resolve conflict

pkg/cloudcommon/db/db_dispatcher.go

@@ -254,6 +254,11 @@ func applyListItemsGeneralJointFilters(manager IModelManager, q *sqlchemy.SQuery
 	return q, nil
 }
 
+func ListItemQueryFilters(manager IModelManager, ctx context.Context, q *sqlchemy.SQuery,
+	userCred mcclient.TokenCredential, query jsonutils.JSONObject) (*sqlchemy.SQuery, error) {
+	return listItemQueryFilters(manager, ctx, q, userCred, query)
+}
+
 func listItemQueryFilters(manager IModelManager, ctx context.Context, q *sqlchemy.SQuery,
 	userCred mcclient.TokenCredential, query jsonutils.JSONObject) (*sqlchemy.SQuery, error) {
 
@@ -954,10 +959,6 @@ func objectPerformAction(dispatcher *DBModelDispatcher, modelValue reflect.Value
 }
 
 func updateItem(manager IModelManager, item IModel, ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) {
-	if !item.AllowUpdateItem(ctx, userCred) {
-		return nil, httperrors.NewForbiddenError(fmt.Sprintf("Not allow to update item"))
-	}
-
 	var err error
 
 	err = item.ValidateUpdateCondition(ctx)
@@ -1029,6 +1030,10 @@ func (dispatcher *DBModelDispatcher) Update(ctx context.Context, idStr string, q
 		return nil, httperrors.NewGeneralError(err)
 	}
 
+	if !model.AllowUpdateItem(ctx, userCred) {
+		return nil, httperrors.NewForbiddenError(fmt.Sprintf("Not allow to update item"))
+	}
+
 	lockman.LockObject(ctx, model)
 	defer lockman.ReleaseObject(ctx, model)
 

pkg/cloudcommon/db/db_joint_dispatcher.go

@@ -136,7 +136,7 @@ func (dispatcher *DBJointModelDispatcher) Get(ctx context.Context, id1 string, i
 	} else if err != nil {
 		return nil, httperrors.NewGeneralError(err)
 	}
-	if !item.AllowGetDetails(ctx, userCred, query) {
+	if !item.AllowGetJointDetails(ctx, userCred, query, item) {
 		return nil, httperrors.NewForbiddenError("Not allow to get details")
 	}
 	return getItemDetails(dispatcher.JointModelManager(), item, ctx, userCred, query)
@@ -200,6 +200,11 @@ func (dispatcher *DBJointModelDispatcher) Update(ctx context.Context, id1 string
 	} else if err != nil {
 		return nil, httperrors.NewGeneralError(err)
 	}
+
+	if !item.AllowUpdateJointItem(ctx, userCred, item) {
+		return nil, httperrors.NewForbiddenError(fmt.Sprintf("Not allow to update item"))
+	}
+
 	lockman.LockJointObject(ctx, master, slave)
 	defer lockman.ReleaseJointObject(ctx, master, slave)
 	return updateItem(dispatcher.JointModelManager(), item, ctx, userCred, query, data)

pkg/cloudcommon/db/interface.go

@@ -131,6 +131,8 @@ type IJointModel interface {
 	Slave() IStandaloneModel
 
 	Detach(ctx context.Context, userCred mcclient.TokenCredential) error
+	AllowGetJointDetails(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, item IJointModel) bool
+	AllowUpdateJointItem(ctx context.Context, userCred mcclient.TokenCredential, item IJointModel) bool
 }
 
 type IStandaloneModelManager interface {

pkg/cloudcommon/db/jointbase.go

@@ -179,6 +179,16 @@ func (joint *SJointResourceBase) Slave() IStandaloneModel {
 	return nil
 }
 
+func (self *SJointResourceBase) AllowGetJointDetails(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, item IJointModel) bool {
+	masterVirtual := item.Master().(IVirtualModel)
+	return masterVirtual.IsOwner(userCred)
+}
+
+func (self *SJointResourceBase) AllowUpdateJointItem(ctx context.Context, userCred mcclient.TokenCredential, item IJointModel) bool {
+	masterVirtual := item.Master().(IVirtualModel)
+	return masterVirtual.IsOwner(userCred)
+}
+
 /*
 func (joint *SJointResourceBase) GetCustomizeColumns(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) *jsonutils.JSONDict {
 	extra := joint.SResourceBase.GetCustomizeColumns(ctx, userCred, query)