policyManager增加IsAdminCapable接口

cmd/climc/shell/treenodes.go

@@ -158,13 +158,13 @@ func init() {
 		printObject(result)
 		return nil
 	})
-	
+
 	/**
 	 * 修改服务树节点的项目类型
 	 */
 	type ServiceTreeNodeChangeProjectTypeOptions struct {
-		PROJECTID     string `help:"ID of project"`
-		PROJECTTYPE   string `help:"TYPE of project" choices:"CreateNewProject|RelatedExisting"`
+		PROJECTID   string `help:"ID of project"`
+		PROJECTTYPE string `help:"TYPE of project" choices:"CreateNewProject|RelatedExisting"`
 	}
 	R(&ServiceTreeNodeChangeProjectTypeOptions{}, "servicetree-node-change-project-type", "servicetree-node-change-project-type", func(s *mcclient.ClientSession, args *ServiceTreeNodeChangeProjectTypeOptions) error {
 		params := jsonutils.NewDict()

pkg/cloudcommon/database.go

@@ -6,8 +6,8 @@ import (
 	"yunion.io/x/log"
 	"yunion.io/x/sqlchemy"
 
-	"yunion.io/x/onecloud/pkg/cloudcommon/db/lockman"
 	"yunion.io/x/onecloud/pkg/cloudcommon/consts"
+	"yunion.io/x/onecloud/pkg/cloudcommon/db/lockman"
 )
 
 func InitDB(options *DBOptions) {

pkg/cloudcommon/options.go

@@ -29,7 +29,7 @@ type Options struct {
 	AuthTokenCacheSize uint32   `help:"Auth token Cache Size" default:"2048"`
 	TempPath           string   `help:"Path for store temp file, at least 40G space" default:"/opt/yunion/tmp"`
 
-	DebugClient  bool     `help:"Switch on/off mcclient debugs" default:"false"`
+	DebugClient bool `help:"Switch on/off mcclient debugs" default:"false"`
 
 	ApplicationID      string `help:"Application ID"`
 	RequestWorkerCount int    `default:"4" help:"Request worker thread count, default is 4"`

pkg/cloudcommon/policy/policy.go

@@ -10,6 +10,7 @@ import (
 	"yunion.io/x/onecloud/pkg/mcclient"
 	"yunion.io/x/onecloud/pkg/mcclient/auth"
 	"yunion.io/x/onecloud/pkg/mcclient/modules"
+	"yunion.io/x/onecloud/pkg/util/conditionparser"
 	"yunion.io/x/onecloud/pkg/util/rbacutils"
 )
 
@@ -143,7 +144,7 @@ func (manager *SPolicyManager) Allow(isAdmin bool, userCred mcclient.TokenCreden
 		return false
 	}
 	userCredJson := userCred.ToJson()
-	log.Debugf("%s", userCredJson)
+	// log.Debugf("%s", userCredJson)
 	for _, p := range policies {
 		if p.Allow(userCredJson, service, resource, action, extra...) {
 			return true
@@ -206,3 +207,14 @@ func (manager *SPolicyManager) ExplainRpc(userCred mcclient.TokenCredential, par
 	}
 	return ret, nil
 }
+
+func (manager *SPolicyManager) IsAdminCapable(userCred mcclient.TokenCredential) bool {
+	userCredJson := userCred.ToJson()
+	for _, p := range manager.adminPolicies {
+		match, _ := conditionparser.Eval(p.Condition, userCredJson)
+		if match {
+			return true
+		}
+	}
+	return false
+}