dec 2018 00:42:29 +0800 Subject: [PATCH 03/15] minor fixes --- pkg/cloudcommon/db/interface.go | 1 + pkg/cloudcommon/db/keystonecache.go | 2 +- pkg/cloudcommon/db/opslog.go | 7 ------- pkg/cloudcommon/db/tenantcache.go | 4 ++-- pkg/cloudcommon/db/usercache.go | 4 ++-- pkg/compute/models/secgrouprules.go | 2 +- 6 files changed, 7 insertions(+), 13 deletions(-) diff --git a/pkg/cloudcommon/db/interface.go b/pkg/cloudcommon/db/interface.go index b42c522bb9..aefec45f8b 100644 --- a/pkg/cloudcommon/db/interface.go +++ b/pkg/cloudcommon/db/interface.go @@ -22,6 +22,7 @@ type IModelManager interface { KeywordPlural() string Alias() string AliasPlural() string + SetAlias(alias string, aliasPlural string) ValidateName(name string) error diff --git a/pkg/cloudcommon/db/keystonecache.go b/pkg/cloudcommon/db/keystonecache.go index cfe3cbc45c..306fcef368 100644 --- a/pkg/cloudcommon/db/keystonecache.go +++ b/pkg/cloudcommon/db/keystonecache.go @@ -64,7 +64,7 @@ func NewKeystoneCacheObject(id string, name string, domainId string, domain stri }*/ func (manager *SKeystoneCacheObjectManager) BatchFetchNames(idStrs []string) []string { - t := manager.tableSpec.Instance() + t := manager.TableSpec().Instance() results, err := t.Query(t.Field("name")).In("id", idStrs).AllStringMap() if err != nil { return nil diff --git a/pkg/cloudcommon/db/opslog.go b/pkg/cloudcommon/db/opslog.go index 456c617697..45c147eb9e 100644 --- a/pkg/cloudcommon/db/opslog.go +++ b/pkg/cloudcommon/db/opslog.go @@ -176,13 +176,6 @@ var _ IModel = (*SOpsLog)(nil) func init() { OpsLog = &SOpsLogManager{NewModelBaseManager(SOpsLog{}, "opslog_tbl", "event", "events")} - -} - -func (manager *SOpsLogManager) SetKeyword(kw, kwPlural string) *SOpsLogManager { - manager.keyword = kw - manager.keywordPlural = kwPlural - return manager } func (opslog *SOpsLog) GetId() string { diff --git a/pkg/cloudcommon/db/tenantcache.go b/pkg/cloudcommon/db/tenantcache.go index f2a7aa6068..6b8f4c3f69 100644 --- a/pkg/cloudcommon/db/tenantcache.go +++ b/pkg/cloudcommon/db/tenantcache.go @@ -90,8 +90,8 @@ func (manager *STenantCacheManager) fetchTenantFromKeystone(ctx context.Context, } func (manager *STenantCacheManager) Save(ctx context.Context, idStr string, name string, domainId string, domain string) (*STenant, error) { - lockman.LockRawObject(ctx, manager.keyword, idStr) - defer lockman.ReleaseRawObject(ctx, manager.keyword, idStr) + lockman.LockRawObject(ctx, manager.KeywordPlural(), idStr) + defer lockman.ReleaseRawObject(ctx, manager.KeywordPlural(), idStr) objo, err := manager.FetchById(idStr) if err != nil && err != sql.ErrNoRows { diff --git a/pkg/cloudcommon/db/usercache.go b/pkg/cloudcommon/db/usercache.go index 1fe3f560c5..7b01d845bc 100644 --- a/pkg/cloudcommon/db/usercache.go +++ b/pkg/cloudcommon/db/usercache.go @@ -53,8 +53,8 @@ func (manager *SUserCacheManager) FetchUserByName(idStr string) (*SUser, error) } func (manager *SUserCacheManager) Save(ctx context.Context, idStr string, name string, domainId string, domain string) (*SUser, error) { - lockman.LockRawObject(ctx, manager.keyword, idStr) - defer lockman.ReleaseRawObject(ctx, manager.keyword, idStr) + lockman.LockRawObject(ctx, manager.KeywordPlural(), idStr) + defer lockman.ReleaseRawObject(ctx, manager.KeywordPlural(), idStr) obj, err := manager.FetchUserById(idStr) if err != nil && err != sql.ErrNoRows { diff --git a/pkg/compute/models/secgrouprules.go b/pkg/compute/models/secgrouprules.go index 91c6abc17f..93ae01adee 100644 --- a/pkg/compute/models/secgrouprules.go +++ b/pkg/compute/models/secgrouprules.go @@ -203,7 +203,7 @@ func (manager *SSecurityGroupRuleManager) ValidateCreateData(ctx context.Context if err != nil { return nil, httperrors.NewInputParameterError(err.Error()) } - return manager.SModelBaseManager.ValidateCreateData(ctx, userCred, ownerProjId, query, data) + return manager.SResourceBaseManager.ValidateCreateData(ctx, userCred, ownerProjId, query, data) } func (self *SSecurityGroupRule) ValidateUpdateData(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data *jsonutils.JSONDict) (*jsonutils.JSONDict, error) { From b4fcb63b643d4e751200779b7e71fe75edb9198b Mon Sep 17 00:00:00 2001 From: Qiu Jian Date: Sat, 1 Dec 2018 01:05:13 +0800 Subject: [PATCH 04/15] Remove SInfrastructureManager & SInfrasture --- pkg/cloudcommon/policy/policy.go | 24 ++++++++++++++++++ pkg/compute/models/baremetalagents.go | 22 ++++++++++++++-- pkg/compute/models/cachedimages.go | 22 ++++++++++++++-- pkg/compute/models/cloudaccounts.go | 22 ++++++++++++++-- pkg/compute/models/cloudproviders.go | 22 ++++++++++++++-- pkg/compute/models/cloudregions.go | 18 +++++++++++-- pkg/compute/models/dynamicschedtags.go | 22 ++++++++++++++-- pkg/compute/models/hosts.go | 31 +++++++++++++---------- pkg/compute/models/inframanagers.go | 30 ++-------------------- pkg/compute/models/loadbalanceragents.go | 27 +++++++++++++++----- pkg/compute/models/schedpolicies.go | 22 ++++++++++++++-- pkg/compute/models/schedtags.go | 16 ++++++++++-- pkg/compute/models/storagecachedimages.go | 22 ++++++++++++++-- pkg/compute/models/storagecaches.go | 22 ++++++++++++++-- pkg/compute/models/storages.go | 25 ++++++++++++++---- pkg/compute/models/vcenters.go | 2 -- pkg/compute/models/vpcs.go | 22 ++++++++++++++-- pkg/compute/models/wires.go | 24 ++++++++++++++++-- pkg/compute/models/zones.go | 20 +++++++++++++-- 19 files changed, 335 insertions(+), 80 deletions(-) diff --git a/pkg/cloudcommon/policy/policy.go b/pkg/cloudcommon/policy/policy.go index 2431c64ea5..019f2c4284 100644 --- a/pkg/cloudcommon/policy/policy.go +++ b/pkg/cloudcommon/policy/policy.go @@ -48,6 +48,30 @@ var ( Action: PolicyActionGet, Result: rbacutils.UserAllow, }, + { + Service: "compute", + Resource: "storages", + Action: PolicyActionList, + Result: rbacutils.UserAllow, + }, + { + Service: "compute", + Resource: "storages", + Action: PolicyActionGet, + Result: rbacutils.UserAllow, + }, + { + Service: "compute", + Resource: "schedtags", + Action: PolicyActionList, + Result: rbacutils.UserAllow, + }, + { + Service: "compute", + Resource: "schedtags", + Action: PolicyActionGet, + Result: rbacutils.UserAllow, + }, { Service: "compute", Resource: "cloudregions", diff --git a/pkg/compute/models/baremetalagents.go b/pkg/compute/models/baremetalagents.go index 606333ea67..5bbf758354 100644 --- a/pkg/compute/models/baremetalagents.go +++ b/pkg/compute/models/baremetalagents.go @@ -21,12 +21,10 @@ const ( type SBaremetalagentManager struct { db.SStandaloneResourceBaseManager - SInfrastructureManager } type SBaremetalagent struct { db.SStandaloneResourceBase - SInfrastructure Status string `width:"36" charset:"ascii" nullable:"false" default:"disable" list:"user" create:"optional"` AccessIp string `width:"16" charset:"ascii" nullable:"false" list:"admin" update:"admin" create:"admin_required"` @@ -40,6 +38,26 @@ func init() { BaremetalagentManager = &SBaremetalagentManager{SStandaloneResourceBaseManager: db.NewStandaloneResourceBaseManager(SBaremetalagent{}, "baremetalagents_tbl", "baremetalagent", "baremetalagents")} } +func (self *SBaremetalagentManager) AllowListItems(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionList) +} + +func (self *SBaremetalagentManager) AllowCreateItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionCreate) +} + +func (self *SBaremetalagent) AllowGetDetails(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionGet) +} + +func (self *SBaremetalagent) AllowUpdateItem(ctx context.Context, userCred mcclient.TokenCredential) bool { + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionUpdate) +} + +func (self *SBaremetalagent) AllowDeleteItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionDelete) +} + func (self *SBaremetalagent) ValidateDeleteCondition(ctx context.Context) error { if self.Status == BAREMETAL_AGENT_ENABLED { return fmt.Errorf("Cannot delete in status %s", self.Status) diff --git a/pkg/compute/models/cachedimages.go b/pkg/compute/models/cachedimages.go index 67e0069e25..1a4ac36bfb 100644 --- a/pkg/compute/models/cachedimages.go +++ b/pkg/compute/models/cachedimages.go @@ -30,7 +30,6 @@ const ( type SCachedimageManager struct { db.SStandaloneResourceBaseManager - SInfrastructureManager } var CachedimageManager *SCachedimageManager @@ -48,7 +47,6 @@ func init() { type SCachedimage struct { db.SStandaloneResourceBase - SInfrastructure Size int64 `nullable:"false" list:"admin" update:"admin" create:"admin_required"` // = Column(BigInteger, nullable=False) # in Byte // virtual_size = Column(BigInteger, nullable=False) # in Byte @@ -58,6 +56,26 @@ type SCachedimage struct { RefCount int `default:"0" list:"admin"` // = Column(Integer, default=0, server_default='0') } +func (self *SCachedimageManager) AllowListItems(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionList) +} + +func (self *SCachedimageManager) AllowCreateItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionCreate) +} + +func (self *SCachedimage) AllowGetDetails(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionGet) +} + +func (self *SCachedimage) AllowUpdateItem(ctx context.Context, userCred mcclient.TokenCredential) bool { + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionUpdate) +} + +func (self *SCachedimage) AllowDeleteItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionDelete) +} + func (self *SCachedimage) ValidateDeleteCondition(ctx context.Context) error { if self.getStoragecacheCount() > 0 { return httperrors.NewNotEmptyError("The image has been cached on storages") diff --git a/pkg/compute/models/cloudaccounts.go b/pkg/compute/models/cloudaccounts.go index 93d0bce62d..9b3b51f2ff 100644 --- a/pkg/compute/models/cloudaccounts.go +++ b/pkg/compute/models/cloudaccounts.go @@ -25,7 +25,6 @@ import ( type SCloudaccountManager struct { db.SEnabledStatusStandaloneResourceBaseManager - SInfrastructureManager } var CloudaccountManager *SCloudaccountManager @@ -43,7 +42,6 @@ func init() { type SCloudaccount struct { db.SEnabledStatusStandaloneResourceBase - SInfrastructure AccessUrl string `width:"64" charset:"ascii" nullable:"true" list:"admin" update:"admin" create:"admin_optional"` @@ -60,6 +58,26 @@ type SCloudaccount struct { Provider string `width:"64" charset:"ascii" list:"admin" create:"admin_required"` } +func (self *SCloudaccountManager) AllowListItems(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionList) +} + +func (self *SCloudaccountManager) AllowCreateItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionCreate) +} + +func (self *SCloudaccount) AllowGetDetails(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionGet) +} + +func (self *SCloudaccount) AllowUpdateItem(ctx context.Context, userCred mcclient.TokenCredential) bool { + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionUpdate) +} + +func (self *SCloudaccount) AllowDeleteItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionDelete) +} + func (self *SCloudaccount) GetCloudproviders() []SCloudprovider { cloudproviders := []SCloudprovider{} q := CloudproviderManager.Query().Equals("cloudaccount_id", self.Id) diff --git a/pkg/compute/models/cloudproviders.go b/pkg/compute/models/cloudproviders.go index 9ba07a5600..959166aed1 100644 --- a/pkg/compute/models/cloudproviders.go +++ b/pkg/compute/models/cloudproviders.go @@ -40,7 +40,6 @@ const ( type SCloudproviderManager struct { db.SEnabledStatusStandaloneResourceBaseManager - SInfrastructureManager } var CloudproviderManager *SCloudproviderManager @@ -58,7 +57,6 @@ func init() { type SCloudprovider struct { db.SEnabledStatusStandaloneResourceBase - SInfrastructure AccessUrl string `width:"64" charset:"ascii" nullable:"true" list:"admin" update:"admin" create:"admin_optional"` // Hostname string `width:"64" charset:"ascii" nullable:"true"` // Column(VARCHAR(64, charset='ascii'), nullable=False) @@ -87,6 +85,26 @@ func (self *SCloudprovider) GetOwnerProjectId() string { return self.ProjectId } +func (self *SCloudproviderManager) AllowListItems(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionList) +} + +func (self *SCloudproviderManager) AllowCreateItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionCreate) +} + +func (self *SCloudprovider) AllowGetDetails(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionGet) +} + +func (self *SCloudprovider) AllowUpdateItem(ctx context.Context, userCred mcclient.TokenCredential) bool { + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionUpdate) +} + +func (self *SCloudprovider) AllowDeleteItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionDelete) +} + func (self *SCloudprovider) ValidateDeleteCondition(ctx context.Context) error { if self.Enabled { return httperrors.NewInvalidStatusError("provider is enabled") diff --git a/pkg/compute/models/cloudregions.go b/pkg/compute/models/cloudregions.go index 374682c40e..5f6f34c269 100644 --- a/pkg/compute/models/cloudregions.go +++ b/pkg/compute/models/cloudregions.go @@ -25,7 +25,6 @@ const ( type SCloudregionManager struct { db.SEnabledStatusStandaloneResourceBaseManager - SInfrastructureManager } var CloudregionManager *SCloudregionManager @@ -43,7 +42,6 @@ func init() { type SCloudregion struct { db.SEnabledStatusStandaloneResourceBase - SInfrastructure Latitude float32 `list:"user"` Longitude float32 `list:"user"` @@ -54,6 +52,22 @@ func (manager *SCloudregionManager) AllowListItems(ctx context.Context, userCred return true } +func (self *SCloudregionManager) AllowCreateItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionCreate) +} + +func (self *SCloudregion) AllowGetDetails(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionGet) +} + +func (self *SCloudregion) AllowUpdateItem(ctx context.Context, userCred mcclient.TokenCredential) bool { + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionUpdate) +} + +func (self *SCloudregion) AllowDeleteItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionDelete) +} + func (self *SCloudregion) CustomizeCreate(ctx context.Context, userCred mcclient.TokenCredential, ownerProjId string, query jsonutils.JSONObject, data jsonutils.JSONObject) error { idstr, _ := data.GetString("id") if len(idstr) > 0 { diff --git a/pkg/compute/models/dynamicschedtags.go b/pkg/compute/models/dynamicschedtags.go index 9770802575..0a1ab9e640 100644 --- a/pkg/compute/models/dynamicschedtags.go +++ b/pkg/compute/models/dynamicschedtags.go @@ -17,7 +17,6 @@ import ( type SDynamicschedtagManager struct { db.SStandaloneResourceBaseManager - SInfrastructureManager } var DynamicschedtagManager *SDynamicschedtagManager @@ -39,7 +38,6 @@ func init() { // type SDynamicschedtag struct { db.SStandaloneResourceBase - SInfrastructure Condition string `width:"256" charset:"ascii" nullable:"false" list:"user" create:"required" update:"admin"` SchedtagId string `width:"36" charset:"ascii" nullable:"false" list:"user" create:"required" update:"admin"` @@ -47,6 +45,26 @@ type SDynamicschedtag struct { Enabled bool `nullable:"false" default:"true" create:"optional" list:"user" update:"user"` } +func (self *SDynamicschedtagManager) AllowListItems(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionList) +} + +func (self *SDynamicschedtagManager) AllowCreateItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionCreate) +} + +func (self *SDynamicschedtag) AllowGetDetails(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionGet) +} + +func (self *SDynamicschedtag) AllowUpdateItem(ctx context.Context, userCred mcclient.TokenCredential) bool { + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionUpdate) +} + +func (self *SDynamicschedtag) AllowDeleteItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionDelete) +} + func validateDynamicSchedtagInputData(data *jsonutils.JSONDict, create bool) error { condStr := jsonutils.GetAnyString(data, []string{"condition"}) if len(condStr) == 0 && create { diff --git a/pkg/compute/models/hosts.go b/pkg/compute/models/hosts.go index 5edbc95027..dc47e1ace2 100644 --- a/pkg/compute/models/hosts.go +++ b/pkg/compute/models/hosts.go @@ -90,7 +90,6 @@ var NIC_TYPES = []string{NIC_TYPE_IPMI, NIC_TYPE_ADMIN} type SHostManager struct { db.SEnabledStatusStandaloneResourceBaseManager - SInfrastructureManager } var HostManager *SHostManager @@ -109,7 +108,6 @@ func init() { type SHost struct { db.SEnabledStatusStandaloneResourceBase - SInfrastructure SManagedResourceBase Rack string `width:"16" charset:"ascii" nullable:"true" get:"admin" update:"admin" create:"admin_optional"` // Column(VARCHAR(16, charset='ascii'), nullable=True) @@ -161,17 +159,24 @@ func (manager *SHostManager) GetContextManager() []db.IModelManager { return []db.IModelManager{ZoneManager} } -func (manager *SHostManager) AllowCreateItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - // allow create host without zone_id - /*zoneId, err := data.GetString("zone_id") - if err != nil { - return false - } - _, err = ZoneManager.FetchById(zoneId) - if err != nil { - return false - }*/ - return userCred.IsAdminAllow(consts.GetServiceType(), manager.KeywordPlural(), policy.PolicyActionCreate) +func (self *SHostManager) AllowListItems(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionList) +} + +func (self *SHostManager) AllowCreateItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionCreate) +} + +func (self *SHost) AllowGetDetails(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionGet) +} + +func (self *SHost) AllowUpdateItem(ctx context.Context, userCred mcclient.TokenCredential) bool { + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionUpdate) +} + +func (self *SHost) AllowDeleteItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionDelete) } func (manager *SHostManager) ListItemFilter(ctx context.Context, q *sqlchemy.SQuery, userCred mcclient.TokenCredential, query jsonutils.JSONObject) (*sqlchemy.SQuery, error) { diff --git a/pkg/compute/models/inframanagers.go b/pkg/compute/models/inframanagers.go index 96c9a5607f..4a60c48cfb 100644 --- a/pkg/compute/models/inframanagers.go +++ b/pkg/compute/models/inframanagers.go @@ -1,35 +1,9 @@ package models -import ( - "context" - "yunion.io/x/jsonutils" - "yunion.io/x/onecloud/pkg/cloudcommon/consts" - "yunion.io/x/onecloud/pkg/cloudcommon/policy" - "yunion.io/x/onecloud/pkg/mcclient" -) - -type SInfrastructureManager struct { +type TSInfrastructureManager struct { } -type SInfrastructure struct { +type TSInfrastructure struct { } -func (self *SInfrastructureManager) AllowListItems(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), "*", policy.PolicyActionList) -} -func (self *SInfrastructureManager) AllowCreateItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), "*", policy.PolicyActionCreate) -} - -func (self *SInfrastructure) AllowGetDetails(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), "*", policy.PolicyActionGet) -} - -func (self *SInfrastructure) AllowUpdateItem(ctx context.Context, userCred mcclient.TokenCredential) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), "*", policy.PolicyActionUpdate) -} - -func (self *SInfrastructure) AllowDeleteItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), "*", policy.PolicyActionDelete) -} diff --git a/pkg/compute/models/loadbalanceragents.go b/pkg/compute/models/loadbalanceragents.go index b7a0a1f455..a92e50513e 100644 --- a/pkg/compute/models/loadbalanceragents.go +++ b/pkg/compute/models/loadbalanceragents.go @@ -22,7 +22,6 @@ import ( type SLoadbalancerAgentManager struct { db.SStandaloneResourceBaseManager - SInfrastructureManager } var LoadbalancerAgentManager *SLoadbalancerAgentManager @@ -48,7 +47,6 @@ func init() { // type SLoadbalancerAgent struct { db.SStandaloneResourceBase - SInfrastructure HbLastSeen time.Time `nullable:"true" list:"admin" update:"admin"` HbTimeout int `nullable:"true" list:"admin" update:"admin" create:"optional" default:"3600"` @@ -239,6 +237,27 @@ func (p *SLoadbalancerAgentParams) IsZero() bool { return false } + +func (self *SLoadbalancerAgentManager) AllowListItems(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionList) +} + +func (self *SLoadbalancerAgentManager) AllowCreateItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionCreate) +} + +func (self *SLoadbalancerAgent) AllowGetDetails(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionGet) +} + +func (self *SLoadbalancerAgent) AllowUpdateItem(ctx context.Context, userCred mcclient.TokenCredential) bool { + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionUpdate) +} + +func (self *SLoadbalancerAgent) AllowDeleteItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionDelete) +} + func (man *SLoadbalancerAgentManager) ValidateCreateData(ctx context.Context, userCred mcclient.TokenCredential, ownerProjId string, query jsonutils.JSONObject, data *jsonutils.JSONDict) (*jsonutils.JSONDict, error) { { keyV := map[string]validators.IValidator{ @@ -355,10 +374,6 @@ func (man *SLoadbalancerAgentManager) CleanPendingDeleteLoadbalancers(ctx contex } } -func (man *SLoadbalancerAgentManager) AllowCreateItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), man.KeywordPlural(), policy.PolicyActionCreate) -} - func (lbagent *SLoadbalancerAgent) ValidateUpdateData(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data *jsonutils.JSONDict) (*jsonutils.JSONDict, error) { { keyV := map[string]validators.IValidator{ diff --git a/pkg/compute/models/schedpolicies.go b/pkg/compute/models/schedpolicies.go index edf88f4832..000445cf14 100644 --- a/pkg/compute/models/schedpolicies.go +++ b/pkg/compute/models/schedpolicies.go @@ -18,7 +18,6 @@ import ( type SSchedpolicyManager struct { db.SStandaloneResourceBaseManager - SInfrastructureManager } var SchedpolicyManager *SSchedpolicyManager @@ -37,7 +36,6 @@ func init() { // sched policy is called before calling scheduler, add additional preferences for schedtags type SSchedpolicy struct { db.SStandaloneResourceBase - SInfrastructure Condition string `width:"256" charset:"ascii" nullable:"false" list:"user" create:"required" update:"user"` SchedtagId string `width:"36" charset:"ascii" nullable:"false" list:"user" create:"required" update:"user"` @@ -64,6 +62,26 @@ func validateSchedpolicyInputData(data *jsonutils.JSONDict, create bool) error { return nil } +func (self *SSchedpolicyManager) AllowListItems(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionList) +} + +func (self *SSchedpolicyManager) AllowCreateItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionCreate) +} + +func (self *SSchedpolicy) AllowGetDetails(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionGet) +} + +func (self *SSchedpolicy) AllowUpdateItem(ctx context.Context, userCred mcclient.TokenCredential) bool { + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionUpdate) +} + +func (self *SSchedpolicy) AllowDeleteItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionDelete) +} + func (manager *SSchedpolicyManager) ValidateCreateData(ctx context.Context, userCred mcclient.TokenCredential, ownerProjId string, query jsonutils.JSONObject, data *jsonutils.JSONDict) (*jsonutils.JSONDict, error) { err := validateSchedpolicyInputData(data, true) if err != nil { diff --git a/pkg/compute/models/schedtags.go b/pkg/compute/models/schedtags.go index 2c06f65eb8..43557ff2f9 100644 --- a/pkg/compute/models/schedtags.go +++ b/pkg/compute/models/schedtags.go @@ -12,6 +12,8 @@ import ( "yunion.io/x/onecloud/pkg/mcclient" "yunion.io/x/pkg/utils" "yunion.io/x/sqlchemy" + "yunion.io/x/onecloud/pkg/cloudcommon/consts" + "yunion.io/x/onecloud/pkg/cloudcommon/policy" ) type SchedStrategyType string @@ -30,7 +32,6 @@ var STRATEGY_LIST = []string{STRATEGY_REQUIRE, STRATEGY_EXCLUDE, STRATEGY_PREFER type SSchedtagManager struct { db.SStandaloneResourceBaseManager - SInfrastructureManager } var SchedtagManager *SSchedtagManager @@ -48,7 +49,6 @@ func init() { type SSchedtag struct { db.SStandaloneResourceBase - SInfrastructure DefaultStrategy string `width:"16" charset:"ascii" nullable:"true" default:"" list:"user" update:"admin" create:"admin_optional"` // Column(VARCHAR(16, charset='ascii'), nullable=True, default='') } @@ -61,6 +61,18 @@ func (self *SSchedtag) AllowGetDetails(ctx context.Context, userCred mcclient.To return true } +func (self *SSchedtagManager) AllowCreateItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionCreate) +} + +func (self *SSchedtag) AllowUpdateItem(ctx context.Context, userCred mcclient.TokenCredential) bool { + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionUpdate) +} + +func (self *SSchedtag) AllowDeleteItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionDelete) +} + func (manager *SSchedtagManager) ValidateSchedtags(userCred mcclient.TokenCredential, schedtags map[string]string) (map[string]string, error) { ret := make(map[string]string) for tag, act := range schedtags { diff --git a/pkg/compute/models/storagecachedimages.go b/pkg/compute/models/storagecachedimages.go index 29d5889890..693fa088a0 100644 --- a/pkg/compute/models/storagecachedimages.go +++ b/pkg/compute/models/storagecachedimages.go @@ -32,7 +32,6 @@ const ( type SStoragecachedimageManager struct { db.SJointResourceBaseManager - SInfrastructureManager } var StoragecachedimageManager *SStoragecachedimageManager @@ -54,7 +53,6 @@ func init() { type SStoragecachedimage struct { db.SJointResourceBase - SInfrastructure StoragecacheId string `width:"36" charset:"ascii" nullable:"false" list:"admin" create:"admin_required" key_index:"true"` CachedimageId string `width:"36" charset:"ascii" nullable:"false" list:"admin" create:"admin_required" key_index:"true"` @@ -75,6 +73,26 @@ func (joint *SStoragecachedimage) Slave() db.IStandaloneModel { return db.JointSlave(joint) } +func (self *SStoragecachedimageManager) AllowListItems(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionList) +} + +func (self *SStoragecachedimageManager) AllowCreateItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionCreate) +} + +func (self *SStoragecachedimage) AllowGetDetails(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionGet) +} + +func (self *SStoragecachedimage) AllowUpdateItem(ctx context.Context, userCred mcclient.TokenCredential) bool { + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionUpdate) +} + +func (self *SStoragecachedimage) AllowDeleteItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionDelete) +} + func (self *SStoragecachedimage) getStorageHostId() (string, error) { var s SStorage storage := StorageManager.Query() diff --git a/pkg/compute/models/storagecaches.go b/pkg/compute/models/storagecaches.go index 78f33ad971..f21faa1dbc 100644 --- a/pkg/compute/models/storagecaches.go +++ b/pkg/compute/models/storagecaches.go @@ -21,7 +21,6 @@ import ( type SStoragecacheManager struct { db.SStandaloneResourceBaseManager - SInfrastructureManager } var StoragecacheManager *SStoragecacheManager @@ -39,12 +38,31 @@ func init() { type SStoragecache struct { db.SStandaloneResourceBase - SInfrastructure SManagedResourceBase Path string `width:"256" charset:"utf8" nullable:"true" list:"admin" update:"admin" create:"admin_optional"` // = Column(VARCHAR(256, charset='utf8'), nullable=True) } +func (self *SStoragecacheManager) AllowListItems(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionList) +} + +func (self *SStoragecacheManager) AllowCreateItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionCreate) +} + +func (self *SStoragecache) AllowGetDetails(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionGet) +} + +func (self *SStoragecache) AllowUpdateItem(ctx context.Context, userCred mcclient.TokenCredential) bool { + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionUpdate) +} + +func (self *SStoragecache) AllowDeleteItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionDelete) +} + func (self *SStoragecache) getStorages() []SStorage { storages := make([]SStorage, 0) q := StorageManager.Query().Equals("storagecache_id", self.Id) diff --git a/pkg/compute/models/storages.go b/pkg/compute/models/storages.go index 7a76c6e995..2f79e92b27 100644 --- a/pkg/compute/models/storages.go +++ b/pkg/compute/models/storages.go @@ -87,7 +87,6 @@ var ( type SStorageManager struct { db.SEnabledStatusStandaloneResourceBaseManager - SInfrastructureManager } var StorageManager *SStorageManager @@ -105,7 +104,6 @@ func init() { type SStorage struct { db.SEnabledStatusStandaloneResourceBase - SInfrastructure SManagedResourceBase Capacity int `nullable:"false" list:"admin" update:"admin" create:"admin_required"` // Column(Integer, nullable=False) # capacity of disk in MB @@ -124,6 +122,26 @@ func (manager *SStorageManager) GetContextManager() []db.IModelManager { return []db.IModelManager{ZoneManager, StoragecacheManager} } +func (manager *SStorageManager) AllowListItems(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { + return true +} + +func (self *SStorageManager) AllowCreateItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionCreate) +} + +func (self *SStorage) AllowGetDetails(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionGet) +} + +func (self *SStorage) AllowUpdateItem(ctx context.Context, userCred mcclient.TokenCredential) bool { + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionUpdate) +} + +func (self *SStorage) AllowDeleteItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionDelete) +} + func (manager *SStorageManager) ValidateCreateData(ctx context.Context, userCred mcclient.TokenCredential, ownerProjId string, query jsonutils.JSONObject, data *jsonutils.JSONDict) (*jsonutils.JSONDict, error) { storageType, _ := data.GetString("storage_type") mediumType, _ := data.GetString("medium_type") @@ -181,9 +199,6 @@ func (self *SStorage) IsLocal() bool { return self.StorageType == STORAGE_LOCAL || self.StorageType == STORAGE_BAREMETAL } -func (manager *SStorageManager) AllowListItems(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { - return true -} func (self *SStorage) getMoreDetails(extra *jsonutils.JSONDict) *jsonutils.JSONDict { used := self.GetUsedCapacity(tristate.True) diff --git a/pkg/compute/models/vcenters.go b/pkg/compute/models/vcenters.go index 79b298ccb2..f4ebc43687 100644 --- a/pkg/compute/models/vcenters.go +++ b/pkg/compute/models/vcenters.go @@ -11,7 +11,6 @@ import ( type SVCenterManager struct { db.SEnabledStatusStandaloneResourceBaseManager - SInfrastructureManager } var VCenterManager *SVCenterManager @@ -29,7 +28,6 @@ func init() { type SVCenter struct { db.SEnabledStatusStandaloneResourceBase - SInfrastructure Hostname string `width:"64" charset:"ascii" nullable:"false" list:"admin"` // = Column(VARCHAR(64, charset='ascii'), nullable=False) Port int `nullable:"false" list:"admin"` // = Column(Integer, nullable=False) diff --git a/pkg/compute/models/vpcs.go b/pkg/compute/models/vpcs.go index 532dd2a512..c5fa194e16 100644 --- a/pkg/compute/models/vpcs.go +++ b/pkg/compute/models/vpcs.go @@ -35,7 +35,6 @@ const ( type SVpcManager struct { db.SEnabledStatusStandaloneResourceBaseManager - SInfrastructureManager } var VpcManager *SVpcManager @@ -53,7 +52,6 @@ func init() { type SVpc struct { db.SEnabledStatusStandaloneResourceBase - SInfrastructure SManagedResourceBase IsDefault bool `default:"false" list:"admin" create:"admin_optional"` @@ -67,6 +65,26 @@ func (manager *SVpcManager) GetContextManager() []db.IModelManager { return []db.IModelManager{CloudregionManager} } +func (self *SVpcManager) AllowListItems(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionList) +} + +func (self *SVpcManager) AllowCreateItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionCreate) +} + +func (self *SVpc) AllowGetDetails(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionGet) +} + +func (self *SVpc) AllowUpdateItem(ctx context.Context, userCred mcclient.TokenCredential) bool { + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionUpdate) +} + +func (self *SVpc) AllowDeleteItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionDelete) +} + func (self *SVpc) GetCloudRegionId() string { if len(self.CloudregionId) == 0 { return "default" diff --git a/pkg/compute/models/wires.go b/pkg/compute/models/wires.go index 61d1da68e3..00364f0dfc 100644 --- a/pkg/compute/models/wires.go +++ b/pkg/compute/models/wires.go @@ -15,11 +15,12 @@ import ( "yunion.io/x/pkg/util/compare" "yunion.io/x/pkg/util/netutils" "yunion.io/x/sqlchemy" + "yunion.io/x/onecloud/pkg/cloudcommon/consts" + "yunion.io/x/onecloud/pkg/cloudcommon/policy" ) type SWireManager struct { db.SStandaloneResourceBaseManager - SInfrastructureManager } var WireManager *SWireManager @@ -39,7 +40,6 @@ func init() { type SWire struct { db.SStandaloneResourceBase - SInfrastructure Bandwidth int `list:"admin" update:"admin" nullable:"false" create:"admin_required"` // = Column(Integer, nullable=False) # bandwidth of network in Mbps ScheduleRank int `list:"admin" update:"admin"` // = Column(Integer, default=0, nullable=True) @@ -51,6 +51,26 @@ func (manager *SWireManager) GetContextManager() []db.IModelManager { return []db.IModelManager{ZoneManager, VpcManager} } +func (self *SWireManager) AllowListItems(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionList) +} + +func (self *SWireManager) AllowCreateItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionCreate) +} + +func (self *SWire) AllowGetDetails(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionGet) +} + +func (self *SWire) AllowUpdateItem(ctx context.Context, userCred mcclient.TokenCredential) bool { + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionUpdate) +} + +func (self *SWire) AllowDeleteItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionDelete) +} + func (manager *SWireManager) ValidateCreateData(ctx context.Context, userCred mcclient.TokenCredential, ownerProjId string, query jsonutils.JSONObject, data *jsonutils.JSONDict) (*jsonutils.JSONDict, error) { bandwidth, err := data.Int("bandwidth") if err != nil || bandwidth == 0 { diff --git a/pkg/compute/models/zones.go b/pkg/compute/models/zones.go index 6f7ff2649c..50b6f5a351 100644 --- a/pkg/compute/models/zones.go +++ b/pkg/compute/models/zones.go @@ -12,6 +12,8 @@ import ( "yunion.io/x/pkg/tristate" "yunion.io/x/pkg/util/compare" "yunion.io/x/sqlchemy" + "yunion.io/x/onecloud/pkg/cloudcommon/consts" + "yunion.io/x/onecloud/pkg/cloudcommon/policy" ) const ( @@ -23,7 +25,6 @@ const ( type SZoneManager struct { db.SStatusStandaloneResourceBaseManager - SInfrastructureManager } var ZoneManager *SZoneManager @@ -42,7 +43,6 @@ func init() { type SZone struct { db.SStatusStandaloneResourceBase - SInfrastructure Location string `width:"256" charset:"utf8" get:"user" update:"admin"` // = Column(VARCHAR(256, charset='utf8')) Contacts string `width:"256" charset:"utf8" get:"user" update:"admin"` // = Column(VARCHAR(256, charset='utf8')) @@ -57,6 +57,22 @@ func (manager *SZoneManager) GetContextManager() []db.IModelManager { return []db.IModelManager{CloudregionManager} } +func (self *SZoneManager) AllowCreateItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionCreate) +} + +func (self *SZone) AllowGetDetails(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionGet) +} + +func (self *SZone) AllowUpdateItem(ctx context.Context, userCred mcclient.TokenCredential) bool { + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionUpdate) +} + +func (self *SZone) AllowDeleteItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionDelete) +} + func (manager *SZoneManager) AllowListItems(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { return true } From 0a7b736336031a6e83559dc129deb153a265144b Mon Sep 17 00:00:00 2001 From: Qiu Jian Date: Sat, 1 Dec 2018 01:12:12 +0800 Subject: [PATCH 05/15] allow zone_id empty for hosts --- pkg/compute/models/hosts.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pkg/compute/models/hosts.go b/pkg/compute/models/hosts.go index dc47e1ace2..af12e6dd4c 100644 --- a/pkg/compute/models/hosts.go +++ b/pkg/compute/models/hosts.go @@ -1943,7 +1943,7 @@ func (manager *SHostManager) ValidateSizeParams(data *jsonutils.JSONDict) (*json func (manager *SHostManager) ValidateCreateData(ctx context.Context, userCred mcclient.TokenCredential, ownerProjId string, query jsonutils.JSONObject, data *jsonutils.JSONDict) (*jsonutils.JSONDict, error) { zoneId, _ := data.GetString("zone_id") - if len(zoneId) == 0 || ZoneManager.Query().Equals("id", zoneId).Count() == 0 { + if len(zoneId) > 0 && ZoneManager.Query().Equals("id", zoneId).Count() == 0 { return nil, httperrors.NewInputParameterError("Zone id %s not found", zoneId) } mangerUri, err := data.GetString("manager_uri") From e42f1a77441d12c073fb3c325ad28e329557aafe Mon Sep 17 00:00:00 2001 From: Qiu Jian Date: Sat, 1 Dec 2018 12:05:41 +0800 Subject: [PATCH 06/15] recode --- pkg/cloudcommon/db/db_dispatcher.go | 10 +-- pkg/cloudcommon/db/enabledstatusstandalone.go | 6 +- pkg/cloudcommon/db/jointbase.go | 6 +- pkg/cloudcommon/db/metadata.go | 8 +- pkg/cloudcommon/db/modelbase.go | 4 +- pkg/cloudcommon/db/opslog.go | 6 +- pkg/cloudcommon/db/rbac.go | 32 ++++++++ pkg/cloudcommon/db/sharablevirtual.go | 8 +- pkg/cloudcommon/db/standalone.go | 10 +-- pkg/cloudcommon/db/statusstandalone.go | 4 +- pkg/cloudcommon/db/taskman/tasks.go | 4 +- pkg/cloudcommon/db/virtualjointbase.go | 12 ++- pkg/cloudcommon/db/virtualresource.go | 20 +++-- pkg/compute/models/baremetalagents.go | 20 +++-- pkg/compute/models/cachedimages.go | 14 ++-- pkg/compute/models/cloudaccounts.go | 20 +++-- pkg/compute/models/cloudproviders.go | 18 ++--- pkg/compute/models/cloudregions.go | 12 ++- pkg/compute/models/disks.go | 16 ++-- pkg/compute/models/dnsrecords.go | 10 +-- pkg/compute/models/dynamicschedtags.go | 14 ++-- pkg/compute/models/elasticips.go | 12 ++- pkg/compute/models/guest_actions.go | 78 +++++++++---------- pkg/compute/models/guests.go | 12 ++- pkg/compute/models/hostjoints.go | 16 ++-- pkg/compute/models/hosts.go | 54 +++++++------ pkg/compute/models/isolated_devices.go | 6 +- pkg/compute/models/keypairs.go | 12 ++- pkg/compute/models/loadbalanceracls.go | 4 +- pkg/compute/models/loadbalanceragents.go | 16 ++-- pkg/compute/models/loadbalancerbackends.go | 4 +- .../models/loadbalancerlistenerrules.go | 4 +- pkg/compute/models/loadbalancerlisteners.go | 4 +- pkg/compute/models/loadbalancers.go | 4 +- pkg/compute/models/networks.go | 18 ++--- pkg/compute/models/reservedips.go | 4 +- pkg/compute/models/schedpolicies.go | 14 ++-- pkg/compute/models/schedtags.go | 8 +- pkg/compute/models/secgrouprules.go | 6 +- pkg/compute/models/snapshots.go | 10 +-- pkg/compute/models/storagecachedimages.go | 14 ++-- pkg/compute/models/storagecaches.go | 16 ++-- pkg/compute/models/storages.go | 25 +++--- pkg/compute/models/vpcs.go | 14 ++-- pkg/compute/models/wires.go | 12 ++- pkg/compute/models/zones.go | 10 +-- pkg/yunionconf/models/parameters.go | 14 ++-- 47 files changed, 295 insertions(+), 350 deletions(-) diff --git a/pkg/cloudcommon/db/db_dispatcher.go b/pkg/cloudcommon/db/db_dispatcher.go index 70ce2f8c91..630af1dcd2 100644 --- a/pkg/cloudcommon/db/db_dispatcher.go +++ b/pkg/cloudcommon/db/db_dispatcher.go @@ -113,7 +113,7 @@ func listFields(manager IModelManager, userCred mcclient.TokenCredential) []stri if !utils.IsInStringArray(list, []string{"user", "admin", ""}) { log.Warningf("Invalid list value %s for field %s", list, col.Name()) } - if list == "user" || (list == "admin" && userCred.IsAdminAllow(consts.GetServiceType(), manager.KeywordPlural(), policy.PolicyActionList)) { + if list == "user" || (list == "admin" && IsAdminAllowList(userCred, manager)) { ret = append(ret, col.Name()) } } @@ -127,7 +127,7 @@ func searchFields(manager IModelManager, userCred mcclient.TokenCredential) []st tags := col.Tags() list := tags["list"] search := tags["search"] - if list == "user" || search == "user" || ((list == "admin" || search == "admin") && userCred.IsAdminAllow(consts.GetServiceType(), manager.KeywordPlural(), policy.PolicyActionList)) { + if list == "user" || search == "user" || ((list == "admin" || search == "admin") && IsAdminAllowList(userCred, manager)) { ret = append(ret, col.Name()) } } @@ -152,7 +152,7 @@ func createRequireFields(manager IModelManager, userCred mcclient.TokenCredentia for _, col := range manager.TableSpec().Columns() { tags := col.Tags() create, _ := tags["create"] - if create == "required" || (create == "admin_required" && userCred.IsAdminAllow(consts.GetServiceType(), manager.KeywordPlural(), policy.PolicyActionCreate)) { + if create == "required" || (create == "admin_required" && IsAdminAllowCreate(userCred, manager)) { ret = append(ret, col.Name()) } } @@ -166,7 +166,7 @@ func createFields(manager IModelManager, userCred mcclient.TokenCredential) []st tags := col.Tags() create, _ := tags["create"] update := tags["update"] - if update == "user" || (update == "admin" && userCred.IsAdminAllow(consts.GetServiceType(), manager.KeywordPlural(), policy.PolicyActionCreate)) || create == "required" || create == "optional" || ((create == "admin_required" || create == "admin_optional") && userCred.IsAdminAllow(consts.GetServiceType(), manager.KeywordPlural(), policy.PolicyActionCreate)) { + if update == "user" || (update == "admin" && IsAdminAllowCreate(userCred, manager)) || create == "required" || create == "optional" || ((create == "admin_required" || create == "admin_optional") && IsAdminAllowCreate(userCred, manager)) { ret = append(ret, col.Name()) } } @@ -315,7 +315,7 @@ func query2List(manager IModelManager, ctx context.Context, userCred mcclient.To } listF := listFields(manager, userCred) fieldFilter := jsonutils.GetQueryStringArray(query, "field") - if len(fieldFilter) > 0 && userCred.IsAdminAllow(consts.GetServiceType(), manager.KeywordPlural(), policy.PolicyActionList) { + if len(fieldFilter) > 0 && IsAdminAllowList(userCred, manager) { // only sysadmin can specify list Fields listF = fieldFilter } diff --git a/pkg/cloudcommon/db/enabledstatusstandalone.go b/pkg/cloudcommon/db/enabledstatusstandalone.go index ad6da79d6f..6a456a429b 100644 --- a/pkg/cloudcommon/db/enabledstatusstandalone.go +++ b/pkg/cloudcommon/db/enabledstatusstandalone.go @@ -5,8 +5,6 @@ import ( "yunion.io/x/jsonutils" "yunion.io/x/log" - "yunion.io/x/onecloud/pkg/cloudcommon/consts" - "yunion.io/x/onecloud/pkg/cloudcommon/policy" "yunion.io/x/onecloud/pkg/mcclient" ) @@ -25,7 +23,7 @@ func NewEnabledStatusStandaloneResourceBaseManager(dt interface{}, tableName str } func (self *SEnabledStatusStandaloneResourceBase) AllowPerformEnable(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.GetModelManager().KeywordPlural(), policy.PolicyActionPerform, "enable") + return IsAdminAllowPerform(userCred, self, "enable") } func (self *SEnabledStatusStandaloneResourceBase) PerformEnable(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -44,7 +42,7 @@ func (self *SEnabledStatusStandaloneResourceBase) PerformEnable(ctx context.Cont } func (self *SEnabledStatusStandaloneResourceBase) AllowPerformDisable(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.GetModelManager().KeywordPlural(), policy.PolicyActionPerform, "disable") + return IsAdminAllowPerform(userCred, self, "disable") } func (self *SEnabledStatusStandaloneResourceBase) PerformDisable(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { diff --git a/pkg/cloudcommon/db/jointbase.go b/pkg/cloudcommon/db/jointbase.go index 14094ae5e4..17a3276b1d 100644 --- a/pkg/cloudcommon/db/jointbase.go +++ b/pkg/cloudcommon/db/jointbase.go @@ -8,8 +8,6 @@ import ( "yunion.io/x/jsonutils" "yunion.io/x/log" - "yunion.io/x/onecloud/pkg/cloudcommon/consts" - "yunion.io/x/onecloud/pkg/cloudcommon/policy" "yunion.io/x/onecloud/pkg/mcclient" "yunion.io/x/pkg/util/reflectutils" "yunion.io/x/sqlchemy" @@ -193,7 +191,7 @@ func (self *SJointResourceBase) AllowGetJointDetails(ctx context.Context, userCr master := item.Master() switch master.(type) { case IVirtualModel: - return master.(IVirtualModel).IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), master.KeywordPlural(), policy.PolicyActionGet) + return master.(IVirtualModel).IsOwner(userCred) || IsAdminAllowGet(userCred, master) default: // case item implemented customized AllowGetDetails, eg hostjoints return item.AllowGetDetails(ctx, userCred, query) } @@ -203,7 +201,7 @@ func (self *SJointResourceBase) AllowUpdateJointItem(ctx context.Context, userCr master := item.Master() switch master.(type) { case IVirtualModel: - return master.(IVirtualModel).IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), master.KeywordPlural(), policy.PolicyActionUpdate) + return master.(IVirtualModel).IsOwner(userCred) || IsAdminAllowUpdate(userCred, master) default: // case item implemented customized AllowGetDetails, eg hostjoints return item.AllowUpdateItem(ctx, userCred) } diff --git a/pkg/cloudcommon/db/metadata.go b/pkg/cloudcommon/db/metadata.go index 88463b21f9..b6ac604efe 100644 --- a/pkg/cloudcommon/db/metadata.go +++ b/pkg/cloudcommon/db/metadata.go @@ -11,9 +11,7 @@ import ( "yunion.io/x/onecloud/pkg/mcclient" "yunion.io/x/pkg/util/stringutils" - "yunion.io/x/onecloud/pkg/cloudcommon/consts" "yunion.io/x/onecloud/pkg/cloudcommon/db/lockman" - "yunion.io/x/onecloud/pkg/cloudcommon/policy" ) const ( @@ -67,7 +65,7 @@ raise Exception('get_object_idstr: failed to generate obj ID') return idstr */ func (manager *SMetadataManager) GetStringValue(model IModel, key string, userCred mcclient.TokenCredential) string { - if strings.HasPrefix(key, SYSTEM_ADMIN_PREFIX) && (userCred == nil || !userCred.IsAdminAllow(consts.GetServiceType(), model.GetModelManager().KeywordPlural(), policy.PolicyActionGet, "metadata")) { + if strings.HasPrefix(key, SYSTEM_ADMIN_PREFIX) && (userCred == nil || !IsAdminAllowGetSpec(userCred, model, "metadata")) { return "" } idStr := GetObjectIdstr(model) @@ -80,7 +78,7 @@ func (manager *SMetadataManager) GetStringValue(model IModel, key string, userCr } func (manager *SMetadataManager) GetJsonValue(model IModel, key string, userCred mcclient.TokenCredential) jsonutils.JSONObject { - if strings.HasPrefix(key, SYSTEM_ADMIN_PREFIX) && (userCred == nil || !userCred.IsAdminAllow(consts.GetServiceType(), model.GetModelManager().KeywordPlural(), policy.PolicyActionGet, "metadata")) { + if strings.HasPrefix(key, SYSTEM_ADMIN_PREFIX) && (userCred == nil || !IsAdminAllowGetSpec(userCred, model, "metadata")) { return nil } idStr := GetObjectIdstr(model) @@ -196,7 +194,7 @@ func (manager *SMetadataManager) GetAll(obj IModel, keys []string, userCred mccl for _, rec := range records { if len(rec.Value) > 0 { if strings.HasPrefix(rec.Key, SYSTEM_ADMIN_PREFIX) { - if userCred != nil && userCred.IsAdminAllow(consts.GetServiceType(), obj.GetModelManager().KeywordPlural(), policy.PolicyActionGet, "metadata") { + if userCred != nil && IsAdminAllowGetSpec(userCred, obj, "metadata") { key := rec.Key[len(SYSTEM_ADMIN_PREFIX):] ret[key] = rec.Value } diff --git a/pkg/cloudcommon/db/modelbase.go b/pkg/cloudcommon/db/modelbase.go index bd5db2cdb8..1af11f2982 100644 --- a/pkg/cloudcommon/db/modelbase.go +++ b/pkg/cloudcommon/db/modelbase.go @@ -6,8 +6,6 @@ import ( "fmt" "yunion.io/x/jsonutils" - "yunion.io/x/onecloud/pkg/cloudcommon/consts" - "yunion.io/x/onecloud/pkg/cloudcommon/policy" "yunion.io/x/onecloud/pkg/mcclient" "yunion.io/x/sqlchemy" ) @@ -153,7 +151,7 @@ func (manager *SModelBaseManager) PerformAction(ctx context.Context, userCred mc } func (manager *SModelBaseManager) AllowPerformCheckCreateData(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), manager.KeywordPlural(), policy.PolicyActionPerform, "check-create-data") + return IsAdminAllowClassPerform(userCred, manager, "check-create-data") } func (manager *SModelBaseManager) InitializeData() error { diff --git a/pkg/cloudcommon/db/opslog.go b/pkg/cloudcommon/db/opslog.go index 45c147eb9e..4cb4101063 100644 --- a/pkg/cloudcommon/db/opslog.go +++ b/pkg/cloudcommon/db/opslog.go @@ -9,8 +9,6 @@ import ( "yunion.io/x/jsonutils" "yunion.io/x/log" - "yunion.io/x/onecloud/pkg/cloudcommon/consts" - "yunion.io/x/onecloud/pkg/cloudcommon/policy" "yunion.io/x/onecloud/pkg/mcclient" "yunion.io/x/onecloud/pkg/util/logclient" "yunion.io/x/pkg/util/stringutils" @@ -288,7 +286,7 @@ func (manager *SOpsLogManager) ListItemFilter(ctx context.Context, q *sqlchemy.S queryDict.RemoveIgnoreCase("action") q = q.Filter(sqlchemy.In(q.Field("action"), action)) } - if !userCred.IsAdminAllow(consts.GetServiceType(), manager.KeywordPlural(), policy.PolicyActionList) { + if !IsAdminAllowList(userCred, manager) { q = q.Filter(sqlchemy.OR(sqlchemy.AND(sqlchemy.IsNotNull(q.Field("owner_tenant_id")), sqlchemy.Equals(q.Field("owner_tenant_id"), userCred.GetProjectId())), sqlchemy.Equals(q.Field("tenant_id"), userCred.GetProjectId()))) } since, _ := query.GetTime("since") @@ -319,7 +317,7 @@ func (manager *SOpsLogManager) AllowCreateItem(ctx context.Context, userCred mcc } func (self *SOpsLog) AllowGetDetails(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.GetModelManager().KeywordPlural(), policy.PolicyActionGet) || userCred.GetProjectId() == self.ProjectId || userCred.GetProjectId() == self.OwnerProjectId + return IsAdminAllowGet(userCred, self) || userCred.GetProjectId() == self.ProjectId || userCred.GetProjectId() == self.OwnerProjectId } func (self *SOpsLog) AllowUpdateItem(ctx context.Context, userCred mcclient.TokenCredential) bool { diff --git a/pkg/cloudcommon/db/rbac.go b/pkg/cloudcommon/db/rbac.go index 76c2fd2152..83da4b9753 100644 --- a/pkg/cloudcommon/db/rbac.go +++ b/pkg/cloudcommon/db/rbac.go @@ -122,3 +122,35 @@ func isObjectRbacAllowed(manager IModelManager, model IModel, userCred mcclient. func isJointObjectRbacAllowed(manager IJointModelManager, item IJointModel, userCred mcclient.TokenCredential, action string, extra ...string) bool { return isObjectRbacAllowed(manager, item.Master(), userCred, action, extra...) } + +func IsAdminAllowList(userCred mcclient.TokenCredential, manager IModelManager) bool { + return userCred.IsAdminAllow(consts.GetServiceType(), manager.KeywordPlural(), policy.PolicyActionList) +} + +func IsAdminAllowCreate(userCred mcclient.TokenCredential, manager IModelManager) bool { + return userCred.IsAdminAllow(consts.GetServiceType(), manager.KeywordPlural(), policy.PolicyActionCreate) +} + +func IsAdminAllowClassPerform(userCred mcclient.TokenCredential, manager IModelManager, action string) bool { + return userCred.IsAdminAllow(consts.GetServiceType(), manager.KeywordPlural(), policy.PolicyActionPerform, action) +} + +func IsAdminAllowGet(userCred mcclient.TokenCredential, obj IModel) bool { + return userCred.IsAdminAllow(consts.GetServiceType(), obj.KeywordPlural(), policy.PolicyActionGet) +} + +func IsAdminAllowGetSpec(userCred mcclient.TokenCredential, obj IModel, spec string) bool { + return userCred.IsAdminAllow(consts.GetServiceType(), obj.KeywordPlural(), policy.PolicyActionGet, spec) +} + +func IsAdminAllowPerform(userCred mcclient.TokenCredential, obj IModel, action string) bool { + return userCred.IsAdminAllow(consts.GetServiceType(), obj.KeywordPlural(), policy.PolicyActionPerform, action) +} + +func IsAdminAllowUpdate(userCred mcclient.TokenCredential, obj IModel) bool { + return userCred.IsAdminAllow(consts.GetServiceType(), obj.KeywordPlural(), policy.PolicyActionUpdate) +} + +func IsAdminAllowDelete(userCred mcclient.TokenCredential, obj IModel) bool { + return userCred.IsAdminAllow(consts.GetServiceType(), obj.KeywordPlural(), policy.PolicyActionDelete) +} \ No newline at end of file diff --git a/pkg/cloudcommon/db/sharablevirtual.go b/pkg/cloudcommon/db/sharablevirtual.go index d8c78a98df..bf048007f4 100644 --- a/pkg/cloudcommon/db/sharablevirtual.go +++ b/pkg/cloudcommon/db/sharablevirtual.go @@ -4,8 +4,6 @@ import ( "context" "yunion.io/x/jsonutils" - "yunion.io/x/onecloud/pkg/cloudcommon/consts" - "yunion.io/x/onecloud/pkg/cloudcommon/policy" "yunion.io/x/onecloud/pkg/mcclient" "yunion.io/x/sqlchemy" ) @@ -32,7 +30,7 @@ func (manager *SSharableVirtualResourceBaseManager) FilterByOwner(q *sqlchemy.SQ } func (model *SSharableVirtualResourceBase) AllowGetDetails(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { - return model.IsOwner(userCred) || model.IsPublic || userCred.IsAdminAllow(consts.GetServiceType(), model.KeywordPlural(), policy.PolicyActionGet) + return model.IsOwner(userCred) || model.IsPublic || IsAdminAllowGet(userCred, model) } func (model *SSharableVirtualResourceBase) IsSharable() bool { @@ -40,11 +38,11 @@ func (model *SSharableVirtualResourceBase) IsSharable() bool { } func (model *SSharableVirtualResourceBase) AllowPerformPublic(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), model.GetModelManager().KeywordPlural(), policy.PolicyActionPerform, "public") + return IsAdminAllowPerform(userCred, model, "public") } func (model *SSharableVirtualResourceBase) AllowPerformPrivate(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), model.GetModelManager().KeywordPlural(), policy.PolicyActionPerform, "private") + return IsAdminAllowPerform(userCred, model, "private") } func (model *SSharableVirtualResourceBase) PerformPublic(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { diff --git a/pkg/cloudcommon/db/standalone.go b/pkg/cloudcommon/db/standalone.go index 9d8d11f080..935e53d74c 100644 --- a/pkg/cloudcommon/db/standalone.go +++ b/pkg/cloudcommon/db/standalone.go @@ -7,8 +7,6 @@ import ( "yunion.io/x/jsonutils" "yunion.io/x/log" - "yunion.io/x/onecloud/pkg/cloudcommon/consts" - "yunion.io/x/onecloud/pkg/cloudcommon/policy" "yunion.io/x/onecloud/pkg/httperrors" "yunion.io/x/onecloud/pkg/mcclient" "yunion.io/x/pkg/util/regutils" @@ -149,7 +147,7 @@ func (model *SStandaloneResourceBase) GetMetadataJson(key string, userCred mccli } func (model *SStandaloneResourceBase) SetMetadata(ctx context.Context, key string, value interface{}, userCred mcclient.TokenCredential) error { - if Metadata.IsSystemAdminKey(key) && !userCred.IsAdminAllow(consts.GetServiceType(), model.GetModelManager().KeywordPlural(), policy.PolicyActionPerform, "metadata") { + if Metadata.IsSystemAdminKey(key) && !IsAdminAllowPerform(userCred, model, "metadata") { return httperrors.NewNotSufficientPrivilegeError("cannot set system key") } return Metadata.SetValue(ctx, model, key, value, userCred) @@ -157,7 +155,7 @@ func (model *SStandaloneResourceBase) SetMetadata(ctx context.Context, key strin func (model *SStandaloneResourceBase) SetAllMetadata(ctx context.Context, dictstore map[string]interface{}, userCred mcclient.TokenCredential) error { for k := range dictstore { - if Metadata.IsSystemAdminKey(k) && !userCred.IsAdminAllow(consts.GetServiceType(), model.GetModelManager().KeywordPlural(), policy.PolicyActionPerform, "metadata") { + if Metadata.IsSystemAdminKey(k) && !IsAdminAllowPerform(userCred, model, "metadata") { return httperrors.NewNotSufficientPrivilegeError(fmt.Sprintf("not allow to set system key %s", k)) } } @@ -177,7 +175,7 @@ func (model *SStandaloneResourceBase) GetAllMetadata(userCred mcclient.TokenCred } func (model *SStandaloneResourceBase) AllowGetDetailsMetadata(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), model.GetModelManager().KeywordPlural(), policy.PolicyActionGet, "metadata") + return IsAdminAllowGetSpec(userCred, model, "metadata") } func (model *SStandaloneResourceBase) GetDetailsMetadata(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -190,7 +188,7 @@ func (model *SStandaloneResourceBase) GetDetailsMetadata(ctx context.Context, us } func (model *SStandaloneResourceBase) AllowPerformMetadata(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), model.GetModelManager().KeywordPlural(), policy.PolicyActionPerform, "metadata") + return IsAdminAllowPerform(userCred, model, "metadata") } func (model *SStandaloneResourceBase) PerformMetadata(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { diff --git a/pkg/cloudcommon/db/statusstandalone.go b/pkg/cloudcommon/db/statusstandalone.go index 7f436d2c4c..5d3a6e66b3 100644 --- a/pkg/cloudcommon/db/statusstandalone.go +++ b/pkg/cloudcommon/db/statusstandalone.go @@ -6,8 +6,6 @@ import ( "strings" "yunion.io/x/jsonutils" - "yunion.io/x/onecloud/pkg/cloudcommon/consts" - "yunion.io/x/onecloud/pkg/cloudcommon/policy" "yunion.io/x/onecloud/pkg/mcclient" "yunion.io/x/onecloud/pkg/util/logclient" ) @@ -52,7 +50,7 @@ func (model *SStatusStandaloneResourceBase) SetStatus(userCred mcclient.TokenCre } func (model *SStatusStandaloneResourceBase) AllowPerformStatus(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), model.GetModelManager().KeywordPlural(), policy.PolicyActionPerform, "status") + return IsAdminAllowPerform(userCred, model, "status") } func (model *SStatusStandaloneResourceBase) PerformStatus(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { diff --git a/pkg/cloudcommon/db/taskman/tasks.go b/pkg/cloudcommon/db/taskman/tasks.go index 177bb0a203..aeac7ef0e0 100644 --- a/pkg/cloudcommon/db/taskman/tasks.go +++ b/pkg/cloudcommon/db/taskman/tasks.go @@ -18,11 +18,9 @@ import ( "yunion.io/x/pkg/utils" "yunion.io/x/sqlchemy" - "yunion.io/x/onecloud/pkg/cloudcommon/consts" "yunion.io/x/onecloud/pkg/cloudcommon/db" "yunion.io/x/onecloud/pkg/cloudcommon/db/lockman" "yunion.io/x/onecloud/pkg/cloudcommon/db/quotas" - "yunion.io/x/onecloud/pkg/cloudcommon/policy" ) const ( @@ -117,7 +115,7 @@ func (manager *STaskManager) FilterByOwner(q *sqlchemy.SQuery, owner string) *sq } func (self *STask) AllowGetDetails(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.GetModelManager().KeywordPlural(), policy.PolicyActionGet) || userCred.GetProjectId() == self.UserCred.GetProjectId() + return db.IsAdminAllowGet(userCred, self) || userCred.GetProjectId() == self.UserCred.GetProjectId() } func (self *STask) AllowUpdateItem(ctx context.Context, userCred mcclient.TokenCredential) bool { diff --git a/pkg/cloudcommon/db/virtualjointbase.go b/pkg/cloudcommon/db/virtualjointbase.go index 5a0e571e5d..ce5b3ce8ba 100644 --- a/pkg/cloudcommon/db/virtualjointbase.go +++ b/pkg/cloudcommon/db/virtualjointbase.go @@ -10,8 +10,6 @@ import ( "yunion.io/x/pkg/util/reflectutils" "yunion.io/x/sqlchemy" - "yunion.io/x/onecloud/pkg/cloudcommon/consts" - "yunion.io/x/onecloud/pkg/cloudcommon/policy" "yunion.io/x/onecloud/pkg/httperrors" "yunion.io/x/onecloud/pkg/mcclient" ) @@ -29,7 +27,7 @@ func NewVirtualJointResourceBaseManager(dt interface{}, tableName string, keywor } func (manager *SVirtualJointResourceBaseManager) AllowListItems(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { - if jsonutils.QueryBoolean(query, "admin", false) && !userCred.IsAdminAllow(consts.GetServiceType(), manager.KeywordPlural(), policy.PolicyActionList) { + if jsonutils.QueryBoolean(query, "admin", false) && !IsAdminAllowList(userCred, manager) { return false } return true @@ -38,7 +36,7 @@ func (manager *SVirtualJointResourceBaseManager) AllowListItems(ctx context.Cont func (manager *SVirtualJointResourceBaseManager) AllowListDescendent(ctx context.Context, userCred mcclient.TokenCredential, master IStandaloneModel, query jsonutils.JSONObject) bool { masterVirtual := master.(IVirtualModel) - if masterVirtual.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), masterVirtual.KeywordPlural(), policy.PolicyActionList) { + if masterVirtual.IsOwner(userCred) || IsAdminAllowList(userCred, manager) { return true } return false @@ -64,12 +62,12 @@ func (manager *SVirtualJointResourceBaseManager) AllowAttach(ctx context.Context func (self *SVirtualJointResourceBase) AllowGetDetails(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { masterVirtual := self.Master().(IVirtualModel) - return masterVirtual.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), masterVirtual.KeywordPlural(), policy.PolicyActionGet) + return masterVirtual.IsOwner(userCred) || IsAdminAllowGet(userCred, self) } func (self *SVirtualJointResourceBase) AllowUpdateItem(ctx context.Context, userCred mcclient.TokenCredential) bool { masterVirtual := self.Master().(IVirtualModel) - return masterVirtual.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), masterVirtual.KeywordPlural(), policy.PolicyActionUpdate) + return masterVirtual.IsOwner(userCred) || IsAdminAllowUpdate(userCred, self) } func (manager *SVirtualJointResourceBaseManager) ListItemFilter(ctx context.Context, q *sqlchemy.SQuery, userCred mcclient.TokenCredential, query jsonutils.JSONObject) (*sqlchemy.SQuery, error) { @@ -98,7 +96,7 @@ func (manager *SVirtualJointResourceBaseManager) ListItemFilter(ctx context.Cont sqlchemy.IsFalse(masterTable.Field("deleted")))) q = q.Join(slaveTable, sqlchemy.AND(sqlchemy.Equals(slaveField, slaveTable.Field("id")), sqlchemy.IsFalse(slaveTable.Field("deleted")))) - if jsonutils.QueryBoolean(query, "admin", false) && userCred.IsAdminAllow(consts.GetServiceType(), manager.KeywordPlural(), policy.PolicyActionList) { + if jsonutils.QueryBoolean(query, "admin", false) && IsAdminAllowList(userCred, manager) { isSystem := jsonutils.QueryBoolean(query, "system", false) if !isSystem { if len(slaveQueryId) == 0 { diff --git a/pkg/cloudcommon/db/virtualresource.go b/pkg/cloudcommon/db/virtualresource.go index a9e31f0263..4aec78a2d3 100644 --- a/pkg/cloudcommon/db/virtualresource.go +++ b/pkg/cloudcommon/db/virtualresource.go @@ -12,9 +12,7 @@ import ( "yunion.io/x/pkg/utils" "yunion.io/x/sqlchemy" - "yunion.io/x/onecloud/pkg/cloudcommon/consts" "yunion.io/x/onecloud/pkg/cloudcommon/db/lockman" - "yunion.io/x/onecloud/pkg/cloudcommon/policy" "yunion.io/x/onecloud/pkg/httperrors" "yunion.io/x/onecloud/pkg/mcclient" ) @@ -113,7 +111,7 @@ func (manager *SVirtualResourceBaseManager) ListItemFilter(ctx context.Context, func (manager *SVirtualResourceBaseManager) ValidateCreateData(ctx context.Context, userCred mcclient.TokenCredential, ownerProjId string, query jsonutils.JSONObject, data *jsonutils.JSONDict) (*jsonutils.JSONDict, error) { isSystem, err := data.Bool("is_system") - if err == nil && isSystem && !userCred.IsAdminAllow(consts.GetServiceType(), manager.KeywordPlural(), policy.PolicyActionCreate) { + if err == nil && isSystem && !IsAdminAllowCreate(userCred, manager) { return nil, httperrors.NewNotSufficientPrivilegeError("non-admin user not allowed to create system object") } return manager.SStandaloneResourceBaseManager.ValidateCreateData(ctx, userCred, ownerProjId, query, data) @@ -132,14 +130,14 @@ func (model *SVirtualResourceBase) CustomizeCreate(ctx context.Context, userCred func (manager *SVirtualResourceBaseManager) AllowListItems(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { isAdmin, err := query.Bool("admin") - if err == nil && isAdmin && !userCred.IsAdminAllow(consts.GetServiceType(), manager.KeywordPlural(), policy.PolicyActionList) { + if err == nil && isAdmin && !IsAdminAllowList(userCred, manager) { return false } return true } func (model *SVirtualResourceBase) AllowGetDetails(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { - return model.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), model.KeywordPlural(), policy.PolicyActionGet) + return model.IsOwner(userCred) || IsAdminAllowGet(userCred, model) } func (manager *SVirtualResourceBaseManager) AllowCreateItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { @@ -147,19 +145,19 @@ func (manager *SVirtualResourceBaseManager) AllowCreateItem(ctx context.Context, } func (model *SVirtualResourceBase) AllowUpdateItem(ctx context.Context, userCred mcclient.TokenCredential) bool { - return model.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), model.KeywordPlural(), policy.PolicyActionUpdate) + return model.IsOwner(userCred) || IsAdminAllowUpdate(userCred, model) } func (model *SVirtualResourceBase) AllowDeleteItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return model.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), model.KeywordPlural(), policy.PolicyActionDelete) + return model.IsOwner(userCred) || IsAdminAllowDelete(userCred, model) } func (model *SVirtualResourceBase) AllowGetDetailsMetadata(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { - return model.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), model.KeywordPlural(), policy.PolicyActionGet, "metadata") + return model.IsOwner(userCred) || IsAdminAllowGetSpec(userCred, model, "metadata") } func (model *SVirtualResourceBase) AllowPerformMetadata(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return model.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), model.KeywordPlural(), policy.PolicyActionPerform, "metadata") + return model.IsOwner(userCred) || IsAdminAllowPerform(userCred, model, "metadata") } func (model *SVirtualResourceBase) GetTenantCache(ctx context.Context) (*STenant, error) { @@ -168,7 +166,7 @@ func (model *SVirtualResourceBase) GetTenantCache(ctx context.Context) (*STenant } func (model *SVirtualResourceBase) getMoreDetails(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, extra *jsonutils.JSONDict) *jsonutils.JSONDict { - if userCred.IsAdminAllow(consts.GetServiceType(), model.GetModelManager().KeywordPlural(), policy.PolicyActionGet) { + if IsAdminAllowGet(userCred, model) { // log.Debugf("GetCustomizeColumns") tobj, err := model.GetTenantCache(ctx) if err == nil { @@ -200,7 +198,7 @@ func (model *SVirtualResourceBase) GetExtraDetails(ctx context.Context, userCred } func (model *SVirtualResourceBase) AllowPerformChangeOwner(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), model.GetModelManager().KeywordPlural(), policy.PolicyActionPerform, "change-owner") + return IsAdminAllowPerform(userCred, model, "change-owner") } func (model *SVirtualResourceBase) PerformChangeOwner(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { diff --git a/pkg/compute/models/baremetalagents.go b/pkg/compute/models/baremetalagents.go index 5bbf758354..5a0bd97232 100644 --- a/pkg/compute/models/baremetalagents.go +++ b/pkg/compute/models/baremetalagents.go @@ -5,9 +5,7 @@ import ( "fmt" "yunion.io/x/jsonutils" - "yunion.io/x/onecloud/pkg/cloudcommon/consts" "yunion.io/x/onecloud/pkg/cloudcommon/db" - "yunion.io/x/onecloud/pkg/cloudcommon/policy" "yunion.io/x/onecloud/pkg/httperrors" "yunion.io/x/onecloud/pkg/mcclient" "yunion.io/x/pkg/util/regutils" @@ -39,23 +37,23 @@ func init() { } func (self *SBaremetalagentManager) AllowListItems(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionList) + return db.IsAdminAllowList(userCred, self) } func (self *SBaremetalagentManager) AllowCreateItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionCreate) + return db.IsAdminAllowCreate(userCred, self) } func (self *SBaremetalagent) AllowGetDetails(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionGet) + return db.IsAdminAllowGet(userCred, self) } func (self *SBaremetalagent) AllowUpdateItem(ctx context.Context, userCred mcclient.TokenCredential) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionUpdate) + return db.IsAdminAllowUpdate(userCred, self) } func (self *SBaremetalagent) AllowDeleteItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionDelete) + return db.IsAdminAllowDelete(userCred, self) } func (self *SBaremetalagent) ValidateDeleteCondition(ctx context.Context) error { @@ -100,7 +98,7 @@ func (manager *SBaremetalagentManager) ValidateCreateData(ctx context.Context, u } func (self *SBaremetalagent) AllowPerformEnable(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.GetModelManager().KeywordPlural(), policy.PolicyActionPerform, "enable") + return db.IsAdminAllowPerform(userCred, self, "enable") } func (self *SBaremetalagent) PerformEnable(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -115,7 +113,7 @@ func (self *SBaremetalagent) PerformEnable(ctx context.Context, userCred mcclien } func (self *SBaremetalagent) AllowPerformDisable(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.GetModelManager().KeywordPlural(), policy.PolicyActionPerform, "disable") + return db.IsAdminAllowPerform(userCred, self, "disable") } func (self *SBaremetalagent) PerformDisable(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -130,7 +128,7 @@ func (self *SBaremetalagent) PerformDisable(ctx context.Context, userCred mcclie } func (self *SBaremetalagent) AllowPerformOnline(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.GetModelManager().KeywordPlural(), policy.PolicyActionPerform, "online") + return db.IsAdminAllowPerform(userCred, self, "online") } func (self *SBaremetalagent) PerformOnline(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -145,7 +143,7 @@ func (self *SBaremetalagent) PerformOnline(ctx context.Context, userCred mcclien } func (self *SBaremetalagent) AllowPerformOffline(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.GetModelManager().KeywordPlural(), policy.PolicyActionPerform, "offline") + return db.IsAdminAllowPerform(userCred, self, "offline") } func (self *SBaremetalagent) PerformOffline(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { diff --git a/pkg/compute/models/cachedimages.go b/pkg/compute/models/cachedimages.go index 1a4ac36bfb..c3fce4e476 100644 --- a/pkg/compute/models/cachedimages.go +++ b/pkg/compute/models/cachedimages.go @@ -16,10 +16,8 @@ import ( "yunion.io/x/pkg/util/timeutils" "yunion.io/x/sqlchemy" - "yunion.io/x/onecloud/pkg/cloudcommon/consts" "yunion.io/x/onecloud/pkg/cloudcommon/db" "yunion.io/x/onecloud/pkg/cloudcommon/db/lockman" - "yunion.io/x/onecloud/pkg/cloudcommon/policy" "yunion.io/x/onecloud/pkg/compute/options" ) @@ -57,23 +55,23 @@ type SCachedimage struct { } func (self *SCachedimageManager) AllowListItems(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionList) + return db.IsAdminAllowList(userCred, self) } func (self *SCachedimageManager) AllowCreateItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionCreate) + return db.IsAdminAllowCreate(userCred, self) } func (self *SCachedimage) AllowGetDetails(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionGet) + return db.IsAdminAllowGet(userCred, self) } func (self *SCachedimage) AllowUpdateItem(ctx context.Context, userCred mcclient.TokenCredential) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionUpdate) + return db.IsAdminAllowUpdate(userCred, self) } func (self *SCachedimage) AllowDeleteItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionDelete) + return db.IsAdminAllowDelete(userCred, self) } func (self *SCachedimage) ValidateDeleteCondition(ctx context.Context) error { @@ -260,7 +258,7 @@ func (self *SCachedimage) GetCustomizeColumns(ctx context.Context, userCred mccl } func (self *SCachedimage) AllowPerformRefresh(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.GetModelManager().KeywordPlural(), policy.PolicyActionPerform, "refresh") + return db.IsAdminAllowPerform(userCred, self, "refresh") } func (self *SCachedimage) PerformRefresh(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { diff --git a/pkg/compute/models/cloudaccounts.go b/pkg/compute/models/cloudaccounts.go index 9b3b51f2ff..b879a96343 100644 --- a/pkg/compute/models/cloudaccounts.go +++ b/pkg/compute/models/cloudaccounts.go @@ -13,10 +13,8 @@ import ( "yunion.io/x/pkg/utils" "yunion.io/x/sqlchemy" - "yunion.io/x/onecloud/pkg/cloudcommon/consts" "yunion.io/x/onecloud/pkg/cloudcommon/db" "yunion.io/x/onecloud/pkg/cloudcommon/db/taskman" - "yunion.io/x/onecloud/pkg/cloudcommon/policy" "yunion.io/x/onecloud/pkg/cloudprovider" "yunion.io/x/onecloud/pkg/httperrors" "yunion.io/x/onecloud/pkg/mcclient" @@ -59,23 +57,23 @@ type SCloudaccount struct { } func (self *SCloudaccountManager) AllowListItems(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionList) + return db.IsAdminAllowList(userCred, self) } func (self *SCloudaccountManager) AllowCreateItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionCreate) + return db.IsAdminAllowCreate(userCred, self) } func (self *SCloudaccount) AllowGetDetails(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionGet) + return db.IsAdminAllowGet(userCred, self) } func (self *SCloudaccount) AllowUpdateItem(ctx context.Context, userCred mcclient.TokenCredential) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionUpdate) + return db.IsAdminAllowUpdate(userCred, self) } func (self *SCloudaccount) AllowDeleteItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionDelete) + return db.IsAdminAllowDelete(userCred, self) } func (self *SCloudaccount) GetCloudproviders() []SCloudprovider { @@ -219,7 +217,7 @@ func (self *SCloudaccount) CanSync() bool { } func (self *SCloudaccount) AllowPerformSync(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.GetModelManager().KeywordPlural(), policy.PolicyActionPerform, "sync") + return db.IsAdminAllowPerform(userCred, self, "sync") } func (self *SCloudaccount) PerformSync(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -238,7 +236,7 @@ func (self *SCloudaccount) PerformSync(ctx context.Context, userCred mcclient.To } func (self *SCloudaccount) AllowPerformUpdateCredential(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.GetModelManager().KeywordPlural(), policy.PolicyActionPerform, "update-credential") + return db.IsAdminAllowPerform(userCred, self, "update-credential") } func (self *SCloudaccount) PerformUpdateCredential(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -464,7 +462,7 @@ func (self *SCloudaccount) ImportSubAccount(ctx context.Context, userCred mcclie } func (self *SCloudaccount) AllowPerformImport(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.GetModelManager().KeywordPlural(), policy.PolicyActionPerform, "import") + return db.IsAdminAllowPerform(userCred, self, "import") } func (self *SCloudaccount) PerformImport(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -638,7 +636,7 @@ func (self *SCloudaccount) GetBalance() (float64, error) { } func (self *SCloudaccount) AllowGetDetailsBalance(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.GetModelManager().KeywordPlural(), policy.PolicyActionGet, "balance") + return db.IsAdminAllowGetSpec(userCred, self, "balance") } func (self *SCloudaccount) GetDetailsBalance(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) (jsonutils.JSONObject, error) { diff --git a/pkg/compute/models/cloudproviders.go b/pkg/compute/models/cloudproviders.go index 959166aed1..307a258c79 100644 --- a/pkg/compute/models/cloudproviders.go +++ b/pkg/compute/models/cloudproviders.go @@ -12,10 +12,8 @@ import ( "yunion.io/x/pkg/utils" "yunion.io/x/sqlchemy" - "yunion.io/x/onecloud/pkg/cloudcommon/consts" "yunion.io/x/onecloud/pkg/cloudcommon/db" "yunion.io/x/onecloud/pkg/cloudcommon/db/taskman" - "yunion.io/x/onecloud/pkg/cloudcommon/policy" "yunion.io/x/onecloud/pkg/cloudprovider" "yunion.io/x/onecloud/pkg/compute/options" "yunion.io/x/onecloud/pkg/httperrors" @@ -86,23 +84,23 @@ func (self *SCloudprovider) GetOwnerProjectId() string { } func (self *SCloudproviderManager) AllowListItems(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionList) + return db.IsAdminAllowList(userCred, self) } func (self *SCloudproviderManager) AllowCreateItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionCreate) + return db.IsAdminAllowCreate(userCred, self) } func (self *SCloudprovider) AllowGetDetails(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionGet) + return db.IsAdminAllowGet(userCred, self) } func (self *SCloudprovider) AllowUpdateItem(ctx context.Context, userCred mcclient.TokenCredential) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionUpdate) + return db.IsAdminAllowUpdate(userCred, self) } func (self *SCloudprovider) AllowDeleteItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionDelete) + return db.IsAdminAllowDelete(userCred, self) } func (self *SCloudprovider) ValidateDeleteCondition(ctx context.Context) error { @@ -317,7 +315,7 @@ func (sr *SSyncRange) Normalize() error { } func (self *SCloudprovider) AllowPerformSync(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "sync") + return db.IsAdminAllowPerform(userCred, self, "sync") } func (self *SCloudprovider) PerformSync(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -350,7 +348,7 @@ func (self *SCloudprovider) StartSyncCloudProviderInfoTask(ctx context.Context, } func (self *SCloudprovider) AllowPerformChangeProject(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "change-project") + return db.IsAdminAllowPerform(userCred, self, "change-project") } func (self *SCloudprovider) PerformChangeProject(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -601,7 +599,7 @@ func (self *SCloudprovider) GetBalance() (float64, error) { } func (self *SCloudprovider) AllowGetDetailsBalance(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionGet, "balance") + return db.IsAdminAllowGetSpec(userCred, self, "balance") } func (self *SCloudprovider) GetDetailsBalance(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) (jsonutils.JSONObject, error) { diff --git a/pkg/compute/models/cloudregions.go b/pkg/compute/models/cloudregions.go index 5f6f34c269..7f36857f22 100644 --- a/pkg/compute/models/cloudregions.go +++ b/pkg/compute/models/cloudregions.go @@ -12,9 +12,7 @@ import ( "yunion.io/x/pkg/util/compare" "yunion.io/x/sqlchemy" - "yunion.io/x/onecloud/pkg/cloudcommon/consts" "yunion.io/x/onecloud/pkg/cloudcommon/db" - "yunion.io/x/onecloud/pkg/cloudcommon/policy" "yunion.io/x/onecloud/pkg/cloudprovider" ) @@ -53,19 +51,19 @@ func (manager *SCloudregionManager) AllowListItems(ctx context.Context, userCred } func (self *SCloudregionManager) AllowCreateItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionCreate) + return db.IsAdminAllowCreate(userCred, self) } func (self *SCloudregion) AllowGetDetails(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionGet) + return db.IsAdminAllowGet(userCred, self) } func (self *SCloudregion) AllowUpdateItem(ctx context.Context, userCred mcclient.TokenCredential) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionUpdate) + return db.IsAdminAllowUpdate(userCred, self) } func (self *SCloudregion) AllowDeleteItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionDelete) + return db.IsAdminAllowDelete(userCred, self) } func (self *SCloudregion) CustomizeCreate(ctx context.Context, userCred mcclient.TokenCredential, ownerProjId string, query jsonutils.JSONObject, data jsonutils.JSONObject) error { @@ -264,7 +262,7 @@ func (manager *SCloudregionManager) newFromCloudRegion(cloudRegion cloudprovider } func (self *SCloudregion) AllowPerformDefaultVpc(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "default-vpc") + return db.IsAdminAllowPerform(userCred, self, "default-vpc") } func (self *SCloudregion) PerformDefaultVpc(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { diff --git a/pkg/compute/models/disks.go b/pkg/compute/models/disks.go index f2c0e24168..aa145d2d66 100644 --- a/pkg/compute/models/disks.go +++ b/pkg/compute/models/disks.go @@ -19,11 +19,9 @@ import ( "yunion.io/x/pkg/utils" "yunion.io/x/sqlchemy" - "yunion.io/x/onecloud/pkg/cloudcommon/consts" "yunion.io/x/onecloud/pkg/cloudcommon/db" "yunion.io/x/onecloud/pkg/cloudcommon/db/quotas" "yunion.io/x/onecloud/pkg/cloudcommon/db/taskman" - "yunion.io/x/onecloud/pkg/cloudcommon/policy" "yunion.io/x/onecloud/pkg/cloudprovider" "yunion.io/x/onecloud/pkg/compute/options" "yunion.io/x/onecloud/pkg/httperrors" @@ -444,7 +442,7 @@ func (self *SDisk) StartAllocate(ctx context.Context, host *SHost, storage *SSto } func (self *SDisk) AllowGetDetailsConvertSnapshot(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { - return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionGet, "convert-snapshot") + return self.IsOwner(userCred) || db.IsAdminAllowPerform(userCred, self, "convert-snapshot") } func (self *SDisk) GetDetailsConvertSnapshot(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -501,7 +499,7 @@ func (self *SDisk) CleanUpDiskSnapshots(ctx context.Context, userCred mcclient.T } func (self *SDisk) AllowPerformCreateSnapshot(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "create-snapshot") + return self.IsOwner(userCred) || db.IsAdminAllowPerform(userCred, self, "create-snapshot") } func (self *SDisk) PerformCreateSnapshot(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -515,7 +513,7 @@ func (self *SDisk) PerformCreateSnapshot(ctx context.Context, userCred mcclient. } func (self *SDisk) AllowPerformDiskReset(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "disk-reset") + return self.IsOwner(userCred) || db.IsAdminAllowPerform(userCred, self, "disk-reset") } func (self *SDisk) PerformDiskReset(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -562,7 +560,7 @@ func (self *SDisk) StartResetDisk(ctx context.Context, userCred mcclient.TokenCr } func (self *SDisk) AllowPerformResize(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "resize") + return self.IsOwner(userCred) || db.IsAdminAllowPerform(userCred, self, "resize") } func (self *SDisk) PerformResize(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -653,7 +651,7 @@ func (self *SDisk) PrepareSaveImage(ctx context.Context, userCred mcclient.Token } func (self *SDisk) AllowPerformSave(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "save") + return self.IsOwner(userCred) || db.IsAdminAllowPerform(userCred, self, "save") } func (self *SDisk) PerformSave(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -1141,7 +1139,7 @@ func (self *SDisk) RealDelete(ctx context.Context, userCred mcclient.TokenCreden } func (self *SDisk) AllowPerformPurge(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "purge") + return self.IsOwner(userCred) || db.IsAdminAllowPerform(userCred, self, "purge") } func (self *SDisk) PerformPurge(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -1317,7 +1315,7 @@ func (self *SDisk) isInit() bool { } func (self *SDisk) AllowPerformCancelDelete(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "cancel-delete") + return db.IsAdminAllowPerform(userCred, self, "cancel-delete") } func (self *SDisk) PerformCancelDelete(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { diff --git a/pkg/compute/models/dnsrecords.go b/pkg/compute/models/dnsrecords.go index 74590ae471..a5843c5a69 100644 --- a/pkg/compute/models/dnsrecords.go +++ b/pkg/compute/models/dnsrecords.go @@ -11,9 +11,7 @@ import ( "yunion.io/x/pkg/util/regutils" "yunion.io/x/sqlchemy" - "yunion.io/x/onecloud/pkg/cloudcommon/consts" "yunion.io/x/onecloud/pkg/cloudcommon/db" - "yunion.io/x/onecloud/pkg/cloudcommon/policy" "yunion.io/x/onecloud/pkg/httperrors" "yunion.io/x/onecloud/pkg/mcclient" ) @@ -385,7 +383,7 @@ func (rec *SDnsRecord) AddInfo(userCred mcclient.TokenCredential, data jsonutils } func (rec *SDnsRecord) AllowPerformAddRecords(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return rec.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), rec.KeywordPlural(), policy.PolicyActionPerform, "add-records") + return rec.IsOwner(userCred) || db.IsAdminAllowPerform(userCred, rec, "add-records") } func (rec *SDnsRecord) PerformAddRecords(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -404,7 +402,7 @@ func (rec *SDnsRecord) PerformAddRecords(ctx context.Context, userCred mcclient. } func (rec *SDnsRecord) AllowPerformRemoveRecords(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return rec.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), rec.KeywordPlural(), policy.PolicyActionPerform, "remove-records") + return rec.IsOwner(userCred) || db.IsAdminAllowPerform(userCred, rec, "remove-records") } func (rec *SDnsRecord) PerformRemoveRecords(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -413,7 +411,7 @@ func (rec *SDnsRecord) PerformRemoveRecords(ctx context.Context, userCred mcclie } func (rec *SDnsRecord) AllowPerformEnable(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return rec.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), rec.KeywordPlural(), policy.PolicyActionPerform, "enable") + return rec.IsOwner(userCred) || db.IsAdminAllowPerform(userCred, rec, "enable") } func (rec *SDnsRecord) PerformEnable(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -431,7 +429,7 @@ func (rec *SDnsRecord) PerformEnable(ctx context.Context, userCred mcclient.Toke } func (rec *SDnsRecord) AllowPerformDisable(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return rec.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), rec.KeywordPlural(), policy.PolicyActionPerform, "disable") + return rec.IsOwner(userCred) || db.IsAdminAllowPerform(userCred, rec, "disable") } func (rec *SDnsRecord) PerformDisable(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { diff --git a/pkg/compute/models/dynamicschedtags.go b/pkg/compute/models/dynamicschedtags.go index 0a1ab9e640..54443b2f18 100644 --- a/pkg/compute/models/dynamicschedtags.go +++ b/pkg/compute/models/dynamicschedtags.go @@ -7,9 +7,7 @@ import ( "yunion.io/x/log" "database/sql" - "yunion.io/x/onecloud/pkg/cloudcommon/consts" "yunion.io/x/onecloud/pkg/cloudcommon/db" - "yunion.io/x/onecloud/pkg/cloudcommon/policy" "yunion.io/x/onecloud/pkg/httperrors" "yunion.io/x/onecloud/pkg/mcclient" "yunion.io/x/onecloud/pkg/util/conditionparser" @@ -46,23 +44,23 @@ type SDynamicschedtag struct { } func (self *SDynamicschedtagManager) AllowListItems(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionList) + return db.IsAdminAllowList(userCred, self) } func (self *SDynamicschedtagManager) AllowCreateItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionCreate) + return db.IsAdminAllowCreate(userCred, self) } func (self *SDynamicschedtag) AllowGetDetails(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionGet) + return db.IsAdminAllowGet(userCred, self) } func (self *SDynamicschedtag) AllowUpdateItem(ctx context.Context, userCred mcclient.TokenCredential) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionUpdate) + return db.IsAdminAllowUpdate(userCred, self) } func (self *SDynamicschedtag) AllowDeleteItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionDelete) + return db.IsAdminAllowDelete(userCred, self) } func validateDynamicSchedtagInputData(data *jsonutils.JSONDict, create bool) error { @@ -152,7 +150,7 @@ func (manager *SDynamicschedtagManager) getAllEnabledDynamicSchedtags() []SDynam } func (self *SDynamicschedtag) AllowPerformEvaluate(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "evaluate") + return db.IsAdminAllowPerform(userCred, self, "evaluate") } func (self *SDynamicschedtag) PerformEvaluate(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { diff --git a/pkg/compute/models/elasticips.go b/pkg/compute/models/elasticips.go index 840f29bd35..861c5849a9 100644 --- a/pkg/compute/models/elasticips.go +++ b/pkg/compute/models/elasticips.go @@ -13,12 +13,10 @@ import ( "yunion.io/x/pkg/utils" "yunion.io/x/sqlchemy" - "yunion.io/x/onecloud/pkg/cloudcommon/consts" "yunion.io/x/onecloud/pkg/cloudcommon/db" "yunion.io/x/onecloud/pkg/cloudcommon/db/lockman" "yunion.io/x/onecloud/pkg/cloudcommon/db/quotas" "yunion.io/x/onecloud/pkg/cloudcommon/db/taskman" - "yunion.io/x/onecloud/pkg/cloudcommon/policy" "yunion.io/x/onecloud/pkg/cloudprovider" "yunion.io/x/onecloud/pkg/httperrors" "yunion.io/x/onecloud/pkg/mcclient" @@ -495,7 +493,7 @@ func (self *SElasticip) StartEipDeallocateTask(ctx context.Context, userCred mcc } func (self *SElasticip) AllowPerformAssociate(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "associate") + return self.IsOwner(userCred) || db.IsAdminAllowPerform(userCred, self, "associate") } func (self *SElasticip) PerformAssociate(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -595,7 +593,7 @@ func (self *SElasticip) StartEipAssociateTask(ctx context.Context, userCred mccl } func (self *SElasticip) AllowPerformDissociate(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "dissociate") + return self.IsOwner(userCred) || db.IsAdminAllowPerform(userCred, self, "dissociate") } func (self *SElasticip) PerformDissociate(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -649,7 +647,7 @@ func (self *SElasticip) GetIEip() (cloudprovider.ICloudEIP, error) { } func (self *SElasticip) AllowPerformSync(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "sync") + return self.IsOwner(userCred) || db.IsAdminAllowPerform(userCred, self, "sync") } func (self *SElasticip) PerformSync(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -733,7 +731,7 @@ func (manager *SElasticipManager) allocateEipAndAssociateVM(ctx context.Context, } func (self *SElasticip) AllowPerformChangeBandwidth(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "change-bandwidth") + return self.IsOwner(userCred) || db.IsAdminAllowPerform(userCred, self, "change-bandwidth") } func (self *SElasticip) PerformChangeBandwidth(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -836,7 +834,7 @@ func (manager *SElasticipManager) TotalCount(projectId string, rangeObj db.IStan } func (self *SElasticip) AllowPerformPurge(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionDelete) + return db.IsAdminAllowPerform(userCred, self, "purge") } func (self *SElasticip) PerformPurge(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { diff --git a/pkg/compute/models/guest_actions.go b/pkg/compute/models/guest_actions.go index 83d92064c6..961c0ec84d 100644 --- a/pkg/compute/models/guest_actions.go +++ b/pkg/compute/models/guest_actions.go @@ -23,8 +23,6 @@ import ( "yunion.io/x/jsonutils" "yunion.io/x/log" - "yunion.io/x/onecloud/pkg/cloudcommon/consts" - "yunion.io/x/onecloud/pkg/cloudcommon/policy" "yunion.io/x/pkg/util/fileutils" "yunion.io/x/pkg/util/regutils" "yunion.io/x/pkg/utils" @@ -32,7 +30,7 @@ import ( ) func (self *SGuest) AllowGetDetailsVnc(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { - return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionGet, "vnc") + return self.IsOwner(userCred) || db.IsAdminAllowGetSpec(userCred, self, "vnc") } func (self *SGuest) GetDetailsVnc(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -53,7 +51,7 @@ func (self *SGuest) GetDetailsVnc(ctx context.Context, userCred mcclient.TokenCr } func (self *SGuest) AllowGetDetailsMonitor(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { - return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionGet, "monitor") + return self.IsOwner(userCred) || db.IsAdminAllowGetSpec(userCred, self, "monitor") } func (self *SGuest) GetDetailsMonitor(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -68,7 +66,7 @@ func (self *SGuest) GetDetailsMonitor(ctx context.Context, userCred mcclient.Tok } func (self *SGuest) AllowGetDetailsDesc(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { - return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionGet, "desc") + return self.IsOwner(userCred) || db.IsAdminAllowGetSpec(userCred, self, "desc") } func (self *SGuest) GetDetailsDesc(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -81,7 +79,7 @@ func (self *SGuest) GetDetailsDesc(ctx context.Context, userCred mcclient.TokenC } func (self *SGuest) AllowPerformSaveImage(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "save-image") + return self.IsOwner(userCred) || db.IsAdminAllowPerform(userCred, self, "save-image") } func (self *SGuest) PerformSaveImage(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -119,7 +117,7 @@ func (self *SGuest) StartGuestSaveImage(ctx context.Context, userCred mcclient.T } func (self *SGuest) AllowPerformSync(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "sync") + return self.IsOwner(userCred) || db.IsAdminAllowPerform(userCred, self, "sync") } func (self *SGuest) PerformSync(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -161,7 +159,7 @@ func (self *SGuest) CheckQemuVersion(qemuVer, compareVer string) bool { } func (self *SGuest) AllowPerformMigrate(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "migrate") + return self.IsOwner(userCred) || db.IsAdminAllowPerform(userCred, self, "migrate") } func (self *SGuest) PerformMigrate(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -188,7 +186,7 @@ func (self *SGuest) PerformMigrate(ctx context.Context, userCred mcclient.TokenC var preferHostId string preferHost, _ := data.GetString("prefer_host") if len(preferHost) > 0 { - if !userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "assign-host") { + if !db.IsAdminAllowPerform(userCred, self, "assign-host") { return nil, httperrors.NewBadRequestError("Only system admin can assign host") } iHost, _ := HostManager.FetchByIdOrName(userCred, preferHost) @@ -221,7 +219,7 @@ func (self *SGuest) StartMigrateTask(ctx context.Context, userCred mcclient.Toke } func (self *SGuest) AllowPerformLiveMigrate(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "live-migrate") + return self.IsOwner(userCred) || db.IsAdminAllowPerform(userCred, self, "live-migrate") } func (self *SGuest) PerformLiveMigrate(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -251,7 +249,7 @@ func (self *SGuest) PerformLiveMigrate(ctx context.Context, userCred mcclient.To var preferHostId string preferHost, _ := data.GetString("prefer_host") if len(preferHost) > 0 { - if !userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "assign-host") { + if !db.IsAdminAllowPerform(userCred, self, "assign-host") { return nil, httperrors.NewBadRequestError("Only system admin can assign host") } iHost, _ := HostManager.FetchByIdOrName(userCred, preferHost) @@ -284,7 +282,7 @@ func (self *SGuest) StartGuestLiveMigrateTask(ctx context.Context, userCred mccl } func (self *SGuest) AllowPerformDeploy(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "deploy") + return self.IsOwner(userCred) || db.IsAdminAllowPerform(userCred, self, "deploy") } func (self *SGuest) PerformDeploy(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -347,7 +345,7 @@ func (self *SGuest) PerformDeploy(ctx context.Context, userCred mcclient.TokenCr } func (self *SGuest) AllowPerformAttachdisk(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "attachdisk") + return self.IsOwner(userCred) || db.IsAdminAllowPerform(userCred, self, "attachdisk") } func (self *SGuest) ValidateAttachDisk(ctx context.Context, disk *SDisk) error { @@ -427,7 +425,7 @@ func (self *SGuest) StartSyncTask(ctx context.Context, userCred mcclient.TokenCr } func (self *SGuest) AllowPerformSuspend(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "suspend") + return self.IsOwner(userCred) || db.IsAdminAllowPerform(userCred, self, "suspend") } func (self *SGuest) PerformSuspend(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -450,7 +448,7 @@ func (self *SGuest) AllowPerformStart(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "start") + return self.IsOwner(userCred) || db.IsAdminAllowPerform(userCred, self, "start") } func (self *SGuest) PerformStart(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, @@ -626,11 +624,11 @@ func (self *SGuest) StartDeleteGuestTask(ctx context.Context, userCred mcclient. } func (self *SGuest) AllowPerformAssignSecgroup(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "assign-secgroup") + return self.IsOwner(userCred) || db.IsAdminAllowPerform(userCred, self, "assign-secgroup") } func (self *SGuest) AllowPerformRevokeSecgroup(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "revoke-secgroup") + return self.IsOwner(userCred) || db.IsAdminAllowPerform(userCred, self, "revoke-secgroup") } func (self *SGuest) PerformRevokeSecgroup(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -681,7 +679,7 @@ func (self *SGuest) PerformAssignSecgroup(ctx context.Context, userCred mcclient } func (self *SGuest) AllowPerformPurge(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionDelete) + return db.IsAdminAllowPerform(userCred, self, "purge") } func (self *SGuest) PerformPurge(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -709,7 +707,7 @@ func (self *SGuest) setKeypairId(userCred mcclient.TokenCredential, keypairId st } func (self *SGuest) AllowPerformRebuildRoot(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "rebuild-root") + return self.IsOwner(userCred) || db.IsAdminAllowPerform(userCred, self, "rebuild-root") } func (self *SGuest) PerformRebuildRoot(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -816,7 +814,7 @@ func (self *SGuest) DetachDisk(ctx context.Context, disk *SDisk, userCred mcclie } func (self *SGuest) AllowPerformCreatedisk(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "createdisk") + return self.IsOwner(userCred) || db.IsAdminAllowPerform(userCred, self, "createdisk") } func (self *SGuest) PerformCreatedisk(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -887,7 +885,7 @@ func (self *SGuest) PerformCreatedisk(ctx context.Context, userCred mcclient.Tok } func (self *SGuest) AllowPerformDetachdisk(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "detachdisk") + return self.IsOwner(userCred) || db.IsAdminAllowPerform(userCred, self, "detachdisk") } func (self *SGuest) PerformDetachdisk(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -933,7 +931,7 @@ func (self *SGuest) PerformDetachdisk(ctx context.Context, userCred mcclient.Tok } func (self *SGuest) AllowPerformDetachIsolatedDevice(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "detach-isolated-device") + return self.IsOwner(userCred) || db.IsAdminAllowPerform(userCred, self, "detach-isolated-device") } func (self *SGuest) PerformDetachIsolatedDevice(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -983,7 +981,7 @@ func (self *SGuest) detachIsolateDevice(userCred mcclient.TokenCredential, dev * } func (self *SGuest) AllowPerformAttachIsolatedDevice(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "attach-isolated-device") + return self.IsOwner(userCred) || db.IsAdminAllowPerform(userCred, self, "attach-isolated-device") } func (self *SGuest) PerformAttachIsolatedDevice(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -1021,7 +1019,7 @@ func (self *SGuest) PerformAttachIsolatedDevice(ctx context.Context, userCred mc } func (self *SGuest) AllowPerformDetachnetwork(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "detachnetwork") + return self.IsOwner(userCred) || db.IsAdminAllowPerform(userCred, self, "detachnetwork") } func (self *SGuest) PerformDetachnetwork(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -1043,7 +1041,7 @@ func (self *SGuest) PerformDetachnetwork(ctx context.Context, userCred mcclient. } func (self *SGuest) AllowPerformAttachnetwork(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "attachnetwork") + return self.IsOwner(userCred) || db.IsAdminAllowPerform(userCred, self, "attachnetwork") } func (self *SGuest) PerformAttachnetwork(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -1094,7 +1092,7 @@ func (self *SGuest) PerformAttachnetwork(ctx context.Context, userCred mcclient. } func (self *SGuest) AllowPerformChangeBandwidth(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "change-bandwidth") + return self.IsOwner(userCred) || db.IsAdminAllowPerform(userCred, self, "change-bandwidth") } func (self *SGuest) PerformChangeBandwidth(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -1128,7 +1126,7 @@ func (self *SGuest) PerformChangeBandwidth(ctx context.Context, userCred mcclien } func (self *SGuest) AllowPerformChangeConfig(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "change-config") + return self.IsOwner(userCred) || db.IsAdminAllowPerform(userCred, self, "change-config") } func (self *SGuest) PerformChangeConfig(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -1319,7 +1317,7 @@ func (self *SGuest) DoPendingDelete(ctx context.Context, userCred mcclient.Token } func (model *SGuest) AllowPerformCancelDelete(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), model.KeywordPlural(), policy.PolicyActionPerform, "cancel-delete") + return db.IsAdminAllowPerform(userCred, model, "cancel-delete") } func (self *SGuest) PerformCancelDelete(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -1355,7 +1353,7 @@ func (self *SGuest) AllowPerformReset(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "reset") + return self.IsOwner(userCred) || db.IsAdminAllowPerform(userCred, self, "reset") } func (self *SGuest) PerformReset(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, @@ -1369,7 +1367,7 @@ func (self *SGuest) PerformReset(ctx context.Context, userCred mcclient.TokenCre } func (self *SGuest) AllowPerformDiskSnapshot(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "disk-snapshot") + return self.IsOwner(userCred) || db.IsAdminAllowPerform(userCred, self, "disk-snapshot") } func (self *SGuest) PerformDiskSnapshot(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -1423,7 +1421,7 @@ func (self *SGuest) PerformDiskSnapshot(ctx context.Context, userCred mcclient.T } func (self *SGuest) AllowPerformSyncstatus(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "syncstatus") + return self.IsOwner(userCred) || db.IsAdminAllowPerform(userCred, self, "syncstatus") } func (self *SGuest) PerformSyncstatus(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -1467,7 +1465,7 @@ func (self *SGuest) AllowPerformStop(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "stop") + return self.IsOwner(userCred) || db.IsAdminAllowPerform(userCred, self, "stop") } func (self *SGuest) PerformStop(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, @@ -1484,7 +1482,7 @@ func (self *SGuest) AllowPerformRestart(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "restart") + return self.IsOwner(userCred) || db.IsAdminAllowPerform(userCred, self, "restart") } func (self *SGuest) PerformRestart(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -1497,7 +1495,7 @@ func (self *SGuest) PerformRestart(ctx context.Context, userCred mcclient.TokenC } func (self *SGuest) AllowPerformSendkeys(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "sendkeys") + return self.IsOwner(userCred) || db.IsAdminAllowPerform(userCred, self, "sendkeys") } func (self *SGuest) PerformSendkeys(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -1571,7 +1569,7 @@ func (self *SGuest) SendMonitorCommand(ctx context.Context, userCred mcclient.To } func (self *SGuest) AllowPerformAssociateEip(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "associate-eip") + return self.IsOwner(userCred) || db.IsAdminAllowPerform(userCred, self, "associate-eip") } func (self *SGuest) PerformAssociateEip(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -1639,7 +1637,7 @@ func (self *SGuest) PerformAssociateEip(ctx context.Context, userCred mcclient.T } func (self *SGuest) AllowPerformDissociateEip(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "dissociate-eip") + return self.IsOwner(userCred) || db.IsAdminAllowPerform(userCred, self, "dissociate-eip") } func (self *SGuest) PerformDissociateEip(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -1663,7 +1661,7 @@ func (self *SGuest) PerformDissociateEip(ctx context.Context, userCred mcclient. } func (self *SGuest) AllowPerformCreateEip(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "create-eip") + return self.IsOwner(userCred) || db.IsAdminAllowPerform(userCred, self, "create-eip") } func (self *SGuest) PerformCreateEip(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -1718,7 +1716,7 @@ func (self *SGuest) setUserData(ctx context.Context, userCred mcclient.TokenCred } func (self *SGuest) AllowPerformUserData(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "userdata") + return self.IsOwner(userCred) || db.IsAdminAllowPerform(userCred, self, "userdata") } func (self *SGuest) PerformUserData(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -1740,7 +1738,7 @@ func (self *SGuest) PerformUserData(ctx context.Context, userCred mcclient.Token } func (self *SGuest) AllowPerformSetExtraOption(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "set-extra-option") + return db.IsAdminAllowPerform(userCred, self, "set-extra-option") } func (self *SGuest) PerformSetExtraOption(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -1768,7 +1766,7 @@ func (self *SGuest) SetExtraOptions(ctx context.Context, userCred mcclient.Token } func (self *SGuest) AllowPerformDelExtraOption(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "del-extra-option") + return db.IsAdminAllowPerform(userCred, self, "del-extra-option") } func (self *SGuest) PerformDelExtraOption(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { diff --git a/pkg/compute/models/guests.go b/pkg/compute/models/guests.go index 011b3ae613..1a1145d5eb 100644 --- a/pkg/compute/models/guests.go +++ b/pkg/compute/models/guests.go @@ -22,11 +22,9 @@ import ( "yunion.io/x/pkg/utils" "yunion.io/x/sqlchemy" - "yunion.io/x/onecloud/pkg/cloudcommon/consts" "yunion.io/x/onecloud/pkg/cloudcommon/db" "yunion.io/x/onecloud/pkg/cloudcommon/db/lockman" "yunion.io/x/onecloud/pkg/cloudcommon/db/quotas" - "yunion.io/x/onecloud/pkg/cloudcommon/policy" "yunion.io/x/onecloud/pkg/cloudprovider" "yunion.io/x/onecloud/pkg/compute/options" "yunion.io/x/onecloud/pkg/compute/sshkeys" @@ -209,7 +207,7 @@ type SGuest struct { func (manager *SGuestManager) AllowListItems(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { if query.Contains("host") || query.Contains("wire") || query.Contains("zone") { - if !userCred.IsAdminAllow(consts.GetServiceType(), manager.KeywordPlural(), policy.PolicyActionList) { + if !db.IsAdminAllowList(userCred, manager) { return false } } @@ -921,7 +919,7 @@ func (self *SGuest) getExtBandwidth() int { func (self *SGuest) GetCustomizeColumns(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) *jsonutils.JSONDict { extra := self.SVirtualResourceBase.GetCustomizeColumns(ctx, userCred, query) - if userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionGet) { + if db.IsAdminAllowGet(userCred, self) { host := self.GetHost() if host != nil { extra.Add(jsonutils.NewString(host.Name), "host") @@ -1014,7 +1012,7 @@ func (self *SGuest) GetExtraDetails(ctx context.Context, userCred mcclient.Token if metaData, err := self.GetAllMetadata(userCred); err == nil { extra.Add(jsonutils.Marshal(metaData), "metadata") } - if userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionGet) { + if db.IsAdminAllowGet(userCred, self) { host := self.GetHost() if host != nil { extra.Add(jsonutils.NewString(host.GetName()), "host") @@ -2213,10 +2211,10 @@ func (self *SGuest) AllowDeleteItem(ctx context.Context, userCred mcclient.Token overridePendingDelete = jsonutils.QueryBoolean(data, "override_pending_delete", false) purge = jsonutils.QueryBoolean(data, "purge", false) } - if (overridePendingDelete || purge) && !userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionDelete) { + if (overridePendingDelete || purge) && !db.IsAdminAllowDelete(userCred, self) { return false } - return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionDelete) + return self.IsOwner(userCred) || db.IsAdminAllowDelete(userCred, self) } func (self *SGuest) CustomizeDelete(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) error { diff --git a/pkg/compute/models/hostjoints.go b/pkg/compute/models/hostjoints.go index b8d7dac8f3..ccc1aaabab 100644 --- a/pkg/compute/models/hostjoints.go +++ b/pkg/compute/models/hostjoints.go @@ -6,9 +6,7 @@ import ( "yunion.io/x/jsonutils" "yunion.io/x/onecloud/pkg/mcclient" - "yunion.io/x/onecloud/pkg/cloudcommon/consts" "yunion.io/x/onecloud/pkg/cloudcommon/db" - "yunion.io/x/onecloud/pkg/cloudcommon/policy" ) type SHostJointsManager struct { @@ -33,29 +31,29 @@ type SHostJointsBase struct { } func (manager *SHostJointsManager) AllowListItems(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), manager.KeywordPlural(), policy.PolicyActionList) + return db.IsAdminAllowList(userCred, manager) } func (manager *SHostJointsManager) AllowCreateItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), manager.KeywordPlural(), policy.PolicyActionCreate) + return db.IsAdminAllowCreate(userCred, manager) } func (manager *SHostJointsManager) AllowListDescendent(ctx context.Context, userCred mcclient.TokenCredential, model db.IStandaloneModel, query jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), manager.KeywordPlural(), policy.PolicyActionList) + return db.IsAdminAllowList(userCred, manager) } func (manager *SHostJointsManager) AllowAttach(ctx context.Context, userCred mcclient.TokenCredential, master db.IStandaloneModel, slave db.IStandaloneModel) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), manager.KeywordPlural(), policy.PolicyActionDelete) + return db.IsAdminAllowCreate(userCred, manager) } func (self *SHostJointsBase) AllowGetDetails(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.GetModelManager().KeywordPlural(), policy.PolicyActionGet) + return db.IsAdminAllowGet(userCred, self) } func (self *SHostJointsBase) AllowUpdateItem(ctx context.Context, userCred mcclient.TokenCredential) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.GetModelManager().KeywordPlural(), policy.PolicyActionUpdate) + return db.IsAdminAllowUpdate(userCred, self) } func (self *SHostJointsBase) AllowDeleteItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.GetModelManager().KeywordPlural(), policy.PolicyActionDelete) + return db.IsAdminAllowDelete(userCred, self) } diff --git a/pkg/compute/models/hosts.go b/pkg/compute/models/hosts.go index af12e6dd4c..8ae5e880a5 100644 --- a/pkg/compute/models/hosts.go +++ b/pkg/compute/models/hosts.go @@ -20,11 +20,9 @@ import ( "yunion.io/x/pkg/utils" "yunion.io/x/sqlchemy" - "yunion.io/x/onecloud/pkg/cloudcommon/consts" "yunion.io/x/onecloud/pkg/cloudcommon/db" "yunion.io/x/onecloud/pkg/cloudcommon/db/lockman" "yunion.io/x/onecloud/pkg/cloudcommon/db/taskman" - "yunion.io/x/onecloud/pkg/cloudcommon/policy" "yunion.io/x/onecloud/pkg/cloudprovider" "yunion.io/x/onecloud/pkg/compute/baremetal" "yunion.io/x/onecloud/pkg/compute/options" @@ -160,23 +158,23 @@ func (manager *SHostManager) GetContextManager() []db.IModelManager { } func (self *SHostManager) AllowListItems(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionList) + return db.IsAdminAllowList(userCred, self) } func (self *SHostManager) AllowCreateItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionCreate) + return db.IsAdminAllowCreate(userCred, self) } func (self *SHost) AllowGetDetails(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionGet) + return db.IsAdminAllowGet(userCred, self) } func (self *SHost) AllowUpdateItem(ctx context.Context, userCred mcclient.TokenCredential) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionUpdate) + return db.IsAdminAllowUpdate(userCred, self) } func (self *SHost) AllowDeleteItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionDelete) + return db.IsAdminAllowDelete(userCred, self) } func (manager *SHostManager) ListItemFilter(ctx context.Context, q *sqlchemy.SQuery, userCred mcclient.TokenCredential, query jsonutils.JSONObject) (*sqlchemy.SQuery, error) { @@ -1792,7 +1790,7 @@ func (self *SHost) GetExtraDetails(ctx context.Context, userCred mcclient.TokenC } func (self *SHost) AllowGetDetailsVnc(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionGet, "vnc") + return db.IsAdminAllowGetSpec(userCred, self, "vnc") } func (self *SHost) GetDetailsVnc(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -1807,7 +1805,7 @@ func (self *SHost) GetDetailsVnc(ctx context.Context, userCred mcclient.TokenCre } func (self *SHost) AllowGetDetailsIpmi(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionGet, "ipmi") + return db.IsAdminAllowGetSpec(userCred, self, "ipmi") } func (self *SHost) GetDetailsIpmi(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -2098,7 +2096,7 @@ func (self *SHost) AllowPerformStart(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "start") + return db.IsAdminAllowPerform(userCred, self, "start") } func (self *SHost) PerformStart(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, @@ -2133,7 +2131,7 @@ func (self *SHost) AllowPerformStop(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "stop") + return db.IsAdminAllowPerform(userCred, self, "stop") } func (self *SHost) PerformStop(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, @@ -2183,7 +2181,7 @@ func (self *SHost) AllowPerformMaintenance(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "maintenance") + return db.IsAdminAllowPerform(userCred, self, "maintenance") } @@ -2223,7 +2221,7 @@ func (self *SHost) AllowPerformUnmaintenance(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "unmaintenance") + return db.IsAdminAllowPerform(userCred, self, "unmaintenance") } func (self *SHost) PerformUnmaintenance(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -2285,7 +2283,7 @@ func (self *SHost) AllowPerformOffline(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "offline") + return db.IsAdminAllowPerform(userCred, self, "offline") } func (self *SHost) PerformOffline(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -2304,7 +2302,7 @@ func (self *SHost) AllowPerformOnline(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "online") + return db.IsAdminAllowPerform(userCred, self, "online") } func (self *SHost) PerformOnline(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -2337,7 +2335,7 @@ func (self *SHost) AllowPerformPing(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "ping") + return db.IsAdminAllowPerform(userCred, self, "ping") } func (self *SHost) PerformPing(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -2364,7 +2362,7 @@ func (self *SHost) AllowPerformPrepare(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "prepare") + return db.IsAdminAllowPerform(userCred, self, "prepare") } func (self *SHost) PerformPrepare(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -2400,7 +2398,7 @@ func (self *SHost) AllowPerformAddNetif(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "add-netif") + return db.IsAdminAllowPerform(userCred, self, "add-netif") } func (self *SHost) PerformAddNetif(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -2552,7 +2550,7 @@ func (self *SHost) AllowPerformEnableNetif(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "enable-netif") + return db.IsAdminAllowPerform(userCred, self, "enable-netif") } func (self *SHost) PerformEnableNetif(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -2626,7 +2624,7 @@ func (self *SHost) AllowPerformDisableNetif(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "disable-netif") + return db.IsAdminAllowPerform(userCred, self, "disable-netif") } func (self *SHost) PerformDisableNetif(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -2680,7 +2678,7 @@ func (self *SHost) AllowPerformRemoveNetif(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "remove-netif") + return db.IsAdminAllowPerform(userCred, self, "remove-netif") } func (self *SHost) PerformRemoveNetif(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -2734,7 +2732,7 @@ func (self *SHost) AllowPerformSyncstatus(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "syncstatus") + return db.IsAdminAllowPerform(userCred, self, "syncstatus") } func (self *SHost) PerformSyncstatus(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -2746,7 +2744,7 @@ func (self *SHost) AllowPerformReset(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "reset") + return db.IsAdminAllowPerform(userCred, self, "reset") } func (self *SHost) PerformReset(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -2776,7 +2774,7 @@ func (self *SHost) AllowPerformRemoveAllNetifs(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "remove-all-netifs") + return db.IsAdminAllowPerform(userCred, self, "remove-all-netifs") } func (self *SHost) PerformRemoveAllNetifs(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -2793,7 +2791,7 @@ func (self *SHost) AllowPerformDisable(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "disable") + return db.IsAdminAllowPerform(userCred, self, "disable") } func (self *SHost) PerformDisable(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -2816,7 +2814,7 @@ func (self *SHost) AllowPerformCacheImage(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "cache-image") + return db.IsAdminAllowPerform(userCred, self, "cache-image") } func (self *SHost) PerformCacheImage(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -2848,7 +2846,7 @@ func (self *SHost) AllowPerformConvertHypervisor(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "convert-hypervisor") + return db.IsAdminAllowPerform(userCred, self, "convert-hypervisor") } func (self *SHost) isAlterNameUnique(name string) bool { @@ -2914,7 +2912,7 @@ func (self *SHost) AllowPerformUndoConvert(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "undo-convert") + return db.IsAdminAllowPerform(userCred, self, "undo-convert") } func (self *SHost) PerformUndoConvert(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { diff --git a/pkg/compute/models/isolated_devices.go b/pkg/compute/models/isolated_devices.go index 7e55afb02b..7a9a8738de 100644 --- a/pkg/compute/models/isolated_devices.go +++ b/pkg/compute/models/isolated_devices.go @@ -7,9 +7,7 @@ import ( "yunion.io/x/jsonutils" "yunion.io/x/log" - "yunion.io/x/onecloud/pkg/cloudcommon/consts" "yunion.io/x/onecloud/pkg/cloudcommon/db" - "yunion.io/x/onecloud/pkg/cloudcommon/policy" "yunion.io/x/onecloud/pkg/httperrors" "yunion.io/x/onecloud/pkg/mcclient" "yunion.io/x/pkg/util/regutils" @@ -82,7 +80,7 @@ type SIsolatedDevice struct { func (manager *SIsolatedDeviceManager) AllowListItems(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { host, _ := query.GetString("host") - if len(host) > 0 && !userCred.IsAdminAllow(consts.GetServiceType(), manager.KeywordPlural(), policy.PolicyActionList) { + if len(host) > 0 && !db.IsAdminAllowList(userCred, manager) { return false } return true @@ -94,7 +92,7 @@ func (manager *SIsolatedDeviceManager) ExtraSearchConditions(ctx context.Context } func (manager *SIsolatedDeviceManager) AllowCreateItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), manager.KeywordPlural(), policy.PolicyActionCreate) + return db.IsAdminAllowCreate(userCred, manager) } func (manager *SIsolatedDeviceManager) ListItemFilter(ctx context.Context, q *sqlchemy.SQuery, userCred mcclient.TokenCredential, query jsonutils.JSONObject) (*sqlchemy.SQuery, error) { diff --git a/pkg/compute/models/keypairs.go b/pkg/compute/models/keypairs.go index 67ae5c7638..e4bc4f3f77 100644 --- a/pkg/compute/models/keypairs.go +++ b/pkg/compute/models/keypairs.go @@ -8,9 +8,7 @@ import ( "yunion.io/x/sqlchemy" "golang.org/x/crypto/ssh" - "yunion.io/x/onecloud/pkg/cloudcommon/consts" "yunion.io/x/onecloud/pkg/cloudcommon/db" - "yunion.io/x/onecloud/pkg/cloudcommon/policy" "yunion.io/x/onecloud/pkg/httperrors" "yunion.io/x/onecloud/pkg/mcclient" "yunion.io/x/onecloud/pkg/util/seclib2" @@ -49,7 +47,7 @@ func (manager *SKeypairManager) ListItemFilter(ctx context.Context, q *sqlchemy. if err != nil { return nil, err } - if jsonutils.QueryBoolean(query, "admin", false) && userCred.IsAdminAllow(consts.GetServiceType(), manager.KeywordPlural(), policy.PolicyActionList) { + if jsonutils.QueryBoolean(query, "admin", false) && db.IsAdminAllowList(userCred, manager) { user, _ := query.GetString("user") if len(user) > 0 { uc, _ := db.UserCacheManager.FetchUserByIdOrName(user) @@ -73,7 +71,7 @@ func (self *SKeypair) IsOwner(userCred mcclient.TokenCredential) bool { } func (self *SKeypair) AllowGetDetails(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { - return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionGet) + return self.IsOwner(userCred) || db.IsAdminAllowGet(userCred, self) } func (self *SKeypair) GetCustomizeColumns(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) *jsonutils.JSONDict { @@ -87,7 +85,7 @@ func (self *SKeypair) GetExtraDetails(ctx context.Context, userCred mcclient.Tok extra := self.SStandaloneResourceBase.GetExtraDetails(ctx, userCred, query) extra.Add(jsonutils.NewInt(int64(len(self.PrivateKey))), "private_key_len") extra.Add(jsonutils.NewInt(int64(self.GetLinkedGuestsCount())), "linked_guest_count") - if userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionGet) { + if db.IsAdminAllowGet(userCred, self) { extra.Add(jsonutils.NewString(self.OwnerId), "owner_id") uc, _ := db.UserCacheManager.FetchUserById(self.OwnerId) if uc != nil { @@ -102,11 +100,11 @@ func (manager *SKeypairManager) AllowCreateItem(ctx context.Context, userCred mc } func (self *SKeypair) AllowUpdateItem(ctx context.Context, userCred mcclient.TokenCredential) bool { - return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionUpdate) + return self.IsOwner(userCred) || db.IsAdminAllowUpdate(userCred, self) } func (self *SKeypair) AllowDeleteItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionDelete) + return self.IsOwner(userCred) || db.IsAdminAllowDelete(userCred, self) } func (self *SKeypair) GetLinkedGuestsCount() int { diff --git a/pkg/compute/models/loadbalanceracls.go b/pkg/compute/models/loadbalanceracls.go index d177401fe9..17b0511f77 100644 --- a/pkg/compute/models/loadbalanceracls.go +++ b/pkg/compute/models/loadbalanceracls.go @@ -12,9 +12,7 @@ import ( "yunion.io/x/pkg/gotypes" "yunion.io/x/sqlchemy" - "yunion.io/x/onecloud/pkg/cloudcommon/consts" "yunion.io/x/onecloud/pkg/cloudcommon/db" - "yunion.io/x/onecloud/pkg/cloudcommon/policy" "yunion.io/x/onecloud/pkg/cloudcommon/validators" "yunion.io/x/onecloud/pkg/httperrors" "yunion.io/x/onecloud/pkg/mcclient" @@ -138,7 +136,7 @@ func (lbacl *SLoadbalancerAcl) ValidateUpdateData(ctx context.Context, userCred } func (lbacl *SLoadbalancerAcl) AllowPerformPatch(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data *jsonutils.JSONDict) bool { - return lbacl.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), lbacl.KeywordPlural(), policy.PolicyActionPerform, "patch") + return lbacl.IsOwner(userCred) || db.IsAdminAllowPerform(userCred, lbacl, "patch") } // PerformPatch patches acl entries by adding then deleting the specified acls. diff --git a/pkg/compute/models/loadbalanceragents.go b/pkg/compute/models/loadbalanceragents.go index a92e50513e..11cd9154f1 100644 --- a/pkg/compute/models/loadbalanceragents.go +++ b/pkg/compute/models/loadbalanceragents.go @@ -12,9 +12,7 @@ import ( "yunion.io/x/log" "yunion.io/x/pkg/gotypes" - "yunion.io/x/onecloud/pkg/cloudcommon/consts" "yunion.io/x/onecloud/pkg/cloudcommon/db" - "yunion.io/x/onecloud/pkg/cloudcommon/policy" "yunion.io/x/onecloud/pkg/cloudcommon/validators" "yunion.io/x/onecloud/pkg/httperrors" "yunion.io/x/onecloud/pkg/mcclient" @@ -239,23 +237,23 @@ func (p *SLoadbalancerAgentParams) IsZero() bool { func (self *SLoadbalancerAgentManager) AllowListItems(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionList) + return db.IsAdminAllowList(userCred, self) } func (self *SLoadbalancerAgentManager) AllowCreateItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionCreate) + return db.IsAdminAllowCreate(userCred, self) } func (self *SLoadbalancerAgent) AllowGetDetails(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionGet) + return db.IsAdminAllowGet(userCred, self) } func (self *SLoadbalancerAgent) AllowUpdateItem(ctx context.Context, userCred mcclient.TokenCredential) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionUpdate) + return db.IsAdminAllowUpdate(userCred, self) } func (self *SLoadbalancerAgent) AllowDeleteItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionDelete) + return db.IsAdminAllowDelete(userCred, self) } func (man *SLoadbalancerAgentManager) ValidateCreateData(ctx context.Context, userCred mcclient.TokenCredential, ownerProjId string, query jsonutils.JSONObject, data *jsonutils.JSONDict) (*jsonutils.JSONDict, error) { @@ -417,7 +415,7 @@ func (lbagent *SLoadbalancerAgent) ValidateUpdateData(ctx context.Context, userC } func (lbagent *SLoadbalancerAgent) AllowPerformHb(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data *jsonutils.JSONDict) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), lbagent.KeywordPlural(), policy.PolicyActionPerform, "hb") + return db.IsAdminAllowPerform(userCred, lbagent, "hb") } func (lbagent *SLoadbalancerAgent) PerformHb(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data *jsonutils.JSONDict) (*jsonutils.JSONDict, error) { @@ -443,7 +441,7 @@ func (lbagent *SLoadbalancerAgent) IsActive() bool { } func (lbagent *SLoadbalancerAgent) AllowPerformParamsPatch(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data *jsonutils.JSONDict) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), lbagent.KeywordPlural(), policy.PolicyActionPerform, "params-patch") + return db.IsAdminAllowPerform(userCred, lbagent, "params-patch") } func (lbagent *SLoadbalancerAgent) PerformParamsPatch(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data *jsonutils.JSONDict) (*jsonutils.JSONDict, error) { diff --git a/pkg/compute/models/loadbalancerbackends.go b/pkg/compute/models/loadbalancerbackends.go index 2ebc741a75..4eb5dcba9d 100644 --- a/pkg/compute/models/loadbalancerbackends.go +++ b/pkg/compute/models/loadbalancerbackends.go @@ -7,9 +7,7 @@ import ( "yunion.io/x/jsonutils" "yunion.io/x/sqlchemy" - "yunion.io/x/onecloud/pkg/cloudcommon/consts" "yunion.io/x/onecloud/pkg/cloudcommon/db" - "yunion.io/x/onecloud/pkg/cloudcommon/policy" "yunion.io/x/onecloud/pkg/cloudcommon/validators" "yunion.io/x/onecloud/pkg/mcclient" ) @@ -139,7 +137,7 @@ func (man *SLoadbalancerBackendManager) ValidateCreateData(ctx context.Context, } baseName = guest.Name case LB_BACKEND_HOST: - if !userCred.IsAdminAllow(consts.GetServiceType(), man.KeywordPlural(), policy.PolicyActionCreate) { + if !db.IsAdminAllowCreate(userCred, man) { return nil, fmt.Errorf("only sysadmin can specify host as backend") } backendV := validators.NewModelIdOrNameValidator("backend", "host", userCred.GetProjectId()) diff --git a/pkg/compute/models/loadbalancerlistenerrules.go b/pkg/compute/models/loadbalancerlistenerrules.go index a78f271e25..3e3d3bccc8 100644 --- a/pkg/compute/models/loadbalancerlistenerrules.go +++ b/pkg/compute/models/loadbalancerlistenerrules.go @@ -8,9 +8,7 @@ import ( "yunion.io/x/log" "yunion.io/x/sqlchemy" - "yunion.io/x/onecloud/pkg/cloudcommon/consts" "yunion.io/x/onecloud/pkg/cloudcommon/db" - "yunion.io/x/onecloud/pkg/cloudcommon/policy" "yunion.io/x/onecloud/pkg/cloudcommon/validators" "yunion.io/x/onecloud/pkg/httperrors" "yunion.io/x/onecloud/pkg/mcclient" @@ -128,7 +126,7 @@ func (man *SLoadbalancerListenerRuleManager) ValidateCreateData(ctx context.Cont } func (lbr *SLoadbalancerListenerRule) AllowPerformStatus(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return lbr.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), lbr.KeywordPlural(), policy.PolicyActionPerform, "status") + return lbr.IsOwner(userCred) || db.IsAdminAllowPerform(userCred, lbr, "status") } func (lbr *SLoadbalancerListenerRule) ValidateUpdateData(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data *jsonutils.JSONDict) (*jsonutils.JSONDict, error) { diff --git a/pkg/compute/models/loadbalancerlisteners.go b/pkg/compute/models/loadbalancerlisteners.go index 6a115282fa..ea16d3e9a4 100644 --- a/pkg/compute/models/loadbalancerlisteners.go +++ b/pkg/compute/models/loadbalancerlisteners.go @@ -9,10 +9,8 @@ import ( "yunion.io/x/log" "yunion.io/x/sqlchemy" - "yunion.io/x/onecloud/pkg/cloudcommon/consts" "yunion.io/x/onecloud/pkg/cloudcommon/db" "yunion.io/x/onecloud/pkg/cloudcommon/db/lockman" - "yunion.io/x/onecloud/pkg/cloudcommon/policy" "yunion.io/x/onecloud/pkg/cloudcommon/validators" "yunion.io/x/onecloud/pkg/httperrors" "yunion.io/x/onecloud/pkg/mcclient" @@ -297,7 +295,7 @@ func (man *SLoadbalancerListenerManager) validateAcl(aclStatusV *validators.Vali } func (lblis *SLoadbalancerListener) AllowPerformStatus(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return lblis.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), lblis.KeywordPlural(), policy.PolicyActionPerform, "status") + return lblis.IsOwner(userCred) || db.IsAdminAllowPerform(userCred, lblis, "status") } func (lblis *SLoadbalancerListener) ValidateUpdateData(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data *jsonutils.JSONDict) (*jsonutils.JSONDict, error) { diff --git a/pkg/compute/models/loadbalancers.go b/pkg/compute/models/loadbalancers.go index 00ce2c2219..c77e689677 100644 --- a/pkg/compute/models/loadbalancers.go +++ b/pkg/compute/models/loadbalancers.go @@ -9,10 +9,8 @@ import ( "yunion.io/x/pkg/util/netutils" "yunion.io/x/sqlchemy" - "yunion.io/x/onecloud/pkg/cloudcommon/consts" "yunion.io/x/onecloud/pkg/cloudcommon/db" "yunion.io/x/onecloud/pkg/cloudcommon/db/lockman" - "yunion.io/x/onecloud/pkg/cloudcommon/policy" "yunion.io/x/onecloud/pkg/cloudcommon/validators" "yunion.io/x/onecloud/pkg/httperrors" "yunion.io/x/onecloud/pkg/mcclient" @@ -134,7 +132,7 @@ func (man *SLoadbalancerManager) ValidateCreateData(ctx context.Context, userCre } func (lb *SLoadbalancer) AllowPerformStatus(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return lb.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), lb.KeywordPlural(), policy.PolicyActionPerform, "status") + return lb.IsOwner(userCred) || db.IsAdminAllowPerform(userCred, lb, "status") } func (lb *SLoadbalancer) PostCreate(ctx context.Context, userCred mcclient.TokenCredential, ownerProjId string, query jsonutils.JSONObject, data jsonutils.JSONObject) { diff --git a/pkg/compute/models/networks.go b/pkg/compute/models/networks.go index d6316a8ff1..be63d8d010 100644 --- a/pkg/compute/models/networks.go +++ b/pkg/compute/models/networks.go @@ -17,10 +17,8 @@ import ( "yunion.io/x/pkg/utils" "yunion.io/x/sqlchemy" - "yunion.io/x/onecloud/pkg/cloudcommon/consts" "yunion.io/x/onecloud/pkg/cloudcommon/db" "yunion.io/x/onecloud/pkg/cloudcommon/db/taskman" - "yunion.io/x/onecloud/pkg/cloudcommon/policy" "yunion.io/x/onecloud/pkg/cloudprovider" "yunion.io/x/onecloud/pkg/compute/options" "yunion.io/x/onecloud/pkg/httperrors" @@ -136,7 +134,7 @@ func (self *SNetwork) GetVpc() *SVpc { } func (manager *SNetworkManager) AllowCreateItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), manager.KeywordPlural(), policy.PolicyActionCreate) + return db.IsAdminAllowCreate(userCred, manager) } func (self *SNetwork) ValidateDeleteCondition(ctx context.Context) error { @@ -629,7 +627,7 @@ func (manager *SNetworkManager) allNetworksQ(rangeObj db.IStandaloneModel) *sqlc func (manager *SNetworkManager) totalPortCountQ(userCred mcclient.TokenCredential, rangeObj db.IStandaloneModel) *sqlchemy.SQuery { q := manager.allNetworksQ(rangeObj) networks := manager.Query().SubQuery() - if userCred != nil && !userCred.IsAdminAllow(consts.GetServiceType(), manager.KeywordPlural(), policy.PolicyActionList) { + if userCred != nil && !db.IsAdminAllowList(userCred, manager) { q = q.Filter(sqlchemy.OR( sqlchemy.Equals(networks.Field("tenant_id"), userCred.GetProjectId()), sqlchemy.IsTrue(networks.Field("is_public")))) @@ -762,7 +760,7 @@ func isValidNetworkInfo(userCred mcclient.TokenCredential, netConfig *SNetworkCo } if netConfig.Reserved { // the privilege to access reserved ip - if !userCred.IsAdminAllow(consts.GetServiceType(), ReservedipManager.KeywordPlural(), policy.PolicyActionGet) { + if !db.IsAdminAllowList(userCred, ReservedipManager) { return httperrors.NewForbiddenError("Only system admin allowed to use reserved ip") } if ReservedipManager.GetReservedIP(net, netConfig.Address) == nil { @@ -879,7 +877,7 @@ func (self *SNetwork) GetCustomizeColumns(ctx context.Context, userCred mcclient } func (self *SNetwork) AllowPerformReserveIp(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "reserve-ip") + return self.IsOwner(userCred) || db.IsAdminAllowPerform(userCred, self, "reserve-ip") } func (self *SNetwork) PerformReserveIp(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -906,7 +904,7 @@ func (self *SNetwork) PerformReserveIp(ctx context.Context, userCred mcclient.To } func (self *SNetwork) AllowPerformReleaseReservedIp(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "release-reserved-ip") + return self.IsOwner(userCred) || db.IsAdminAllowPerform(userCred, self, "release-reserved-ip") } func (self *SNetwork) PerformReleaseReservedIp(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -923,7 +921,7 @@ func (self *SNetwork) PerformReleaseReservedIp(ctx context.Context, userCred mcc } func (self *SNetwork) AllowGetDetailsReservedIps(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { - return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionGet, "reserved-ips") + return self.IsOwner(userCred) || db.IsAdminAllowGetSpec(userCred, self, "reserved-ips") } func (self *SNetwork) GetDetailsReservedIps(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -1214,7 +1212,7 @@ func isOverlapNetworks(nets []SNetwork, startIp netutils.IPV4Addr, endIp netutil } func (self *SNetwork) CustomizeCreate(ctx context.Context, userCred mcclient.TokenCredential, ownerProjId string, query jsonutils.JSONObject, data jsonutils.JSONObject) error { - if userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionCreate) && ownerProjId == userCred.GetProjectId() { + if db.IsAdminAllowCreate(userCred, self.GetModelManager()) && ownerProjId == userCred.GetProjectId() { self.IsPublic = true } else { self.IsPublic = false @@ -1399,7 +1397,7 @@ func (self *SNetwork) ValidateUpdateCondition(ctx context.Context) error { } func (self *SNetwork) AllowPerformPurge(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionDelete) + return db.IsAdminAllowPerform(userCred, self, "purge") } func (self *SNetwork) PerformPurge(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { diff --git a/pkg/compute/models/reservedips.go b/pkg/compute/models/reservedips.go index 80ca7fa632..1acb41a388 100644 --- a/pkg/compute/models/reservedips.go +++ b/pkg/compute/models/reservedips.go @@ -6,9 +6,7 @@ import ( "yunion.io/x/jsonutils" "yunion.io/x/log" - "yunion.io/x/onecloud/pkg/cloudcommon/consts" "yunion.io/x/onecloud/pkg/cloudcommon/db" - "yunion.io/x/onecloud/pkg/cloudcommon/policy" "yunion.io/x/onecloud/pkg/httperrors" "yunion.io/x/onecloud/pkg/mcclient" "yunion.io/x/sqlchemy" @@ -41,7 +39,7 @@ type SReservedip struct { } func (manager *SReservedipManager) AllowListItems(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), manager.KeywordPlural(), policy.PolicyActionList) + return db.IsAdminAllowList(userCred, manager) } func (manager *SReservedipManager) AllowCreateItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { diff --git a/pkg/compute/models/schedpolicies.go b/pkg/compute/models/schedpolicies.go index 000445cf14..e4a54dafef 100644 --- a/pkg/compute/models/schedpolicies.go +++ b/pkg/compute/models/schedpolicies.go @@ -7,9 +7,7 @@ import ( "database/sql" "yunion.io/x/log" - "yunion.io/x/onecloud/pkg/cloudcommon/consts" "yunion.io/x/onecloud/pkg/cloudcommon/db" - "yunion.io/x/onecloud/pkg/cloudcommon/policy" "yunion.io/x/onecloud/pkg/httperrors" "yunion.io/x/onecloud/pkg/mcclient" "yunion.io/x/onecloud/pkg/util/conditionparser" @@ -63,23 +61,23 @@ func validateSchedpolicyInputData(data *jsonutils.JSONDict, create bool) error { } func (self *SSchedpolicyManager) AllowListItems(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionList) + return db.IsAdminAllowList(userCred, self) } func (self *SSchedpolicyManager) AllowCreateItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionCreate) + return db.IsAdminAllowCreate(userCred, self) } func (self *SSchedpolicy) AllowGetDetails(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionGet) + return db.IsAdminAllowGet(userCred, self) } func (self *SSchedpolicy) AllowUpdateItem(ctx context.Context, userCred mcclient.TokenCredential) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionUpdate) + return db.IsAdminAllowUpdate(userCred, self) } func (self *SSchedpolicy) AllowDeleteItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionDelete) + return db.IsAdminAllowDelete(userCred, self) } func (manager *SSchedpolicyManager) ValidateCreateData(ctx context.Context, userCred mcclient.TokenCredential, ownerProjId string, query jsonutils.JSONObject, data *jsonutils.JSONDict) (*jsonutils.JSONDict, error) { @@ -141,7 +139,7 @@ func (manager *SSchedpolicyManager) getAllEnabledPolicies() []SSchedpolicy { } func (self *SSchedpolicy) AllowPerformEvaluate(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "evaluate") + return db.IsAdminAllowPerform(userCred, self, "evaluate") } func (self *SSchedpolicy) PerformEvaluate(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { diff --git a/pkg/compute/models/schedtags.go b/pkg/compute/models/schedtags.go index 43557ff2f9..b4605d7e9a 100644 --- a/pkg/compute/models/schedtags.go +++ b/pkg/compute/models/schedtags.go @@ -12,8 +12,6 @@ import ( "yunion.io/x/onecloud/pkg/mcclient" "yunion.io/x/pkg/utils" "yunion.io/x/sqlchemy" - "yunion.io/x/onecloud/pkg/cloudcommon/consts" - "yunion.io/x/onecloud/pkg/cloudcommon/policy" ) type SchedStrategyType string @@ -62,15 +60,15 @@ func (self *SSchedtag) AllowGetDetails(ctx context.Context, userCred mcclient.To } func (self *SSchedtagManager) AllowCreateItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionCreate) + return db.IsAdminAllowCreate(userCred, self) } func (self *SSchedtag) AllowUpdateItem(ctx context.Context, userCred mcclient.TokenCredential) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionUpdate) + return db.IsAdminAllowUpdate(userCred, self) } func (self *SSchedtag) AllowDeleteItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionDelete) + return db.IsAdminAllowDelete(userCred, self) } func (manager *SSchedtagManager) ValidateSchedtags(userCred mcclient.TokenCredential, schedtags map[string]string) (map[string]string, error) { diff --git a/pkg/compute/models/secgrouprules.go b/pkg/compute/models/secgrouprules.go index 93ae01adee..c8a23f2ec1 100644 --- a/pkg/compute/models/secgrouprules.go +++ b/pkg/compute/models/secgrouprules.go @@ -9,9 +9,7 @@ import ( "yunion.io/x/jsonutils" "yunion.io/x/log" - "yunion.io/x/onecloud/pkg/cloudcommon/consts" "yunion.io/x/onecloud/pkg/cloudcommon/db" - "yunion.io/x/onecloud/pkg/cloudcommon/policy" "yunion.io/x/onecloud/pkg/httperrors" "yunion.io/x/onecloud/pkg/mcclient" "yunion.io/x/pkg/util/compare" @@ -80,14 +78,14 @@ func (manager *SSecurityGroupRuleManager) AllowListItems(ctx context.Context, us func (self *SSecurityGroupRule) AllowUpdateItem(ctx context.Context, userCred mcclient.TokenCredential) bool { if secgroup := self.GetSecGroup(); secgroup != nil { - return secgroup.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionUpdate) + return secgroup.IsOwner(userCred) || db.IsAdminAllowUpdate(userCred, self) } return false } func (self *SSecurityGroupRule) AllowDeleteItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { if secgroup := self.GetSecGroup(); secgroup != nil { - return secgroup.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionDelete) + return secgroup.IsOwner(userCred) || db.IsAdminAllowDelete(userCred, self) } return false } diff --git a/pkg/compute/models/snapshots.go b/pkg/compute/models/snapshots.go index b586fd9bff..09e557f0c8 100644 --- a/pkg/compute/models/snapshots.go +++ b/pkg/compute/models/snapshots.go @@ -11,10 +11,8 @@ import ( "yunion.io/x/pkg/util/compare" "yunion.io/x/sqlchemy" - "yunion.io/x/onecloud/pkg/cloudcommon/consts" "yunion.io/x/onecloud/pkg/cloudcommon/db" "yunion.io/x/onecloud/pkg/cloudcommon/db/taskman" - "yunion.io/x/onecloud/pkg/cloudcommon/policy" "yunion.io/x/onecloud/pkg/cloudprovider" "yunion.io/x/onecloud/pkg/compute/options" "yunion.io/x/onecloud/pkg/httperrors" @@ -325,7 +323,7 @@ func (self *SSnapshotManager) CreateSnapshot(ctx context.Context, userCred mccli } func (self *SSnapshot) AllowDeleteItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionDelete) + return self.IsOwner(userCred) || db.IsAdminAllowDelete(userCred, self) } func (self *SSnapshot) StartSnapshotDeleteTask(ctx context.Context, userCred mcclient.TokenCredential, reloadDisk bool, parentTaskId string) error { @@ -366,7 +364,7 @@ func (self *SSnapshot) CustomizeDelete(ctx context.Context, userCred mcclient.To } func (self *SSnapshot) AllowPerformDeleted(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionDelete) + return self.IsOwner(userCred) || db.IsAdminAllowPerform(userCred, self, "deleted") } func (self *SSnapshot) PerformDeleted(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -403,7 +401,7 @@ func (self *SSnapshotManager) GetConvertSnapshot(deleteSnapshot *SSnapshot) (*SS } func (self *SSnapshotManager) AllowPerformDeleteDiskSnapshots(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "delete-disk-snapshots") + return db.IsAdminAllowClassPerform(userCred, self, "delete-disk-snapshots") } func (self *SSnapshotManager) PerformDeleteDiskSnapshots(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -588,7 +586,7 @@ func (self *SSnapshot) GetISnapshotRegion() (cloudprovider.ICloudRegion, error) } func (self *SSnapshot) AllowPerformPurge(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionDelete) + return db.IsAdminAllowPerform(userCred, self, "purge") } func (self *SSnapshot) PerformPurge(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { diff --git a/pkg/compute/models/storagecachedimages.go b/pkg/compute/models/storagecachedimages.go index 693fa088a0..d20b97c6f1 100644 --- a/pkg/compute/models/storagecachedimages.go +++ b/pkg/compute/models/storagecachedimages.go @@ -11,10 +11,8 @@ import ( "yunion.io/x/pkg/utils" "yunion.io/x/sqlchemy" - "yunion.io/x/onecloud/pkg/cloudcommon/consts" "yunion.io/x/onecloud/pkg/cloudcommon/db" "yunion.io/x/onecloud/pkg/cloudcommon/db/lockman" - "yunion.io/x/onecloud/pkg/cloudcommon/policy" "yunion.io/x/onecloud/pkg/httperrors" "yunion.io/x/onecloud/pkg/mcclient" ) @@ -74,23 +72,23 @@ func (joint *SStoragecachedimage) Slave() db.IStandaloneModel { } func (self *SStoragecachedimageManager) AllowListItems(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionList) + return db.IsAdminAllowList(userCred, self) } func (self *SStoragecachedimageManager) AllowCreateItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionCreate) + return db.IsAdminAllowCreate(userCred, self) } func (self *SStoragecachedimage) AllowGetDetails(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionGet) + return db.IsAdminAllowGet(userCred, self) } func (self *SStoragecachedimage) AllowUpdateItem(ctx context.Context, userCred mcclient.TokenCredential) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionUpdate) + return db.IsAdminAllowUpdate(userCred, self) } func (self *SStoragecachedimage) AllowDeleteItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionDelete) + return db.IsAdminAllowDelete(userCred, self) } func (self *SStoragecachedimage) getStorageHostId() (string, error) { @@ -147,7 +145,7 @@ func (self *SStoragecachedimage) GetExtraDetails(ctx context.Context, userCred m } func (manager *SStoragecachedimageManager) AllowListDescendent(ctx context.Context, userCred mcclient.TokenCredential, model db.IStandaloneModel, query jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), manager.KeywordPlural(), policy.PolicyActionList) + return db.IsAdminAllowList(userCred, manager) } func (self *SStoragecachedimage) GetCachedimage() *SCachedimage { diff --git a/pkg/compute/models/storagecaches.go b/pkg/compute/models/storagecaches.go index f21faa1dbc..34d05d628c 100644 --- a/pkg/compute/models/storagecaches.go +++ b/pkg/compute/models/storagecaches.go @@ -9,10 +9,8 @@ import ( "yunion.io/x/log" "yunion.io/x/sqlchemy" - "yunion.io/x/onecloud/pkg/cloudcommon/consts" "yunion.io/x/onecloud/pkg/cloudcommon/db" "yunion.io/x/onecloud/pkg/cloudcommon/db/taskman" - "yunion.io/x/onecloud/pkg/cloudcommon/policy" "yunion.io/x/onecloud/pkg/cloudprovider" "yunion.io/x/onecloud/pkg/httperrors" "yunion.io/x/onecloud/pkg/mcclient" @@ -44,23 +42,23 @@ type SStoragecache struct { } func (self *SStoragecacheManager) AllowListItems(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionList) + return db.IsAdminAllowList(userCred, self) } func (self *SStoragecacheManager) AllowCreateItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionCreate) + return db.IsAdminAllowCreate(userCred, self) } func (self *SStoragecache) AllowGetDetails(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionGet) + return db.IsAdminAllowGet(userCred, self) } func (self *SStoragecache) AllowUpdateItem(ctx context.Context, userCred mcclient.TokenCredential) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionUpdate) + return db.IsAdminAllowUpdate(userCred, self) } func (self *SStoragecache) AllowDeleteItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionDelete) + return db.IsAdminAllowDelete(userCred, self) } func (self *SStoragecache) getStorages() []SStorage { @@ -312,7 +310,7 @@ func (self *SStoragecache) ValidateDeleteCondition(ctx context.Context) error { } func (self *SStoragecache) AllowPerformUncacheImage(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "uncache-image") + return db.IsAdminAllowPerform(userCred, self, "uncache-image") } func (self *SStoragecache) PerformUncacheImage(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -349,7 +347,7 @@ func (self *SStoragecache) PerformUncacheImage(ctx context.Context, userCred mcc } func (self *SStoragecache) AllowPerformCacheImage(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "cache-image") + return db.IsAdminAllowPerform(userCred, self, "cache-image") } func (self *SStoragecache) PerformCacheImage(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { diff --git a/pkg/compute/models/storages.go b/pkg/compute/models/storages.go index 2f79e92b27..1c14dc5162 100644 --- a/pkg/compute/models/storages.go +++ b/pkg/compute/models/storages.go @@ -5,17 +5,16 @@ import ( "yunion.io/x/jsonutils" "yunion.io/x/log" - "yunion.io/x/onecloud/pkg/cloudcommon/consts" - "yunion.io/x/onecloud/pkg/cloudcommon/db" - "yunion.io/x/onecloud/pkg/cloudcommon/policy" - "yunion.io/x/onecloud/pkg/cloudprovider" - "yunion.io/x/onecloud/pkg/compute/options" - "yunion.io/x/onecloud/pkg/httperrors" - "yunion.io/x/onecloud/pkg/mcclient" "yunion.io/x/pkg/tristate" "yunion.io/x/pkg/util/compare" "yunion.io/x/pkg/utils" "yunion.io/x/sqlchemy" + + "yunion.io/x/onecloud/pkg/cloudcommon/db" + "yunion.io/x/onecloud/pkg/cloudprovider" + "yunion.io/x/onecloud/pkg/compute/options" + "yunion.io/x/onecloud/pkg/httperrors" + "yunion.io/x/onecloud/pkg/mcclient" ) const ( @@ -127,19 +126,19 @@ func (manager *SStorageManager) AllowListItems(ctx context.Context, userCred mcc } func (self *SStorageManager) AllowCreateItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionCreate) + return db.IsAdminAllowCreate(userCred, self) } func (self *SStorage) AllowGetDetails(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionGet) + return db.IsAdminAllowGet(userCred, self) } func (self *SStorage) AllowUpdateItem(ctx context.Context, userCred mcclient.TokenCredential) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionUpdate) + return db.IsAdminAllowUpdate(userCred, self) } func (self *SStorage) AllowDeleteItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionDelete) + return db.IsAdminAllowDelete(userCred, self) } func (manager *SStorageManager) ValidateCreateData(ctx context.Context, userCred mcclient.TokenCredential, ownerProjId string, query jsonutils.JSONObject, data *jsonutils.JSONDict) (*jsonutils.JSONDict, error) { @@ -709,7 +708,7 @@ func (self *SStorage) SetStoragecache(cache *SStoragecache) error { } func (self *SStorage) AllowPerformCacheImage(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "cache-image") + return db.IsAdminAllowPerform(userCred, self, "cache-image") } func (self *SStorage) GetStoragecache() *SStoragecache { @@ -731,7 +730,7 @@ func (self *SStorage) PerformCacheImage(ctx context.Context, userCred mcclient.T } func (self *SStorage) AllowPerformUncacheImage(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "uncache-image") + return db.IsAdminAllowPerform(userCred, self, "uncache-image") } func (self *SStorage) PerformUncacheImage(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { diff --git a/pkg/compute/models/vpcs.go b/pkg/compute/models/vpcs.go index c5fa194e16..50dcdeb1e0 100644 --- a/pkg/compute/models/vpcs.go +++ b/pkg/compute/models/vpcs.go @@ -11,10 +11,8 @@ import ( "yunion.io/x/pkg/util/netutils" "yunion.io/x/sqlchemy" - "yunion.io/x/onecloud/pkg/cloudcommon/consts" "yunion.io/x/onecloud/pkg/cloudcommon/db" "yunion.io/x/onecloud/pkg/cloudcommon/db/taskman" - "yunion.io/x/onecloud/pkg/cloudcommon/policy" "yunion.io/x/onecloud/pkg/cloudprovider" "yunion.io/x/onecloud/pkg/httperrors" "yunion.io/x/onecloud/pkg/mcclient" @@ -66,23 +64,23 @@ func (manager *SVpcManager) GetContextManager() []db.IModelManager { } func (self *SVpcManager) AllowListItems(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionList) + return db.IsAdminAllowList(userCred, self) } func (self *SVpcManager) AllowCreateItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionCreate) + return db.IsAdminAllowCreate(userCred, self) } func (self *SVpc) AllowGetDetails(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionGet) + return db.IsAdminAllowGet(userCred, self) } func (self *SVpc) AllowUpdateItem(ctx context.Context, userCred mcclient.TokenCredential) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionUpdate) + return db.IsAdminAllowUpdate(userCred, self) } func (self *SVpc) AllowDeleteItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionDelete) + return db.IsAdminAllowDelete(userCred, self) } func (self *SVpc) GetCloudRegionId() string { @@ -476,7 +474,7 @@ func (self *SVpc) getIPRange() netutils.IPV4AddrRange { } func (self *SVpc) AllowPerformPurge(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionDelete) + return db.IsAdminAllowPerform(userCred, self, "purge") } func (self *SVpc) PerformPurge(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { diff --git a/pkg/compute/models/wires.go b/pkg/compute/models/wires.go index 00364f0dfc..9d9cc82dec 100644 --- a/pkg/compute/models/wires.go +++ b/pkg/compute/models/wires.go @@ -15,8 +15,6 @@ import ( "yunion.io/x/pkg/util/compare" "yunion.io/x/pkg/util/netutils" "yunion.io/x/sqlchemy" - "yunion.io/x/onecloud/pkg/cloudcommon/consts" - "yunion.io/x/onecloud/pkg/cloudcommon/policy" ) type SWireManager struct { @@ -52,23 +50,23 @@ func (manager *SWireManager) GetContextManager() []db.IModelManager { } func (self *SWireManager) AllowListItems(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionList) + return db.IsAdminAllowList(userCred, self) } func (self *SWireManager) AllowCreateItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionCreate) + return db.IsAdminAllowCreate(userCred, self) } func (self *SWire) AllowGetDetails(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionGet) + return db.IsAdminAllowGet(userCred, self) } func (self *SWire) AllowUpdateItem(ctx context.Context, userCred mcclient.TokenCredential) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionUpdate) + return db.IsAdminAllowUpdate(userCred, self) } func (self *SWire) AllowDeleteItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionDelete) + return db.IsAdminAllowDelete(userCred, self) } func (manager *SWireManager) ValidateCreateData(ctx context.Context, userCred mcclient.TokenCredential, ownerProjId string, query jsonutils.JSONObject, data *jsonutils.JSONDict) (*jsonutils.JSONDict, error) { diff --git a/pkg/compute/models/zones.go b/pkg/compute/models/zones.go index 50b6f5a351..2a85c27899 100644 --- a/pkg/compute/models/zones.go +++ b/pkg/compute/models/zones.go @@ -12,8 +12,6 @@ import ( "yunion.io/x/pkg/tristate" "yunion.io/x/pkg/util/compare" "yunion.io/x/sqlchemy" - "yunion.io/x/onecloud/pkg/cloudcommon/consts" - "yunion.io/x/onecloud/pkg/cloudcommon/policy" ) const ( @@ -58,19 +56,19 @@ func (manager *SZoneManager) GetContextManager() []db.IModelManager { } func (self *SZoneManager) AllowCreateItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionCreate) + return db.IsAdminAllowCreate(userCred, self) } func (self *SZone) AllowGetDetails(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionGet) + return db.IsAdminAllowGet(userCred, self) } func (self *SZone) AllowUpdateItem(ctx context.Context, userCred mcclient.TokenCredential) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionUpdate) + return db.IsAdminAllowUpdate(userCred, self) } func (self *SZone) AllowDeleteItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionDelete) + return db.IsAdminAllowDelete(userCred, self) } func (manager *SZoneManager) AllowListItems(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { diff --git a/pkg/yunionconf/models/parameters.go b/pkg/yunionconf/models/parameters.go index dbb11026be..90f40903fa 100644 --- a/pkg/yunionconf/models/parameters.go +++ b/pkg/yunionconf/models/parameters.go @@ -74,7 +74,7 @@ func getNamespaceInContext(userCred mcclient.TokenCredential, query jsonutils.JS func getNamespace(userCred mcclient.TokenCredential, query jsonutils.JSONObject, data *jsonutils.JSONDict) (string, string, error) { var namespace, namespace_id string - if userCred.IsAdminAllow(consts.GetServiceType(), ParameterManager.KeywordPlural(), policy.PolicyActionGet) { + if db.IsAdminAllowGet(userCred, ParameterManager) { if name, nameId, e := getNamespaceInContext(userCred, query, data); e != nil { return "", "", e } else { @@ -94,7 +94,7 @@ func (manager *SParameterManager) AllowListItems(ctx context.Context, userCred m return true } - return userCred.IsAdminAllow(consts.GetServiceType(), manager.KeywordPlural(), policy.PolicyActionList) + return db.IsAdminAllowList(userCred, manager) } func (manager *SParameterManager) AllowCreateItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { @@ -102,7 +102,7 @@ func (manager *SParameterManager) AllowCreateItem(ctx context.Context, userCred return true } - return userCred.IsAdminAllow(consts.GetServiceType(), manager.KeywordPlural(), policy.PolicyActionCreate) + return db.IsAdminAllowCreate(userCred, manager) } func (manager *SParameterManager) ValidateCreateData(ctx context.Context, userCred mcclient.TokenCredential, ownerProjId string, query jsonutils.JSONObject, data *jsonutils.JSONDict) (*jsonutils.JSONDict, error) { @@ -148,7 +148,7 @@ func (manager *SParameterManager) FilterByName(q *sqlchemy.SQuery, name string) } func (manager *SParameterManager) ListItemFilter(ctx context.Context, q *sqlchemy.SQuery, userCred mcclient.TokenCredential, query jsonutils.JSONObject) (*sqlchemy.SQuery, error) { - if userCred.IsAdminAllow(consts.GetServiceType(), manager.KeywordPlural(), policy.PolicyActionList) { + if db.IsAdminAllowList(userCred, manager) { if id, _ := query.GetString("namespace_id"); len(id) > 0 { q = q.Equals("namespace_id", id) } else if id, _ := query.GetString("service_id"); len(id) > 0 { @@ -173,7 +173,7 @@ func (model *SParameter) IsOwner(userCred mcclient.TokenCredential) bool { } func (model *SParameter) AllowUpdateItem(ctx context.Context, userCred mcclient.TokenCredential) bool { - return model.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), model.KeywordPlural(), policy.PolicyActionUpdate) + return model.IsOwner(userCred) || db.IsAdminAllowUpdate(userCred, model) } func (model *SParameter) ValidateUpdateData(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data *jsonutils.JSONDict) (*jsonutils.JSONDict, error) { @@ -193,7 +193,7 @@ func (model *SParameter) ValidateUpdateData(ctx context.Context, userCred mcclie } func (model *SParameter) AllowDeleteItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return model.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), model.KeywordPlural(), policy.PolicyActionDelete) + return model.IsOwner(userCred) || db.IsAdminAllowDelete(userCred, model) } func (model *SParameter) CustomizeDelete(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) error { @@ -213,5 +213,5 @@ func (model *SParameter) Delete(ctx context.Context, userCred mcclient.TokenCred } func (model *SParameter) AllowGetDetails(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { - return model.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), model.KeywordPlural(), policy.PolicyActionGet) + return model.IsOwner(userCred) || db.IsAdminAllowGet(userCred, model) } From a95b396f2407b782d6d76dd02d6387591cb58a47 Mon Sep 17 00:00:00 2001 From: Qiu Jian Date: Sat, 1 Dec 2018 12:08:02 +0800 Subject: [PATCH 07/15] remove inframanager.go --- pkg/compute/models/inframanagers.go | 9 --------- 1 file changed, 9 deletions(-) delete mode 100644 pkg/compute/models/inframanagers.go diff --git a/pkg/compute/models/inframanagers.go b/pkg/compute/models/inframanagers.go deleted file mode 100644 index 4a60c48cfb..0000000000 --- a/pkg/compute/models/inframanagers.go +++ /dev/null @@ -1,9 +0,0 @@ -package models - -type TSInfrastructureManager struct { -} - -type TSInfrastructure struct { -} - - From 7b2fed8d85dcb1060623f474d52c50898f403f63 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E5=B1=88=E8=BD=A9?= Date: Sat, 1 Dec 2018 13:00:10 +0800 Subject: [PATCH 08/15] =?UTF-8?q?=E6=A3=80=E6=9F=A5=E5=85=AC=E6=9C=89?= =?UTF-8?q?=E4=BA=91=E7=A3=81=E7=9B=98=E5=88=9B=E5=BB=BA=E9=99=90=E5=88=B6?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- pkg/compute/hostdrivers/aliyun.go | 16 +++++++++++++ pkg/compute/hostdrivers/aws.go | 25 +++++++++++++++++++++ pkg/compute/hostdrivers/azure.go | 4 ++++ pkg/compute/hostdrivers/base.go | 4 ++++ pkg/compute/hostdrivers/qcloud.go | 22 ++++++++++++++++++ pkg/compute/models/disks.go | 35 +++++++++++++---------------- pkg/compute/models/guest_actions.go | 22 +++++++++--------- pkg/compute/models/guests.go | 2 +- pkg/compute/models/hostdrivers.go | 1 + 9 files changed, 100 insertions(+), 31 deletions(-) diff --git a/pkg/compute/hostdrivers/aliyun.go b/pkg/compute/hostdrivers/aliyun.go index 2c9df47e38..47bdbe971e 100644 --- a/pkg/compute/hostdrivers/aliyun.go +++ b/pkg/compute/hostdrivers/aliyun.go @@ -13,6 +13,7 @@ import ( "yunion.io/x/onecloud/pkg/compute/models" "yunion.io/x/onecloud/pkg/compute/options" "yunion.io/x/onecloud/pkg/httperrors" + "yunion.io/x/pkg/utils" ) type SAliyunHostDriver struct { @@ -28,6 +29,21 @@ func (self *SAliyunHostDriver) GetHostType() string { return models.HOST_TYPE_ALIYUN } +func (self *SAliyunHostDriver) ValidateCreateDisk(storage *models.SStorage, sizeGb int) error { + if utils.IsInStringArray(storage.StorageType, []string{models.STORAGE_CLOUD_EFFICIENCY, models.STORAGE_CLOUD_SSD, models.STORAGE_CLOUD_ESSD}) { + if sizeGb < 20 || sizeGb > 32768 { + return fmt.Errorf("The %s disk size must be in the range of 20G ~ 32768G", storage.StorageType) + } + } else if storage.StorageType == models.STORAGE_PUBLIC_CLOUD { + if sizeGb < 5 || sizeGb > 2000 { + return fmt.Errorf("The %s disk size must be in the range of 5G ~ 2000G", storage.StorageType) + } + } else { + return fmt.Errorf("Not support create %s disk", storage.StorageType) + } + return nil +} + func (self *SAliyunHostDriver) CheckAndSetCacheImage(ctx context.Context, host *models.SHost, storageCache *models.SStoragecache, task taskman.ITask) error { params := task.GetParams() imageId, err := params.GetString("image_id") diff --git a/pkg/compute/hostdrivers/aws.go b/pkg/compute/hostdrivers/aws.go index b4022ab211..c1dd56a6c9 100644 --- a/pkg/compute/hostdrivers/aws.go +++ b/pkg/compute/hostdrivers/aws.go @@ -3,11 +3,13 @@ package hostdrivers import ( "context" "fmt" + "yunion.io/x/log" "yunion.io/x/onecloud/pkg/cloudcommon/db/lockman" "yunion.io/x/onecloud/pkg/cloudprovider" "yunion.io/x/onecloud/pkg/compute/options" "yunion.io/x/onecloud/pkg/httperrors" + "yunion.io/x/pkg/utils" "yunion.io/x/jsonutils" "yunion.io/x/onecloud/pkg/cloudcommon/db/taskman" @@ -22,6 +24,29 @@ func (self *SAwsHostDriver) GetHostType() string { return models.HOST_TYPE_AWS } +func (self *SAwsHostDriver) ValidateCreateDisk(storage *models.SStorage, sizeGb int) error { + if storage.StorageType == models.STORAGE_GP2_SSD { + if sizeGb < 1 || sizeGb > 16384 { + return fmt.Errorf("The %s disk size must be in the range of 1G ~ 16384GB", storage.StorageType) + } + } else if storage.StorageType == models.STORAGE_IO1_SSD { + if sizeGb < 4 || sizeGb > 16384 { + return fmt.Errorf("The %s disk size must be in the range of 4G ~ 16384GB", storage.StorageType) + } + } else if utils.IsInStringArray(storage.StorageType, []string{models.STORAGE_ST1_HDD, models.STORAGE_SC1_SSD}) { + if sizeGb < 500 || sizeGb > 16384 { + return fmt.Errorf("The %s disk size must be in the range of 500G ~ 16384GB", storage.StorageType) + } + } else if storage.StorageType == models.STORAGE_STANDARD_SSD { + if sizeGb < 1 || sizeGb > 1024 { + return fmt.Errorf("The %s disk size must be in the range of 1G ~ 1024GB", storage.StorageType) + } + } else { + return fmt.Errorf("Not support create %s disk", storage.StorageType) + } + return nil +} + func (self *SAwsHostDriver) CheckAndSetCacheImage(ctx context.Context, host *models.SHost, storageCache *models.SStoragecache, task taskman.ITask) error { params := task.GetParams() imageId, err := params.GetString("image_id") diff --git a/pkg/compute/hostdrivers/azure.go b/pkg/compute/hostdrivers/azure.go index 6635e9c879..edcf0d15e7 100644 --- a/pkg/compute/hostdrivers/azure.go +++ b/pkg/compute/hostdrivers/azure.go @@ -36,6 +36,10 @@ func (self *SAzureHostDriver) ValidateUpdateDisk(ctx context.Context, userCred m return data, nil } +func (self *SAzureHostDriver) ValidateCreateDisk(storage *models.SStorage, sizeGb int) error { + return nil +} + func (self *SAzureHostDriver) CheckAndSetCacheImage(ctx context.Context, host *models.SHost, storageCache *models.SStoragecache, task taskman.ITask) error { params := task.GetParams() imageId, err := params.GetString("image_id") diff --git a/pkg/compute/hostdrivers/base.go b/pkg/compute/hostdrivers/base.go index fc254c05e4..a245b2befa 100644 --- a/pkg/compute/hostdrivers/base.go +++ b/pkg/compute/hostdrivers/base.go @@ -20,6 +20,10 @@ func (self *SBaseHostDriver) ValidateUpdateDisk(ctx context.Context, userCred mc return data, nil } +func (self *SBaseHostDriver) ValidateCreateDisk(storage *models.SStorage, sizeGb int) error { + return fmt.Errorf("ot Implement ValidateCreateDisk") +} + func (self *SBaseHostDriver) RequestDeleteSnapshotsWithStorage(ctx context.Context, host *models.SHost, snapshot *models.SSnapshot, task taskman.ITask) error { return fmt.Errorf("Not Implement") } diff --git a/pkg/compute/hostdrivers/qcloud.go b/pkg/compute/hostdrivers/qcloud.go index 536c620c64..19c59970e1 100644 --- a/pkg/compute/hostdrivers/qcloud.go +++ b/pkg/compute/hostdrivers/qcloud.go @@ -28,6 +28,28 @@ func (self *SQcloudHostDriver) GetHostType() string { return models.HOST_TYPE_QCLOUD } +func (self *SQcloudHostDriver) ValidateCreateDisk(storage *models.SStorage, sizeGb int) error { + if sizeGb%10 != 0 { + return fmt.Errorf("The disk size must be a multiple of 10Gb") + } + if storage.StorageType == models.STORAGE_CLOUD_BASIC { + if sizeGb < 10 || sizeGb > 16000 { + return fmt.Errorf("The %s disk size must be in the range of 10 ~ 16000GB", storage.StorageType) + } + } else if storage.StorageType == models.STORAGE_CLOUD_PREMIUM { + if sizeGb < 50 || sizeGb > 16000 { + return fmt.Errorf("The %s disk size must be in the range of 50 ~ 16000GB", storage.StorageType) + } + } else if storage.StorageType == models.STORAGE_CLOUD_SSD { + if sizeGb < 100 || sizeGb > 16000 { + return fmt.Errorf("The %s disk size must be in the range of 100 ~ 16000GB", storage.StorageType) + } + } else { + return fmt.Errorf("Not support create %s disk", storage.StorageType) + } + return nil +} + func (self *SQcloudHostDriver) CheckAndSetCacheImage(ctx context.Context, host *models.SHost, storageCache *models.SStoragecache, task taskman.ITask) error { params := task.GetParams() imageId, err := params.GetString("image_id") diff --git a/pkg/compute/models/disks.go b/pkg/compute/models/disks.go index e09560fc9e..b75255497a 100644 --- a/pkg/compute/models/disks.go +++ b/pkg/compute/models/disks.go @@ -293,7 +293,7 @@ func (manager *SDiskManager) ValidateCreateData(ctx context.Context, userCred mc if _, err := manager.SSharableVirtualResourceBaseManager.ValidateCreateData(ctx, userCred, ownerProjId, query, data); err != nil { return nil, err } - pendingUsage := SQuota{Storage: diskConfig.Size} + pendingUsage := SQuota{Storage: diskConfig.SizeMb} if err := QuotaManager.CheckSetPendingQuota(ctx, userCred, userCred.GetProjectId(), &pendingUsage); err != nil { return nil, err } @@ -310,14 +310,11 @@ func (manager *SDiskManager) validateDiskOnStorage(diskConfig *SDiskConfig, stor if storage.StorageType != diskConfig.Backend { return httperrors.NewInputParameterError("Storage type[%s] not match backend %s", storage.StorageType, diskConfig.Backend) } - size := diskConfig.Size >> 10 - if storage.StorageType == STORAGE_CLOUD_EFFICIENCY || storage.StorageType == STORAGE_CLOUD_SSD { - if size < 20 || size > 32768 { - return httperrors.NewInputParameterError("cloud_ssd or cloud_efficiency disk only support 20G ~ 32768G") - } - } else if storage.StorageType == STORAGE_PUBLIC_CLOUD { - if size < 5 || size > 2000 { - return httperrors.NewInputParameterError("cloud disk only support 5G ~ 2000G") + sizeGb := diskConfig.SizeMb >> 10 + if host := storage.GetMasterHost(); host != nil { + //公有云磁盘大小检查。 + if err := host.GetHostDriver().ValidateCreateDisk(storage, sizeGb); err != nil { + return httperrors.NewInputParameterError(err.Error()) } } hoststorages := HoststorageManager.Query().SubQuery() @@ -328,7 +325,7 @@ func (manager *SDiskManager) validateDiskOnStorage(diskConfig *SDiskConfig, stor if len(hoststorage) == 0 { return httperrors.NewInputParameterError("Storage[%s] must attach to a host", storage.Name) } - if diskConfig.Size > storage.GetFreeCapacity() && !storage.IsEmulated { + if diskConfig.SizeMb > storage.GetFreeCapacity() && !storage.IsEmulated { return httperrors.NewInputParameterError("Not enough free space") } return nil @@ -968,7 +965,7 @@ func totalDiskSize(projectId string, active tristate.TriState, ready tristate.Tr type SDiskConfig struct { ImageId string // ImageDiskFormat string - Size int // MB + SizeMb int // MB Fs string // file system Format string // Driver string // @@ -1006,7 +1003,7 @@ func parseDiskInfo(ctx context.Context, userCred mcclient.TokenCredential, info continue } if regutils.MatchSize(p) { - diskConfig.Size, _ = fileutils.GetSizeMb(p, 'M', 1024) + diskConfig.SizeMb, _ = fileutils.GetSizeMb(p, 'M', 1024) } else if utils.IsInStringArray(p, osprofile.FS_TYPES) { diskConfig.Fs = p } else if utils.IsInStringArray(p, osprofile.IMAGE_FORMAT_TYPES) { @@ -1020,7 +1017,7 @@ func parseDiskInfo(ctx context.Context, userCred mcclient.TokenCredential, info } else if p[0] == '/' { diskConfig.Mountpoint = p } else if p == "autoextend" { - diskConfig.Size = -1 + diskConfig.SizeMb = -1 } else if utils.IsInStringArray(p, STORAGE_TYPES) { diskConfig.Backend = p } else if len(p) > 0 { @@ -1042,15 +1039,15 @@ func parseDiskInfo(ctx context.Context, userCred mcclient.TokenCredential, info } // diskConfig.ImageDiskFormat = image.DiskFormat CachedimageManager.ImageAddRefCount(image.Id) - if diskConfig.Size == 0 { - diskConfig.Size = image.MinDisk // MB + if diskConfig.SizeMb == 0 { + diskConfig.SizeMb = image.MinDisk // MB } } } } - if len(diskConfig.ImageId) > 0 && diskConfig.Size == 0 { - diskConfig.Size = options.Options.DefaultDiskSize // MB - } else if len(diskConfig.ImageId) == 0 && diskConfig.Size == 0 { + if len(diskConfig.ImageId) > 0 && diskConfig.SizeMb == 0 { + diskConfig.SizeMb = options.Options.DefaultDiskSize // MB + } else if len(diskConfig.ImageId) == 0 && diskConfig.SizeMb == 0 { return nil, httperrors.NewInputParameterError("Diskinfo not contains either imageID or size") } return &diskConfig, nil @@ -1086,7 +1083,7 @@ func (self *SDisk) fetchDiskInfo(diskConfig *SDiskConfig) { self.Nonpersistent = false } self.DiskFormat = diskConfig.Format - self.DiskSize = diskConfig.Size + self.DiskSize = diskConfig.SizeMb } type DiskInfo struct { diff --git a/pkg/compute/models/guest_actions.go b/pkg/compute/models/guest_actions.go index 0ab0ea09d7..0ebbad08e5 100644 --- a/pkg/compute/models/guest_actions.go +++ b/pkg/compute/models/guest_actions.go @@ -834,11 +834,11 @@ func (self *SGuest) PerformCreatedisk(ctx context.Context, userCred mcclient.Tok } disksConf.Set(diskSeq, jsonutils.Marshal(diskInfo)) if _, ok := diskSizes[diskInfo.Backend]; !ok { - diskSizes[diskInfo.Backend] = diskInfo.Size + diskSizes[diskInfo.Backend] = diskInfo.SizeMb } else { - diskSizes[diskInfo.Backend] += diskInfo.Size + diskSizes[diskInfo.Backend] += diskInfo.SizeMb } - diskSize += diskInfo.Size + diskSize += diskInfo.SizeMb diskIdx += 1 diskSeq = fmt.Sprintf("disk.%d", diskIdx) } @@ -1193,11 +1193,11 @@ func (self *SGuest) PerformChangeConfig(ctx context.Context, userCred mcclient.T if len(diskConf.Backend) == 0 { diskConf.Backend = self.getDefaultStorageType() } - if diskConf.Size > 0 { + if diskConf.SizeMb > 0 { if diskIdx >= len(disks) { newDisks.Add(jsonutils.Marshal(diskConf), fmt.Sprintf("disk.%d", newDiskIdx)) newDiskIdx += 1 - addDisk += diskConf.Size + addDisk += diskConf.SizeMb storage := host.GetLeastUsedStorage(diskConf.Backend) if storage == nil { return nil, httperrors.NewResourceNotReadyError("host not connect storage %s", diskConf.Backend) @@ -1206,22 +1206,22 @@ func (self *SGuest) PerformChangeConfig(ctx context.Context, userCred mcclient.T if !ok { diskSizes[storage.Id] = 0 } - diskSizes[storage.Id] = diskSizes[storage.Id] + diskConf.Size + diskSizes[storage.Id] = diskSizes[storage.Id] + diskConf.SizeMb } else { disk := disks[diskIdx].GetDisk() oldSize := disk.DiskSize - if diskConf.Size < oldSize { + if diskConf.SizeMb < oldSize { return nil, httperrors.NewInputParameterError("Cannot reduce disk size") - } else if diskConf.Size > oldSize { - arr := jsonutils.NewArray(jsonutils.NewString(disks[diskIdx].DiskId), jsonutils.NewInt(int64(diskConf.Size))) + } else if diskConf.SizeMb > oldSize { + arr := jsonutils.NewArray(jsonutils.NewString(disks[diskIdx].DiskId), jsonutils.NewInt(int64(diskConf.SizeMb))) resizeDisks.Add(arr) - addDisk += diskConf.Size - oldSize + addDisk += diskConf.SizeMb - oldSize storage := disks[diskIdx].GetDisk().GetStorage() _, ok := diskSizes[storage.Id] if !ok { diskSizes[storage.Id] = 0 } - diskSizes[storage.Id] = diskSizes[storage.Id] + diskConf.Size - oldSize + diskSizes[storage.Id] = diskSizes[storage.Id] + diskConf.SizeMb - oldSize } } } diff --git a/pkg/compute/models/guests.go b/pkg/compute/models/guests.go index 4d513dea9a..e9d93e888d 100644 --- a/pkg/compute/models/guests.go +++ b/pkg/compute/models/guests.go @@ -820,7 +820,7 @@ func getGuestResourceRequirements(ctx context.Context, userCred mcclient.TokenCr for idx := 0; data.Contains(fmt.Sprintf("disk.%d", idx)); idx += 1 { dataJson, _ := data.Get(fmt.Sprintf("disk.%d", idx)) diskConfig, _ := parseDiskInfo(ctx, userCred, dataJson) - diskSize += diskConfig.Size + diskSize += diskConfig.SizeMb } devCount := 0 diff --git a/pkg/compute/models/hostdrivers.go b/pkg/compute/models/hostdrivers.go index d6217e3c69..fc2cfe89de 100644 --- a/pkg/compute/models/hostdrivers.go +++ b/pkg/compute/models/hostdrivers.go @@ -14,6 +14,7 @@ type IHostDriver interface { GetHostType() string CheckAndSetCacheImage(ctx context.Context, host *SHost, storagecache *SStoragecache, task taskman.ITask) error ValidateUpdateDisk(ctx context.Context, userCred mcclient.TokenCredential, data *jsonutils.JSONDict) (*jsonutils.JSONDict, error) + ValidateCreateDisk(storage *SStorage, sizeGb int) error RequestPrepareSaveDiskOnHost(ctx context.Context, host *SHost, disk *SDisk, imageId string, task taskman.ITask) error RequestSaveUploadImageOnHost(ctx context.Context, host *SHost, disk *SDisk, imageId string, task taskman.ITask, data jsonutils.JSONObject) error RequestAllocateDiskOnStorage(ctx context.Context, host *SHost, storage *SStorage, disk *SDisk, task taskman.ITask, content *jsonutils.JSONDict) error From a543901e2f95d7a717ef7599bf8ecb4de3ea6f96 Mon Sep 17 00:00:00 2001 From: TangBin Date: Sat, 1 Dec 2018 14:52:01 +0800 Subject: [PATCH 09/15] yunionconfig build error fix --- pkg/cloudcommon/db/rbac.go | 2 +- pkg/compute/models/loadbalanceragents.go | 1 - pkg/compute/models/storages.go | 1 - pkg/webconsole/handlers.go | 2 +- pkg/webconsole/service/service.go | 2 +- pkg/yunionconf/models/parameters.go | 12 ++++++------ 6 files changed, 9 insertions(+), 11 deletions(-) diff --git a/pkg/cloudcommon/db/rbac.go b/pkg/cloudcommon/db/rbac.go index 83da4b9753..894429f9a1 100644 --- a/pkg/cloudcommon/db/rbac.go +++ b/pkg/cloudcommon/db/rbac.go @@ -153,4 +153,4 @@ func IsAdminAllowUpdate(userCred mcclient.TokenCredential, obj IModel) bool { func IsAdminAllowDelete(userCred mcclient.TokenCredential, obj IModel) bool { return userCred.IsAdminAllow(consts.GetServiceType(), obj.KeywordPlural(), policy.PolicyActionDelete) -} \ No newline at end of file +} diff --git a/pkg/compute/models/loadbalanceragents.go b/pkg/compute/models/loadbalanceragents.go index 11cd9154f1..12be997064 100644 --- a/pkg/compute/models/loadbalanceragents.go +++ b/pkg/compute/models/loadbalanceragents.go @@ -235,7 +235,6 @@ func (p *SLoadbalancerAgentParams) IsZero() bool { return false } - func (self *SLoadbalancerAgentManager) AllowListItems(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { return db.IsAdminAllowList(userCred, self) } diff --git a/pkg/compute/models/storages.go b/pkg/compute/models/storages.go index 1c14dc5162..a07af000dd 100644 --- a/pkg/compute/models/storages.go +++ b/pkg/compute/models/storages.go @@ -198,7 +198,6 @@ func (self *SStorage) IsLocal() bool { return self.StorageType == STORAGE_LOCAL || self.StorageType == STORAGE_BAREMETAL } - func (self *SStorage) getMoreDetails(extra *jsonutils.JSONDict) *jsonutils.JSONDict { used := self.GetUsedCapacity(tristate.True) waste := self.GetUsedCapacity(tristate.False) diff --git a/pkg/webconsole/handlers.go b/pkg/webconsole/handlers.go index 67ed8f81f6..6d78769dd9 100644 --- a/pkg/webconsole/handlers.go +++ b/pkg/webconsole/handlers.go @@ -9,6 +9,7 @@ import ( "yunion.io/x/jsonutils" "yunion.io/x/onecloud/pkg/appsrv" + "yunion.io/x/onecloud/pkg/cloudcommon/policy" "yunion.io/x/onecloud/pkg/httperrors" "yunion.io/x/onecloud/pkg/mcclient" "yunion.io/x/onecloud/pkg/mcclient/auth" @@ -17,7 +18,6 @@ import ( "yunion.io/x/onecloud/pkg/webconsole/command" o "yunion.io/x/onecloud/pkg/webconsole/options" "yunion.io/x/onecloud/pkg/webconsole/session" - "yunion.io/x/onecloud/pkg/cloudcommon/policy" ) const ( diff --git a/pkg/webconsole/service/service.go b/pkg/webconsole/service/service.go index cc89ee6122..c96fe85d2a 100644 --- a/pkg/webconsole/service/service.go +++ b/pkg/webconsole/service/service.go @@ -12,10 +12,10 @@ import ( "net/http" "yunion.io/x/onecloud/pkg/cloudcommon" + "yunion.io/x/onecloud/pkg/cloudcommon/consts" "yunion.io/x/onecloud/pkg/webconsole" o "yunion.io/x/onecloud/pkg/webconsole/options" "yunion.io/x/onecloud/pkg/webconsole/server" - "yunion.io/x/onecloud/pkg/cloudcommon/consts" ) func ensureBinExists(binPath string) { diff --git a/pkg/yunionconf/models/parameters.go b/pkg/yunionconf/models/parameters.go index 90f40903fa..4921b1e12c 100644 --- a/pkg/yunionconf/models/parameters.go +++ b/pkg/yunionconf/models/parameters.go @@ -5,14 +5,14 @@ import ( "yunion.io/x/jsonutils" "yunion.io/x/log" + "yunion.io/x/onecloud/pkg/cloudcommon/consts" "yunion.io/x/onecloud/pkg/cloudcommon/db" + "yunion.io/x/onecloud/pkg/cloudcommon/policy" "yunion.io/x/onecloud/pkg/httperrors" "yunion.io/x/onecloud/pkg/mcclient" "yunion.io/x/pkg/util/timeutils" "yunion.io/x/pkg/utils" "yunion.io/x/sqlchemy" - "yunion.io/x/onecloud/pkg/cloudcommon/consts" - "yunion.io/x/onecloud/pkg/cloudcommon/policy" ) const ( @@ -72,9 +72,9 @@ func getNamespaceInContext(userCred mcclient.TokenCredential, query jsonutils.JS } } -func getNamespace(userCred mcclient.TokenCredential, query jsonutils.JSONObject, data *jsonutils.JSONDict) (string, string, error) { +func getNamespace(userCred mcclient.TokenCredential, resource string, query jsonutils.JSONObject, data *jsonutils.JSONDict) (string, string, error) { var namespace, namespace_id string - if db.IsAdminAllowGet(userCred, ParameterManager) { + if userCred.IsAdminAllow(consts.GetServiceType(), resource, policy.PolicyActionList) { if name, nameId, e := getNamespaceInContext(userCred, query, data); e != nil { return "", "", e } else { @@ -113,7 +113,7 @@ func (manager *SParameterManager) ValidateCreateData(ctx context.Context, userCr return nil, httperrors.NewUserNotFoundError("user not found") } - namespace, namespace_id, e := getNamespace(userCred, query, data) + namespace, namespace_id, e := getNamespace(userCred, manager.KeywordPlural(), query, data) if e != nil { return nil, e } @@ -182,7 +182,7 @@ func (model *SParameter) ValidateUpdateData(ctx context.Context, userCred mcclie return nil, httperrors.NewUserNotFoundError("user not found") } - namespace, namespace_id, e := getNamespace(userCred, query, data) + namespace, namespace_id, e := getNamespace(userCred, model.KeywordPlural(), query, data) if e != nil { return nil, e } From 719a8a1db572243337194fc71c58cc12357ae075 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E5=B1=88=E8=BD=A9?= Date: Sat, 1 Dec 2018 13:12:29 +0800 Subject: [PATCH 10/15] =?UTF-8?q?=E6=A3=80=E6=9F=A5=E7=A3=81=E7=9B=98?= =?UTF-8?q?=E6=89=A9=E5=AE=B9=E5=A4=A7=E5=B0=8F?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- pkg/compute/hostdrivers/aliyun.go | 6 +++--- pkg/compute/hostdrivers/aws.go | 2 +- pkg/compute/hostdrivers/azure.go | 10 +++++++++- pkg/compute/hostdrivers/base.go | 4 ++-- pkg/compute/hostdrivers/kvm.go | 4 ++++ pkg/compute/hostdrivers/qcloud.go | 2 +- pkg/compute/models/disks.go | 18 +++++++++++------- pkg/compute/models/hostdrivers.go | 2 +- 8 files changed, 32 insertions(+), 16 deletions(-) diff --git a/pkg/compute/hostdrivers/aliyun.go b/pkg/compute/hostdrivers/aliyun.go index 47bdbe971e..08c8b8fa25 100644 --- a/pkg/compute/hostdrivers/aliyun.go +++ b/pkg/compute/hostdrivers/aliyun.go @@ -29,14 +29,14 @@ func (self *SAliyunHostDriver) GetHostType() string { return models.HOST_TYPE_ALIYUN } -func (self *SAliyunHostDriver) ValidateCreateDisk(storage *models.SStorage, sizeGb int) error { +func (self *SAliyunHostDriver) ValidateDiskSize(storage *models.SStorage, sizeGb int) error { if utils.IsInStringArray(storage.StorageType, []string{models.STORAGE_CLOUD_EFFICIENCY, models.STORAGE_CLOUD_SSD, models.STORAGE_CLOUD_ESSD}) { if sizeGb < 20 || sizeGb > 32768 { - return fmt.Errorf("The %s disk size must be in the range of 20G ~ 32768G", storage.StorageType) + return fmt.Errorf("The %s disk size must be in the range of 20G ~ 32768GB", storage.StorageType) } } else if storage.StorageType == models.STORAGE_PUBLIC_CLOUD { if sizeGb < 5 || sizeGb > 2000 { - return fmt.Errorf("The %s disk size must be in the range of 5G ~ 2000G", storage.StorageType) + return fmt.Errorf("The %s disk size must be in the range of 5G ~ 2000GB", storage.StorageType) } } else { return fmt.Errorf("Not support create %s disk", storage.StorageType) diff --git a/pkg/compute/hostdrivers/aws.go b/pkg/compute/hostdrivers/aws.go index c1dd56a6c9..3c8eb084d7 100644 --- a/pkg/compute/hostdrivers/aws.go +++ b/pkg/compute/hostdrivers/aws.go @@ -24,7 +24,7 @@ func (self *SAwsHostDriver) GetHostType() string { return models.HOST_TYPE_AWS } -func (self *SAwsHostDriver) ValidateCreateDisk(storage *models.SStorage, sizeGb int) error { +func (self *SAwsHostDriver) ValidateDiskSize(storage *models.SStorage, sizeGb int) error { if storage.StorageType == models.STORAGE_GP2_SSD { if sizeGb < 1 || sizeGb > 16384 { return fmt.Errorf("The %s disk size must be in the range of 1G ~ 16384GB", storage.StorageType) diff --git a/pkg/compute/hostdrivers/azure.go b/pkg/compute/hostdrivers/azure.go index edcf0d15e7..c24d082f9c 100644 --- a/pkg/compute/hostdrivers/azure.go +++ b/pkg/compute/hostdrivers/azure.go @@ -14,6 +14,7 @@ import ( "yunion.io/x/onecloud/pkg/compute/options" "yunion.io/x/onecloud/pkg/httperrors" "yunion.io/x/onecloud/pkg/mcclient" + "yunion.io/x/pkg/utils" ) type SAzureHostDriver struct { @@ -36,7 +37,14 @@ func (self *SAzureHostDriver) ValidateUpdateDisk(ctx context.Context, userCred m return data, nil } -func (self *SAzureHostDriver) ValidateCreateDisk(storage *models.SStorage, sizeGb int) error { +func (self *SAzureHostDriver) ValidateDiskSize(storage *models.SStorage, sizeGb int) error { + if utils.IsInStringArray(storage.StorageType, []string{models.STORAGE_STANDARD_LRS, models.STORAGE_STANDARDSSD_LRS, models.STORAGE_PREMIUM_LRS}) { + if sizeGb < 1 || sizeGb > 4095 { + return fmt.Errorf("The %s disk size must be in the range of 1G ~ 4095GB", storage.StorageType) + } + } else { + return fmt.Errorf("Not support create %s disk", storage.StorageType) + } return nil } diff --git a/pkg/compute/hostdrivers/base.go b/pkg/compute/hostdrivers/base.go index a245b2befa..6dcaea62f9 100644 --- a/pkg/compute/hostdrivers/base.go +++ b/pkg/compute/hostdrivers/base.go @@ -20,8 +20,8 @@ func (self *SBaseHostDriver) ValidateUpdateDisk(ctx context.Context, userCred mc return data, nil } -func (self *SBaseHostDriver) ValidateCreateDisk(storage *models.SStorage, sizeGb int) error { - return fmt.Errorf("ot Implement ValidateCreateDisk") +func (self *SBaseHostDriver) ValidateDiskSize(storage *models.SStorage, sizeGb int) error { + return fmt.Errorf("Not Implement ValidateDiskSize") } func (self *SBaseHostDriver) RequestDeleteSnapshotsWithStorage(ctx context.Context, host *models.SHost, snapshot *models.SSnapshot, task taskman.ITask) error { diff --git a/pkg/compute/hostdrivers/kvm.go b/pkg/compute/hostdrivers/kvm.go index 57e9fad69a..b7ca0a0bb2 100644 --- a/pkg/compute/hostdrivers/kvm.go +++ b/pkg/compute/hostdrivers/kvm.go @@ -29,6 +29,10 @@ func (self *SKVMHostDriver) GetHostType() string { return models.HOST_TYPE_HYPERVISOR } +func (self *SKVMHostDriver) ValidateDiskSize(storage *models.SStorage, sizeGb int) error { + return nil +} + func (self *SKVMHostDriver) CheckAndSetCacheImage(ctx context.Context, host *models.SHost, storageCache *models.SStoragecache, task taskman.ITask) error { params := task.GetParams() imageId, err := params.GetString("image_id") diff --git a/pkg/compute/hostdrivers/qcloud.go b/pkg/compute/hostdrivers/qcloud.go index 19c59970e1..473af582bb 100644 --- a/pkg/compute/hostdrivers/qcloud.go +++ b/pkg/compute/hostdrivers/qcloud.go @@ -28,7 +28,7 @@ func (self *SQcloudHostDriver) GetHostType() string { return models.HOST_TYPE_QCLOUD } -func (self *SQcloudHostDriver) ValidateCreateDisk(storage *models.SStorage, sizeGb int) error { +func (self *SQcloudHostDriver) ValidateDiskSize(storage *models.SStorage, sizeGb int) error { if sizeGb%10 != 0 { return fmt.Errorf("The disk size must be a multiple of 10Gb") } diff --git a/pkg/compute/models/disks.go b/pkg/compute/models/disks.go index b75255497a..51f4373e9b 100644 --- a/pkg/compute/models/disks.go +++ b/pkg/compute/models/disks.go @@ -310,10 +310,9 @@ func (manager *SDiskManager) validateDiskOnStorage(diskConfig *SDiskConfig, stor if storage.StorageType != diskConfig.Backend { return httperrors.NewInputParameterError("Storage type[%s] not match backend %s", storage.StorageType, diskConfig.Backend) } - sizeGb := diskConfig.SizeMb >> 10 if host := storage.GetMasterHost(); host != nil { //公有云磁盘大小检查。 - if err := host.GetHostDriver().ValidateCreateDisk(storage, sizeGb); err != nil { + if err := host.GetHostDriver().ValidateDiskSize(storage, diskConfig.SizeMb>>10); err != nil { return httperrors.NewInputParameterError(err.Error()) } } @@ -565,21 +564,26 @@ func (self *SDisk) PerformResize(ctx context.Context, userCred mcclient.TokenCre if err != nil { return nil, err } - size, err := fileutils.GetSizeMb(sizeStr, 'M', 1024) + sizeMb, err := fileutils.GetSizeMb(sizeStr, 'M', 1024) if err != nil { return nil, err } if self.Status != DISK_READY { return nil, httperrors.NewResourceNotReadyError("Resize disk when disk is READY") } - if size < self.DiskSize { + if sizeMb < self.DiskSize { return nil, httperrors.NewUnsupportOperationError("Disk cannot be thrink") } - if size == self.DiskSize { + if sizeMb == self.DiskSize { return nil, nil } - addDisk := size - self.DiskSize + addDisk := sizeMb - self.DiskSize storage := self.GetStorage() + if host := storage.GetMasterHost(); host != nil { + if err := host.GetHostDriver().ValidateDiskSize(storage, sizeMb>>10); err != nil { + return nil, httperrors.NewInputParameterError(err.Error()) + } + } if addDisk > storage.GetFreeCapacity() && !storage.IsEmulated { return nil, httperrors.NewOutOfResourceError("Not enough free space") } @@ -592,7 +596,7 @@ func (self *SDisk) PerformResize(ctx context.Context, userCred mcclient.TokenCre if err := QuotaManager.CheckSetPendingQuota(ctx, userCred, userCred.GetProjectId(), &pendingUsage); err != nil { return nil, httperrors.NewOutOfQuotaError(err.Error()) } - return nil, self.StartDiskResizeTask(ctx, userCred, int64(size), "", &pendingUsage) + return nil, self.StartDiskResizeTask(ctx, userCred, int64(sizeMb), "", &pendingUsage) } func (self *SDisk) GetIStorage() (cloudprovider.ICloudStorage, error) { diff --git a/pkg/compute/models/hostdrivers.go b/pkg/compute/models/hostdrivers.go index fc2cfe89de..2e8d1a5fa0 100644 --- a/pkg/compute/models/hostdrivers.go +++ b/pkg/compute/models/hostdrivers.go @@ -14,7 +14,7 @@ type IHostDriver interface { GetHostType() string CheckAndSetCacheImage(ctx context.Context, host *SHost, storagecache *SStoragecache, task taskman.ITask) error ValidateUpdateDisk(ctx context.Context, userCred mcclient.TokenCredential, data *jsonutils.JSONDict) (*jsonutils.JSONDict, error) - ValidateCreateDisk(storage *SStorage, sizeGb int) error + ValidateDiskSize(storage *SStorage, sizeGb int) error RequestPrepareSaveDiskOnHost(ctx context.Context, host *SHost, disk *SDisk, imageId string, task taskman.ITask) error RequestSaveUploadImageOnHost(ctx context.Context, host *SHost, disk *SDisk, imageId string, task taskman.ITask, data jsonutils.JSONObject) error RequestAllocateDiskOnStorage(ctx context.Context, host *SHost, storage *SStorage, disk *SDisk, task taskman.ITask, content *jsonutils.JSONDict) error From 93100dd3058b65e357fd7175af64eb15f0884329 Mon Sep 17 00:00:00 2001 From: wanyaoqi Date: Sat, 1 Dec 2018 16:24:18 +0800 Subject: [PATCH 11/15] fix import not use and not enough arguments in call --- pkg/compute/guestdrivers/azure.go | 1 - pkg/compute/guestdrivers/qcloud.go | 5 ++--- 2 files changed, 2 insertions(+), 4 deletions(-) diff --git a/pkg/compute/guestdrivers/azure.go b/pkg/compute/guestdrivers/azure.go index c1f4b5dc9e..ea5c27c059 100644 --- a/pkg/compute/guestdrivers/azure.go +++ b/pkg/compute/guestdrivers/azure.go @@ -16,7 +16,6 @@ import ( "yunion.io/x/pkg/utils" "yunion.io/x/jsonutils" - "yunion.io/x/onecloud/pkg/cloudcommon/db" "yunion.io/x/onecloud/pkg/cloudcommon/db/lockman" "yunion.io/x/onecloud/pkg/cloudcommon/db/taskman" "yunion.io/x/onecloud/pkg/compute/models" diff --git a/pkg/compute/guestdrivers/qcloud.go b/pkg/compute/guestdrivers/qcloud.go index 49fe9fe0cb..b03431c709 100644 --- a/pkg/compute/guestdrivers/qcloud.go +++ b/pkg/compute/guestdrivers/qcloud.go @@ -12,7 +12,6 @@ import ( "yunion.io/x/pkg/util/compare" "yunion.io/x/pkg/utils" - "yunion.io/x/onecloud/pkg/cloudcommon/db" "yunion.io/x/onecloud/pkg/cloudcommon/db/lockman" "yunion.io/x/onecloud/pkg/cloudcommon/db/taskman" "yunion.io/x/onecloud/pkg/cloudprovider" @@ -344,12 +343,12 @@ func (self *SQcloudGuestDriver) RequestSyncConfigOnHost(ctx context.Context, gue return nil, err } for _, disk := range removed { - if err := iVM.DetachDisk(disk.GetId()); err != nil { + if err := iVM.DetachDisk(ctx, disk.GetId()); err != nil { return nil, err } } for _, disk := range added { - if err := iVM.AttachDisk(disk.ExternalId); err != nil { + if err := iVM.AttachDisk(ctx, disk.ExternalId); err != nil { return nil, err } } From 94fcb7a4001a08e70f66885a9d16d721e66e2771 Mon Sep 17 00:00:00 2001 From: Qiu Jian Date: Mon, 3 Dec 2018 07:14:43 +0800 Subject: [PATCH 12/15] =?UTF-8?q?=E4=BF=AE=E6=AD=A3=EF=BC=9ASPolicyCredent?= =?UTF-8?q?ial=E5=AF=BC=E8=87=B4task=E5=A4=B1=E8=B4=A5?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- pkg/cloudcommon/policy/token.go | 122 +++++--------------------------- 1 file changed, 16 insertions(+), 106 deletions(-) diff --git a/pkg/cloudcommon/policy/token.go b/pkg/cloudcommon/policy/token.go index c42b846bf4..5cb7cfd55b 100644 --- a/pkg/cloudcommon/policy/token.go +++ b/pkg/cloudcommon/policy/token.go @@ -1,9 +1,8 @@ package policy import ( - "time" + "yunion.io/x/log" - "yunion.io/x/jsonutils" "yunion.io/x/pkg/gotypes" "yunion.io/x/onecloud/pkg/cloudcommon/consts" @@ -12,123 +11,34 @@ import ( ) type SPolicyTokenCredential struct { - Token mcclient.TokenCredential -} - -func (self *SPolicyTokenCredential) String() string { - return self.Token.String() -} - -func (self *SPolicyTokenCredential) IsZero() bool { - return self.Token.IsZero() -} - -func (self *SPolicyTokenCredential) GetProjectId() string { - return self.Token.GetProjectId() -} - -func (self *SPolicyTokenCredential) GetTenantId() string { - return self.Token.GetTenantId() -} - -func (self *SPolicyTokenCredential) GetUserId() string { - return self.Token.GetUserId() -} - -func (self *SPolicyTokenCredential) GetServiceURL(service, region, zone, endpointType string) (string, error) { - return self.Token.GetServiceURL(service, region, zone, endpointType) -} - -func (self *SPolicyTokenCredential) GetServiceURLs(service, region, zone, endpointType string) ([]string, error) { - return self.Token.GetServiceURLs(service, region, zone, endpointType) -} - -func (self *SPolicyTokenCredential) GetTokenString() string { - return self.Token.GetTokenString() -} - -func (self *SPolicyTokenCredential) GetDomainId() string { - return self.Token.GetDomainId() -} - -func (self *SPolicyTokenCredential) GetDomainName() string { - return self.Token.GetDomainName() -} - -func (self *SPolicyTokenCredential) GetTenantName() string { - return self.Token.GetTenantName() -} - -func (self *SPolicyTokenCredential) GetProjectName() string { - return self.Token.GetProjectName() -} - -func (self *SPolicyTokenCredential) GetUserName() string { - return self.Token.GetUserName() -} - -func (self *SPolicyTokenCredential) GetRoles() []string { - return self.Token.GetRoles() -} - -func (self *SPolicyTokenCredential) GetExpires() time.Time { - return self.Token.GetExpires() -} - -func (self *SPolicyTokenCredential) IsValid() bool { - return self.Token.IsValid() -} - -func (self *SPolicyTokenCredential) ValidDuration() time.Duration { - return self.Token.ValidDuration() -} - -func (self *SPolicyTokenCredential) GetRegions() []string { - return self.Token.GetRegions() -} - -func (self *SPolicyTokenCredential) GetServiceCatalog() mcclient.IServiceCatalog { - return self.Token.GetServiceCatalog() -} - -func (self *SPolicyTokenCredential) GetCatalogData(serviceTypes []string, region string) jsonutils.JSONObject { - return self.Token.GetCatalogData(serviceTypes, region) -} - -func (self *SPolicyTokenCredential) GetInternalServices(region string) []string { - return self.Token.GetInternalServices(region) -} - -func (self *SPolicyTokenCredential) GetExternalServices(region string) []mcclient.ExternalService { - return self.Token.GetExternalServices(region) -} - -func (self *SPolicyTokenCredential) GetEndpoints(region string, endpointType string) []mcclient.Endpoint { - return self.Token.GetEndpoints(region, endpointType) -} - -func (self *SPolicyTokenCredential) ToJson() jsonutils.JSONObject { - return self.Token.ToJson() + // usage embedded interface + mcclient.TokenCredential } func (self *SPolicyTokenCredential) HasSystemAdminPrivelege() bool { if consts.IsRbacEnabled() { - return PolicyManager.IsAdminCapable(self.Token) + return PolicyManager.IsAdminCapable(self.TokenCredential) } - return self.Token.HasSystemAdminPrivelege() + return self.TokenCredential.HasSystemAdminPrivelege() } func (self *SPolicyTokenCredential) IsAdminAllow(service string, resource string, action string, extra ...string) bool { if consts.IsRbacEnabled() { - result := PolicyManager.Allow(true, self.Token, service, resource, action, extra...) + result := PolicyManager.Allow(true, self.TokenCredential, service, resource, action, extra...) return result == rbacutils.AdminAllow } - return self.Token.IsAdminAllow(service, resource, action, extra...) + return self.TokenCredential.IsAdminAllow(service, resource, action, extra...) } func init() { - gotypes.RegisterSerializable(mcclient.TokenCredentialType, func() gotypes.ISerializable { - return &SPolicyTokenCredential{} + gotypes.RegisterSerializableTransformer(mcclient.TokenCredentialType, func(input gotypes.ISerializable) gotypes.ISerializable { + log.Debugf("do TokenCredential transform for %#v", input) + switch val := input.(type) { + case *mcclient.SSimpleToken: + return &SPolicyTokenCredential{val} + default: + return val + } }) } @@ -140,6 +50,6 @@ func FilterPolicyCredential(token mcclient.TokenCredential) mcclient.TokenCreden case *SPolicyTokenCredential: return token default: - return &SPolicyTokenCredential{Token: token} + return &SPolicyTokenCredential{TokenCredential: token} } } From fe7d54e6cb0a1fa8791416b499981494953f6907 Mon Sep 17 00:00:00 2001 From: Qiu Jian Date: Mon, 3 Dec 2018 07:36:30 +0800 Subject: [PATCH 13/15] fix aws missing init --- pkg/compute/hostdrivers/aws.go | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/pkg/compute/hostdrivers/aws.go b/pkg/compute/hostdrivers/aws.go index 63d5d95312..a0ff3f48d0 100644 --- a/pkg/compute/hostdrivers/aws.go +++ b/pkg/compute/hostdrivers/aws.go @@ -12,6 +12,11 @@ type SAwsHostDriver struct { SManagedVirtualizationHostDriver } +func init() { + driver := SAwsHostDriver{} + models.RegisterHostDriver(&driver) +} + func (self *SAwsHostDriver) GetHostType() string { return models.HOST_TYPE_AWS } From 5c6a5c937516575dc5336d672dd083dd7a99f9d7 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E5=B1=88=E8=BD=A9?= Date: Mon, 3 Dec 2018 12:19:54 +0800 Subject: [PATCH 14/15] =?UTF-8?q?=E4=BF=AE=E5=A4=8D=E8=A7=84=E5=88=99?= =?UTF-8?q?=E7=BC=BA=E5=A4=B1=E4=BC=98=E5=85=88=E7=BA=A7=E5=8F=8A=E6=8F=8F?= =?UTF-8?q?=E8=BF=B0=E4=BF=A1=E6=81=AF?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- pkg/compute/models/secgrouprules.go | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/pkg/compute/models/secgrouprules.go b/pkg/compute/models/secgrouprules.go index c8a23f2ec1..c864d80a06 100644 --- a/pkg/compute/models/secgrouprules.go +++ b/pkg/compute/models/secgrouprules.go @@ -281,7 +281,13 @@ func (self *SSecurityGroupRule) String() string { } func (self *SSecurityGroupRule) toRule() (*secrules.SecurityRule, error) { - return secrules.ParseSecurityRule(self.String()) + rule, err := secrules.ParseSecurityRule(self.String()) + if err != nil { + return nil, err + } + rule.Description = self.Description + rule.Priority = int(self.Priority) + return rule, nil } func (self *SSecurityGroupRule) SingleRules() ([]secrules.SecurityRule, error) { From 9ca04590c35e82070ef2d7636206ce985354119c Mon Sep 17 00:00:00 2001 From: Qiu Jian Date: Mon, 3 Dec 2018 13:17:14 +0800 Subject: [PATCH 15/15] update vendor --- Gopkg.lock | 14 +- .../go-windows-terminal-sequences/license | 9 - vendor/yunion.io/x/jsonutils/marshal.go | 256 ++++++++++++++---- vendor/yunion.io/x/jsonutils/reflect.go | 1 + vendor/yunion.io/x/pkg/gotypes/serialize.go | 39 ++- .../x/pkg/prettytable/prettytable.go | 14 +- .../yunion.io/x/pkg/util/secrules/secrules.go | 19 +- vendor/yunion.io/x/pkg/utils/profiler.go | 10 + vendor/yunion.io/x/structarg/structarg.go | 70 ++--- 9 files changed, 291 insertions(+), 141 deletions(-) delete mode 100644 vendor/github.com/konsorten/go-windows-terminal-sequences/license create mode 100644 vendor/yunion.io/x/pkg/utils/profiler.go diff --git a/Gopkg.lock b/Gopkg.lock index 454faee8ba..97e5f4c360 100644 --- a/Gopkg.lock +++ b/Gopkg.lock @@ -1310,11 +1310,11 @@ [[projects]] branch = "master" - digest = "1:54554b3c72f4fcbd3c27c5137f9acd9d153d7e7150d77cd509af50c75fcb41b9" + digest = "1:a2346cf0c965791c281a428a3e9bf522913941028e4c814a774af7f3cc2360b0" name = "yunion.io/x/jsonutils" packages = ["."] pruneopts = "UT" - revision = "7079aada4c7e9a37e4c3b183bddb0ef684e038f2" + revision = "814e036849815935e5957ebd03bd0f4fc992fe83" [[projects]] branch = "master" @@ -1329,7 +1329,7 @@ [[projects]] branch = "master" - digest = "1:bf987f904fd821c6395fefdab956d070596eb401657fff40420014a3a8e3f45c" + digest = "1:5d9a659bf3c1d341cdf4135eca0009dbfa64a6728b3e0535c06afb6a76189a98" name = "yunion.io/x/pkg" packages = [ "gotypes", @@ -1353,7 +1353,6 @@ "util/secrules", "util/sets", "util/stringutils", - "util/sysutils", "util/timeutils", "util/trace", "util/ttlpool", @@ -1363,7 +1362,7 @@ "utils", ] pruneopts = "UT" - revision = "7614d751299a6703a05f757a13e6dc900332e31b" + revision = "cecf301871b09e94abaf1ff76d5ae7ac51ce0746" [[projects]] branch = "master" @@ -1375,11 +1374,11 @@ [[projects]] branch = "master" - digest = "1:f07a1ef9758f56186dd9039a8608bc9d537070a7c04479dbab6aeb42501001b7" + digest = "1:bbaf572e68e5dad4045e1e424af29838882c620df391fa1631dd8dc851c87a95" name = "yunion.io/x/structarg" packages = ["."] pruneopts = "UT" - revision = "e0cc2c73375327d401b100bd8988fa340c2687ee" + revision = "c95bf78846decd8dea379e925410f2895fb20076" [solve-meta] analyzer-name = "dep" @@ -1493,7 +1492,6 @@ "yunion.io/x/pkg/util/secrules", "yunion.io/x/pkg/util/sets", "yunion.io/x/pkg/util/stringutils", - "yunion.io/x/pkg/util/sysutils", "yunion.io/x/pkg/util/timeutils", "yunion.io/x/pkg/util/trace", "yunion.io/x/pkg/util/ttlpool", diff --git a/vendor/github.com/konsorten/go-windows-terminal-sequences/license b/vendor/github.com/konsorten/go-windows-terminal-sequences/license deleted file mode 100644 index 14127cd831..0000000000 --- a/vendor/github.com/konsorten/go-windows-terminal-sequences/license +++ /dev/null @@ -1,9 +0,0 @@ -(The MIT License) - -Copyright (c) 2017 marvin + konsorten GmbH (open-source@konsorten.de) - -Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the 'Software'), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions: - -The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. - -THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. diff --git a/vendor/yunion.io/x/jsonutils/marshal.go b/vendor/yunion.io/x/jsonutils/marshal.go index aff79cf1d2..97630bb987 100644 --- a/vendor/yunion.io/x/jsonutils/marshal.go +++ b/vendor/yunion.io/x/jsonutils/marshal.go @@ -12,37 +12,118 @@ import ( "reflect" "time" + "strings" "yunion.io/x/log" "yunion.io/x/pkg/gotypes" "yunion.io/x/pkg/tristate" - "yunion.io/x/pkg/util/reflectutils" "yunion.io/x/pkg/util/timeutils" + "yunion.io/x/pkg/utils" ) -func marshalSlice(val reflect.Value) *JSONArray { +func marshalSlice(val reflect.Value, info *jsonMarshalInfo) JSONObject { + if val.Len() == 0 && info != nil && info.omitEmpty { + return JSONNull + } objs := make([]JSONObject, val.Len()) for i := 0; i < val.Len(); i += 1 { - objs[i] = marshalValue(val.Index(i)) + objs[i] = marshalValue(val.Index(i), nil) + } + arr := NewArray(objs...) + if info != nil && info.forceString { + return NewString(arr.String()) + } else { + return arr } - return NewArray(objs...) } -func marshalMap(val reflect.Value) *JSONDict { +func marshalMap(val reflect.Value, info *jsonMarshalInfo) JSONObject { keys := val.MapKeys() + if len(keys) == 0 && info != nil && info.omitEmpty { + return JSONNull + } objPairs := make([]JSONPair, 0) for i := 0; i < len(keys); i += 1 { key := keys[i] - val := marshalValue(val.MapIndex(key)) + val := marshalValue(val.MapIndex(key), nil) if val != JSONNull { objPairs = append(objPairs, JSONPair{key: fmt.Sprintf("%s", key), val: val}) } } - return NewDict(objPairs...) + dict := NewDict(objPairs...) + if info != nil && info.forceString { + return NewString(dict.String()) + } else { + return dict + } } -func marshalStruct(val reflect.Value) *JSONDict { +func marshalStruct(val reflect.Value, info *jsonMarshalInfo) JSONObject { objPairs := struct2JSONPairs(val) - return NewDict(objPairs...) + if len(objPairs) == 0 && info != nil && info.omitEmpty { + return JSONNull + } + dict := NewDict(objPairs...) + if info != nil && info.forceString { + return NewString(dict.String()) + } else { + return dict + } +} + +type jsonMarshalInfo struct { + ignore bool + omitEmpty bool + omitFalse bool + omitZero bool + name string + forceString bool +} + +func parseJsonMarshalInfo(fieldTag reflect.StructTag) jsonMarshalInfo { + info := jsonMarshalInfo{} + info.omitEmpty = true + info.omitZero = false + info.omitFalse = false + + tags := utils.TagMap(fieldTag) + if val, ok := tags["json"]; ok { + keys := strings.Split(val, ",") + if len(keys) > 0 { + if keys[0] == "-" { + if len(keys) > 1 { + info.name = keys[0] + } else { + info.ignore = true + } + } else { + info.name = keys[0] + } + } + if len(keys) > 1 { + for _, k := range keys[1:] { + switch k { + case "omitempty": + info.omitEmpty = true + case "allowempty": + info.omitEmpty = false + case "omitzero": + info.omitZero = true + case "allowzero": + info.omitZero = false + case "omitfalse": + info.omitFalse = true + case "allowfalse": + info.omitFalse = false + case "string": + info.forceString = true + } + } + } + } + if val, ok := tags["name"]; ok { + info.name = val + } + return info } func struct2JSONPairs(val reflect.Value) []JSONPair { @@ -53,16 +134,44 @@ func struct2JSONPairs(val reflect.Value) []JSONPair { if !gotypes.IsFieldExportable(fieldType.Name) { // unexportable field, ignore continue } - if fieldType.Type.Kind() == reflect.Struct && fieldType.Anonymous { // embbed struct - newPairs := struct2JSONPairs(val.Field(i)) - objPairs = append(objPairs, newPairs...) - } else { - key := reflectutils.GetStructFieldName(&fieldType) // utils.CamelSplit(fieldType.Name, "_") - if key == "" { + if fieldType.Anonymous { + nextVal := val.Field(i) + switch fieldType.Type.Kind() { + case reflect.Struct: // embbed struct + nextVal = val.Field(i) + case reflect.Interface: // embbed interface + CHECKINTERFACE: + for { + switch nextVal.Type().Kind() { + case reflect.Interface: + nextVal = nextVal.Elem() + case reflect.Ptr: + nextVal = reflect.Indirect(nextVal) + case reflect.Struct: + break CHECKINTERFACE + default: + log.Warningf("embeded interface point to a non struct data %s", nextVal.Type()) + break CHECKINTERFACE + } + } + default: + log.Warningf("unsupport anonymous embeded type %s", fieldType.Type.Name()) continue } - val := marshalValue(val.Field(i)) - if val != JSONNull { + newPairs := struct2JSONPairs(nextVal) + objPairs = append(objPairs, newPairs...) + } else { + jsonInfo := parseJsonMarshalInfo(fieldType.Tag) + + if jsonInfo.ignore { + continue + } + key := jsonInfo.name + if len(key) == 0 { + key = utils.CamelSplit(fieldType.Name, "_") + } + val := marshalValue(val.Field(i), &jsonInfo) + if val != nil && val != JSONNull { objPair := JSONPair{key: key, val: val} objPairs = append(objPairs, objPair) } @@ -71,23 +180,41 @@ func struct2JSONPairs(val reflect.Value) []JSONPair { return objPairs } -func marshalInt64(val int64) *JSONInt { - return NewInt(val) -} - -func marshalFloat64(val float64) *JSONFloat { - return NewFloat(val) -} - -func marshalBoolean(val bool) *JSONBool { - if val { - return JSONTrue +func marshalInt64(val int64, info *jsonMarshalInfo) JSONObject { + if val == 0 && info != nil && info.omitZero { + return JSONNull + } else if info != nil && info.forceString { + return NewString(fmt.Sprintf("%d", val)) } else { - return JSONFalse + return NewInt(val) } } -func marshalTristate(val tristate.TriState) JSONObject { +func marshalFloat64(val float64, info *jsonMarshalInfo) JSONObject { + if val == 0.0 && info != nil && info.omitZero { + return JSONNull + } else if info != nil && info.forceString { + return NewString(fmt.Sprintf("%f", val)) + } else { + return NewFloat(val) + } +} + +func marshalBoolean(val bool, info *jsonMarshalInfo) JSONObject { + if !val && info != nil && info.omitFalse { + return JSONNull + } else if info != nil && info.forceString { + return NewString(fmt.Sprintf("%v", val)) + } else { + if val { + return JSONTrue + } else { + return JSONFalse + } + } +} + +func marshalTristate(val tristate.TriState, info *jsonMarshalInfo) JSONObject { if val.IsTrue() { return JSONTrue } else if val.IsFalse() { @@ -97,16 +224,19 @@ func marshalTristate(val tristate.TriState) JSONObject { } } -func marshalString(val string) JSONObject { - if len(val) == 0 { +func marshalString(val string, info *jsonMarshalInfo) JSONObject { + if len(val) == 0 && info != nil && info.omitEmpty { return JSONNull } else { return NewString(val) } } -func marshalTime(val time.Time) *JSONString { +func marshalTime(val time.Time, info *jsonMarshalInfo) JSONObject { if val.IsZero() { + if info != nil && info.omitEmpty { + return JSONNull + } return NewString("") } else { return NewString(timeutils.FullIsoTime(val)) @@ -118,10 +248,10 @@ func Marshal(obj interface{}) JSONObject { return JSONNull } objValue := reflect.Indirect(reflect.ValueOf(obj)) - return marshalValue(objValue) + return marshalValue(objValue, nil) } -func marshalValue(objValue reflect.Value) JSONObject { +func marshalValue(objValue reflect.Value, info *jsonMarshalInfo) JSONObject { switch objValue.Type() { case JSONDictPtrType, JSONArrayPtrType, JSONBoolPtrType, JSONIntPtrType, JSONFloatPtrType, JSONStringPtrType, JSONObjectType: if objValue.IsNil() { @@ -131,81 +261,105 @@ func marshalValue(objValue reflect.Value) JSONObject { case JSONDictType: json, ok := objValue.Interface().(JSONDict) if ok { - return &json + if len(json.data) == 0 && info != nil && info.omitEmpty { + return JSONNull + } else { + return &json + } } else { return JSONNull } case JSONArrayType: json, ok := objValue.Interface().(JSONArray) if ok { - return &json + if len(json.data) == 0 && info != nil && info.omitEmpty { + return JSONNull + } else { + return &json + } } else { return JSONNull } case JSONBoolType: json, ok := objValue.Interface().(JSONBool) if ok { - return &json + if !json.data && info != nil && info.omitEmpty { + return JSONNull + } else { + return &json + } } else { return JSONNull } case JSONIntType: json, ok := objValue.Interface().(JSONInt) if ok { - return &json + if json.data == 0 && info != nil && info.omitEmpty { + return JSONNull + } else { + return &json + } } else { return JSONNull } case JSONFloatType: json, ok := objValue.Interface().(JSONFloat) if ok { - return &json + if json.data == 0.0 && info != nil && info.omitEmpty { + return JSONNull + } else { + return &json + } } else { return JSONNull } case JSONStringType: json, ok := objValue.Interface().(JSONString) if ok { - return &json + if len(json.data) == 0 && info != nil && info.omitEmpty { + return JSONNull + } else { + return &json + } } else { return JSONNull } case tristate.TriStateType: tri, ok := objValue.Interface().(tristate.TriState) if ok { - return marshalTristate(tri) + return marshalTristate(tri, info) } else { return JSONNull } } switch objValue.Kind() { case reflect.Slice, reflect.Array: - return marshalSlice(objValue) + return marshalSlice(objValue, info) case reflect.Struct: if objValue.Type() == gotypes.TimeType { - return marshalTime(objValue.Interface().(time.Time)) + return marshalTime(objValue.Interface().(time.Time), info) } else { - return marshalStruct(objValue) + return marshalStruct(objValue, info) } case reflect.Map: - return marshalMap(objValue) + return marshalMap(objValue, info) case reflect.String: strValue := objValue.Convert(gotypes.StringType) - return marshalString(strValue.Interface().(string)) + return marshalString(strValue.Interface().(string), info) case reflect.Bool: - return marshalBoolean(objValue.Interface().(bool)) + return marshalBoolean(objValue.Interface().(bool), info) case reflect.Int, reflect.Int8, reflect.Int16, reflect.Int32, reflect.Int64, reflect.Uint, reflect.Uint8, reflect.Uint16, reflect.Uint32, reflect.Uint64: intValue := objValue.Convert(gotypes.Int64Type) - return marshalInt64(intValue.Interface().(int64)) + return marshalInt64(intValue.Interface().(int64), info) case reflect.Float32, reflect.Float64: floatValue := objValue.Convert(gotypes.Float64Type) - return marshalFloat64(floatValue.Interface().(float64)) + return marshalFloat64(floatValue.Interface().(float64), info) case reflect.Interface, reflect.Ptr: if objValue.IsNil() { return JSONNull } - return marshalValue(objValue.Elem()) + return marshalValue(objValue.Elem(), info) default: log.Errorf("unsupport object %s %s", objValue.Type(), objValue.Interface()) return JSONNull diff --git a/vendor/yunion.io/x/jsonutils/reflect.go b/vendor/yunion.io/x/jsonutils/reflect.go index d19df92fae..eab866e8dc 100644 --- a/vendor/yunion.io/x/jsonutils/reflect.go +++ b/vendor/yunion.io/x/jsonutils/reflect.go @@ -66,5 +66,6 @@ func JSONDeserialize(objType reflect.Type, strVal string) (gotypes.ISerializable if err != nil { return nil, err } + objPtr = gotypes.Transform(objType, objPtr) return objPtr, nil } diff --git a/vendor/yunion.io/x/pkg/gotypes/serialize.go b/vendor/yunion.io/x/pkg/gotypes/serialize.go index fdbc271497..ae601e6310 100644 --- a/vendor/yunion.io/x/pkg/gotypes/serialize.go +++ b/vendor/yunion.io/x/pkg/gotypes/serialize.go @@ -14,10 +14,13 @@ type ISerializable interface { type FuncSerializableAllocator func() ISerializable +type FuncSerializableTransformer func(ISerializable) ISerializable + var ( - ISerializableType = reflect.TypeOf((*ISerializable)(nil)).Elem() - serializableAllocators = map[reflect.Type]FuncSerializableAllocator{} - ErrTypeNotSerializable = errors.New("Type not serializable") + ISerializableType = reflect.TypeOf((*ISerializable)(nil)).Elem() + serializableAllocators = map[reflect.Type]FuncSerializableAllocator{} + serializableTransformers = map[reflect.Type][]FuncSerializableTransformer{} + ErrTypeNotSerializable = errors.New("Type not serializable") ) // RegisterSerializable registers an allocator func for the specified serializable type. @@ -29,17 +32,41 @@ func RegisterSerializable(valType reflect.Type, alloc FuncSerializableAllocator) if !IsSerializable(valType) { panic(valType.String() + " does not implement ISerializable") } + if _, ok := serializableAllocators[valType]; ok { + panic(valType.String() + " has been registered, might need to register a transformer") + } serializableAllocators[valType] = alloc } +func RegisterSerializableTransformer(valType reflect.Type, trans FuncSerializableTransformer) { + if !IsSerializable(valType) { + panic(valType.String() + " does not implement ISerializable") + } + if _, ok := serializableTransformers[valType]; !ok { + serializableTransformers[valType] = make([]FuncSerializableTransformer, 0) + } + serializableTransformers[valType] = append(serializableTransformers[valType], trans) +} + func IsSerializable(valType reflect.Type) bool { return valType.Implements(ISerializableType) } func NewSerializable(objType reflect.Type) (ISerializable, error) { deserFunc, ok := serializableAllocators[objType] - if ok { - return deserFunc(), nil + if !ok { + return nil, ErrTypeNotSerializable } - return nil, ErrTypeNotSerializable + retVal := deserFunc() + return retVal, nil +} + +func Transform(objType reflect.Type, retVal ISerializable) ISerializable { + transFuncs, ok := serializableTransformers[objType] + if ok { + for i := 0; i < len(transFuncs); i += 1 { + retVal = transFuncs[i](retVal) + } + } + return retVal } diff --git a/vendor/yunion.io/x/pkg/prettytable/prettytable.go b/vendor/yunion.io/x/pkg/prettytable/prettytable.go index f5ee4f34f1..feba929161 100644 --- a/vendor/yunion.io/x/pkg/prettytable/prettytable.go +++ b/vendor/yunion.io/x/pkg/prettytable/prettytable.go @@ -3,6 +3,7 @@ package prettytable import ( "bytes" "strings" + "unicode" ) type AlignmentType uint8 @@ -102,6 +103,17 @@ func textLine(buf *bytes.Buffer, columns []ptColumn, widths []int) { } } +func runeDisplayWidth(r rune) int { + const puncts = "。，；：（）、？《》" + if unicode.Is(unicode.Han, r) { + return 2 + } + if strings.ContainsRune(puncts, r) { + return 2 + } + return 1 +} + // cellDisplayWidth returns display width of the cell when printed as the // nthCol. prevWidth is the total display width (as return by this same func) // of previous cells in the same line @@ -116,7 +128,7 @@ func cellDisplayWidth(cell string, nthCol int, prevWidth int) int { for _, c := range line { incr := 0 if c != '\t' { - incr = 1 + incr = runeDisplayWidth(c) } else { // terminal with have the char TabWidth aligned incr = TabWidth - (x & (TabWidth - 1)) diff --git a/vendor/yunion.io/x/pkg/util/secrules/secrules.go b/vendor/yunion.io/x/pkg/util/secrules/secrules.go index 037bb62d45..6437ff1ae9 100644 --- a/vendor/yunion.io/x/pkg/util/secrules/secrules.go +++ b/vendor/yunion.io/x/pkg/util/secrules/secrules.go @@ -127,21 +127,12 @@ func ParseSecurityRule(pattern string) (*SecurityRule, error) { return nil, ErrInvalidAction } } else if status == SEG_IP { - // NOTE regutils.MatchCIDR actually also matches IP address without prefix length if regutils.MatchCIDR(seg) { - if idx := strings.Index(seg, "/"); idx > -1 { - if _, ipnet, err := net.ParseCIDR(seg); err != nil { - return nil, ErrInvalidNet - } else { - rule.IPNet = ipnet - } - } else if ip := net.ParseIP(seg); ip != nil { - rule.IPNet = &net.IPNet{ - IP: ip, - Mask: net.CIDRMask(32, 32), - } - } else { - return nil, ErrInvalidIPAddr + _, rule.IPNet, _ = net.ParseCIDR(seg) + } else if regutils.MatchIPAddr(seg) { + rule.IPNet = &net.IPNet{ + IP: net.ParseIP(seg), + Mask: net.CIDRMask(32, 32), } } else { rule.IPNet = &net.IPNet{ diff --git a/vendor/yunion.io/x/pkg/utils/profiler.go b/vendor/yunion.io/x/pkg/utils/profiler.go new file mode 100644 index 0000000000..35064e43c5 --- /dev/null +++ b/vendor/yunion.io/x/pkg/utils/profiler.go @@ -0,0 +1,10 @@ +package utils + +import ( + "io" + "runtime/pprof" +) + +func DumpAllGoroutineStack(w io.Writer) { + pprof.Lookup("goroutine").WriteTo(w, 1) +} diff --git a/vendor/yunion.io/x/structarg/structarg.go b/vendor/yunion.io/x/structarg/structarg.go index e09e97cdad..ff749484c7 100644 --- a/vendor/yunion.io/x/structarg/structarg.go +++ b/vendor/yunion.io/x/structarg/structarg.go @@ -187,56 +187,6 @@ func (this *ArgumentParser) addStructArgument(tp reflect.Type, val reflect.Value return nil } -/*func findWord(str []byte, offset int) (string, int) { - var buffer bytes.Buffer - i := skipEmpty(str, offset) - if i >= len(str) { - return "", i - } - var endstr string - quote := false - if str[i] == '"' { - quote = true - endstr = "\"" - i++ - } else if str[i] == '\'' { - quote = true - endstr = "'" - i++ - } else { - endstr = " :,\t\n}]" - } - for i < len(str) { - if quote && str[i] == '\\' { - if i+1 < len(str) { - i++ - switch str[i] { - case 'n': - buffer.WriteByte('\n') - case 'r': - buffer.WriteByte('\r') - case 't': - buffer.WriteByte('\t') - default: - buffer.WriteByte(str[i]) - } - i++ - } else { - break - } - } else if strings.IndexByte(endstr, str[i]) >= 0 { // end - if quote { - i++ - } - break - } else { - buffer.WriteByte(str[i]) - i++ - } - } - return buffer.String(), i -}*/ - func (this *ArgumentParser) addArgument(f reflect.StructField, v reflect.Value) error { tagMap := utils.TagMap(f.Tag) help := tagMap[TAG_HELP] @@ -901,6 +851,14 @@ func (this *ArgumentParser) ParseArgs(args []string, ignore_unknown bool) error return err } +func isQuotedByChar(str string, quoteChar byte) bool { + return str[0] == quoteChar && str[len(str)-1] == quoteChar +} + +func isQuoted(str string) bool { + return isQuotedByChar(str, '"') || isQuotedByChar(str, '\'') +} + func (this *ArgumentParser) parseKeyValue(key, value string) error { arg := this.findOptionalArgument(key) if arg != nil { @@ -914,7 +872,15 @@ func (this *ArgumentParser) parseKeyValue(key, value string) error { } } } else { - return arg.SetValue(value) + if !isQuoted(value) { + value = fmt.Sprintf("\"%s\"", value) + } + values := utils.FindWords([]byte(value), 0) + if len(values) == 1 { + return arg.SetValue(values[0]) + } else { + log.Warningf("too many arguments %#v for %s", values, key) + } } } else { log.Warningf("Cannot find argument %s", key) @@ -964,7 +930,7 @@ func (this *ArgumentParser) ParseFile(filepath string) error { for scanner.Scan() { line := scanner.Text() line = strings.TrimSpace(removeComments(line)) - line = removeCharacters(line, `"'`) + // line = removeCharacters(line, `"'`) if len(line) > 0 { key, val, e := line2KeyValue(line) if e == nil {