From e1f8850f2507e028efcfebc346ec2cace4a253f6 Mon Sep 17 00:00:00 2001
From: rainzm <mjoycarry@gmail.com>
Date: Mon, 27 Sep 2021 19:06:24 +0800
Subject: [PATCH] fix(notify): solve the permission problem of subscriber

---
 pkg/notify/models/subscriber.go | 12 +++++-----
 pkg/notify/policy/defaults.go   | 42 +++++++++++++++++++++++++++++++++
 2 files changed, 48 insertions(+), 6 deletions(-)

diff --git a/pkg/notify/models/subscriber.go b/pkg/notify/models/subscriber.go
index 4e0598f2ab..16fef33a16 100644
--- a/pkg/notify/models/subscriber.go
+++ b/pkg/notify/models/subscriber.go
@@ -162,8 +162,8 @@ func (sm *SSubscriberManager) ValidateCreateData(ctx context.Context, userCred m
 		input.ResourceAttributionId = tenant.Id
 		input.ResourceAttributionName = tenant.Name
 	}
-	if input.Scope == sDomain && domainId != userCred.GetDomainId() {
-		return input, httperrors.NewForbiddenError("domain %s admin can't create subscriber for domain %s", userCred.GetDomainId(), domainId)
+	if input.Scope == sDomain && domainId != userCred.GetProjectDomainId() {
+		return input, httperrors.NewForbiddenError("domain %s admin can't create subscriber for domain %s", userCred.GetProjectDomainId(), domainId)
 	}
 
 	var checkQuery *sqlchemy.SQuery
@@ -263,7 +263,7 @@ func (s *SSubscriber) PerformChange(ctx context.Context, userCred mcclient.Token
 		if !db.IsDomainAllowUpdate(userCred, s) {
 			return nil, httperrors.NewForbiddenError("")
 		}
-		if s.DomainId != userCred.GetDomainId() {
+		if s.DomainId != userCred.GetProjectDomainId() {
 			return nil, httperrors.NewForbiddenError("")
 		}
 	}
@@ -314,11 +314,11 @@ func (sm *SSubscriberManager) ListItemFilter(ctx context.Context, q *sqlchemy.SQ
 			return nil, httperrors.NewForbiddenError("")
 		}
 	case sDomain:
-		allow := db.IsAdminAllowList(userCred, sm)
+		allow := db.IsDomainAllowList(userCred, sm)
 		if !allow {
 			return nil, httperrors.NewForbiddenError("")
 		}
-		q = q.Equals("domain_id", userCred.GetDomainId())
+		q = q.Equals("domain_id", userCred.GetProjectDomainId())
 	default:
 		return nil, httperrors.NewInputParameterError("unkown scope %s", input.Scope)
 	}
@@ -375,7 +375,7 @@ func (s *SSubscriber) CustomizeDelete(ctx context.Context, userCred mcclient.Tok
 		if !db.IsDomainAllowDelete(userCred, s) {
 			return httperrors.NewForbiddenError("")
 		}
-		if s.DomainId != userCred.GetDomainId() {
+		if s.DomainId != userCred.GetProjectDomainId() {
 			return httperrors.NewForbiddenError("")
 		}
 	}
diff --git a/pkg/notify/policy/defaults.go b/pkg/notify/policy/defaults.go
index e2d4bb0fa8..f3e5bb3dfd 100644
--- a/pkg/notify/policy/defaults.go
+++ b/pkg/notify/policy/defaults.go
@@ -91,6 +91,48 @@ var (
 				},
 			},
 		},
+		{
+			Auth:  true,
+			Scope: rbacutils.ScopeSystem,
+			Rules: []rbacutils.SRbacRule{
+				{
+					Service:  api.SERVICE_TYPE,
+					Resource: "subscribers",
+					Action:   PolicyActionGet,
+					Result:   rbacutils.Allow,
+				},
+				{
+					Service:  api.SERVICE_TYPE,
+					Resource: "subscribers",
+					Action:   PolicyActionList,
+					Result:   rbacutils.Allow,
+				},
+				{
+					Service:  api.SERVICE_TYPE,
+					Resource: "subscribers",
+					Action:   PolicyActionCreate,
+					Result:   rbacutils.Allow,
+				},
+				{
+					Service:  api.SERVICE_TYPE,
+					Resource: "subscribers",
+					Action:   PolicyActionUpdate,
+					Result:   rbacutils.Allow,
+				},
+				{
+					Service:  api.SERVICE_TYPE,
+					Resource: "subscribers",
+					Action:   PolicyActionDelete,
+					Result:   rbacutils.Allow,
+				},
+				{
+					Service:  api.SERVICE_TYPE,
+					Resource: "subscribers",
+					Action:   PolicyActionPerform,
+					Result:   rbacutils.Allow,
+				},
+			},
+		},
 	}
 )