From 45ddeaf084bf9b68839878a292cfc505f7173478 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E5=B1=88=E8=BD=A9?= Date: Fri, 30 Nov 2018 16:59:24 +0800 Subject: [PATCH 01/15] =?UTF-8?q?=E8=A1=A5=E5=85=85=E8=85=BE=E8=AE=AF?= =?UTF-8?q?=E4=BA=91webconsole?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- pkg/util/qcloud/instance.go | 2 +- pkg/webconsole/handlers.go | 2 +- pkg/webconsole/session/remote_console.go | 21 +++++++++++++++++++-- 3 files changed, 21 insertions(+), 4 deletions(-) diff --git a/pkg/util/qcloud/instance.go b/pkg/util/qcloud/instance.go index 233c5a3c8d..c4eba2cf52 100644 --- a/pkg/util/qcloud/instance.go +++ b/pkg/util/qcloud/instance.go @@ -364,7 +364,7 @@ func (self *SInstance) GetVNCInfo() (jsonutils.JSONObject, error) { return nil, err } ret := jsonutils.NewDict() - ret.Add(jsonutils.NewString("https://img.qcloud.com/qcloud/app/active_vnc/index.html?InstanceVncUrl="+url), "url") + ret.Add(jsonutils.NewString(url), "url") ret.Add(jsonutils.NewString("qcloud"), "protocol") ret.Add(jsonutils.NewString(self.InstanceId), "instance_id") return ret, nil diff --git a/pkg/webconsole/handlers.go b/pkg/webconsole/handlers.go index 2f0ed8c05a..37b2c47071 100644 --- a/pkg/webconsole/handlers.go +++ b/pkg/webconsole/handlers.go @@ -194,7 +194,7 @@ func handleServerRemoteConsole(ctx context.Context, w http.ResponseWriter, r *ht return } switch info.Protocol { - case session.ALIYUN: + case session.ALIYUN, session.QCLOUD: responsePublicCloudConsole(info, w) case session.VNC, session.SPICE, session.WMKS: handleDataSession(info, w) diff --git a/pkg/webconsole/session/remote_console.go b/pkg/webconsole/session/remote_console.go index ae211cc4ce..985d2a2fef 100644 --- a/pkg/webconsole/session/remote_console.go +++ b/pkg/webconsole/session/remote_console.go @@ -12,6 +12,7 @@ import ( const ( VNC = "vnc" ALIYUN = "aliyun" + QCLOUD = "qcloud" SPICE = "spice" WMKS = "wmks" ) @@ -74,10 +75,26 @@ func (info *RemoteConsoleInfo) ShowInfo() string { } func (info *RemoteConsoleInfo) GetConnectParams() (string, error) { - if info.Protocol != ALIYUN { - return "", fmt.Errorf("Can't convert protocol %s to connect params", info.Protocol) + if info.Protocol == ALIYUN { + return info.getAliyunUrl() } + if info.Protocol == QCLOUD { + return info.getQcloudUrl() + } + + return "", fmt.Errorf("Can't convert protocol %s to connect params", info.Protocol) +} + +func (info *RemoteConsoleInfo) getQcloudUrl() (string, error) { + base := "https://img.qcloud.com/qcloud/app/active_vnc/index.html" + params := url.Values{ + "InstanceVncUrl": {info.Url}, + } + return fmt.Sprintf("%s?%s", base, params.Encode()), nil +} + +func (info *RemoteConsoleInfo) getAliyunUrl() (string, error) { isWindows := "False" if info.OsName == "Windows" { isWindows = "True" From 511de80349281b5ad40b038c5dfdf36e3fadc078 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E5=B1=88=E8=BD=A9?= Date: Fri, 30 Nov 2018 17:15:46 +0800 Subject: [PATCH 02/15] =?UTF-8?q?=E7=A3=81=E7=9B=98=E5=90=8D=E7=A7=B0?= =?UTF-8?q?=E4=B8=BA=E6=9C=AA=E5=91=BD=E5=90=8D=E6=97=B6=E4=BD=BF=E7=94=A8?= =?UTF-8?q?=E7=A3=81=E7=9B=98ID?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- pkg/util/qcloud/disk.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pkg/util/qcloud/disk.go b/pkg/util/qcloud/disk.go index 33884aaa78..527c23d514 100644 --- a/pkg/util/qcloud/disk.go +++ b/pkg/util/qcloud/disk.go @@ -178,7 +178,7 @@ func (self *SDisk) Resize(size int64) error { } func (self *SDisk) GetName() string { - if len(self.DiskName) > 0 { + if len(self.DiskName) > 0 && self.DiskName != "未命名" { return self.DiskName } return self.DiskId From d15aa96f861fd6f388c6a26f9b94c1d2f90feaf8 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E5=B1=88=E8=BD=A9?= Date: Fri, 30 Nov 2018 17:29:54 +0800 Subject: [PATCH 03/15] =?UTF-8?q?=E4=BF=AE=E5=A4=8D=E5=90=8C=E6=AD=A5?= =?UTF-8?q?=E8=A7=84=E5=88=99=E7=BC=BA=E5=A4=B1=E9=97=AE=E9=A2=98?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- pkg/util/qcloud/instance.go | 5 ++++- pkg/util/qcloud/securitygroup.go | 4 ++-- 2 files changed, 6 insertions(+), 3 deletions(-) diff --git a/pkg/util/qcloud/instance.go b/pkg/util/qcloud/instance.go index c4eba2cf52..65375440c8 100644 --- a/pkg/util/qcloud/instance.go +++ b/pkg/util/qcloud/instance.go @@ -162,7 +162,10 @@ func (self *SInstance) GetId() string { } func (self *SInstance) GetName() string { - return self.InstanceName + if len(self.InstanceName) > 0 && self.InstanceName != "未命名" { + return self.InstanceName + } + return self.InstanceId } func (self *SInstance) GetGlobalId() string { diff --git a/pkg/util/qcloud/securitygroup.go b/pkg/util/qcloud/securitygroup.go index 9e977adb8a..ad31faf336 100644 --- a/pkg/util/qcloud/securitygroup.go +++ b/pkg/util/qcloud/securitygroup.go @@ -264,8 +264,8 @@ func (self *SSecurityGroup) GetRules() ([]secrules.SecurityRule, error) { secgroup.SecurityGroupPolicySet.Ingress[i].direction = "in" } originRules := []SecurityGroupPolicy{} - originRules = append(secgroup.SecurityGroupPolicySet.Egress) - originRules = append(secgroup.SecurityGroupPolicySet.Ingress) + originRules = append(originRules, secgroup.SecurityGroupPolicySet.Egress...) + originRules = append(originRules, secgroup.SecurityGroupPolicySet.Ingress...) sort.Sort(SecurityGroupRuleSet(originRules)) rules := []secrules.SecurityRule{} priority := 100 From 8e4c1e1672f4d4aa38cf221892888c95bc93d9f2 Mon Sep 17 00:00:00 2001 From: Zexi Li Date: Fri, 30 Nov 2018 18:15:25 +0800 Subject: [PATCH 04/15] climc: k8s release rollback --- cmd/climc/shell/k8s/releases.go | 18 +++++++++++++++++ pkg/mcclient/options/k8s/release.go | 30 +++++++++++++++++++++++++++++ 2 files changed, 48 insertions(+) diff --git a/cmd/climc/shell/k8s/releases.go b/cmd/climc/shell/k8s/releases.go index eaa4e41652..e5480029fa 100644 --- a/cmd/climc/shell/k8s/releases.go +++ b/cmd/climc/shell/k8s/releases.go @@ -66,4 +66,22 @@ func initRelease() { _, err := k8s.Releases.Delete(s, args.NAME, args.Params()) return err }) + + R(&o.ReleaseHistoryOptions{}, cmdN("history"), "Get release history", func(s *mcclient.ClientSession, args *o.ReleaseHistoryOptions) error { + ret, err := k8s.Releases.GetSpecific(s, args.NAME, "history", args.Params()) + if err != nil { + return err + } + printObjectYAML(ret) + return nil + }) + + R(&o.ReleaseRollbackOptions{}, cmdN("rollback"), "Rollback release by history revision number", func(s *mcclient.ClientSession, args *o.ReleaseRollbackOptions) error { + ret, err := k8s.Releases.PerformAction(s, args.NAME, "rollback", args.Params()) + if err != nil { + return err + } + printObjectYAML(ret) + return nil + }) } diff --git a/pkg/mcclient/options/k8s/release.go b/pkg/mcclient/options/k8s/release.go index d6714a8216..2663e6ee57 100644 --- a/pkg/mcclient/options/k8s/release.go +++ b/pkg/mcclient/options/k8s/release.go @@ -128,3 +128,33 @@ type ReleaseDeleteOptions struct { ClusterBaseOptions NAME string `help:"Release instance name"` } + +type ReleaseHistoryOptions struct { + ClusterBaseOptions + NAME string `help:"Release instance name"` + Max int64 `help:"History limit size"` +} + +func (o ReleaseHistoryOptions) Params() *jsonutils.JSONDict { + params := o.ClusterBaseOptions.Params() + if o.Max >= 1 { + params.Add(jsonutils.NewInt(o.Max), "max") + } + return params +} + +type ReleaseRollbackOptions struct { + ClusterBaseOptions + NAME string `help:"Release instance name"` + REVISION int64 `help:"Release history revision number"` + Description string `help:"Release rollback description string"` +} + +func (o ReleaseRollbackOptions) Params() *jsonutils.JSONDict { + params := o.ClusterBaseOptions.Params() + params.Add(jsonutils.NewInt(o.REVISION), "revision") + if o.Description != "" { + params.Add(jsonutils.NewString(o.Description), "description") + } + return params +} From f905e01012f52654ad9e97c0110c2d28e489a83a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E5=B1=88=E8=BD=A9?= Date: Fri, 30 Nov 2018 20:22:17 +0800 Subject: [PATCH 05/15] =?UTF-8?q?=E5=90=8C=E6=AD=A5=E5=90=8C=E4=B8=80?= =?UTF-8?q?=E4=B8=AAsecgroupcache=E9=9C=80=E8=A6=81=E5=8A=A0=E9=94=81?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- pkg/compute/guestdrivers/azure.go | 5 ++ pkg/compute/guestdrivers/managedvirtual.go | 5 ++ pkg/compute/guestdrivers/qcloud.go | 68 ++++++++++++++++++++++ 3 files changed, 78 insertions(+) diff --git a/pkg/compute/guestdrivers/azure.go b/pkg/compute/guestdrivers/azure.go index d9e7a702e3..e7938829ec 100644 --- a/pkg/compute/guestdrivers/azure.go +++ b/pkg/compute/guestdrivers/azure.go @@ -17,6 +17,7 @@ import ( "yunion.io/x/jsonutils" "yunion.io/x/onecloud/pkg/cloudcommon/db" + "yunion.io/x/onecloud/pkg/cloudcommon/db/lockman" "yunion.io/x/onecloud/pkg/cloudcommon/db/taskman" "yunion.io/x/onecloud/pkg/compute/models" ) @@ -322,6 +323,10 @@ func (self *SAzureGuestDriver) RequestSyncConfigOnHost(ctx context.Context, gues if err != nil { return nil, err } + + lockman.LockRawObject(ctx, "secgroupcache", fmt.Sprintf("%s-%s", guest.SecgrpId, vpcID)) + defer lockman.ReleaseRawObject(ctx, "secgroupcache", fmt.Sprintf("%s-%s", guest.SecgrpId, vpcID)) + secgroupCache := models.SecurityGroupCacheManager.Register(ctx, task.GetUserCred(), guest.SecgrpId, vpcID, host.GetRegion().Id, host.ManagerId) if secgroupCache == nil { return nil, fmt.Errorf("failed to registor secgroupCache for secgroup: %s vpc: %s", guest.SecgrpId, vpcID) diff --git a/pkg/compute/guestdrivers/managedvirtual.go b/pkg/compute/guestdrivers/managedvirtual.go index 5c28bb5240..c1b5849274 100644 --- a/pkg/compute/guestdrivers/managedvirtual.go +++ b/pkg/compute/guestdrivers/managedvirtual.go @@ -10,6 +10,7 @@ import ( "yunion.io/x/pkg/util/compare" "yunion.io/x/pkg/util/secrules" + "yunion.io/x/onecloud/pkg/cloudcommon/db/lockman" "yunion.io/x/onecloud/pkg/cloudcommon/db/taskman" "yunion.io/x/onecloud/pkg/cloudprovider" "yunion.io/x/onecloud/pkg/compute/models" @@ -349,6 +350,10 @@ func (self *SManagedVirtualizedGuestDriver) RequestSyncConfigOnHost(ctx context. if err != nil { return nil, err } + + lockman.LockRawObject(ctx, "secgroupcache", fmt.Sprintf("%s-%s", guest.SecgrpId, vpcId)) + defer lockman.ReleaseRawObject(ctx, "secgroupcache", fmt.Sprintf("%s-%s", guest.SecgrpId, vpcId)) + secgroupCache := models.SecurityGroupCacheManager.Register(ctx, task.GetUserCred(), guest.SecgrpId, vpcId, host.GetRegion().Id, host.ManagerId) if secgroupCache == nil { return nil, fmt.Errorf("failed to registor secgroupCache for secgroup: %s vpc: %s", guest.SecgrpId, vpcId) diff --git a/pkg/compute/guestdrivers/qcloud.go b/pkg/compute/guestdrivers/qcloud.go index 64c5b5a47f..f2cb68b437 100644 --- a/pkg/compute/guestdrivers/qcloud.go +++ b/pkg/compute/guestdrivers/qcloud.go @@ -9,9 +9,11 @@ import ( "yunion.io/x/log" "yunion.io/x/onecloud/pkg/httperrors" "yunion.io/x/onecloud/pkg/mcclient" + "yunion.io/x/pkg/util/compare" "yunion.io/x/pkg/utils" "yunion.io/x/onecloud/pkg/cloudcommon/db" + "yunion.io/x/onecloud/pkg/cloudcommon/db/lockman" "yunion.io/x/onecloud/pkg/cloudcommon/db/taskman" "yunion.io/x/onecloud/pkg/cloudprovider" "yunion.io/x/onecloud/pkg/compute/models" @@ -348,6 +350,72 @@ func (self *SQcloudGuestDriver) OnGuestDeployTaskDataReceived(ctx context.Contex return nil } +func (self *SQcloudGuestDriver) RequestSyncConfigOnHost(ctx context.Context, guest *models.SGuest, host *models.SHost, task taskman.ITask) error { + taskman.LocalTaskRun(task, func() (jsonutils.JSONObject, error) { + ihost, err := host.GetIHost() + if err != nil { + return nil, err + } + iVM, err := ihost.GetIVMById(guest.ExternalId) + if err != nil { + return nil, err + } + + if fwOnly, _ := task.GetParams().Bool("fw_only"); fwOnly { + iregion, err := host.GetIRegion() + if err != nil { + return nil, err + } + lockman.LockRawObject(ctx, "secgroupcache", fmt.Sprintf("%s-normal", guest.SecgrpId)) + defer lockman.ReleaseRawObject(ctx, "secgroupcache", fmt.Sprintf("%s-normal", guest.SecgrpId)) + + secgroupCache := models.SecurityGroupCacheManager.Register(ctx, task.GetUserCred(), guest.SecgrpId, "normal", host.GetRegion().Id, host.ManagerId) + if secgroupCache == nil { + return nil, fmt.Errorf("failed to registor secgroupCache for secgroup: %s", guest.SecgrpId) + } + extID, err := iregion.SyncSecurityGroup(secgroupCache.ExternalId, "normal", guest.GetSecgroupName(), "", guest.GetSecRules()) + if err != nil { + return nil, err + } + if err = secgroupCache.SetExternalId(extID); err != nil { + return nil, err + } + return nil, iVM.AssignSecurityGroup(extID) + } + + iDisks, err := iVM.GetIDisks() + if err != nil { + return nil, err + } + disks := make([]models.SDisk, 0) + for _, guestdisk := range guest.GetDisks() { + disk := guestdisk.GetDisk() + disks = append(disks, *disk) + } + + added := make([]models.SDisk, 0) + commondb := make([]models.SDisk, 0) + commonext := make([]cloudprovider.ICloudDisk, 0) + removed := make([]cloudprovider.ICloudDisk, 0) + + if err := compare.CompareSets(disks, iDisks, &added, &commondb, &commonext, &removed); err != nil { + return nil, err + } + for _, disk := range removed { + if err := iVM.DetachDisk(disk.GetId()); err != nil { + return nil, err + } + } + for _, disk := range added { + if err := iVM.AttachDisk(disk.ExternalId); err != nil { + return nil, err + } + } + return nil, nil + }) + return nil +} + func (self *SQcloudGuestDriver) AllowReconfigGuest() bool { return true } From 1530ca8914b96b987685e48f3690ea667783eb19 Mon Sep 17 00:00:00 2001 From: wanyaoqi Date: Fri, 30 Nov 2018 20:30:10 +0800 Subject: [PATCH 06/15] add guest extra options --- cmd/climc/shell/servers.go | 30 +++++++++++++++++++++ pkg/compute/models/guest_actions.go | 42 +++++++++++++++++++++++++++++ 2 files changed, 72 insertions(+) diff --git a/cmd/climc/shell/servers.go b/cmd/climc/shell/servers.go index d6957bfb8e..6e978ed90f 100644 --- a/cmd/climc/shell/servers.go +++ b/cmd/climc/shell/servers.go @@ -467,4 +467,34 @@ func init() { printObject(result) return nil }) + type ServerAddExtraOption struct { + ID string `help:"ID or name of server"` + KEY string `help:"Option key"` + VALUE string `help:"Option value"` + } + R(&ServerAddExtraOption{}, "server-add-extra-options", "Add server extra options", func(s *mcclient.ClientSession, args *ServerAddExtraOption) error { + params := jsonutils.NewDict() + params.Add(jsonutils.NewString(args.KEY), "key") + params.Add(jsonutils.NewString(args.VALUE), "value") + result, err := modules.Servers.PerformAction(s, args.ID, "set-extra-option", params) + if err != nil { + return err + } + printObject(result) + return nil + }) + type ServerRemoveExtraOption struct { + ID string `help:"ID or name of server"` + KEY string `help:"Option key"` + } + R(&ServerRemoveExtraOption{}, "server-remove-extra-options", "Remove server extra options", func(s *mcclient.ClientSession, args *ServerRemoveExtraOption) error { + params := jsonutils.NewDict() + params.Add(jsonutils.NewString(args.KEY), "key") + result, err := modules.Servers.PerformAction(s, args.ID, "del-extra-option", params) + if err != nil { + return err + } + printObject(result) + return nil + }) } diff --git a/pkg/compute/models/guest_actions.go b/pkg/compute/models/guest_actions.go index 3174208e9b..e1585d8980 100644 --- a/pkg/compute/models/guest_actions.go +++ b/pkg/compute/models/guest_actions.go @@ -1571,3 +1571,45 @@ func (self *SGuest) PerformCreateEip(ctx context.Context, userCred mcclient.Toke return nil, nil } + +func (self *SGuest) AllowPerformSetExtraOption(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { + return userCred.IsSystemAdmin() +} + +func (self *SGuest) PerformSetExtraOption(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { + key, err := data.GetString("key") + if err != nil { + return nil, httperrors.NewBadRequestError("Option key required") + } + value, _ := data.GetString("value") + extraOptions := self.GetExtraOptions(userCred) + extraOptions.Set(key, jsonutils.NewString(value)) + return nil, self.SetExtraOptions(ctx, userCred, extraOptions) +} + +func (self *SGuest) GetExtraOptions(userCred mcclient.TokenCredential) *jsonutils.JSONDict { + options := self.GetMetadataJson("extra_options", userCred) + o, ok := options.(*jsonutils.JSONDict) + if ok { + return o + } + return jsonutils.NewDict() +} + +func (self *SGuest) SetExtraOptions(ctx context.Context, userCred mcclient.TokenCredential, extraOptions *jsonutils.JSONDict) error { + return self.SetMetadata(ctx, "extra_options", extraOptions, userCred) +} + +func (self *SGuest) AllowPerformDelExtraOption(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { + return userCred.IsSystemAdmin() +} + +func (self *SGuest) PerformDelExtraOption(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { + key, err := data.GetString("key") + if err != nil { + return nil, httperrors.NewBadRequestError("Option key required") + } + extraOptions := self.GetExtraOptions(userCred) + extraOptions.Remove(key) + return nil, self.SetExtraOptions(ctx, userCred, extraOptions) +} From 0f78dd1ffcb8c4fef3fd42324e5adf22eb8e911e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E5=B1=88=E8=BD=A9?= Date: Fri, 30 Nov 2018 20:40:59 +0800 Subject: [PATCH 07/15] =?UTF-8?q?=E5=A4=A7=E9=83=A8=E5=88=86=E5=85=AC?= =?UTF-8?q?=E6=9C=89=E4=BA=91=E4=B8=8D=E9=9C=80=E8=A6=81=E5=B0=86=E5=AE=89?= =?UTF-8?q?=E5=85=A8=E7=BB=84=E6=8B=86=E5=88=86=E4=B8=BA=E5=8D=95=E4=B8=AA?= =?UTF-8?q?=E5=8D=95=E4=B8=AA=E7=9A=84=E8=A7=84=E5=88=99?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- pkg/compute/models/secgrouprules.go | 4 ++++ pkg/compute/models/secgroups.go | 6 ++++-- 2 files changed, 8 insertions(+), 2 deletions(-) diff --git a/pkg/compute/models/secgrouprules.go b/pkg/compute/models/secgrouprules.go index fdb1f21fcc..86aaa19041 100644 --- a/pkg/compute/models/secgrouprules.go +++ b/pkg/compute/models/secgrouprules.go @@ -273,6 +273,10 @@ func (self *SSecurityGroupRule) String() string { return fields[0] + strings.Join(fields[1:], " ") } +func (self *SSecurityGroupRule) toRule() (*secrules.SecurityRule, error) { + return secrules.ParseSecurityRule(self.String()) +} + func (self *SSecurityGroupRule) SingleRules() ([]secrules.SecurityRule, error) { rules := make([]secrules.SecurityRule, 0) ruleStr := self.String() diff --git a/pkg/compute/models/secgroups.go b/pkg/compute/models/secgroups.go index 68fcd19623..003eab0727 100644 --- a/pkg/compute/models/secgroups.go +++ b/pkg/compute/models/secgroups.go @@ -116,11 +116,13 @@ func (self *SSecurityGroup) getSecurityRules(direction string) (rules []SSecurit func (self *SSecurityGroup) getSecRules(direction string) []secrules.SecurityRule { rules := make([]secrules.SecurityRule, 0) for _, _rule := range self.getSecurityRules(direction) { - singleRules, err := _rule.SingleRules() + //这里没必要拆分为单个单个的端口,到公有云那边适配 + rule, err := _rule.toRule() if err != nil { log.Errorf(err.Error()) + continue } - rules = append(rules, singleRules...) + rules = append(rules, *rule) } return rules } From bc02b3b433c56af54fee254bc6aec3c4fef019bb Mon Sep 17 00:00:00 2001 From: Qiu Jian Date: Fri, 30 Nov 2018 23:00:11 +0800 Subject: [PATCH 08/15] =?UTF-8?q?1.=20=E5=8F=96=E6=B6=88userCred.IsSystemA?= =?UTF-8?q?dmin()=EF=BC=8C=E5=9C=A8=E4=BD=BF=E7=94=A8policy=E7=9A=84?= =?UTF-8?q?=E5=BA=94=E7=94=A8=E4=B8=AD=EF=BC=8C=E9=80=9A=E8=BF=87userCred.?= =?UTF-8?q?IsAdminAllow=E5=88=A4=E6=96=AD=E6=98=AF=E5=90=A6=E6=98=AF?= =?UTF-8?q?=E7=AE=A1=E7=90=86=E5=91=98=E4=B8=94=E5=85=B7=E5=A4=87=E7=9B=B8?= =?UTF-8?q?=E5=BA=94=E7=9A=84=E6=9D=83=E9=99=90=E3=80=82=E8=8E=B7=E5=8F=96?= =?UTF-8?q?token=E6=97=B6=EF=BC=8C=E9=9C=80=E8=A6=81=E4=BC=A0=E5=85=A5poli?= =?UTF-8?q?cy.FilterPolicyCredential=EF=BC=8C=E5=B0=86=E6=99=AE=E9=80=9Aus?= =?UTF-8?q?erCred=E8=BD=AC=E6=8D=A2=E6=88=90=E6=94=AF=E6=8C=81rbac?= =?UTF-8?q?=E7=9A=84userCred=202.=20=E5=9C=A8=E5=BA=94=E7=94=A8=E5=90=AF?= =?UTF-8?q?=E5=8A=A8=E6=97=B6=E5=80=99=EF=BC=8C=E5=BF=85=E9=A1=BB=E8=AE=BE?= =?UTF-8?q?=E7=BD=AE=20SetServiceType=EF=BC=8C=E5=90=A6=E5=88=99=E9=80=80?= =?UTF-8?q?=E5=87=BA?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- pkg/cloudcommon/auth.go | 3 +- pkg/cloudcommon/db/db_dispatcher.go | 18 +-- pkg/cloudcommon/db/enabledstatusstandalone.go | 6 +- pkg/cloudcommon/db/interface.go | 4 +- pkg/cloudcommon/db/jointbase.go | 6 +- pkg/cloudcommon/db/metadata.go | 8 +- pkg/cloudcommon/db/modelbase.go | 8 +- pkg/cloudcommon/db/opslog.go | 6 +- pkg/cloudcommon/db/quotas/handler.go | 14 +- pkg/cloudcommon/db/sharablevirtual.go | 8 +- pkg/cloudcommon/db/standalone.go | 10 +- pkg/cloudcommon/db/statusstandalone.go | 4 +- pkg/cloudcommon/db/taskman/tasks.go | 6 +- pkg/cloudcommon/db/virtualjointbase.go | 12 +- pkg/cloudcommon/db/virtualresource.go | 26 ++-- pkg/cloudcommon/options.go | 4 + pkg/cloudcommon/policy/policy.go | 10 +- pkg/cloudcommon/policy/token.go | 145 ++++++++++++++++++ pkg/compute/capabilities/handler.go | 3 +- pkg/compute/models/baremetalagents.go | 10 +- pkg/compute/models/cachedimages.go | 4 +- pkg/compute/models/cloudaccounts.go | 10 +- pkg/compute/models/cloudproviders.go | 8 +- pkg/compute/models/cloudregions.go | 4 +- pkg/compute/models/disks.go | 16 +- pkg/compute/models/dnsrecords.go | 10 +- pkg/compute/models/dynamicschedtags.go | 4 +- pkg/compute/models/elasticips.go | 12 +- pkg/compute/models/guest_actions.go | 74 ++++----- pkg/compute/models/guests.go | 12 +- pkg/compute/models/helper.go | 4 +- pkg/compute/models/hostjoints.go | 16 +- pkg/compute/models/hosts.go | 57 ++++--- pkg/compute/models/inframanagers.go | 12 +- pkg/compute/models/isolated_devices.go | 6 +- pkg/compute/models/keypairs.go | 12 +- pkg/compute/models/loadbalanceracls.go | 4 +- pkg/compute/models/loadbalanceragents.go | 8 +- pkg/compute/models/loadbalancerbackends.go | 4 +- .../models/loadbalancerlistenerrules.go | 4 +- pkg/compute/models/loadbalancerlisteners.go | 4 +- pkg/compute/models/loadbalancers.go | 4 +- pkg/compute/models/networks.go | 19 ++- pkg/compute/models/reservedips.go | 4 +- pkg/compute/models/schedpolicies.go | 4 +- pkg/compute/models/secgrouprules.go | 6 +- pkg/compute/models/snapshots.go | 14 +- pkg/compute/models/storagecachedimages.go | 4 +- pkg/compute/models/storagecaches.go | 6 +- pkg/compute/models/storages.go | 6 +- pkg/compute/models/vpcs.go | 4 +- pkg/compute/specs/handler.go | 3 +- pkg/compute/sshkeys/handler.go | 10 +- pkg/compute/usages/handler.go | 4 +- pkg/mcclient/auth/middleware.go | 8 +- pkg/mcclient/modules/base.go | 2 +- pkg/mcclient/session.go | 5 +- pkg/mcclient/token.go | 5 +- pkg/mcclient/token2.go | 6 +- pkg/mcclient/token3.go | 6 +- pkg/mcclient/tokensimple.go | 6 +- pkg/webconsole/handlers.go | 5 +- pkg/webconsole/service/service.go | 3 + pkg/yunionconf/models/parameters.go | 16 +- pkg/yunionconf/service/service.go | 2 + 65 files changed, 516 insertions(+), 232 deletions(-) create mode 100644 pkg/cloudcommon/policy/token.go diff --git a/pkg/cloudcommon/auth.go b/pkg/cloudcommon/auth.go index c9661ce977..fab8fa949c 100644 --- a/pkg/cloudcommon/auth.go +++ b/pkg/cloudcommon/auth.go @@ -3,13 +3,14 @@ package cloudcommon import ( "fmt" "os" - "time" + "yunion.io/x/onecloud/pkg/cloudcommon/policy" "yunion.io/x/onecloud/pkg/mcclient/auth" ) func InitAuth(options *Options, authComplete auth.AuthCompletedCallback) { + if len(options.AuthURL) == 0 { fmt.Println("Missing AuthURL") os.Exit(1) diff --git a/pkg/cloudcommon/db/db_dispatcher.go b/pkg/cloudcommon/db/db_dispatcher.go index c2d72e15f2..70ce2f8c91 100644 --- a/pkg/cloudcommon/db/db_dispatcher.go +++ b/pkg/cloudcommon/db/db_dispatcher.go @@ -65,7 +65,7 @@ func (dispatcher *DBModelDispatcher) Filter(f appsrv.FilterHandler) appsrv.Filte } func fetchUserCredential(ctx context.Context) mcclient.TokenCredential { - token := auth.FetchUserCredential(ctx) + token := auth.FetchUserCredential(ctx, policy.FilterPolicyCredential) if token == nil && !consts.IsRbacEnabled() { log.Fatalf("user token credential not found?") } @@ -113,7 +113,7 @@ func listFields(manager IModelManager, userCred mcclient.TokenCredential) []stri if !utils.IsInStringArray(list, []string{"user", "admin", ""}) { log.Warningf("Invalid list value %s for field %s", list, col.Name()) } - if list == "user" || (list == "admin" && userCred.IsSystemAdmin()) { + if list == "user" || (list == "admin" && userCred.IsAdminAllow(consts.GetServiceType(), manager.KeywordPlural(), policy.PolicyActionList)) { ret = append(ret, col.Name()) } } @@ -127,7 +127,7 @@ func searchFields(manager IModelManager, userCred mcclient.TokenCredential) []st tags := col.Tags() list := tags["list"] search := tags["search"] - if list == "user" || search == "user" || ((list == "admin" || search == "admin") && userCred.IsSystemAdmin()) { + if list == "user" || search == "user" || ((list == "admin" || search == "admin") && userCred.IsAdminAllow(consts.GetServiceType(), manager.KeywordPlural(), policy.PolicyActionList)) { ret = append(ret, col.Name()) } } @@ -140,7 +140,7 @@ func getDetailFields(manager IModelManager, userCred mcclient.TokenCredential) [ tags := col.Tags() list := tags["list"] get := tags["get"] - if list == "user" || get == "user" || ((list == "admin" || get == "admin") && userCred.IsSystemAdmin()) { + if list == "user" || get == "user" || ((list == "admin" || get == "admin") && userCred.IsAdminAllow(consts.GetServiceType(), manager.KeywordPlural(), policy.PolicyActionGet)) { ret = append(ret, col.Name()) } } @@ -152,7 +152,7 @@ func createRequireFields(manager IModelManager, userCred mcclient.TokenCredentia for _, col := range manager.TableSpec().Columns() { tags := col.Tags() create, _ := tags["create"] - if create == "required" || (create == "admin_required" && userCred.IsSystemAdmin()) { + if create == "required" || (create == "admin_required" && userCred.IsAdminAllow(consts.GetServiceType(), manager.KeywordPlural(), policy.PolicyActionCreate)) { ret = append(ret, col.Name()) } } @@ -166,7 +166,7 @@ func createFields(manager IModelManager, userCred mcclient.TokenCredential) []st tags := col.Tags() create, _ := tags["create"] update := tags["update"] - if update == "user" || (update == "admin" && userCred.IsSystemAdmin()) || create == "required" || create == "optional" || ((create == "admin_required" || create == "admin_optional") && userCred.IsSystemAdmin()) { + if update == "user" || (update == "admin" && userCred.IsAdminAllow(consts.GetServiceType(), manager.KeywordPlural(), policy.PolicyActionCreate)) || create == "required" || create == "optional" || ((create == "admin_required" || create == "admin_optional") && userCred.IsAdminAllow(consts.GetServiceType(), manager.KeywordPlural(), policy.PolicyActionCreate)) { ret = append(ret, col.Name()) } } @@ -179,7 +179,7 @@ func updateFields(manager IModelManager, userCred mcclient.TokenCredential) []st for _, col := range manager.TableSpec().Columns() { tags := col.Tags() update := tags["update"] - if update == "user" || (update == "admin" && userCred.IsSystemAdmin()) { + if update == "user" || (update == "admin" && userCred.IsAdminAllow(consts.GetServiceType(), manager.KeywordPlural(), policy.PolicyActionUpdate)) { ret = append(ret, col.Name()) } } @@ -315,7 +315,7 @@ func query2List(manager IModelManager, ctx context.Context, userCred mcclient.To } listF := listFields(manager, userCred) fieldFilter := jsonutils.GetQueryStringArray(query, "field") - if len(fieldFilter) > 0 && userCred.IsSystemAdmin() { + if len(fieldFilter) > 0 && userCred.IsAdminAllow(consts.GetServiceType(), manager.KeywordPlural(), policy.PolicyActionList) { // only sysadmin can specify list Fields listF = fieldFilter } @@ -735,7 +735,7 @@ func fetchOwnerProjectId(ctx context.Context, manager IModelManager, userCred mc isAllow = true } } else { - isAllow = userCred.IsSystemAdmin() + isAllow = userCred.IsAdminAllow(consts.GetServiceType(), policy.PolicyDelegation, "") } if !isAllow { return "", httperrors.NewForbiddenError("Delegation not allowed") diff --git a/pkg/cloudcommon/db/enabledstatusstandalone.go b/pkg/cloudcommon/db/enabledstatusstandalone.go index 1528c09200..ad6da79d6f 100644 --- a/pkg/cloudcommon/db/enabledstatusstandalone.go +++ b/pkg/cloudcommon/db/enabledstatusstandalone.go @@ -5,6 +5,8 @@ import ( "yunion.io/x/jsonutils" "yunion.io/x/log" + "yunion.io/x/onecloud/pkg/cloudcommon/consts" + "yunion.io/x/onecloud/pkg/cloudcommon/policy" "yunion.io/x/onecloud/pkg/mcclient" ) @@ -23,7 +25,7 @@ func NewEnabledStatusStandaloneResourceBaseManager(dt interface{}, tableName str } func (self *SEnabledStatusStandaloneResourceBase) AllowPerformEnable(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return userCred.IsAdminAllow(consts.GetServiceType(), self.GetModelManager().KeywordPlural(), policy.PolicyActionPerform, "enable") } func (self *SEnabledStatusStandaloneResourceBase) PerformEnable(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -42,7 +44,7 @@ func (self *SEnabledStatusStandaloneResourceBase) PerformEnable(ctx context.Cont } func (self *SEnabledStatusStandaloneResourceBase) AllowPerformDisable(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return userCred.IsAdminAllow(consts.GetServiceType(), self.GetModelManager().KeywordPlural(), policy.PolicyActionPerform, "disable") } func (self *SEnabledStatusStandaloneResourceBase) PerformDisable(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { diff --git a/pkg/cloudcommon/db/interface.go b/pkg/cloudcommon/db/interface.go index e63c2ac02e..b42c522bb9 100644 --- a/pkg/cloudcommon/db/interface.go +++ b/pkg/cloudcommon/db/interface.go @@ -69,6 +69,8 @@ type IModel interface { GetName() string + KeywordPlural() string + GetModelManager() IModelManager SetModelManager(IModelManager) @@ -164,7 +166,7 @@ type IVirtualModel interface { IStandaloneModel IsOwner(userCred mcclient.TokenCredential) bool - IsAdmin(userCred mcclient.TokenCredential) bool + // IsAdmin(userCred mcclient.TokenCredential) bool } type ISharableVirtualModelManager interface { diff --git a/pkg/cloudcommon/db/jointbase.go b/pkg/cloudcommon/db/jointbase.go index 6dcf2e3c97..14094ae5e4 100644 --- a/pkg/cloudcommon/db/jointbase.go +++ b/pkg/cloudcommon/db/jointbase.go @@ -8,6 +8,8 @@ import ( "yunion.io/x/jsonutils" "yunion.io/x/log" + "yunion.io/x/onecloud/pkg/cloudcommon/consts" + "yunion.io/x/onecloud/pkg/cloudcommon/policy" "yunion.io/x/onecloud/pkg/mcclient" "yunion.io/x/pkg/util/reflectutils" "yunion.io/x/sqlchemy" @@ -191,7 +193,7 @@ func (self *SJointResourceBase) AllowGetJointDetails(ctx context.Context, userCr master := item.Master() switch master.(type) { case IVirtualModel: - return master.(IVirtualModel).IsOwner(userCred) + return master.(IVirtualModel).IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), master.KeywordPlural(), policy.PolicyActionGet) default: // case item implemented customized AllowGetDetails, eg hostjoints return item.AllowGetDetails(ctx, userCred, query) } @@ -201,7 +203,7 @@ func (self *SJointResourceBase) AllowUpdateJointItem(ctx context.Context, userCr master := item.Master() switch master.(type) { case IVirtualModel: - return master.(IVirtualModel).IsOwner(userCred) + return master.(IVirtualModel).IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), master.KeywordPlural(), policy.PolicyActionUpdate) default: // case item implemented customized AllowGetDetails, eg hostjoints return item.AllowUpdateItem(ctx, userCred) } diff --git a/pkg/cloudcommon/db/metadata.go b/pkg/cloudcommon/db/metadata.go index 5c0c98206d..88463b21f9 100644 --- a/pkg/cloudcommon/db/metadata.go +++ b/pkg/cloudcommon/db/metadata.go @@ -11,7 +11,9 @@ import ( "yunion.io/x/onecloud/pkg/mcclient" "yunion.io/x/pkg/util/stringutils" + "yunion.io/x/onecloud/pkg/cloudcommon/consts" "yunion.io/x/onecloud/pkg/cloudcommon/db/lockman" + "yunion.io/x/onecloud/pkg/cloudcommon/policy" ) const ( @@ -65,7 +67,7 @@ raise Exception('get_object_idstr: failed to generate obj ID') return idstr */ func (manager *SMetadataManager) GetStringValue(model IModel, key string, userCred mcclient.TokenCredential) string { - if strings.HasPrefix(key, SYSTEM_ADMIN_PREFIX) && (userCred == nil || !userCred.IsSystemAdmin()) { + if strings.HasPrefix(key, SYSTEM_ADMIN_PREFIX) && (userCred == nil || !userCred.IsAdminAllow(consts.GetServiceType(), model.GetModelManager().KeywordPlural(), policy.PolicyActionGet, "metadata")) { return "" } idStr := GetObjectIdstr(model) @@ -78,7 +80,7 @@ func (manager *SMetadataManager) GetStringValue(model IModel, key string, userCr } func (manager *SMetadataManager) GetJsonValue(model IModel, key string, userCred mcclient.TokenCredential) jsonutils.JSONObject { - if strings.HasPrefix(key, SYSTEM_ADMIN_PREFIX) && (userCred == nil || !userCred.IsSystemAdmin()) { + if strings.HasPrefix(key, SYSTEM_ADMIN_PREFIX) && (userCred == nil || !userCred.IsAdminAllow(consts.GetServiceType(), model.GetModelManager().KeywordPlural(), policy.PolicyActionGet, "metadata")) { return nil } idStr := GetObjectIdstr(model) @@ -194,7 +196,7 @@ func (manager *SMetadataManager) GetAll(obj IModel, keys []string, userCred mccl for _, rec := range records { if len(rec.Value) > 0 { if strings.HasPrefix(rec.Key, SYSTEM_ADMIN_PREFIX) { - if userCred != nil && userCred.IsSystemAdmin() { + if userCred != nil && userCred.IsAdminAllow(consts.GetServiceType(), obj.GetModelManager().KeywordPlural(), policy.PolicyActionGet, "metadata") { key := rec.Key[len(SYSTEM_ADMIN_PREFIX):] ret[key] = rec.Value } diff --git a/pkg/cloudcommon/db/modelbase.go b/pkg/cloudcommon/db/modelbase.go index d4c9a704a9..bd5db2cdb8 100644 --- a/pkg/cloudcommon/db/modelbase.go +++ b/pkg/cloudcommon/db/modelbase.go @@ -6,6 +6,8 @@ import ( "fmt" "yunion.io/x/jsonutils" + "yunion.io/x/onecloud/pkg/cloudcommon/consts" + "yunion.io/x/onecloud/pkg/cloudcommon/policy" "yunion.io/x/onecloud/pkg/mcclient" "yunion.io/x/sqlchemy" ) @@ -151,7 +153,7 @@ func (manager *SModelBaseManager) PerformAction(ctx context.Context, userCred mc } func (manager *SModelBaseManager) AllowPerformCheckCreateData(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return userCred.IsAdminAllow(consts.GetServiceType(), manager.KeywordPlural(), policy.PolicyActionPerform, "check-create-data") } func (manager *SModelBaseManager) InitializeData() error { @@ -178,6 +180,10 @@ func (model *SModelBase) Keyword() string { return model.GetModelManager().Keyword() } +func (model *SModelBase) KeywordPlural() string { + return model.GetModelManager().KeywordPlural() +} + func (model *SModelBase) GetName() string { return "" } diff --git a/pkg/cloudcommon/db/opslog.go b/pkg/cloudcommon/db/opslog.go index 35ef9c13e2..456c617697 100644 --- a/pkg/cloudcommon/db/opslog.go +++ b/pkg/cloudcommon/db/opslog.go @@ -9,6 +9,8 @@ import ( "yunion.io/x/jsonutils" "yunion.io/x/log" + "yunion.io/x/onecloud/pkg/cloudcommon/consts" + "yunion.io/x/onecloud/pkg/cloudcommon/policy" "yunion.io/x/onecloud/pkg/mcclient" "yunion.io/x/onecloud/pkg/util/logclient" "yunion.io/x/pkg/util/stringutils" @@ -293,7 +295,7 @@ func (manager *SOpsLogManager) ListItemFilter(ctx context.Context, q *sqlchemy.S queryDict.RemoveIgnoreCase("action") q = q.Filter(sqlchemy.In(q.Field("action"), action)) } - if !userCred.IsSystemAdmin() { + if !userCred.IsAdminAllow(consts.GetServiceType(), manager.KeywordPlural(), policy.PolicyActionList) { q = q.Filter(sqlchemy.OR(sqlchemy.AND(sqlchemy.IsNotNull(q.Field("owner_tenant_id")), sqlchemy.Equals(q.Field("owner_tenant_id"), userCred.GetProjectId())), sqlchemy.Equals(q.Field("tenant_id"), userCred.GetProjectId()))) } since, _ := query.GetTime("since") @@ -324,7 +326,7 @@ func (manager *SOpsLogManager) AllowCreateItem(ctx context.Context, userCred mcc } func (self *SOpsLog) AllowGetDetails(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() || userCred.GetProjectId() == self.ProjectId || userCred.GetProjectId() == self.OwnerProjectId + return userCred.IsAdminAllow(consts.GetServiceType(), self.GetModelManager().KeywordPlural(), policy.PolicyActionGet) || userCred.GetProjectId() == self.ProjectId || userCred.GetProjectId() == self.OwnerProjectId } func (self *SOpsLog) AllowUpdateItem(ctx context.Context, userCred mcclient.TokenCredential) bool { diff --git a/pkg/cloudcommon/db/quotas/handler.go b/pkg/cloudcommon/db/quotas/handler.go index ed27a32b72..4729168e4f 100644 --- a/pkg/cloudcommon/db/quotas/handler.go +++ b/pkg/cloudcommon/db/quotas/handler.go @@ -72,7 +72,7 @@ func queryQuota(ctx context.Context, projectId string) (*jsonutils.JSONDict, err } func getQuotaHanlder(ctx context.Context, w http.ResponseWriter, r *http.Request) { - userCred := auth.FetchUserCredential(ctx) + userCred := auth.FetchUserCredential(ctx, policy.FilterPolicyCredential) params := appctx.AppContextParams(ctx) projectId := params[""] @@ -93,7 +93,7 @@ func getQuotaHanlder(ctx context.Context, w http.ResponseWriter, r *http.Request policy.PolicyDelegation, policy.PolicyActionGet) isAllow = result == rbacutils.AdminAllow } else { - isAllow = userCred.IsSystemAdmin() + isAllow = userCred.IsAdminAllow(consts.GetServiceType(), policy.PolicyDelegation, policy.PolicyActionGet) } if !isAllow { httperrors.ForbiddenError(w, "not allow to delegate query quota") @@ -133,14 +133,15 @@ func getQuotaHanlder(ctx context.Context, w http.ResponseWriter, r *http.Request } func setQuotaHanlder(ctx context.Context, w http.ResponseWriter, r *http.Request) { - userCred := auth.FetchUserCredential(ctx) + userCred := auth.FetchUserCredential(ctx, policy.FilterPolicyCredential) var isAllow bool if consts.IsRbacEnabled() { isAllow = policy.PolicyManager.Allow(true, userCred, consts.GetServiceType(), "quotas", policy.PolicyActionUpdate) == rbacutils.AdminAllow } else { - isAllow = userCred.IsSystemAdmin() + isAllow = userCred.IsAdminAllow(consts.GetServiceType(), + "quotas", policy.PolicyActionUpdate) } if !isAllow { httperrors.ForbiddenError(w, "not allow to set quota") @@ -196,14 +197,15 @@ func setQuotaHanlder(ctx context.Context, w http.ResponseWriter, r *http.Request } func checkQuotaHanlder(ctx context.Context, w http.ResponseWriter, r *http.Request) { - userCred := auth.FetchUserCredential(ctx) + userCred := auth.FetchUserCredential(ctx, policy.FilterPolicyCredential) isAllow := false if consts.IsRbacEnabled() { isAllow = policy.PolicyManager.Allow(true, userCred, consts.GetServiceType(), policy.PolicyDelegation, policy.PolicyActionGet) == rbacutils.AdminAllow } else { - isAllow = userCred.IsSystemAdmin() + isAllow = userCred.IsAdminAllow(consts.GetServiceType(), + policy.PolicyDelegation, policy.PolicyActionGet) } if !isAllow { httperrors.ForbiddenError(w, "not allow to delegate check quota") diff --git a/pkg/cloudcommon/db/sharablevirtual.go b/pkg/cloudcommon/db/sharablevirtual.go index 8d1cf2db5f..d8c78a98df 100644 --- a/pkg/cloudcommon/db/sharablevirtual.go +++ b/pkg/cloudcommon/db/sharablevirtual.go @@ -4,6 +4,8 @@ import ( "context" "yunion.io/x/jsonutils" + "yunion.io/x/onecloud/pkg/cloudcommon/consts" + "yunion.io/x/onecloud/pkg/cloudcommon/policy" "yunion.io/x/onecloud/pkg/mcclient" "yunion.io/x/sqlchemy" ) @@ -30,7 +32,7 @@ func (manager *SSharableVirtualResourceBaseManager) FilterByOwner(q *sqlchemy.SQ } func (model *SSharableVirtualResourceBase) AllowGetDetails(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { - return model.IsOwner(userCred) || model.IsPublic + return model.IsOwner(userCred) || model.IsPublic || userCred.IsAdminAllow(consts.GetServiceType(), model.KeywordPlural(), policy.PolicyActionGet) } func (model *SSharableVirtualResourceBase) IsSharable() bool { @@ -38,11 +40,11 @@ func (model *SSharableVirtualResourceBase) IsSharable() bool { } func (model *SSharableVirtualResourceBase) AllowPerformPublic(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return userCred.IsAdminAllow(consts.GetServiceType(), model.GetModelManager().KeywordPlural(), policy.PolicyActionPerform, "public") } func (model *SSharableVirtualResourceBase) AllowPerformPrivate(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return userCred.IsAdminAllow(consts.GetServiceType(), model.GetModelManager().KeywordPlural(), policy.PolicyActionPerform, "private") } func (model *SSharableVirtualResourceBase) PerformPublic(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { diff --git a/pkg/cloudcommon/db/standalone.go b/pkg/cloudcommon/db/standalone.go index d1fd803ae7..9d8d11f080 100644 --- a/pkg/cloudcommon/db/standalone.go +++ b/pkg/cloudcommon/db/standalone.go @@ -7,6 +7,8 @@ import ( "yunion.io/x/jsonutils" "yunion.io/x/log" + "yunion.io/x/onecloud/pkg/cloudcommon/consts" + "yunion.io/x/onecloud/pkg/cloudcommon/policy" "yunion.io/x/onecloud/pkg/httperrors" "yunion.io/x/onecloud/pkg/mcclient" "yunion.io/x/pkg/util/regutils" @@ -147,7 +149,7 @@ func (model *SStandaloneResourceBase) GetMetadataJson(key string, userCred mccli } func (model *SStandaloneResourceBase) SetMetadata(ctx context.Context, key string, value interface{}, userCred mcclient.TokenCredential) error { - if Metadata.IsSystemAdminKey(key) && !userCred.IsSystemAdmin() { + if Metadata.IsSystemAdminKey(key) && !userCred.IsAdminAllow(consts.GetServiceType(), model.GetModelManager().KeywordPlural(), policy.PolicyActionPerform, "metadata") { return httperrors.NewNotSufficientPrivilegeError("cannot set system key") } return Metadata.SetValue(ctx, model, key, value, userCred) @@ -155,7 +157,7 @@ func (model *SStandaloneResourceBase) SetMetadata(ctx context.Context, key strin func (model *SStandaloneResourceBase) SetAllMetadata(ctx context.Context, dictstore map[string]interface{}, userCred mcclient.TokenCredential) error { for k := range dictstore { - if Metadata.IsSystemAdminKey(k) && !userCred.IsSystemAdmin() { + if Metadata.IsSystemAdminKey(k) && !userCred.IsAdminAllow(consts.GetServiceType(), model.GetModelManager().KeywordPlural(), policy.PolicyActionPerform, "metadata") { return httperrors.NewNotSufficientPrivilegeError(fmt.Sprintf("not allow to set system key %s", k)) } } @@ -175,7 +177,7 @@ func (model *SStandaloneResourceBase) GetAllMetadata(userCred mcclient.TokenCred } func (model *SStandaloneResourceBase) AllowGetDetailsMetadata(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return userCred.IsAdminAllow(consts.GetServiceType(), model.GetModelManager().KeywordPlural(), policy.PolicyActionGet, "metadata") } func (model *SStandaloneResourceBase) GetDetailsMetadata(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -188,7 +190,7 @@ func (model *SStandaloneResourceBase) GetDetailsMetadata(ctx context.Context, us } func (model *SStandaloneResourceBase) AllowPerformMetadata(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return userCred.IsAdminAllow(consts.GetServiceType(), model.GetModelManager().KeywordPlural(), policy.PolicyActionPerform, "metadata") } func (model *SStandaloneResourceBase) PerformMetadata(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { diff --git a/pkg/cloudcommon/db/statusstandalone.go b/pkg/cloudcommon/db/statusstandalone.go index 4304a37388..7f436d2c4c 100644 --- a/pkg/cloudcommon/db/statusstandalone.go +++ b/pkg/cloudcommon/db/statusstandalone.go @@ -6,6 +6,8 @@ import ( "strings" "yunion.io/x/jsonutils" + "yunion.io/x/onecloud/pkg/cloudcommon/consts" + "yunion.io/x/onecloud/pkg/cloudcommon/policy" "yunion.io/x/onecloud/pkg/mcclient" "yunion.io/x/onecloud/pkg/util/logclient" ) @@ -50,7 +52,7 @@ func (model *SStatusStandaloneResourceBase) SetStatus(userCred mcclient.TokenCre } func (model *SStatusStandaloneResourceBase) AllowPerformStatus(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return userCred.IsAdminAllow(consts.GetServiceType(), model.GetModelManager().KeywordPlural(), policy.PolicyActionPerform, "status") } func (model *SStatusStandaloneResourceBase) PerformStatus(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { diff --git a/pkg/cloudcommon/db/taskman/tasks.go b/pkg/cloudcommon/db/taskman/tasks.go index f16cc14387..177bb0a203 100644 --- a/pkg/cloudcommon/db/taskman/tasks.go +++ b/pkg/cloudcommon/db/taskman/tasks.go @@ -18,9 +18,11 @@ import ( "yunion.io/x/pkg/utils" "yunion.io/x/sqlchemy" + "yunion.io/x/onecloud/pkg/cloudcommon/consts" "yunion.io/x/onecloud/pkg/cloudcommon/db" "yunion.io/x/onecloud/pkg/cloudcommon/db/lockman" "yunion.io/x/onecloud/pkg/cloudcommon/db/quotas" + "yunion.io/x/onecloud/pkg/cloudcommon/policy" ) const ( @@ -70,7 +72,7 @@ type STask struct { } func (manager *STaskManager) AllowListItems(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return true } func (manager *STaskManager) AllowCreateItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { @@ -115,7 +117,7 @@ func (manager *STaskManager) FilterByOwner(q *sqlchemy.SQuery, owner string) *sq } func (self *STask) AllowGetDetails(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() || userCred.GetProjectId() == self.UserCred.GetProjectId() + return userCred.IsAdminAllow(consts.GetServiceType(), self.GetModelManager().KeywordPlural(), policy.PolicyActionGet) || userCred.GetProjectId() == self.UserCred.GetProjectId() } func (self *STask) AllowUpdateItem(ctx context.Context, userCred mcclient.TokenCredential) bool { diff --git a/pkg/cloudcommon/db/virtualjointbase.go b/pkg/cloudcommon/db/virtualjointbase.go index 23565cc777..5a0e571e5d 100644 --- a/pkg/cloudcommon/db/virtualjointbase.go +++ b/pkg/cloudcommon/db/virtualjointbase.go @@ -10,6 +10,8 @@ import ( "yunion.io/x/pkg/util/reflectutils" "yunion.io/x/sqlchemy" + "yunion.io/x/onecloud/pkg/cloudcommon/consts" + "yunion.io/x/onecloud/pkg/cloudcommon/policy" "yunion.io/x/onecloud/pkg/httperrors" "yunion.io/x/onecloud/pkg/mcclient" ) @@ -27,7 +29,7 @@ func NewVirtualJointResourceBaseManager(dt interface{}, tableName string, keywor } func (manager *SVirtualJointResourceBaseManager) AllowListItems(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { - if jsonutils.QueryBoolean(query, "admin", false) && !userCred.IsSystemAdmin() { + if jsonutils.QueryBoolean(query, "admin", false) && !userCred.IsAdminAllow(consts.GetServiceType(), manager.KeywordPlural(), policy.PolicyActionList) { return false } return true @@ -36,7 +38,7 @@ func (manager *SVirtualJointResourceBaseManager) AllowListItems(ctx context.Cont func (manager *SVirtualJointResourceBaseManager) AllowListDescendent(ctx context.Context, userCred mcclient.TokenCredential, master IStandaloneModel, query jsonutils.JSONObject) bool { masterVirtual := master.(IVirtualModel) - if masterVirtual.IsOwner(userCred) { + if masterVirtual.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), masterVirtual.KeywordPlural(), policy.PolicyActionList) { return true } return false @@ -62,12 +64,12 @@ func (manager *SVirtualJointResourceBaseManager) AllowAttach(ctx context.Context func (self *SVirtualJointResourceBase) AllowGetDetails(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { masterVirtual := self.Master().(IVirtualModel) - return masterVirtual.IsOwner(userCred) + return masterVirtual.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), masterVirtual.KeywordPlural(), policy.PolicyActionGet) } func (self *SVirtualJointResourceBase) AllowUpdateItem(ctx context.Context, userCred mcclient.TokenCredential) bool { masterVirtual := self.Master().(IVirtualModel) - return masterVirtual.IsOwner(userCred) + return masterVirtual.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), masterVirtual.KeywordPlural(), policy.PolicyActionUpdate) } func (manager *SVirtualJointResourceBaseManager) ListItemFilter(ctx context.Context, q *sqlchemy.SQuery, userCred mcclient.TokenCredential, query jsonutils.JSONObject) (*sqlchemy.SQuery, error) { @@ -96,7 +98,7 @@ func (manager *SVirtualJointResourceBaseManager) ListItemFilter(ctx context.Cont sqlchemy.IsFalse(masterTable.Field("deleted")))) q = q.Join(slaveTable, sqlchemy.AND(sqlchemy.Equals(slaveField, slaveTable.Field("id")), sqlchemy.IsFalse(slaveTable.Field("deleted")))) - if jsonutils.QueryBoolean(query, "admin", false) && userCred.IsSystemAdmin() { + if jsonutils.QueryBoolean(query, "admin", false) && userCred.IsAdminAllow(consts.GetServiceType(), manager.KeywordPlural(), policy.PolicyActionList) { isSystem := jsonutils.QueryBoolean(query, "system", false) if !isSystem { if len(slaveQueryId) == 0 { diff --git a/pkg/cloudcommon/db/virtualresource.go b/pkg/cloudcommon/db/virtualresource.go index 16a9b44572..a9e31f0263 100644 --- a/pkg/cloudcommon/db/virtualresource.go +++ b/pkg/cloudcommon/db/virtualresource.go @@ -12,7 +12,9 @@ import ( "yunion.io/x/pkg/utils" "yunion.io/x/sqlchemy" + "yunion.io/x/onecloud/pkg/cloudcommon/consts" "yunion.io/x/onecloud/pkg/cloudcommon/db/lockman" + "yunion.io/x/onecloud/pkg/cloudcommon/policy" "yunion.io/x/onecloud/pkg/httperrors" "yunion.io/x/onecloud/pkg/mcclient" ) @@ -38,12 +40,12 @@ type SVirtualResourceBase struct { } func (model *SVirtualResourceBase) IsOwner(userCred mcclient.TokenCredential) bool { - return userCred.IsSystemAdmin() || userCred.GetProjectId() == model.ProjectId + return userCred.GetProjectId() == model.ProjectId } -func (model *SVirtualResourceBase) IsAdmin(userCred mcclient.TokenCredential) bool { +/*func (model *SVirtualResourceBase) IsAdmin(userCred mcclient.TokenCredential) bool { return userCred.IsSystemAdmin() || (userCred.GetProjectId() == model.ProjectId && userCred.IsAdmin()) -} +}*/ func (model *SVirtualResourceBase) GetOwnerProjectId() string { return model.ProjectId @@ -111,7 +113,7 @@ func (manager *SVirtualResourceBaseManager) ListItemFilter(ctx context.Context, func (manager *SVirtualResourceBaseManager) ValidateCreateData(ctx context.Context, userCred mcclient.TokenCredential, ownerProjId string, query jsonutils.JSONObject, data *jsonutils.JSONDict) (*jsonutils.JSONDict, error) { isSystem, err := data.Bool("is_system") - if err == nil && isSystem && !userCred.IsSystemAdmin() { + if err == nil && isSystem && !userCred.IsAdminAllow(consts.GetServiceType(), manager.KeywordPlural(), policy.PolicyActionCreate) { return nil, httperrors.NewNotSufficientPrivilegeError("non-admin user not allowed to create system object") } return manager.SStandaloneResourceBaseManager.ValidateCreateData(ctx, userCred, ownerProjId, query, data) @@ -130,14 +132,14 @@ func (model *SVirtualResourceBase) CustomizeCreate(ctx context.Context, userCred func (manager *SVirtualResourceBaseManager) AllowListItems(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { isAdmin, err := query.Bool("admin") - if err == nil && isAdmin && !userCred.IsSystemAdmin() { + if err == nil && isAdmin && !userCred.IsAdminAllow(consts.GetServiceType(), manager.KeywordPlural(), policy.PolicyActionList) { return false } return true } func (model *SVirtualResourceBase) AllowGetDetails(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { - return model.IsOwner(userCred) + return model.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), model.KeywordPlural(), policy.PolicyActionGet) } func (manager *SVirtualResourceBaseManager) AllowCreateItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { @@ -145,19 +147,19 @@ func (manager *SVirtualResourceBaseManager) AllowCreateItem(ctx context.Context, } func (model *SVirtualResourceBase) AllowUpdateItem(ctx context.Context, userCred mcclient.TokenCredential) bool { - return model.IsOwner(userCred) + return model.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), model.KeywordPlural(), policy.PolicyActionUpdate) } func (model *SVirtualResourceBase) AllowDeleteItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return model.IsOwner(userCred) + return model.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), model.KeywordPlural(), policy.PolicyActionDelete) } func (model *SVirtualResourceBase) AllowGetDetailsMetadata(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { - return model.IsOwner(userCred) + return model.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), model.KeywordPlural(), policy.PolicyActionGet, "metadata") } func (model *SVirtualResourceBase) AllowPerformMetadata(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return model.IsOwner(userCred) + return model.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), model.KeywordPlural(), policy.PolicyActionPerform, "metadata") } func (model *SVirtualResourceBase) GetTenantCache(ctx context.Context) (*STenant, error) { @@ -166,7 +168,7 @@ func (model *SVirtualResourceBase) GetTenantCache(ctx context.Context) (*STenant } func (model *SVirtualResourceBase) getMoreDetails(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, extra *jsonutils.JSONDict) *jsonutils.JSONDict { - if userCred.IsSystemAdmin() { + if userCred.IsAdminAllow(consts.GetServiceType(), model.GetModelManager().KeywordPlural(), policy.PolicyActionGet) { // log.Debugf("GetCustomizeColumns") tobj, err := model.GetTenantCache(ctx) if err == nil { @@ -198,7 +200,7 @@ func (model *SVirtualResourceBase) GetExtraDetails(ctx context.Context, userCred } func (model *SVirtualResourceBase) AllowPerformChangeOwner(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return userCred.IsAdminAllow(consts.GetServiceType(), model.GetModelManager().KeywordPlural(), policy.PolicyActionPerform, "change-owner") } func (model *SVirtualResourceBase) PerformChangeOwner(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { diff --git a/pkg/cloudcommon/options.go b/pkg/cloudcommon/options.go index fa7730c4a9..c3d92e4201 100644 --- a/pkg/cloudcommon/options.go +++ b/pkg/cloudcommon/options.go @@ -63,6 +63,10 @@ func (this *DBOptions) GetDBConnection() (dialect, connstr string, err error) { } func ParseOptions(optStruct interface{}, optionsRef *Options, args []string, configFileName string) { + if len(consts.GetServiceType()) == 0 { + log.Fatalf("ServiceType not initialized!") + } + serviceName := path.Base(args[0]) parser, err := structarg.NewArgumentParser(optStruct, serviceName, diff --git a/pkg/cloudcommon/policy/policy.go b/pkg/cloudcommon/policy/policy.go index d4ab475993..2431c64ea5 100644 --- a/pkg/cloudcommon/policy/policy.go +++ b/pkg/cloudcommon/policy/policy.go @@ -90,6 +90,12 @@ var ( Action: PolicyActionCreate, Result: rbacutils.UserAllow, }, + { + Service: "yunionconf", + Resource: "parameters", + Action: PolicyActionGet, + Result: rbacutils.OwnerAllow, + }, } ) @@ -278,7 +284,7 @@ func (manager *SPolicyManager) explainPolicy(userCred mcclient.TokenCredential, if !consts.IsRbacEnabled() { if !isAdmin { return reqStrs, rbacutils.OwnerAllow, nil - } else if isAdmin && userCred.IsSystemAdmin() { + } else if isAdmin && userCred.HasSystemAdminPrivelege() { return reqStrs, rbacutils.AdminAllow, nil } else { return reqStrs, rbacutils.Deny, httperrors.NewForbiddenError("operation not allowed") @@ -305,7 +311,7 @@ func (manager *SPolicyManager) ExplainRpc(userCred mcclient.TokenCredential, par } func (manager *SPolicyManager) IsAdminCapable(userCred mcclient.TokenCredential) bool { - if !consts.IsRbacEnabled() && userCred.IsSystemAdmin() { + if !consts.IsRbacEnabled() && userCred.HasSystemAdminPrivelege() { return true } diff --git a/pkg/cloudcommon/policy/token.go b/pkg/cloudcommon/policy/token.go new file mode 100644 index 0000000000..c42b846bf4 --- /dev/null +++ b/pkg/cloudcommon/policy/token.go @@ -0,0 +1,145 @@ +package policy + +import ( + "time" + + "yunion.io/x/jsonutils" + "yunion.io/x/pkg/gotypes" + + "yunion.io/x/onecloud/pkg/cloudcommon/consts" + "yunion.io/x/onecloud/pkg/mcclient" + "yunion.io/x/onecloud/pkg/util/rbacutils" +) + +type SPolicyTokenCredential struct { + Token mcclient.TokenCredential +} + +func (self *SPolicyTokenCredential) String() string { + return self.Token.String() +} + +func (self *SPolicyTokenCredential) IsZero() bool { + return self.Token.IsZero() +} + +func (self *SPolicyTokenCredential) GetProjectId() string { + return self.Token.GetProjectId() +} + +func (self *SPolicyTokenCredential) GetTenantId() string { + return self.Token.GetTenantId() +} + +func (self *SPolicyTokenCredential) GetUserId() string { + return self.Token.GetUserId() +} + +func (self *SPolicyTokenCredential) GetServiceURL(service, region, zone, endpointType string) (string, error) { + return self.Token.GetServiceURL(service, region, zone, endpointType) +} + +func (self *SPolicyTokenCredential) GetServiceURLs(service, region, zone, endpointType string) ([]string, error) { + return self.Token.GetServiceURLs(service, region, zone, endpointType) +} + +func (self *SPolicyTokenCredential) GetTokenString() string { + return self.Token.GetTokenString() +} + +func (self *SPolicyTokenCredential) GetDomainId() string { + return self.Token.GetDomainId() +} + +func (self *SPolicyTokenCredential) GetDomainName() string { + return self.Token.GetDomainName() +} + +func (self *SPolicyTokenCredential) GetTenantName() string { + return self.Token.GetTenantName() +} + +func (self *SPolicyTokenCredential) GetProjectName() string { + return self.Token.GetProjectName() +} + +func (self *SPolicyTokenCredential) GetUserName() string { + return self.Token.GetUserName() +} + +func (self *SPolicyTokenCredential) GetRoles() []string { + return self.Token.GetRoles() +} + +func (self *SPolicyTokenCredential) GetExpires() time.Time { + return self.Token.GetExpires() +} + +func (self *SPolicyTokenCredential) IsValid() bool { + return self.Token.IsValid() +} + +func (self *SPolicyTokenCredential) ValidDuration() time.Duration { + return self.Token.ValidDuration() +} + +func (self *SPolicyTokenCredential) GetRegions() []string { + return self.Token.GetRegions() +} + +func (self *SPolicyTokenCredential) GetServiceCatalog() mcclient.IServiceCatalog { + return self.Token.GetServiceCatalog() +} + +func (self *SPolicyTokenCredential) GetCatalogData(serviceTypes []string, region string) jsonutils.JSONObject { + return self.Token.GetCatalogData(serviceTypes, region) +} + +func (self *SPolicyTokenCredential) GetInternalServices(region string) []string { + return self.Token.GetInternalServices(region) +} + +func (self *SPolicyTokenCredential) GetExternalServices(region string) []mcclient.ExternalService { + return self.Token.GetExternalServices(region) +} + +func (self *SPolicyTokenCredential) GetEndpoints(region string, endpointType string) []mcclient.Endpoint { + return self.Token.GetEndpoints(region, endpointType) +} + +func (self *SPolicyTokenCredential) ToJson() jsonutils.JSONObject { + return self.Token.ToJson() +} + +func (self *SPolicyTokenCredential) HasSystemAdminPrivelege() bool { + if consts.IsRbacEnabled() { + return PolicyManager.IsAdminCapable(self.Token) + } + return self.Token.HasSystemAdminPrivelege() +} + +func (self *SPolicyTokenCredential) IsAdminAllow(service string, resource string, action string, extra ...string) bool { + if consts.IsRbacEnabled() { + result := PolicyManager.Allow(true, self.Token, service, resource, action, extra...) + return result == rbacutils.AdminAllow + } + return self.Token.IsAdminAllow(service, resource, action, extra...) +} + +func init() { + gotypes.RegisterSerializable(mcclient.TokenCredentialType, func() gotypes.ISerializable { + return &SPolicyTokenCredential{} + }) +} + +func FilterPolicyCredential(token mcclient.TokenCredential) mcclient.TokenCredential { + if !consts.IsRbacEnabled() { + return token + } + switch token.(type) { + case *SPolicyTokenCredential: + return token + default: + return &SPolicyTokenCredential{Token: token} + } +} diff --git a/pkg/compute/capabilities/handler.go b/pkg/compute/capabilities/handler.go index a6f0aa9378..8df5482467 100644 --- a/pkg/compute/capabilities/handler.go +++ b/pkg/compute/capabilities/handler.go @@ -8,6 +8,7 @@ import ( "yunion.io/x/jsonutils" "yunion.io/x/onecloud/pkg/appsrv" + "yunion.io/x/onecloud/pkg/cloudcommon/policy" "yunion.io/x/onecloud/pkg/compute/models" "yunion.io/x/onecloud/pkg/httperrors" "yunion.io/x/onecloud/pkg/mcclient/auth" @@ -18,7 +19,7 @@ func AddCapabilityHandler(prefix string, app *appsrv.Application) { } func capaHandler(ctx context.Context, w http.ResponseWriter, r *http.Request) { - userCred := auth.FetchUserCredential(ctx) + userCred := auth.FetchUserCredential(ctx, policy.FilterPolicyCredential) query, err := jsonutils.ParseQueryString(r.URL.RawQuery) if err != nil { httperrors.GeneralServerError(w, err) diff --git a/pkg/compute/models/baremetalagents.go b/pkg/compute/models/baremetalagents.go index 780a5645ec..606333ea67 100644 --- a/pkg/compute/models/baremetalagents.go +++ b/pkg/compute/models/baremetalagents.go @@ -5,7 +5,9 @@ import ( "fmt" "yunion.io/x/jsonutils" + "yunion.io/x/onecloud/pkg/cloudcommon/consts" "yunion.io/x/onecloud/pkg/cloudcommon/db" + "yunion.io/x/onecloud/pkg/cloudcommon/policy" "yunion.io/x/onecloud/pkg/httperrors" "yunion.io/x/onecloud/pkg/mcclient" "yunion.io/x/pkg/util/regutils" @@ -80,7 +82,7 @@ func (manager *SBaremetalagentManager) ValidateCreateData(ctx context.Context, u } func (self *SBaremetalagent) AllowPerformEnable(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return userCred.IsAdminAllow(consts.GetServiceType(), self.GetModelManager().KeywordPlural(), policy.PolicyActionPerform, "enable") } func (self *SBaremetalagent) PerformEnable(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -95,7 +97,7 @@ func (self *SBaremetalagent) PerformEnable(ctx context.Context, userCred mcclien } func (self *SBaremetalagent) AllowPerformDisable(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return userCred.IsAdminAllow(consts.GetServiceType(), self.GetModelManager().KeywordPlural(), policy.PolicyActionPerform, "disable") } func (self *SBaremetalagent) PerformDisable(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -110,7 +112,7 @@ func (self *SBaremetalagent) PerformDisable(ctx context.Context, userCred mcclie } func (self *SBaremetalagent) AllowPerformOnline(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return userCred.IsAdminAllow(consts.GetServiceType(), self.GetModelManager().KeywordPlural(), policy.PolicyActionPerform, "online") } func (self *SBaremetalagent) PerformOnline(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -125,7 +127,7 @@ func (self *SBaremetalagent) PerformOnline(ctx context.Context, userCred mcclien } func (self *SBaremetalagent) AllowPerformOffline(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return userCred.IsAdminAllow(consts.GetServiceType(), self.GetModelManager().KeywordPlural(), policy.PolicyActionPerform, "offline") } func (self *SBaremetalagent) PerformOffline(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { diff --git a/pkg/compute/models/cachedimages.go b/pkg/compute/models/cachedimages.go index 3d49d59128..67e0069e25 100644 --- a/pkg/compute/models/cachedimages.go +++ b/pkg/compute/models/cachedimages.go @@ -16,8 +16,10 @@ import ( "yunion.io/x/pkg/util/timeutils" "yunion.io/x/sqlchemy" + "yunion.io/x/onecloud/pkg/cloudcommon/consts" "yunion.io/x/onecloud/pkg/cloudcommon/db" "yunion.io/x/onecloud/pkg/cloudcommon/db/lockman" + "yunion.io/x/onecloud/pkg/cloudcommon/policy" "yunion.io/x/onecloud/pkg/compute/options" ) @@ -240,7 +242,7 @@ func (self *SCachedimage) GetCustomizeColumns(ctx context.Context, userCred mccl } func (self *SCachedimage) AllowPerformRefresh(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return userCred.IsAdminAllow(consts.GetServiceType(), self.GetModelManager().KeywordPlural(), policy.PolicyActionPerform, "refresh") } func (self *SCachedimage) PerformRefresh(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { diff --git a/pkg/compute/models/cloudaccounts.go b/pkg/compute/models/cloudaccounts.go index fa889598f1..93d0bce62d 100644 --- a/pkg/compute/models/cloudaccounts.go +++ b/pkg/compute/models/cloudaccounts.go @@ -13,8 +13,10 @@ import ( "yunion.io/x/pkg/utils" "yunion.io/x/sqlchemy" + "yunion.io/x/onecloud/pkg/cloudcommon/consts" "yunion.io/x/onecloud/pkg/cloudcommon/db" "yunion.io/x/onecloud/pkg/cloudcommon/db/taskman" + "yunion.io/x/onecloud/pkg/cloudcommon/policy" "yunion.io/x/onecloud/pkg/cloudprovider" "yunion.io/x/onecloud/pkg/httperrors" "yunion.io/x/onecloud/pkg/mcclient" @@ -199,7 +201,7 @@ func (self *SCloudaccount) CanSync() bool { } func (self *SCloudaccount) AllowPerformSync(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return userCred.IsAdminAllow(consts.GetServiceType(), self.GetModelManager().KeywordPlural(), policy.PolicyActionPerform, "sync") } func (self *SCloudaccount) PerformSync(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -218,7 +220,7 @@ func (self *SCloudaccount) PerformSync(ctx context.Context, userCred mcclient.To } func (self *SCloudaccount) AllowPerformUpdateCredential(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return userCred.IsAdminAllow(consts.GetServiceType(), self.GetModelManager().KeywordPlural(), policy.PolicyActionPerform, "update-credential") } func (self *SCloudaccount) PerformUpdateCredential(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -444,7 +446,7 @@ func (self *SCloudaccount) ImportSubAccount(ctx context.Context, userCred mcclie } func (self *SCloudaccount) AllowPerformImport(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return userCred.IsAdminAllow(consts.GetServiceType(), self.GetModelManager().KeywordPlural(), policy.PolicyActionPerform, "import") } func (self *SCloudaccount) PerformImport(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -618,7 +620,7 @@ func (self *SCloudaccount) GetBalance() (float64, error) { } func (self *SCloudaccount) AllowGetDetailsBalance(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return userCred.IsAdminAllow(consts.GetServiceType(), self.GetModelManager().KeywordPlural(), policy.PolicyActionGet, "balance") } func (self *SCloudaccount) GetDetailsBalance(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) (jsonutils.JSONObject, error) { diff --git a/pkg/compute/models/cloudproviders.go b/pkg/compute/models/cloudproviders.go index 2a1361eb61..9ba07a5600 100644 --- a/pkg/compute/models/cloudproviders.go +++ b/pkg/compute/models/cloudproviders.go @@ -12,8 +12,10 @@ import ( "yunion.io/x/pkg/utils" "yunion.io/x/sqlchemy" + "yunion.io/x/onecloud/pkg/cloudcommon/consts" "yunion.io/x/onecloud/pkg/cloudcommon/db" "yunion.io/x/onecloud/pkg/cloudcommon/db/taskman" + "yunion.io/x/onecloud/pkg/cloudcommon/policy" "yunion.io/x/onecloud/pkg/cloudprovider" "yunion.io/x/onecloud/pkg/compute/options" "yunion.io/x/onecloud/pkg/httperrors" @@ -297,7 +299,7 @@ func (sr *SSyncRange) Normalize() error { } func (self *SCloudprovider) AllowPerformSync(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "sync") } func (self *SCloudprovider) PerformSync(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -330,7 +332,7 @@ func (self *SCloudprovider) StartSyncCloudProviderInfoTask(ctx context.Context, } func (self *SCloudprovider) AllowPerformChangeProject(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "change-project") } func (self *SCloudprovider) PerformChangeProject(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -581,7 +583,7 @@ func (self *SCloudprovider) GetBalance() (float64, error) { } func (self *SCloudprovider) AllowGetDetailsBalance(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionGet, "balance") } func (self *SCloudprovider) GetDetailsBalance(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) (jsonutils.JSONObject, error) { diff --git a/pkg/compute/models/cloudregions.go b/pkg/compute/models/cloudregions.go index 3e4c931cc8..374682c40e 100644 --- a/pkg/compute/models/cloudregions.go +++ b/pkg/compute/models/cloudregions.go @@ -12,7 +12,9 @@ import ( "yunion.io/x/pkg/util/compare" "yunion.io/x/sqlchemy" + "yunion.io/x/onecloud/pkg/cloudcommon/consts" "yunion.io/x/onecloud/pkg/cloudcommon/db" + "yunion.io/x/onecloud/pkg/cloudcommon/policy" "yunion.io/x/onecloud/pkg/cloudprovider" ) @@ -248,7 +250,7 @@ func (manager *SCloudregionManager) newFromCloudRegion(cloudRegion cloudprovider } func (self *SCloudregion) AllowPerformDefaultVpc(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "default-vpc") } func (self *SCloudregion) PerformDefaultVpc(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { diff --git a/pkg/compute/models/disks.go b/pkg/compute/models/disks.go index e09560fc9e..f2c0e24168 100644 --- a/pkg/compute/models/disks.go +++ b/pkg/compute/models/disks.go @@ -19,9 +19,11 @@ import ( "yunion.io/x/pkg/utils" "yunion.io/x/sqlchemy" + "yunion.io/x/onecloud/pkg/cloudcommon/consts" "yunion.io/x/onecloud/pkg/cloudcommon/db" "yunion.io/x/onecloud/pkg/cloudcommon/db/quotas" "yunion.io/x/onecloud/pkg/cloudcommon/db/taskman" + "yunion.io/x/onecloud/pkg/cloudcommon/policy" "yunion.io/x/onecloud/pkg/cloudprovider" "yunion.io/x/onecloud/pkg/compute/options" "yunion.io/x/onecloud/pkg/httperrors" @@ -442,7 +444,7 @@ func (self *SDisk) StartAllocate(ctx context.Context, host *SHost, storage *SSto } func (self *SDisk) AllowGetDetailsConvertSnapshot(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { - return self.IsOwner(userCred) + return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionGet, "convert-snapshot") } func (self *SDisk) GetDetailsConvertSnapshot(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -499,7 +501,7 @@ func (self *SDisk) CleanUpDiskSnapshots(ctx context.Context, userCred mcclient.T } func (self *SDisk) AllowPerformCreateSnapshot(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) + return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "create-snapshot") } func (self *SDisk) PerformCreateSnapshot(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -513,7 +515,7 @@ func (self *SDisk) PerformCreateSnapshot(ctx context.Context, userCred mcclient. } func (self *SDisk) AllowPerformDiskReset(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) + return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "disk-reset") } func (self *SDisk) PerformDiskReset(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -560,7 +562,7 @@ func (self *SDisk) StartResetDisk(ctx context.Context, userCred mcclient.TokenCr } func (self *SDisk) AllowPerformResize(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) + return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "resize") } func (self *SDisk) PerformResize(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -651,7 +653,7 @@ func (self *SDisk) PrepareSaveImage(ctx context.Context, userCred mcclient.Token } func (self *SDisk) AllowPerformSave(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) + return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "save") } func (self *SDisk) PerformSave(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -1139,7 +1141,7 @@ func (self *SDisk) RealDelete(ctx context.Context, userCred mcclient.TokenCreden } func (self *SDisk) AllowPerformPurge(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) + return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "purge") } func (self *SDisk) PerformPurge(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -1315,7 +1317,7 @@ func (self *SDisk) isInit() bool { } func (self *SDisk) AllowPerformCancelDelete(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "cancel-delete") } func (self *SDisk) PerformCancelDelete(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { diff --git a/pkg/compute/models/dnsrecords.go b/pkg/compute/models/dnsrecords.go index 14c5ec9f2f..74590ae471 100644 --- a/pkg/compute/models/dnsrecords.go +++ b/pkg/compute/models/dnsrecords.go @@ -11,7 +11,9 @@ import ( "yunion.io/x/pkg/util/regutils" "yunion.io/x/sqlchemy" + "yunion.io/x/onecloud/pkg/cloudcommon/consts" "yunion.io/x/onecloud/pkg/cloudcommon/db" + "yunion.io/x/onecloud/pkg/cloudcommon/policy" "yunion.io/x/onecloud/pkg/httperrors" "yunion.io/x/onecloud/pkg/mcclient" ) @@ -383,7 +385,7 @@ func (rec *SDnsRecord) AddInfo(userCred mcclient.TokenCredential, data jsonutils } func (rec *SDnsRecord) AllowPerformAddRecords(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return rec.IsOwner(userCred) + return rec.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), rec.KeywordPlural(), policy.PolicyActionPerform, "add-records") } func (rec *SDnsRecord) PerformAddRecords(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -402,7 +404,7 @@ func (rec *SDnsRecord) PerformAddRecords(ctx context.Context, userCred mcclient. } func (rec *SDnsRecord) AllowPerformRemoveRecords(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return rec.IsOwner(userCred) + return rec.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), rec.KeywordPlural(), policy.PolicyActionPerform, "remove-records") } func (rec *SDnsRecord) PerformRemoveRecords(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -411,7 +413,7 @@ func (rec *SDnsRecord) PerformRemoveRecords(ctx context.Context, userCred mcclie } func (rec *SDnsRecord) AllowPerformEnable(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return rec.IsOwner(userCred) || userCred.IsSystemAdmin() + return rec.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), rec.KeywordPlural(), policy.PolicyActionPerform, "enable") } func (rec *SDnsRecord) PerformEnable(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -429,7 +431,7 @@ func (rec *SDnsRecord) PerformEnable(ctx context.Context, userCred mcclient.Toke } func (rec *SDnsRecord) AllowPerformDisable(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return rec.IsOwner(userCred) || userCred.IsSystemAdmin() + return rec.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), rec.KeywordPlural(), policy.PolicyActionPerform, "disable") } func (rec *SDnsRecord) PerformDisable(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { diff --git a/pkg/compute/models/dynamicschedtags.go b/pkg/compute/models/dynamicschedtags.go index 3911948365..9770802575 100644 --- a/pkg/compute/models/dynamicschedtags.go +++ b/pkg/compute/models/dynamicschedtags.go @@ -7,7 +7,9 @@ import ( "yunion.io/x/log" "database/sql" + "yunion.io/x/onecloud/pkg/cloudcommon/consts" "yunion.io/x/onecloud/pkg/cloudcommon/db" + "yunion.io/x/onecloud/pkg/cloudcommon/policy" "yunion.io/x/onecloud/pkg/httperrors" "yunion.io/x/onecloud/pkg/mcclient" "yunion.io/x/onecloud/pkg/util/conditionparser" @@ -132,7 +134,7 @@ func (manager *SDynamicschedtagManager) getAllEnabledDynamicSchedtags() []SDynam } func (self *SDynamicschedtag) AllowPerformEvaluate(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "evaluate") } func (self *SDynamicschedtag) PerformEvaluate(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { diff --git a/pkg/compute/models/elasticips.go b/pkg/compute/models/elasticips.go index b879e2010e..840f29bd35 100644 --- a/pkg/compute/models/elasticips.go +++ b/pkg/compute/models/elasticips.go @@ -13,10 +13,12 @@ import ( "yunion.io/x/pkg/utils" "yunion.io/x/sqlchemy" + "yunion.io/x/onecloud/pkg/cloudcommon/consts" "yunion.io/x/onecloud/pkg/cloudcommon/db" "yunion.io/x/onecloud/pkg/cloudcommon/db/lockman" "yunion.io/x/onecloud/pkg/cloudcommon/db/quotas" "yunion.io/x/onecloud/pkg/cloudcommon/db/taskman" + "yunion.io/x/onecloud/pkg/cloudcommon/policy" "yunion.io/x/onecloud/pkg/cloudprovider" "yunion.io/x/onecloud/pkg/httperrors" "yunion.io/x/onecloud/pkg/mcclient" @@ -493,7 +495,7 @@ func (self *SElasticip) StartEipDeallocateTask(ctx context.Context, userCred mcc } func (self *SElasticip) AllowPerformAssociate(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) + return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "associate") } func (self *SElasticip) PerformAssociate(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -593,7 +595,7 @@ func (self *SElasticip) StartEipAssociateTask(ctx context.Context, userCred mccl } func (self *SElasticip) AllowPerformDissociate(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) + return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "dissociate") } func (self *SElasticip) PerformDissociate(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -647,7 +649,7 @@ func (self *SElasticip) GetIEip() (cloudprovider.ICloudEIP, error) { } func (self *SElasticip) AllowPerformSync(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) + return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "sync") } func (self *SElasticip) PerformSync(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -731,7 +733,7 @@ func (manager *SElasticipManager) allocateEipAndAssociateVM(ctx context.Context, } func (self *SElasticip) AllowPerformChangeBandwidth(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) + return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "change-bandwidth") } func (self *SElasticip) PerformChangeBandwidth(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -834,7 +836,7 @@ func (manager *SElasticipManager) TotalCount(projectId string, rangeObj db.IStan } func (self *SElasticip) AllowPerformPurge(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionDelete) } func (self *SElasticip) PerformPurge(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { diff --git a/pkg/compute/models/guest_actions.go b/pkg/compute/models/guest_actions.go index 28cfa3fe33..3eab593ff8 100644 --- a/pkg/compute/models/guest_actions.go +++ b/pkg/compute/models/guest_actions.go @@ -23,6 +23,8 @@ import ( "yunion.io/x/jsonutils" "yunion.io/x/log" + "yunion.io/x/onecloud/pkg/cloudcommon/consts" + "yunion.io/x/onecloud/pkg/cloudcommon/policy" "yunion.io/x/pkg/util/fileutils" "yunion.io/x/pkg/util/regutils" "yunion.io/x/pkg/utils" @@ -30,7 +32,7 @@ import ( ) func (self *SGuest) AllowGetDetailsVnc(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { - return self.IsOwner(userCred) + return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionGet, "vnc") } func (self *SGuest) GetDetailsVnc(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -51,7 +53,7 @@ func (self *SGuest) GetDetailsVnc(ctx context.Context, userCred mcclient.TokenCr } func (self *SGuest) AllowGetDetailsMonitor(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { - return self.IsOwner(userCred) + return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionGet, "monitor") } func (self *SGuest) GetDetailsMonitor(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -66,7 +68,7 @@ func (self *SGuest) GetDetailsMonitor(ctx context.Context, userCred mcclient.Tok } func (self *SGuest) AllowGetDetailsDesc(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { - return self.IsOwner(userCred) + return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionGet, "desc") } func (self *SGuest) GetDetailsDesc(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -79,7 +81,7 @@ func (self *SGuest) GetDetailsDesc(ctx context.Context, userCred mcclient.TokenC } func (self *SGuest) AllowPerformSaveImage(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) + return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "save-image") } func (self *SGuest) PerformSaveImage(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -117,7 +119,7 @@ func (self *SGuest) StartGuestSaveImage(ctx context.Context, userCred mcclient.T } func (self *SGuest) AllowPerformSync(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) + return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "sync") } func (self *SGuest) PerformSync(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -159,7 +161,7 @@ func (self *SGuest) CheckQemuVersion(qemuVer, compareVer string) bool { } func (self *SGuest) AllowPerformMigrate(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) + return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "migrate") } func (self *SGuest) PerformMigrate(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -186,7 +188,7 @@ func (self *SGuest) PerformMigrate(ctx context.Context, userCred mcclient.TokenC var preferHostId string preferHost, _ := data.GetString("prefer_host") if len(preferHost) > 0 { - if !userCred.IsSystemAdmin() { + if !userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "assign-host") { return nil, httperrors.NewBadRequestError("Only system admin can assign host") } iHost, _ := HostManager.FetchByIdOrName(userCred, preferHost) @@ -219,7 +221,7 @@ func (self *SGuest) StartMigrateTask(ctx context.Context, userCred mcclient.Toke } func (self *SGuest) AllowPerformLiveMigrate(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) + return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "live-migrate") } func (self *SGuest) PerformLiveMigrate(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -249,7 +251,7 @@ func (self *SGuest) PerformLiveMigrate(ctx context.Context, userCred mcclient.To var preferHostId string preferHost, _ := data.GetString("prefer_host") if len(preferHost) > 0 { - if !userCred.IsSystemAdmin() { + if !userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "assign-host") { return nil, httperrors.NewBadRequestError("Only system admin can assign host") } iHost, _ := HostManager.FetchByIdOrName(userCred, preferHost) @@ -282,7 +284,7 @@ func (self *SGuest) StartGuestLiveMigrateTask(ctx context.Context, userCred mccl } func (self *SGuest) AllowPerformDeploy(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) + return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "deploy") } func (self *SGuest) PerformDeploy(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -345,7 +347,7 @@ func (self *SGuest) PerformDeploy(ctx context.Context, userCred mcclient.TokenCr } func (self *SGuest) AllowPerformAttachdisk(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) + return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "attachdisk") } func (self *SGuest) ValidateAttachDisk(ctx context.Context, disk *SDisk) error { @@ -425,7 +427,7 @@ func (self *SGuest) StartSyncTask(ctx context.Context, userCred mcclient.TokenCr } func (self *SGuest) AllowPerformSuspend(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) + return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "suspend") } func (self *SGuest) PerformSuspend(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -448,7 +450,7 @@ func (self *SGuest) AllowPerformStart(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) + return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "start") } func (self *SGuest) PerformStart(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, @@ -624,11 +626,11 @@ func (self *SGuest) StartDeleteGuestTask(ctx context.Context, userCred mcclient. } func (self *SGuest) AllowPerformAssignSecgroup(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) + return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "assign-secgroup") } func (self *SGuest) AllowPerformRevokeSecgroup(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) + return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "revoke-secgroup") } func (self *SGuest) PerformRevokeSecgroup(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -679,7 +681,7 @@ func (self *SGuest) PerformAssignSecgroup(ctx context.Context, userCred mcclient } func (self *SGuest) AllowPerformPurge(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsAdmin(userCred) + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionDelete) } func (self *SGuest) PerformPurge(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -707,7 +709,7 @@ func (self *SGuest) setKeypairId(userCred mcclient.TokenCredential, keypairId st } func (self *SGuest) AllowPerformRebuildRoot(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) + return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "rebuild-root") } func (self *SGuest) PerformRebuildRoot(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -814,7 +816,7 @@ func (self *SGuest) DetachDisk(ctx context.Context, disk *SDisk, userCred mcclie } func (self *SGuest) AllowPerformCreatedisk(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) + return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "createdisk") } func (self *SGuest) PerformCreatedisk(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -885,7 +887,7 @@ func (self *SGuest) PerformCreatedisk(ctx context.Context, userCred mcclient.Tok } func (self *SGuest) AllowPerformDetachdisk(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) + return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "detachdisk") } func (self *SGuest) PerformDetachdisk(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -931,7 +933,7 @@ func (self *SGuest) PerformDetachdisk(ctx context.Context, userCred mcclient.Tok } func (self *SGuest) AllowPerformDetachIsolatedDevice(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "detach-isolated-device") } func (self *SGuest) PerformDetachIsolatedDevice(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -981,7 +983,7 @@ func (self *SGuest) detachIsolateDevice(userCred mcclient.TokenCredential, dev * } func (self *SGuest) AllowPerformAttachIsolatedDevice(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "attach-isolated-device") } func (self *SGuest) PerformAttachIsolatedDevice(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -1019,7 +1021,7 @@ func (self *SGuest) PerformAttachIsolatedDevice(ctx context.Context, userCred mc } func (self *SGuest) AllowPerformDetachnetwork(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) + return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "detachnetwork") } func (self *SGuest) PerformDetachnetwork(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -1041,7 +1043,7 @@ func (self *SGuest) PerformDetachnetwork(ctx context.Context, userCred mcclient. } func (self *SGuest) AllowPerformAttachnetwork(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) + return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "attachnetwork") } func (self *SGuest) PerformAttachnetwork(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -1092,7 +1094,7 @@ func (self *SGuest) PerformAttachnetwork(ctx context.Context, userCred mcclient. } func (self *SGuest) AllowPerformChangeBandwidth(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) || userCred.IsSystemAdmin() + return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "change-bandwidth") } func (self *SGuest) PerformChangeBandwidth(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -1126,7 +1128,7 @@ func (self *SGuest) PerformChangeBandwidth(ctx context.Context, userCred mcclien } func (self *SGuest) AllowPerformChangeConfig(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) || self.IsAdmin(userCred) + return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "change-config") } func (self *SGuest) PerformChangeConfig(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -1317,7 +1319,7 @@ func (self *SGuest) DoPendingDelete(ctx context.Context, userCred mcclient.Token } func (model *SGuest) AllowPerformCancelDelete(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return userCred.IsAdminAllow(consts.GetServiceType(), model.KeywordPlural(), policy.PolicyActionPerform, "cancel-delete") } func (self *SGuest) PerformCancelDelete(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -1353,7 +1355,7 @@ func (self *SGuest) AllowPerformReset(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) + return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "reset") } func (self *SGuest) PerformReset(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, @@ -1367,7 +1369,7 @@ func (self *SGuest) PerformReset(ctx context.Context, userCred mcclient.TokenCre } func (self *SGuest) AllowPerformDiskSnapshot(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) + return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "disk-snapshot") } func (self *SGuest) PerformDiskSnapshot(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -1421,7 +1423,7 @@ func (self *SGuest) PerformDiskSnapshot(ctx context.Context, userCred mcclient.T } func (self *SGuest) AllowPerformSyncstatus(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) + return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "syncstatus") } func (self *SGuest) PerformSyncstatus(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -1465,7 +1467,7 @@ func (self *SGuest) AllowPerformStop(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) + return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "stop") } func (self *SGuest) PerformStop(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, @@ -1482,7 +1484,7 @@ func (self *SGuest) AllowPerformRestart(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) + return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "restart") } func (self *SGuest) PerformRestart(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -1495,7 +1497,7 @@ func (self *SGuest) PerformRestart(ctx context.Context, userCred mcclient.TokenC } func (self *SGuest) AllowPerformSendkeys(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) + return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "sendkeys") } func (self *SGuest) PerformSendkeys(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -1569,7 +1571,7 @@ func (self *SGuest) SendMonitorCommand(ctx context.Context, userCred mcclient.To } func (self *SGuest) AllowPerformAssociateEip(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) + return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "associate-eip") } func (self *SGuest) PerformAssociateEip(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -1637,7 +1639,7 @@ func (self *SGuest) PerformAssociateEip(ctx context.Context, userCred mcclient.T } func (self *SGuest) AllowPerformDissociateEip(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) + return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "dissociate-eip") } func (self *SGuest) PerformDissociateEip(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -1661,7 +1663,7 @@ func (self *SGuest) PerformDissociateEip(ctx context.Context, userCred mcclient. } func (self *SGuest) AllowPerformCreateEip(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) + return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "create-eip") } func (self *SGuest) PerformCreateEip(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -1716,7 +1718,7 @@ func (self *SGuest) setUserData(ctx context.Context, userCred mcclient.TokenCred } func (self *SGuest) AllowPerformUserData(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) + return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "userdata") } func (self *SGuest) PerformUserData(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { diff --git a/pkg/compute/models/guests.go b/pkg/compute/models/guests.go index 4d513dea9a..011b3ae613 100644 --- a/pkg/compute/models/guests.go +++ b/pkg/compute/models/guests.go @@ -22,9 +22,11 @@ import ( "yunion.io/x/pkg/utils" "yunion.io/x/sqlchemy" + "yunion.io/x/onecloud/pkg/cloudcommon/consts" "yunion.io/x/onecloud/pkg/cloudcommon/db" "yunion.io/x/onecloud/pkg/cloudcommon/db/lockman" "yunion.io/x/onecloud/pkg/cloudcommon/db/quotas" + "yunion.io/x/onecloud/pkg/cloudcommon/policy" "yunion.io/x/onecloud/pkg/cloudprovider" "yunion.io/x/onecloud/pkg/compute/options" "yunion.io/x/onecloud/pkg/compute/sshkeys" @@ -207,7 +209,7 @@ type SGuest struct { func (manager *SGuestManager) AllowListItems(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { if query.Contains("host") || query.Contains("wire") || query.Contains("zone") { - if !userCred.IsSystemAdmin() { + if !userCred.IsAdminAllow(consts.GetServiceType(), manager.KeywordPlural(), policy.PolicyActionList) { return false } } @@ -919,7 +921,7 @@ func (self *SGuest) getExtBandwidth() int { func (self *SGuest) GetCustomizeColumns(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) *jsonutils.JSONDict { extra := self.SVirtualResourceBase.GetCustomizeColumns(ctx, userCred, query) - if userCred.IsSystemAdmin() { + if userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionGet) { host := self.GetHost() if host != nil { extra.Add(jsonutils.NewString(host.Name), "host") @@ -1012,7 +1014,7 @@ func (self *SGuest) GetExtraDetails(ctx context.Context, userCred mcclient.Token if metaData, err := self.GetAllMetadata(userCred); err == nil { extra.Add(jsonutils.Marshal(metaData), "metadata") } - if userCred.IsSystemAdmin() { + if userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionGet) { host := self.GetHost() if host != nil { extra.Add(jsonutils.NewString(host.GetName()), "host") @@ -2211,10 +2213,10 @@ func (self *SGuest) AllowDeleteItem(ctx context.Context, userCred mcclient.Token overridePendingDelete = jsonutils.QueryBoolean(data, "override_pending_delete", false) purge = jsonutils.QueryBoolean(data, "purge", false) } - if (overridePendingDelete || purge) && !userCred.IsSystemAdmin() { + if (overridePendingDelete || purge) && !userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionDelete) { return false } - return self.IsOwner(userCred) + return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionDelete) } func (self *SGuest) CustomizeDelete(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) error { diff --git a/pkg/compute/models/helper.go b/pkg/compute/models/helper.go index 41e680cdf6..83575fd8ac 100644 --- a/pkg/compute/models/helper.go +++ b/pkg/compute/models/helper.go @@ -10,8 +10,10 @@ import ( "yunion.io/x/log" "yunion.io/x/pkg/utils" + "yunion.io/x/onecloud/pkg/cloudcommon/consts" "yunion.io/x/onecloud/pkg/cloudcommon/db" "yunion.io/x/onecloud/pkg/cloudcommon/db/taskman" + "yunion.io/x/onecloud/pkg/cloudcommon/policy" "yunion.io/x/onecloud/pkg/httperrors" "yunion.io/x/onecloud/pkg/mcclient" ) @@ -47,7 +49,7 @@ func ValidateScheduleCreateData(ctx context.Context, userCred mcclient.TokenCred // base validate_create_data if (data.Contains("prefer_baremetal") || data.Contains("prefer_host")) && hypervisor != HYPERVISOR_CONTAINER { - if !userCred.IsSystemAdmin() { + if !userCred.IsAdminAllow(consts.GetServiceType(), GuestManager.KeywordPlural(), policy.PolicyActionPerform, "assign-host") { return nil, httperrors.NewNotSufficientPrivilegeError("Only system admin can specify preferred host") } bmName, _ := data.GetString("prefer_host") diff --git a/pkg/compute/models/hostjoints.go b/pkg/compute/models/hostjoints.go index c6477c1877..b8d7dac8f3 100644 --- a/pkg/compute/models/hostjoints.go +++ b/pkg/compute/models/hostjoints.go @@ -6,7 +6,9 @@ import ( "yunion.io/x/jsonutils" "yunion.io/x/onecloud/pkg/mcclient" + "yunion.io/x/onecloud/pkg/cloudcommon/consts" "yunion.io/x/onecloud/pkg/cloudcommon/db" + "yunion.io/x/onecloud/pkg/cloudcommon/policy" ) type SHostJointsManager struct { @@ -31,29 +33,29 @@ type SHostJointsBase struct { } func (manager *SHostJointsManager) AllowListItems(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return userCred.IsAdminAllow(consts.GetServiceType(), manager.KeywordPlural(), policy.PolicyActionList) } func (manager *SHostJointsManager) AllowCreateItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return userCred.IsAdminAllow(consts.GetServiceType(), manager.KeywordPlural(), policy.PolicyActionCreate) } func (manager *SHostJointsManager) AllowListDescendent(ctx context.Context, userCred mcclient.TokenCredential, model db.IStandaloneModel, query jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return userCred.IsAdminAllow(consts.GetServiceType(), manager.KeywordPlural(), policy.PolicyActionList) } func (manager *SHostJointsManager) AllowAttach(ctx context.Context, userCred mcclient.TokenCredential, master db.IStandaloneModel, slave db.IStandaloneModel) bool { - return userCred.IsSystemAdmin() + return userCred.IsAdminAllow(consts.GetServiceType(), manager.KeywordPlural(), policy.PolicyActionDelete) } func (self *SHostJointsBase) AllowGetDetails(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return userCred.IsAdminAllow(consts.GetServiceType(), self.GetModelManager().KeywordPlural(), policy.PolicyActionGet) } func (self *SHostJointsBase) AllowUpdateItem(ctx context.Context, userCred mcclient.TokenCredential) bool { - return userCred.IsSystemAdmin() + return userCred.IsAdminAllow(consts.GetServiceType(), self.GetModelManager().KeywordPlural(), policy.PolicyActionUpdate) } func (self *SHostJointsBase) AllowDeleteItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return userCred.IsAdminAllow(consts.GetServiceType(), self.GetModelManager().KeywordPlural(), policy.PolicyActionDelete) } diff --git a/pkg/compute/models/hosts.go b/pkg/compute/models/hosts.go index 187ed6e7d0..5edbc95027 100644 --- a/pkg/compute/models/hosts.go +++ b/pkg/compute/models/hosts.go @@ -20,9 +20,11 @@ import ( "yunion.io/x/pkg/utils" "yunion.io/x/sqlchemy" + "yunion.io/x/onecloud/pkg/cloudcommon/consts" "yunion.io/x/onecloud/pkg/cloudcommon/db" "yunion.io/x/onecloud/pkg/cloudcommon/db/lockman" "yunion.io/x/onecloud/pkg/cloudcommon/db/taskman" + "yunion.io/x/onecloud/pkg/cloudcommon/policy" "yunion.io/x/onecloud/pkg/cloudprovider" "yunion.io/x/onecloud/pkg/compute/baremetal" "yunion.io/x/onecloud/pkg/compute/options" @@ -142,7 +144,7 @@ type SHost struct { // Status string = Column(VARCHAR(16, charset='ascii'), nullable=False, default=baremetalstatus.INIT) # status HostStatus string `width:"16" charset:"ascii" nullable:"false" default:"offline" list:"admin"` // Column(VARCHAR(16, charset='ascii'), nullable=False, server_default=HOST_OFFLINE, default=HOST_OFFLINE) - ZoneId string `width:"128" charset:"ascii" nullable:"false" list:"admin" create:"admin_required"` // Column(VARCHAR(ID_LENGTH, charset='ascii'), nullable=False) + ZoneId string `width:"128" charset:"ascii" nullable:"false" list:"admin" create:"admin_optional"` // Column(VARCHAR(ID_LENGTH, charset='ascii'), nullable=False) HostType string `width:"36" charset:"ascii" nullable:"false" list:"admin" update:"admin" create:"admin_required"` // Column(VARCHAR(36, charset='ascii'), nullable=False) @@ -160,15 +162,16 @@ func (manager *SHostManager) GetContextManager() []db.IModelManager { } func (manager *SHostManager) AllowCreateItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - zoneId, err := data.GetString("zone_id") + // allow create host without zone_id + /*zoneId, err := data.GetString("zone_id") if err != nil { return false } _, err = ZoneManager.FetchById(zoneId) if err != nil { return false - } - return userCred.IsSystemAdmin() + }*/ + return userCred.IsAdminAllow(consts.GetServiceType(), manager.KeywordPlural(), policy.PolicyActionCreate) } func (manager *SHostManager) ListItemFilter(ctx context.Context, q *sqlchemy.SQuery, userCred mcclient.TokenCredential, query jsonutils.JSONObject) (*sqlchemy.SQuery, error) { @@ -261,6 +264,9 @@ func (manager *SHostManager) ListItemFilter(ctx context.Context, q *sqlchemy.SQu } func (self *SHost) GetZone() *SZone { + if len(self.ZoneId) == 0 { + return nil + } zone, _ := ZoneManager.FetchById(self.ZoneId) if zone != nil { return zone.(*SZone) @@ -1781,7 +1787,7 @@ func (self *SHost) GetExtraDetails(ctx context.Context, userCred mcclient.TokenC } func (self *SHost) AllowGetDetailsVnc(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionGet, "vnc") } func (self *SHost) GetDetailsVnc(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -1796,7 +1802,7 @@ func (self *SHost) GetDetailsVnc(ctx context.Context, userCred mcclient.TokenCre } func (self *SHost) AllowGetDetailsIpmi(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionGet, "ipmi") } func (self *SHost) GetDetailsIpmi(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -2087,7 +2093,7 @@ func (self *SHost) AllowPerformStart(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "start") } func (self *SHost) PerformStart(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, @@ -2122,7 +2128,7 @@ func (self *SHost) AllowPerformStop(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "stop") } func (self *SHost) PerformStop(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, @@ -2172,7 +2178,8 @@ func (self *SHost) AllowPerformMaintenance(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "maintenance") + } func (self *SHost) PerformMaintenance(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -2211,7 +2218,7 @@ func (self *SHost) AllowPerformUnmaintenance(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "unmaintenance") } func (self *SHost) PerformUnmaintenance(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -2273,7 +2280,7 @@ func (self *SHost) AllowPerformOffline(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "offline") } func (self *SHost) PerformOffline(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -2292,7 +2299,7 @@ func (self *SHost) AllowPerformOnline(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "online") } func (self *SHost) PerformOnline(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -2325,7 +2332,7 @@ func (self *SHost) AllowPerformPing(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "ping") } func (self *SHost) PerformPing(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -2352,7 +2359,7 @@ func (self *SHost) AllowPerformPrepare(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "prepare") } func (self *SHost) PerformPrepare(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -2388,7 +2395,7 @@ func (self *SHost) AllowPerformAddNetif(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "add-netif") } func (self *SHost) PerformAddNetif(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -2540,7 +2547,7 @@ func (self *SHost) AllowPerformEnableNetif(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "enable-netif") } func (self *SHost) PerformEnableNetif(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -2614,7 +2621,7 @@ func (self *SHost) AllowPerformDisableNetif(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "disable-netif") } func (self *SHost) PerformDisableNetif(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -2668,7 +2675,7 @@ func (self *SHost) AllowPerformRemoveNetif(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "remove-netif") } func (self *SHost) PerformRemoveNetif(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -2722,7 +2729,7 @@ func (self *SHost) AllowPerformSyncstatus(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "syncstatus") } func (self *SHost) PerformSyncstatus(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -2734,7 +2741,7 @@ func (self *SHost) AllowPerformReset(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "reset") } func (self *SHost) PerformReset(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -2764,7 +2771,7 @@ func (self *SHost) AllowPerformRemoveAllNetifs(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "remove-all-netifs") } func (self *SHost) PerformRemoveAllNetifs(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -2781,7 +2788,7 @@ func (self *SHost) AllowPerformDisable(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "disable") } func (self *SHost) PerformDisable(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -2804,7 +2811,7 @@ func (self *SHost) AllowPerformCacheImage(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "cache-image") } func (self *SHost) PerformCacheImage(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -2836,7 +2843,7 @@ func (self *SHost) AllowPerformConvertHypervisor(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "convert-hypervisor") } func (self *SHost) isAlterNameUnique(name string) bool { @@ -2902,7 +2909,7 @@ func (self *SHost) AllowPerformUndoConvert(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "undo-convert") } func (self *SHost) PerformUndoConvert(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { diff --git a/pkg/compute/models/inframanagers.go b/pkg/compute/models/inframanagers.go index 962f752369..96c9a5607f 100644 --- a/pkg/compute/models/inframanagers.go +++ b/pkg/compute/models/inframanagers.go @@ -3,6 +3,8 @@ package models import ( "context" "yunion.io/x/jsonutils" + "yunion.io/x/onecloud/pkg/cloudcommon/consts" + "yunion.io/x/onecloud/pkg/cloudcommon/policy" "yunion.io/x/onecloud/pkg/mcclient" ) @@ -13,21 +15,21 @@ type SInfrastructure struct { } func (self *SInfrastructureManager) AllowListItems(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return userCred.IsAdminAllow(consts.GetServiceType(), "*", policy.PolicyActionList) } func (self *SInfrastructureManager) AllowCreateItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return userCred.IsAdminAllow(consts.GetServiceType(), "*", policy.PolicyActionCreate) } func (self *SInfrastructure) AllowGetDetails(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return userCred.IsAdminAllow(consts.GetServiceType(), "*", policy.PolicyActionGet) } func (self *SInfrastructure) AllowUpdateItem(ctx context.Context, userCred mcclient.TokenCredential) bool { - return userCred.IsSystemAdmin() + return userCred.IsAdminAllow(consts.GetServiceType(), "*", policy.PolicyActionUpdate) } func (self *SInfrastructure) AllowDeleteItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return userCred.IsAdminAllow(consts.GetServiceType(), "*", policy.PolicyActionDelete) } diff --git a/pkg/compute/models/isolated_devices.go b/pkg/compute/models/isolated_devices.go index 0c30205d36..7e55afb02b 100644 --- a/pkg/compute/models/isolated_devices.go +++ b/pkg/compute/models/isolated_devices.go @@ -7,7 +7,9 @@ import ( "yunion.io/x/jsonutils" "yunion.io/x/log" + "yunion.io/x/onecloud/pkg/cloudcommon/consts" "yunion.io/x/onecloud/pkg/cloudcommon/db" + "yunion.io/x/onecloud/pkg/cloudcommon/policy" "yunion.io/x/onecloud/pkg/httperrors" "yunion.io/x/onecloud/pkg/mcclient" "yunion.io/x/pkg/util/regutils" @@ -80,7 +82,7 @@ type SIsolatedDevice struct { func (manager *SIsolatedDeviceManager) AllowListItems(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { host, _ := query.GetString("host") - if len(host) > 0 && !userCred.IsSystemAdmin() { + if len(host) > 0 && !userCred.IsAdminAllow(consts.GetServiceType(), manager.KeywordPlural(), policy.PolicyActionList) { return false } return true @@ -92,7 +94,7 @@ func (manager *SIsolatedDeviceManager) ExtraSearchConditions(ctx context.Context } func (manager *SIsolatedDeviceManager) AllowCreateItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return userCred.IsAdminAllow(consts.GetServiceType(), manager.KeywordPlural(), policy.PolicyActionCreate) } func (manager *SIsolatedDeviceManager) ListItemFilter(ctx context.Context, q *sqlchemy.SQuery, userCred mcclient.TokenCredential, query jsonutils.JSONObject) (*sqlchemy.SQuery, error) { diff --git a/pkg/compute/models/keypairs.go b/pkg/compute/models/keypairs.go index 687a21243f..67ae5c7638 100644 --- a/pkg/compute/models/keypairs.go +++ b/pkg/compute/models/keypairs.go @@ -8,7 +8,9 @@ import ( "yunion.io/x/sqlchemy" "golang.org/x/crypto/ssh" + "yunion.io/x/onecloud/pkg/cloudcommon/consts" "yunion.io/x/onecloud/pkg/cloudcommon/db" + "yunion.io/x/onecloud/pkg/cloudcommon/policy" "yunion.io/x/onecloud/pkg/httperrors" "yunion.io/x/onecloud/pkg/mcclient" "yunion.io/x/onecloud/pkg/util/seclib2" @@ -47,7 +49,7 @@ func (manager *SKeypairManager) ListItemFilter(ctx context.Context, q *sqlchemy. if err != nil { return nil, err } - if userCred.IsSystemAdmin() && jsonutils.QueryBoolean(query, "admin", false) { + if jsonutils.QueryBoolean(query, "admin", false) && userCred.IsAdminAllow(consts.GetServiceType(), manager.KeywordPlural(), policy.PolicyActionList) { user, _ := query.GetString("user") if len(user) > 0 { uc, _ := db.UserCacheManager.FetchUserByIdOrName(user) @@ -71,7 +73,7 @@ func (self *SKeypair) IsOwner(userCred mcclient.TokenCredential) bool { } func (self *SKeypair) AllowGetDetails(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { - return self.IsOwner(userCred) || userCred.IsSystemAdmin() + return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionGet) } func (self *SKeypair) GetCustomizeColumns(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) *jsonutils.JSONDict { @@ -85,7 +87,7 @@ func (self *SKeypair) GetExtraDetails(ctx context.Context, userCred mcclient.Tok extra := self.SStandaloneResourceBase.GetExtraDetails(ctx, userCred, query) extra.Add(jsonutils.NewInt(int64(len(self.PrivateKey))), "private_key_len") extra.Add(jsonutils.NewInt(int64(self.GetLinkedGuestsCount())), "linked_guest_count") - if userCred.IsSystemAdmin() { + if userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionGet) { extra.Add(jsonutils.NewString(self.OwnerId), "owner_id") uc, _ := db.UserCacheManager.FetchUserById(self.OwnerId) if uc != nil { @@ -100,11 +102,11 @@ func (manager *SKeypairManager) AllowCreateItem(ctx context.Context, userCred mc } func (self *SKeypair) AllowUpdateItem(ctx context.Context, userCred mcclient.TokenCredential) bool { - return self.IsOwner(userCred) + return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionUpdate) } func (self *SKeypair) AllowDeleteItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) || userCred.IsSystemAdmin() + return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionDelete) } func (self *SKeypair) GetLinkedGuestsCount() int { diff --git a/pkg/compute/models/loadbalanceracls.go b/pkg/compute/models/loadbalanceracls.go index 94fd544b2a..d177401fe9 100644 --- a/pkg/compute/models/loadbalanceracls.go +++ b/pkg/compute/models/loadbalanceracls.go @@ -12,7 +12,9 @@ import ( "yunion.io/x/pkg/gotypes" "yunion.io/x/sqlchemy" + "yunion.io/x/onecloud/pkg/cloudcommon/consts" "yunion.io/x/onecloud/pkg/cloudcommon/db" + "yunion.io/x/onecloud/pkg/cloudcommon/policy" "yunion.io/x/onecloud/pkg/cloudcommon/validators" "yunion.io/x/onecloud/pkg/httperrors" "yunion.io/x/onecloud/pkg/mcclient" @@ -136,7 +138,7 @@ func (lbacl *SLoadbalancerAcl) ValidateUpdateData(ctx context.Context, userCred } func (lbacl *SLoadbalancerAcl) AllowPerformPatch(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data *jsonutils.JSONDict) bool { - return lbacl.IsOwner(userCred) || userCred.IsSystemAdmin() + return lbacl.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), lbacl.KeywordPlural(), policy.PolicyActionPerform, "patch") } // PerformPatch patches acl entries by adding then deleting the specified acls. diff --git a/pkg/compute/models/loadbalanceragents.go b/pkg/compute/models/loadbalanceragents.go index 29269063fd..b7a0a1f455 100644 --- a/pkg/compute/models/loadbalanceragents.go +++ b/pkg/compute/models/loadbalanceragents.go @@ -12,7 +12,9 @@ import ( "yunion.io/x/log" "yunion.io/x/pkg/gotypes" + "yunion.io/x/onecloud/pkg/cloudcommon/consts" "yunion.io/x/onecloud/pkg/cloudcommon/db" + "yunion.io/x/onecloud/pkg/cloudcommon/policy" "yunion.io/x/onecloud/pkg/cloudcommon/validators" "yunion.io/x/onecloud/pkg/httperrors" "yunion.io/x/onecloud/pkg/mcclient" @@ -354,7 +356,7 @@ func (man *SLoadbalancerAgentManager) CleanPendingDeleteLoadbalancers(ctx contex } func (man *SLoadbalancerAgentManager) AllowCreateItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return userCred.IsAdminAllow(consts.GetServiceType(), man.KeywordPlural(), policy.PolicyActionCreate) } func (lbagent *SLoadbalancerAgent) ValidateUpdateData(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data *jsonutils.JSONDict) (*jsonutils.JSONDict, error) { @@ -400,7 +402,7 @@ func (lbagent *SLoadbalancerAgent) ValidateUpdateData(ctx context.Context, userC } func (lbagent *SLoadbalancerAgent) AllowPerformHb(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data *jsonutils.JSONDict) bool { - return userCred.IsSystemAdmin() + return userCred.IsAdminAllow(consts.GetServiceType(), lbagent.KeywordPlural(), policy.PolicyActionPerform, "hb") } func (lbagent *SLoadbalancerAgent) PerformHb(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data *jsonutils.JSONDict) (*jsonutils.JSONDict, error) { @@ -426,7 +428,7 @@ func (lbagent *SLoadbalancerAgent) IsActive() bool { } func (lbagent *SLoadbalancerAgent) AllowPerformParamsPatch(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data *jsonutils.JSONDict) bool { - return userCred.IsSystemAdmin() + return userCred.IsAdminAllow(consts.GetServiceType(), lbagent.KeywordPlural(), policy.PolicyActionPerform, "params-patch") } func (lbagent *SLoadbalancerAgent) PerformParamsPatch(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data *jsonutils.JSONDict) (*jsonutils.JSONDict, error) { diff --git a/pkg/compute/models/loadbalancerbackends.go b/pkg/compute/models/loadbalancerbackends.go index f82dcc65cc..2ebc741a75 100644 --- a/pkg/compute/models/loadbalancerbackends.go +++ b/pkg/compute/models/loadbalancerbackends.go @@ -7,7 +7,9 @@ import ( "yunion.io/x/jsonutils" "yunion.io/x/sqlchemy" + "yunion.io/x/onecloud/pkg/cloudcommon/consts" "yunion.io/x/onecloud/pkg/cloudcommon/db" + "yunion.io/x/onecloud/pkg/cloudcommon/policy" "yunion.io/x/onecloud/pkg/cloudcommon/validators" "yunion.io/x/onecloud/pkg/mcclient" ) @@ -137,7 +139,7 @@ func (man *SLoadbalancerBackendManager) ValidateCreateData(ctx context.Context, } baseName = guest.Name case LB_BACKEND_HOST: - if !userCred.IsSystemAdmin() { + if !userCred.IsAdminAllow(consts.GetServiceType(), man.KeywordPlural(), policy.PolicyActionCreate) { return nil, fmt.Errorf("only sysadmin can specify host as backend") } backendV := validators.NewModelIdOrNameValidator("backend", "host", userCred.GetProjectId()) diff --git a/pkg/compute/models/loadbalancerlistenerrules.go b/pkg/compute/models/loadbalancerlistenerrules.go index 71be2e4b89..a78f271e25 100644 --- a/pkg/compute/models/loadbalancerlistenerrules.go +++ b/pkg/compute/models/loadbalancerlistenerrules.go @@ -8,7 +8,9 @@ import ( "yunion.io/x/log" "yunion.io/x/sqlchemy" + "yunion.io/x/onecloud/pkg/cloudcommon/consts" "yunion.io/x/onecloud/pkg/cloudcommon/db" + "yunion.io/x/onecloud/pkg/cloudcommon/policy" "yunion.io/x/onecloud/pkg/cloudcommon/validators" "yunion.io/x/onecloud/pkg/httperrors" "yunion.io/x/onecloud/pkg/mcclient" @@ -126,7 +128,7 @@ func (man *SLoadbalancerListenerRuleManager) ValidateCreateData(ctx context.Cont } func (lbr *SLoadbalancerListenerRule) AllowPerformStatus(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return lbr.IsOwner(userCred) || userCred.IsSystemAdmin() + return lbr.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), lbr.KeywordPlural(), policy.PolicyActionPerform, "status") } func (lbr *SLoadbalancerListenerRule) ValidateUpdateData(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data *jsonutils.JSONDict) (*jsonutils.JSONDict, error) { diff --git a/pkg/compute/models/loadbalancerlisteners.go b/pkg/compute/models/loadbalancerlisteners.go index 7ce180e9c1..6a115282fa 100644 --- a/pkg/compute/models/loadbalancerlisteners.go +++ b/pkg/compute/models/loadbalancerlisteners.go @@ -9,8 +9,10 @@ import ( "yunion.io/x/log" "yunion.io/x/sqlchemy" + "yunion.io/x/onecloud/pkg/cloudcommon/consts" "yunion.io/x/onecloud/pkg/cloudcommon/db" "yunion.io/x/onecloud/pkg/cloudcommon/db/lockman" + "yunion.io/x/onecloud/pkg/cloudcommon/policy" "yunion.io/x/onecloud/pkg/cloudcommon/validators" "yunion.io/x/onecloud/pkg/httperrors" "yunion.io/x/onecloud/pkg/mcclient" @@ -295,7 +297,7 @@ func (man *SLoadbalancerListenerManager) validateAcl(aclStatusV *validators.Vali } func (lblis *SLoadbalancerListener) AllowPerformStatus(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return lblis.IsOwner(userCred) || userCred.IsSystemAdmin() + return lblis.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), lblis.KeywordPlural(), policy.PolicyActionPerform, "status") } func (lblis *SLoadbalancerListener) ValidateUpdateData(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data *jsonutils.JSONDict) (*jsonutils.JSONDict, error) { diff --git a/pkg/compute/models/loadbalancers.go b/pkg/compute/models/loadbalancers.go index 787a4b3159..00ce2c2219 100644 --- a/pkg/compute/models/loadbalancers.go +++ b/pkg/compute/models/loadbalancers.go @@ -9,8 +9,10 @@ import ( "yunion.io/x/pkg/util/netutils" "yunion.io/x/sqlchemy" + "yunion.io/x/onecloud/pkg/cloudcommon/consts" "yunion.io/x/onecloud/pkg/cloudcommon/db" "yunion.io/x/onecloud/pkg/cloudcommon/db/lockman" + "yunion.io/x/onecloud/pkg/cloudcommon/policy" "yunion.io/x/onecloud/pkg/cloudcommon/validators" "yunion.io/x/onecloud/pkg/httperrors" "yunion.io/x/onecloud/pkg/mcclient" @@ -132,7 +134,7 @@ func (man *SLoadbalancerManager) ValidateCreateData(ctx context.Context, userCre } func (lb *SLoadbalancer) AllowPerformStatus(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return lb.IsOwner(userCred) || userCred.IsSystemAdmin() + return lb.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), lb.KeywordPlural(), policy.PolicyActionPerform, "status") } func (lb *SLoadbalancer) PostCreate(ctx context.Context, userCred mcclient.TokenCredential, ownerProjId string, query jsonutils.JSONObject, data jsonutils.JSONObject) { diff --git a/pkg/compute/models/networks.go b/pkg/compute/models/networks.go index c1ddf8b93d..d6316a8ff1 100644 --- a/pkg/compute/models/networks.go +++ b/pkg/compute/models/networks.go @@ -17,8 +17,10 @@ import ( "yunion.io/x/pkg/utils" "yunion.io/x/sqlchemy" + "yunion.io/x/onecloud/pkg/cloudcommon/consts" "yunion.io/x/onecloud/pkg/cloudcommon/db" "yunion.io/x/onecloud/pkg/cloudcommon/db/taskman" + "yunion.io/x/onecloud/pkg/cloudcommon/policy" "yunion.io/x/onecloud/pkg/cloudprovider" "yunion.io/x/onecloud/pkg/compute/options" "yunion.io/x/onecloud/pkg/httperrors" @@ -134,7 +136,7 @@ func (self *SNetwork) GetVpc() *SVpc { } func (manager *SNetworkManager) AllowCreateItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return userCred.IsAdminAllow(consts.GetServiceType(), manager.KeywordPlural(), policy.PolicyActionCreate) } func (self *SNetwork) ValidateDeleteCondition(ctx context.Context) error { @@ -627,7 +629,7 @@ func (manager *SNetworkManager) allNetworksQ(rangeObj db.IStandaloneModel) *sqlc func (manager *SNetworkManager) totalPortCountQ(userCred mcclient.TokenCredential, rangeObj db.IStandaloneModel) *sqlchemy.SQuery { q := manager.allNetworksQ(rangeObj) networks := manager.Query().SubQuery() - if userCred != nil && !userCred.IsSystemAdmin() { + if userCred != nil && !userCred.IsAdminAllow(consts.GetServiceType(), manager.KeywordPlural(), policy.PolicyActionList) { q = q.Filter(sqlchemy.OR( sqlchemy.Equals(networks.Field("tenant_id"), userCred.GetProjectId()), sqlchemy.IsTrue(networks.Field("is_public")))) @@ -759,7 +761,8 @@ func isValidNetworkInfo(userCred mcclient.TokenCredential, netConfig *SNetworkCo return httperrors.NewInputParameterError("Address %s not in range", netConfig.Address) } if netConfig.Reserved { - if !userCred.IsSystemAdmin() { + // the privilege to access reserved ip + if !userCred.IsAdminAllow(consts.GetServiceType(), ReservedipManager.KeywordPlural(), policy.PolicyActionGet) { return httperrors.NewForbiddenError("Only system admin allowed to use reserved ip") } if ReservedipManager.GetReservedIP(net, netConfig.Address) == nil { @@ -876,7 +879,7 @@ func (self *SNetwork) GetCustomizeColumns(ctx context.Context, userCred mcclient } func (self *SNetwork) AllowPerformReserveIp(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) + return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "reserve-ip") } func (self *SNetwork) PerformReserveIp(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -903,7 +906,7 @@ func (self *SNetwork) PerformReserveIp(ctx context.Context, userCred mcclient.To } func (self *SNetwork) AllowPerformReleaseReservedIp(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) + return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "release-reserved-ip") } func (self *SNetwork) PerformReleaseReservedIp(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -920,7 +923,7 @@ func (self *SNetwork) PerformReleaseReservedIp(ctx context.Context, userCred mcc } func (self *SNetwork) AllowGetDetailsReservedIps(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { - return self.IsOwner(userCred) + return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionGet, "reserved-ips") } func (self *SNetwork) GetDetailsReservedIps(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -1211,7 +1214,7 @@ func isOverlapNetworks(nets []SNetwork, startIp netutils.IPV4Addr, endIp netutil } func (self *SNetwork) CustomizeCreate(ctx context.Context, userCred mcclient.TokenCredential, ownerProjId string, query jsonutils.JSONObject, data jsonutils.JSONObject) error { - if userCred.IsSystemAdmin() && ownerProjId == userCred.GetProjectId() { + if userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionCreate) && ownerProjId == userCred.GetProjectId() { self.IsPublic = true } else { self.IsPublic = false @@ -1396,7 +1399,7 @@ func (self *SNetwork) ValidateUpdateCondition(ctx context.Context) error { } func (self *SNetwork) AllowPerformPurge(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionDelete) } func (self *SNetwork) PerformPurge(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { diff --git a/pkg/compute/models/reservedips.go b/pkg/compute/models/reservedips.go index a03c11e945..80ca7fa632 100644 --- a/pkg/compute/models/reservedips.go +++ b/pkg/compute/models/reservedips.go @@ -6,7 +6,9 @@ import ( "yunion.io/x/jsonutils" "yunion.io/x/log" + "yunion.io/x/onecloud/pkg/cloudcommon/consts" "yunion.io/x/onecloud/pkg/cloudcommon/db" + "yunion.io/x/onecloud/pkg/cloudcommon/policy" "yunion.io/x/onecloud/pkg/httperrors" "yunion.io/x/onecloud/pkg/mcclient" "yunion.io/x/sqlchemy" @@ -39,7 +41,7 @@ type SReservedip struct { } func (manager *SReservedipManager) AllowListItems(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return userCred.IsAdminAllow(consts.GetServiceType(), manager.KeywordPlural(), policy.PolicyActionList) } func (manager *SReservedipManager) AllowCreateItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { diff --git a/pkg/compute/models/schedpolicies.go b/pkg/compute/models/schedpolicies.go index 185f932e6b..edf88f4832 100644 --- a/pkg/compute/models/schedpolicies.go +++ b/pkg/compute/models/schedpolicies.go @@ -7,7 +7,9 @@ import ( "database/sql" "yunion.io/x/log" + "yunion.io/x/onecloud/pkg/cloudcommon/consts" "yunion.io/x/onecloud/pkg/cloudcommon/db" + "yunion.io/x/onecloud/pkg/cloudcommon/policy" "yunion.io/x/onecloud/pkg/httperrors" "yunion.io/x/onecloud/pkg/mcclient" "yunion.io/x/onecloud/pkg/util/conditionparser" @@ -121,7 +123,7 @@ func (manager *SSchedpolicyManager) getAllEnabledPolicies() []SSchedpolicy { } func (self *SSchedpolicy) AllowPerformEvaluate(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "evaluate") } func (self *SSchedpolicy) PerformEvaluate(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { diff --git a/pkg/compute/models/secgrouprules.go b/pkg/compute/models/secgrouprules.go index e107610536..126cc3ca7f 100644 --- a/pkg/compute/models/secgrouprules.go +++ b/pkg/compute/models/secgrouprules.go @@ -9,7 +9,9 @@ import ( "yunion.io/x/jsonutils" "yunion.io/x/log" + "yunion.io/x/onecloud/pkg/cloudcommon/consts" "yunion.io/x/onecloud/pkg/cloudcommon/db" + "yunion.io/x/onecloud/pkg/cloudcommon/policy" "yunion.io/x/onecloud/pkg/httperrors" "yunion.io/x/onecloud/pkg/mcclient" "yunion.io/x/pkg/util/compare" @@ -78,14 +80,14 @@ func (manager *SSecurityGroupRuleManager) AllowListItems(ctx context.Context, us func (self *SSecurityGroupRule) AllowUpdateItem(ctx context.Context, userCred mcclient.TokenCredential) bool { if secgroup := self.GetSecGroup(); secgroup != nil { - return secgroup.IsOwner(userCred) + return secgroup.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionUpdate) } return false } func (self *SSecurityGroupRule) AllowDeleteItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { if secgroup := self.GetSecGroup(); secgroup != nil { - return secgroup.IsOwner(userCred) + return secgroup.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionDelete) } return false } diff --git a/pkg/compute/models/snapshots.go b/pkg/compute/models/snapshots.go index ea57780729..b586fd9bff 100644 --- a/pkg/compute/models/snapshots.go +++ b/pkg/compute/models/snapshots.go @@ -11,8 +11,10 @@ import ( "yunion.io/x/pkg/util/compare" "yunion.io/x/sqlchemy" + "yunion.io/x/onecloud/pkg/cloudcommon/consts" "yunion.io/x/onecloud/pkg/cloudcommon/db" "yunion.io/x/onecloud/pkg/cloudcommon/db/taskman" + "yunion.io/x/onecloud/pkg/cloudcommon/policy" "yunion.io/x/onecloud/pkg/cloudprovider" "yunion.io/x/onecloud/pkg/compute/options" "yunion.io/x/onecloud/pkg/httperrors" @@ -86,8 +88,8 @@ func ValidateSnapshotName(hypervisor, name, owner string) error { return nil } -func (self *SSnapshot) AllowListItems(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { - return self.IsOwner(userCred) +func (self *SSnapshotManager) AllowListItems(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { + return true } func (manager *SSnapshotManager) ListItemFilter(ctx context.Context, q *sqlchemy.SQuery, userCred mcclient.TokenCredential, query jsonutils.JSONObject) (*sqlchemy.SQuery, error) { @@ -323,7 +325,7 @@ func (self *SSnapshotManager) CreateSnapshot(ctx context.Context, userCred mccli } func (self *SSnapshot) AllowDeleteItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) + return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionDelete) } func (self *SSnapshot) StartSnapshotDeleteTask(ctx context.Context, userCred mcclient.TokenCredential, reloadDisk bool, parentTaskId string) error { @@ -364,7 +366,7 @@ func (self *SSnapshot) CustomizeDelete(ctx context.Context, userCred mcclient.To } func (self *SSnapshot) AllowPerformDeleted(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) + return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionDelete) } func (self *SSnapshot) PerformDeleted(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -401,7 +403,7 @@ func (self *SSnapshotManager) GetConvertSnapshot(deleteSnapshot *SSnapshot) (*SS } func (self *SSnapshotManager) AllowPerformDeleteDiskSnapshots(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsAdmin() + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "delete-disk-snapshots") } func (self *SSnapshotManager) PerformDeleteDiskSnapshots(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -586,7 +588,7 @@ func (self *SSnapshot) GetISnapshotRegion() (cloudprovider.ICloudRegion, error) } func (self *SSnapshot) AllowPerformPurge(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionDelete) } func (self *SSnapshot) PerformPurge(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { diff --git a/pkg/compute/models/storagecachedimages.go b/pkg/compute/models/storagecachedimages.go index 4a646c146d..29d5889890 100644 --- a/pkg/compute/models/storagecachedimages.go +++ b/pkg/compute/models/storagecachedimages.go @@ -11,8 +11,10 @@ import ( "yunion.io/x/pkg/utils" "yunion.io/x/sqlchemy" + "yunion.io/x/onecloud/pkg/cloudcommon/consts" "yunion.io/x/onecloud/pkg/cloudcommon/db" "yunion.io/x/onecloud/pkg/cloudcommon/db/lockman" + "yunion.io/x/onecloud/pkg/cloudcommon/policy" "yunion.io/x/onecloud/pkg/httperrors" "yunion.io/x/onecloud/pkg/mcclient" ) @@ -127,7 +129,7 @@ func (self *SStoragecachedimage) GetExtraDetails(ctx context.Context, userCred m } func (manager *SStoragecachedimageManager) AllowListDescendent(ctx context.Context, userCred mcclient.TokenCredential, model db.IStandaloneModel, query jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return userCred.IsAdminAllow(consts.GetServiceType(), manager.KeywordPlural(), policy.PolicyActionList) } func (self *SStoragecachedimage) GetCachedimage() *SCachedimage { diff --git a/pkg/compute/models/storagecaches.go b/pkg/compute/models/storagecaches.go index 240a99782b..78f33ad971 100644 --- a/pkg/compute/models/storagecaches.go +++ b/pkg/compute/models/storagecaches.go @@ -9,8 +9,10 @@ import ( "yunion.io/x/log" "yunion.io/x/sqlchemy" + "yunion.io/x/onecloud/pkg/cloudcommon/consts" "yunion.io/x/onecloud/pkg/cloudcommon/db" "yunion.io/x/onecloud/pkg/cloudcommon/db/taskman" + "yunion.io/x/onecloud/pkg/cloudcommon/policy" "yunion.io/x/onecloud/pkg/cloudprovider" "yunion.io/x/onecloud/pkg/httperrors" "yunion.io/x/onecloud/pkg/mcclient" @@ -292,7 +294,7 @@ func (self *SStoragecache) ValidateDeleteCondition(ctx context.Context) error { } func (self *SStoragecache) AllowPerformUncacheImage(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "uncache-image") } func (self *SStoragecache) PerformUncacheImage(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -329,7 +331,7 @@ func (self *SStoragecache) PerformUncacheImage(ctx context.Context, userCred mcc } func (self *SStoragecache) AllowPerformCacheImage(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "cache-image") } func (self *SStoragecache) PerformCacheImage(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { diff --git a/pkg/compute/models/storages.go b/pkg/compute/models/storages.go index abab9ce61b..7a76c6e995 100644 --- a/pkg/compute/models/storages.go +++ b/pkg/compute/models/storages.go @@ -5,7 +5,9 @@ import ( "yunion.io/x/jsonutils" "yunion.io/x/log" + "yunion.io/x/onecloud/pkg/cloudcommon/consts" "yunion.io/x/onecloud/pkg/cloudcommon/db" + "yunion.io/x/onecloud/pkg/cloudcommon/policy" "yunion.io/x/onecloud/pkg/cloudprovider" "yunion.io/x/onecloud/pkg/compute/options" "yunion.io/x/onecloud/pkg/httperrors" @@ -692,7 +694,7 @@ func (self *SStorage) SetStoragecache(cache *SStoragecache) error { } func (self *SStorage) AllowPerformCacheImage(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "cache-image") } func (self *SStorage) GetStoragecache() *SStoragecache { @@ -714,7 +716,7 @@ func (self *SStorage) PerformCacheImage(ctx context.Context, userCred mcclient.T } func (self *SStorage) AllowPerformUncacheImage(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "uncache-image") } func (self *SStorage) PerformUncacheImage(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { diff --git a/pkg/compute/models/vpcs.go b/pkg/compute/models/vpcs.go index 842f55b98b..532dd2a512 100644 --- a/pkg/compute/models/vpcs.go +++ b/pkg/compute/models/vpcs.go @@ -11,8 +11,10 @@ import ( "yunion.io/x/pkg/util/netutils" "yunion.io/x/sqlchemy" + "yunion.io/x/onecloud/pkg/cloudcommon/consts" "yunion.io/x/onecloud/pkg/cloudcommon/db" "yunion.io/x/onecloud/pkg/cloudcommon/db/taskman" + "yunion.io/x/onecloud/pkg/cloudcommon/policy" "yunion.io/x/onecloud/pkg/cloudprovider" "yunion.io/x/onecloud/pkg/httperrors" "yunion.io/x/onecloud/pkg/mcclient" @@ -456,7 +458,7 @@ func (self *SVpc) getIPRange() netutils.IPV4AddrRange { } func (self *SVpc) AllowPerformPurge(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionDelete) } func (self *SVpc) PerformPurge(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { diff --git a/pkg/compute/specs/handler.go b/pkg/compute/specs/handler.go index 2cf3b80d39..a7bc1a11b8 100644 --- a/pkg/compute/specs/handler.go +++ b/pkg/compute/specs/handler.go @@ -12,6 +12,7 @@ import ( "yunion.io/x/onecloud/pkg/appctx" "yunion.io/x/onecloud/pkg/appsrv" + "yunion.io/x/onecloud/pkg/cloudcommon/policy" "yunion.io/x/onecloud/pkg/compute/models" "yunion.io/x/onecloud/pkg/httperrors" "yunion.io/x/onecloud/pkg/mcclient" @@ -42,7 +43,7 @@ func AddSpecHandler(prefix string, app *appsrv.Application) { func processFilter(handleFunc specHandleFunc) appsrv.FilterHandler { return func(ctx context.Context, w http.ResponseWriter, r *http.Request) { - userCred := auth.FetchUserCredential(ctx) + userCred := auth.FetchUserCredential(ctx, policy.FilterPolicyCredential) query, err := jsonutils.ParseQueryString(r.URL.RawQuery) if err != nil { httperrors.GeneralServerError(w, err) diff --git a/pkg/compute/sshkeys/handler.go b/pkg/compute/sshkeys/handler.go index f6bda5d2cf..85f8777933 100644 --- a/pkg/compute/sshkeys/handler.go +++ b/pkg/compute/sshkeys/handler.go @@ -9,7 +9,9 @@ import ( "yunion.io/x/jsonutils" "yunion.io/x/onecloud/pkg/appctx" "yunion.io/x/onecloud/pkg/appsrv" + "yunion.io/x/onecloud/pkg/cloudcommon/consts" "yunion.io/x/onecloud/pkg/cloudcommon/db" + "yunion.io/x/onecloud/pkg/cloudcommon/policy" "yunion.io/x/onecloud/pkg/httperrors" "yunion.io/x/onecloud/pkg/mcclient" "yunion.io/x/onecloud/pkg/mcclient/auth" @@ -22,8 +24,8 @@ func AddSshKeysHandler(prefix string, app *appsrv.Application) { func adminSshKeysHandler(ctx context.Context, w http.ResponseWriter, r *http.Request) { publicOnly := false - userCred := auth.FetchUserCredential(ctx) - if !userCred.IsSystemAdmin() { + userCred := auth.FetchUserCredential(ctx, policy.FilterPolicyCredential) + if !userCred.IsAdminAllow(consts.GetServiceType(), "sshkeypairs", policy.PolicyActionGet) { publicOnly = true } params := appctx.AppContextParams(ctx) @@ -53,7 +55,7 @@ func adminSshKeysHandler(ctx context.Context, w http.ResponseWriter, r *http.Req } func sshKeysHandler(ctx context.Context, w http.ResponseWriter, r *http.Request) { - userCred := auth.FetchUserCredential(ctx) + userCred := auth.FetchUserCredential(ctx, policy.FilterPolicyCredential) query, err := jsonutils.ParseQueryString(r.URL.RawQuery) if err != nil { httperrors.GeneralServerError(w, err) @@ -67,7 +69,7 @@ func sshKeysHandler(ctx context.Context, w http.ResponseWriter, r *http.Request) func sendSshKey(ctx context.Context, w http.ResponseWriter, userCred mcclient.TokenCredential, projectId string, isAdmin bool, publicOnly bool) { var privKey, pubKey string - if isAdmin && userCred.IsSystemAdmin() { + if isAdmin && userCred.IsAdminAllow(consts.GetServiceType(), "sshkeypairs", policy.PolicyActionGet) { privKey, pubKey, _ = GetSshAdminKeypair(ctx) } else { privKey, pubKey, _ = GetSshProjectKeypair(ctx, projectId) diff --git a/pkg/compute/usages/handler.go b/pkg/compute/usages/handler.go index 7a32ccfddd..edd4300612 100644 --- a/pkg/compute/usages/handler.go +++ b/pkg/compute/usages/handler.go @@ -75,7 +75,7 @@ func rangeObjHandler( reporter objUsageFunc, ) appsrv.FilterHandler { return func(ctx context.Context, w http.ResponseWriter, r *http.Request) { - userCred := auth.FetchUserCredential(ctx) + userCred := auth.FetchUserCredential(ctx, policy.FilterPolicyCredential) obj, err := getRangeObj(ctx, manager, userCred) if err != nil { httperrors.NotFoundError(w, err.Error()) @@ -276,7 +276,7 @@ func ReportGeneralUsage(userCred mcclient.TokenCredential, rangeObj db.IStandalo isAdmin = true } } else { - isAdmin = userCred.IsSystemAdmin() + isAdmin = userCred.IsAdminAllow(consts.GetServiceType(), "usages", policy.PolicyActionGet) } if isAdmin { diff --git a/pkg/mcclient/auth/middleware.go b/pkg/mcclient/auth/middleware.go index fa14ac898c..5c892a33ce 100644 --- a/pkg/mcclient/auth/middleware.go +++ b/pkg/mcclient/auth/middleware.go @@ -53,10 +53,14 @@ func AuthenticateWithDelayDecision(f appsrv.FilterHandler, delayDecision bool) a } } -func FetchUserCredential(ctx context.Context) mcclient.TokenCredential { +func FetchUserCredential(ctx context.Context, filter func(mcclient.TokenCredential) mcclient.TokenCredential) mcclient.TokenCredential { tokenValue := ctx.Value(AUTH_TOKEN) if tokenValue != nil { - return tokenValue.(mcclient.TokenCredential) + token := tokenValue.(mcclient.TokenCredential) + if filter != nil { + token = filter(token) + } + return token } return nil } diff --git a/pkg/mcclient/modules/base.go b/pkg/mcclient/modules/base.go index 3a71f43eac..97becef66b 100644 --- a/pkg/mcclient/modules/base.go +++ b/pkg/mcclient/modules/base.go @@ -32,7 +32,7 @@ func NewBaseManager(serviceType, endpointType, version string, columns, adminCol func (this *BaseManager) GetColumns(session *mcclient.ClientSession) []string { cols := this.columns - if session.IsSystemAdmin() && len(this.adminColumns) > 0 { + if session.HasSystemAdminPrivelege() && len(this.adminColumns) > 0 { cols = append(cols, this.adminColumns...) } return cols diff --git a/pkg/mcclient/session.go b/pkg/mcclient/session.go index fdf29f278d..574878ab3a 100644 --- a/pkg/mcclient/session.go +++ b/pkg/mcclient/session.go @@ -9,7 +9,6 @@ import ( "regexp" "strings" "time" - "yunion.io/x/jsonutils" "yunion.io/x/onecloud/pkg/util/httputils" "yunion.io/x/pkg/utils" @@ -150,8 +149,8 @@ func (this *ClientSession) ParseJSONResponse(resp *http.Response, err error) (ht return httputils.ParseJSONResponse(resp, err, this.client.debug) } -func (this *ClientSession) IsSystemAdmin() bool { - return this.token.IsSystemAdmin() +func (this *ClientSession) HasSystemAdminPrivelege() bool { + return this.token.HasSystemAdminPrivelege() } func (this *ClientSession) GetRegion() string { diff --git a/pkg/mcclient/token.go b/pkg/mcclient/token.go index 6aef27acd7..a2a0ab7ad8 100644 --- a/pkg/mcclient/token.go +++ b/pkg/mcclient/token.go @@ -44,8 +44,9 @@ type TokenCredential interface { GetExpires() time.Time IsValid() bool ValidDuration() time.Duration - IsAdmin() bool - IsSystemAdmin() bool + // IsAdmin() bool + HasSystemAdminPrivelege() bool + IsAdminAllow(service string, resource string, action string, extra ...string) bool GetRegions() []string GetServiceCatalog() IServiceCatalog diff --git a/pkg/mcclient/token2.go b/pkg/mcclient/token2.go index f2a8eb8a43..f64d045014 100644 --- a/pkg/mcclient/token2.go +++ b/pkg/mcclient/token2.go @@ -130,10 +130,14 @@ func (this *TokenCredentialV2) GetRegions() []string { return this.ServiceCatalog.getRegions() } -func (this *TokenCredentialV2) IsSystemAdmin() bool { +func (this *TokenCredentialV2) HasSystemAdminPrivelege() bool { return this.IsAdmin() && this.GetTenantName() == "system" } +func (this *TokenCredentialV2) IsAdminAllow(service string, resource string, action string, extra ...string) bool { + return this.HasSystemAdminPrivelege() +} + func (this *TokenCredentialV2) GetServiceURL(service, region, zone, endpointType string) (string, error) { return this.ServiceCatalog.GetServiceURL(service, region, zone, endpointType) } diff --git a/pkg/mcclient/token3.go b/pkg/mcclient/token3.go index bc172bf78d..38e962b119 100644 --- a/pkg/mcclient/token3.go +++ b/pkg/mcclient/token3.go @@ -135,10 +135,14 @@ func (this *TokenCredentialV3) IsAdmin() bool { return false } -func (this *TokenCredentialV3) IsSystemAdmin() bool { +func (this *TokenCredentialV3) HasSystemAdminPrivelege() bool { return this.IsAdmin() && this.GetTenantName() == "system" } +func (this *TokenCredentialV3) IsAdminAllow(service string, resource string, action string, extra ...string) bool { + return this.HasSystemAdminPrivelege() +} + func (this *TokenCredentialV3) GetRegions() []string { return this.Token.Catalog.getRegions() } diff --git a/pkg/mcclient/tokensimple.go b/pkg/mcclient/tokensimple.go index f10c2b73fa..15a8badbfb 100644 --- a/pkg/mcclient/tokensimple.go +++ b/pkg/mcclient/tokensimple.go @@ -84,10 +84,14 @@ func (self *SSimpleToken) IsAdmin() bool { return false } -func (self *SSimpleToken) IsSystemAdmin() bool { +func (self *SSimpleToken) HasSystemAdminPrivelege() bool { return self.IsAdmin() && self.Project == "system" } +func (this *SSimpleToken) IsAdminAllow(service string, resource string, action string, extra ...string) bool { + return this.HasSystemAdminPrivelege() +} + func (self *SSimpleToken) GetRegions() []string { return nil } diff --git a/pkg/webconsole/handlers.go b/pkg/webconsole/handlers.go index 37b2c47071..67ed8f81f6 100644 --- a/pkg/webconsole/handlers.go +++ b/pkg/webconsole/handlers.go @@ -17,6 +17,7 @@ import ( "yunion.io/x/onecloud/pkg/webconsole/command" o "yunion.io/x/onecloud/pkg/webconsole/options" "yunion.io/x/onecloud/pkg/webconsole/session" + "yunion.io/x/onecloud/pkg/cloudcommon/policy" ) const ( @@ -102,7 +103,7 @@ type CloudEnv struct { func fetchCloudEnv(ctx context.Context, w http.ResponseWriter, r *http.Request) (*CloudEnv, error) { params, query, body := appsrv.FetchEnv(ctx, w, r) - userCred := auth.FetchUserCredential(ctx) + userCred := auth.FetchUserCredential(ctx, policy.FilterPolicyCredential) if userCred == nil { return nil, httperrors.NewUnauthorizedError("No token founded") } @@ -141,7 +142,7 @@ func handleK8sLog(ctx context.Context, w http.ResponseWriter, r *http.Request) { } func handleSshShell(ctx context.Context, w http.ResponseWriter, r *http.Request) { - userCred := auth.FetchUserCredential(ctx) + userCred := auth.FetchUserCredential(ctx, policy.FilterPolicyCredential) env, err := fetchCloudEnv(ctx, w, r) if err != nil { httperrors.GeneralServerError(w, err) diff --git a/pkg/webconsole/service/service.go b/pkg/webconsole/service/service.go index d86ef761c4..cc89ee6122 100644 --- a/pkg/webconsole/service/service.go +++ b/pkg/webconsole/service/service.go @@ -15,6 +15,7 @@ import ( "yunion.io/x/onecloud/pkg/webconsole" o "yunion.io/x/onecloud/pkg/webconsole/options" "yunion.io/x/onecloud/pkg/webconsole/server" + "yunion.io/x/onecloud/pkg/cloudcommon/consts" ) func ensureBinExists(binPath string) { @@ -24,6 +25,8 @@ func ensureBinExists(binPath string) { } func StartService() { + consts.SetServiceType("webconsole") + cloudcommon.ParseOptions(&o.Options, &o.Options.Options, os.Args, "webconsole.conf") if o.Options.ApiServer == "" { diff --git a/pkg/yunionconf/models/parameters.go b/pkg/yunionconf/models/parameters.go index 9f3f56f97f..dbb11026be 100644 --- a/pkg/yunionconf/models/parameters.go +++ b/pkg/yunionconf/models/parameters.go @@ -11,6 +11,8 @@ import ( "yunion.io/x/pkg/util/timeutils" "yunion.io/x/pkg/utils" "yunion.io/x/sqlchemy" + "yunion.io/x/onecloud/pkg/cloudcommon/consts" + "yunion.io/x/onecloud/pkg/cloudcommon/policy" ) const ( @@ -72,7 +74,7 @@ func getNamespaceInContext(userCred mcclient.TokenCredential, query jsonutils.JS func getNamespace(userCred mcclient.TokenCredential, query jsonutils.JSONObject, data *jsonutils.JSONDict) (string, string, error) { var namespace, namespace_id string - if userCred.IsSystemAdmin() { + if userCred.IsAdminAllow(consts.GetServiceType(), ParameterManager.KeywordPlural(), policy.PolicyActionGet) { if name, nameId, e := getNamespaceInContext(userCred, query, data); e != nil { return "", "", e } else { @@ -92,7 +94,7 @@ func (manager *SParameterManager) AllowListItems(ctx context.Context, userCred m return true } - return userCred.IsSystemAdmin() + return userCred.IsAdminAllow(consts.GetServiceType(), manager.KeywordPlural(), policy.PolicyActionList) } func (manager *SParameterManager) AllowCreateItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { @@ -100,7 +102,7 @@ func (manager *SParameterManager) AllowCreateItem(ctx context.Context, userCred return true } - return userCred.IsSystemAdmin() + return userCred.IsAdminAllow(consts.GetServiceType(), manager.KeywordPlural(), policy.PolicyActionCreate) } func (manager *SParameterManager) ValidateCreateData(ctx context.Context, userCred mcclient.TokenCredential, ownerProjId string, query jsonutils.JSONObject, data *jsonutils.JSONDict) (*jsonutils.JSONDict, error) { @@ -146,7 +148,7 @@ func (manager *SParameterManager) FilterByName(q *sqlchemy.SQuery, name string) } func (manager *SParameterManager) ListItemFilter(ctx context.Context, q *sqlchemy.SQuery, userCred mcclient.TokenCredential, query jsonutils.JSONObject) (*sqlchemy.SQuery, error) { - if userCred.IsSystemAdmin() { + if userCred.IsAdminAllow(consts.GetServiceType(), manager.KeywordPlural(), policy.PolicyActionList) { if id, _ := query.GetString("namespace_id"); len(id) > 0 { q = q.Equals("namespace_id", id) } else if id, _ := query.GetString("service_id"); len(id) > 0 { @@ -171,7 +173,7 @@ func (model *SParameter) IsOwner(userCred mcclient.TokenCredential) bool { } func (model *SParameter) AllowUpdateItem(ctx context.Context, userCred mcclient.TokenCredential) bool { - return model.IsOwner(userCred) || userCred.IsSystemAdmin() + return model.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), model.KeywordPlural(), policy.PolicyActionUpdate) } func (model *SParameter) ValidateUpdateData(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data *jsonutils.JSONDict) (*jsonutils.JSONDict, error) { @@ -191,7 +193,7 @@ func (model *SParameter) ValidateUpdateData(ctx context.Context, userCred mcclie } func (model *SParameter) AllowDeleteItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return model.IsOwner(userCred) || userCred.IsSystemAdmin() + return model.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), model.KeywordPlural(), policy.PolicyActionDelete) } func (model *SParameter) CustomizeDelete(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) error { @@ -211,5 +213,5 @@ func (model *SParameter) Delete(ctx context.Context, userCred mcclient.TokenCred } func (model *SParameter) AllowGetDetails(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { - return model.IsOwner(userCred) || userCred.IsSystemAdmin() + return model.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), model.KeywordPlural(), policy.PolicyActionGet) } diff --git a/pkg/yunionconf/service/service.go b/pkg/yunionconf/service/service.go index 8899ce3f1f..9520a5dfba 100644 --- a/pkg/yunionconf/service/service.go +++ b/pkg/yunionconf/service/service.go @@ -16,6 +16,8 @@ import ( ) func StartService() { + consts.SetServiceType("yunionconf") + cloudcommon.ParseOptions(&options.Options, &options.Options.Options, os.Args, "yunionconf.conf") cloudcommon.InitAuth(&options.Options.Options, func() { log.Infof("Auth complete!!") From bc0b5d1e44bce18e560ab1b42a15141eb700aa99 Mon Sep 17 00:00:00 2001 From: Qiu Jian Date: Fri, 30 Nov 2018 23:29:03 +0800 Subject: [PATCH 09/15] fix userCred.IsSystemAdmin() for set/del extra option --- pkg/compute/models/guest_actions.go | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkg/compute/models/guest_actions.go b/pkg/compute/models/guest_actions.go index c696b687e5..83d92064c6 100644 --- a/pkg/compute/models/guest_actions.go +++ b/pkg/compute/models/guest_actions.go @@ -1740,7 +1740,7 @@ func (self *SGuest) PerformUserData(ctx context.Context, userCred mcclient.Token } func (self *SGuest) AllowPerformSetExtraOption(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "set-extra-option") } func (self *SGuest) PerformSetExtraOption(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -1768,7 +1768,7 @@ func (self *SGuest) SetExtraOptions(ctx context.Context, userCred mcclient.Token } func (self *SGuest) AllowPerformDelExtraOption(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "del-extra-option") } func (self *SGuest) PerformDelExtraOption(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { From 334f3605bab8878490a2f67567e9fc8f1deb6319 Mon Sep 17 00:00:00 2001 From: Qiu Jian Date: Sat, 1 Dec 2018 00:42:29 +0800 Subject: [PATCH 10/15] minor fixes --- pkg/cloudcommon/db/interface.go | 1 + pkg/cloudcommon/db/keystonecache.go | 2 +- pkg/cloudcommon/db/opslog.go | 7 ------- pkg/cloudcommon/db/tenantcache.go | 4 ++-- pkg/cloudcommon/db/usercache.go | 4 ++-- pkg/compute/models/secgrouprules.go | 2 +- 6 files changed, 7 insertions(+), 13 deletions(-) diff --git a/pkg/cloudcommon/db/interface.go b/pkg/cloudcommon/db/interface.go index b42c522bb9..aefec45f8b 100644 --- a/pkg/cloudcommon/db/interface.go +++ b/pkg/cloudcommon/db/interface.go @@ -22,6 +22,7 @@ type IModelManager interface { KeywordPlural() string Alias() string AliasPlural() string + SetAlias(alias string, aliasPlural string) ValidateName(name string) error diff --git a/pkg/cloudcommon/db/keystonecache.go b/pkg/cloudcommon/db/keystonecache.go index cfe3cbc45c..306fcef368 100644 --- a/pkg/cloudcommon/db/keystonecache.go +++ b/pkg/cloudcommon/db/keystonecache.go @@ -64,7 +64,7 @@ func NewKeystoneCacheObject(id string, name string, domainId string, domain stri }*/ func (manager *SKeystoneCacheObjectManager) BatchFetchNames(idStrs []string) []string { - t := manager.tableSpec.Instance() + t := manager.TableSpec().Instance() results, err := t.Query(t.Field("name")).In("id", idStrs).AllStringMap() if err != nil { return nil diff --git a/pkg/cloudcommon/db/opslog.go b/pkg/cloudcommon/db/opslog.go index 456c617697..45c147eb9e 100644 --- a/pkg/cloudcommon/db/opslog.go +++ b/pkg/cloudcommon/db/opslog.go @@ -176,13 +176,6 @@ var _ IModel = (*SOpsLog)(nil) func init() { OpsLog = &SOpsLogManager{NewModelBaseManager(SOpsLog{}, "opslog_tbl", "event", "events")} - -} - -func (manager *SOpsLogManager) SetKeyword(kw, kwPlural string) *SOpsLogManager { - manager.keyword = kw - manager.keywordPlural = kwPlural - return manager } func (opslog *SOpsLog) GetId() string { diff --git a/pkg/cloudcommon/db/tenantcache.go b/pkg/cloudcommon/db/tenantcache.go index f2a7aa6068..6b8f4c3f69 100644 --- a/pkg/cloudcommon/db/tenantcache.go +++ b/pkg/cloudcommon/db/tenantcache.go @@ -90,8 +90,8 @@ func (manager *STenantCacheManager) fetchTenantFromKeystone(ctx context.Context, } func (manager *STenantCacheManager) Save(ctx context.Context, idStr string, name string, domainId string, domain string) (*STenant, error) { - lockman.LockRawObject(ctx, manager.keyword, idStr) - defer lockman.ReleaseRawObject(ctx, manager.keyword, idStr) + lockman.LockRawObject(ctx, manager.KeywordPlural(), idStr) + defer lockman.ReleaseRawObject(ctx, manager.KeywordPlural(), idStr) objo, err := manager.FetchById(idStr) if err != nil && err != sql.ErrNoRows { diff --git a/pkg/cloudcommon/db/usercache.go b/pkg/cloudcommon/db/usercache.go index 1fe3f560c5..7b01d845bc 100644 --- a/pkg/cloudcommon/db/usercache.go +++ b/pkg/cloudcommon/db/usercache.go @@ -53,8 +53,8 @@ func (manager *SUserCacheManager) FetchUserByName(idStr string) (*SUser, error) } func (manager *SUserCacheManager) Save(ctx context.Context, idStr string, name string, domainId string, domain string) (*SUser, error) { - lockman.LockRawObject(ctx, manager.keyword, idStr) - defer lockman.ReleaseRawObject(ctx, manager.keyword, idStr) + lockman.LockRawObject(ctx, manager.KeywordPlural(), idStr) + defer lockman.ReleaseRawObject(ctx, manager.KeywordPlural(), idStr) obj, err := manager.FetchUserById(idStr) if err != nil && err != sql.ErrNoRows { diff --git a/pkg/compute/models/secgrouprules.go b/pkg/compute/models/secgrouprules.go index 91c6abc17f..93ae01adee 100644 --- a/pkg/compute/models/secgrouprules.go +++ b/pkg/compute/models/secgrouprules.go @@ -203,7 +203,7 @@ func (manager *SSecurityGroupRuleManager) ValidateCreateData(ctx context.Context if err != nil { return nil, httperrors.NewInputParameterError(err.Error()) } - return manager.SModelBaseManager.ValidateCreateData(ctx, userCred, ownerProjId, query, data) + return manager.SResourceBaseManager.ValidateCreateData(ctx, userCred, ownerProjId, query, data) } func (self *SSecurityGroupRule) ValidateUpdateData(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data *jsonutils.JSONDict) (*jsonutils.JSONDict, error) { From b4fcb63b643d4e751200779b7e71fe75edb9198b Mon Sep 17 00:00:00 2001 From: Qiu Jian Date: Sat, 1 Dec 2018 01:05:13 +0800 Subject: [PATCH 11/15] Remove SInfrastructureManager & SInfrasture --- pkg/cloudcommon/policy/policy.go | 24 ++++++++++++++++++ pkg/compute/models/baremetalagents.go | 22 ++++++++++++++-- pkg/compute/models/cachedimages.go | 22 ++++++++++++++-- pkg/compute/models/cloudaccounts.go | 22 ++++++++++++++-- pkg/compute/models/cloudproviders.go | 22 ++++++++++++++-- pkg/compute/models/cloudregions.go | 18 +++++++++++-- pkg/compute/models/dynamicschedtags.go | 22 ++++++++++++++-- pkg/compute/models/hosts.go | 31 +++++++++++++---------- pkg/compute/models/inframanagers.go | 30 ++-------------------- pkg/compute/models/loadbalanceragents.go | 27 +++++++++++++++----- pkg/compute/models/schedpolicies.go | 22 ++++++++++++++-- pkg/compute/models/schedtags.go | 16 ++++++++++-- pkg/compute/models/storagecachedimages.go | 22 ++++++++++++++-- pkg/compute/models/storagecaches.go | 22 ++++++++++++++-- pkg/compute/models/storages.go | 25 ++++++++++++++---- pkg/compute/models/vcenters.go | 2 -- pkg/compute/models/vpcs.go | 22 ++++++++++++++-- pkg/compute/models/wires.go | 24 ++++++++++++++++-- pkg/compute/models/zones.go | 20 +++++++++++++-- 19 files changed, 335 insertions(+), 80 deletions(-) diff --git a/pkg/cloudcommon/policy/policy.go b/pkg/cloudcommon/policy/policy.go index 2431c64ea5..019f2c4284 100644 --- a/pkg/cloudcommon/policy/policy.go +++ b/pkg/cloudcommon/policy/policy.go @@ -48,6 +48,30 @@ var ( Action: PolicyActionGet, Result: rbacutils.UserAllow, }, + { + Service: "compute", + Resource: "storages", + Action: PolicyActionList, + Result: rbacutils.UserAllow, + }, + { + Service: "compute", + Resource: "storages", + Action: PolicyActionGet, + Result: rbacutils.UserAllow, + }, + { + Service: "compute", + Resource: "schedtags", + Action: PolicyActionList, + Result: rbacutils.UserAllow, + }, + { + Service: "compute", + Resource: "schedtags", + Action: PolicyActionGet, + Result: rbacutils.UserAllow, + }, { Service: "compute", Resource: "cloudregions", diff --git a/pkg/compute/models/baremetalagents.go b/pkg/compute/models/baremetalagents.go index 606333ea67..5bbf758354 100644 --- a/pkg/compute/models/baremetalagents.go +++ b/pkg/compute/models/baremetalagents.go @@ -21,12 +21,10 @@ const ( type SBaremetalagentManager struct { db.SStandaloneResourceBaseManager - SInfrastructureManager } type SBaremetalagent struct { db.SStandaloneResourceBase - SInfrastructure Status string `width:"36" charset:"ascii" nullable:"false" default:"disable" list:"user" create:"optional"` AccessIp string `width:"16" charset:"ascii" nullable:"false" list:"admin" update:"admin" create:"admin_required"` @@ -40,6 +38,26 @@ func init() { BaremetalagentManager = &SBaremetalagentManager{SStandaloneResourceBaseManager: db.NewStandaloneResourceBaseManager(SBaremetalagent{}, "baremetalagents_tbl", "baremetalagent", "baremetalagents")} } +func (self *SBaremetalagentManager) AllowListItems(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionList) +} + +func (self *SBaremetalagentManager) AllowCreateItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionCreate) +} + +func (self *SBaremetalagent) AllowGetDetails(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionGet) +} + +func (self *SBaremetalagent) AllowUpdateItem(ctx context.Context, userCred mcclient.TokenCredential) bool { + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionUpdate) +} + +func (self *SBaremetalagent) AllowDeleteItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionDelete) +} + func (self *SBaremetalagent) ValidateDeleteCondition(ctx context.Context) error { if self.Status == BAREMETAL_AGENT_ENABLED { return fmt.Errorf("Cannot delete in status %s", self.Status) diff --git a/pkg/compute/models/cachedimages.go b/pkg/compute/models/cachedimages.go index 67e0069e25..1a4ac36bfb 100644 --- a/pkg/compute/models/cachedimages.go +++ b/pkg/compute/models/cachedimages.go @@ -30,7 +30,6 @@ const ( type SCachedimageManager struct { db.SStandaloneResourceBaseManager - SInfrastructureManager } var CachedimageManager *SCachedimageManager @@ -48,7 +47,6 @@ func init() { type SCachedimage struct { db.SStandaloneResourceBase - SInfrastructure Size int64 `nullable:"false" list:"admin" update:"admin" create:"admin_required"` // = Column(BigInteger, nullable=False) # in Byte // virtual_size = Column(BigInteger, nullable=False) # in Byte @@ -58,6 +56,26 @@ type SCachedimage struct { RefCount int `default:"0" list:"admin"` // = Column(Integer, default=0, server_default='0') } +func (self *SCachedimageManager) AllowListItems(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionList) +} + +func (self *SCachedimageManager) AllowCreateItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionCreate) +} + +func (self *SCachedimage) AllowGetDetails(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionGet) +} + +func (self *SCachedimage) AllowUpdateItem(ctx context.Context, userCred mcclient.TokenCredential) bool { + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionUpdate) +} + +func (self *SCachedimage) AllowDeleteItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionDelete) +} + func (self *SCachedimage) ValidateDeleteCondition(ctx context.Context) error { if self.getStoragecacheCount() > 0 { return httperrors.NewNotEmptyError("The image has been cached on storages") diff --git a/pkg/compute/models/cloudaccounts.go b/pkg/compute/models/cloudaccounts.go index 93d0bce62d..9b3b51f2ff 100644 --- a/pkg/compute/models/cloudaccounts.go +++ b/pkg/compute/models/cloudaccounts.go @@ -25,7 +25,6 @@ import ( type SCloudaccountManager struct { db.SEnabledStatusStandaloneResourceBaseManager - SInfrastructureManager } var CloudaccountManager *SCloudaccountManager @@ -43,7 +42,6 @@ func init() { type SCloudaccount struct { db.SEnabledStatusStandaloneResourceBase - SInfrastructure AccessUrl string `width:"64" charset:"ascii" nullable:"true" list:"admin" update:"admin" create:"admin_optional"` @@ -60,6 +58,26 @@ type SCloudaccount struct { Provider string `width:"64" charset:"ascii" list:"admin" create:"admin_required"` } +func (self *SCloudaccountManager) AllowListItems(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionList) +} + +func (self *SCloudaccountManager) AllowCreateItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionCreate) +} + +func (self *SCloudaccount) AllowGetDetails(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionGet) +} + +func (self *SCloudaccount) AllowUpdateItem(ctx context.Context, userCred mcclient.TokenCredential) bool { + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionUpdate) +} + +func (self *SCloudaccount) AllowDeleteItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionDelete) +} + func (self *SCloudaccount) GetCloudproviders() []SCloudprovider { cloudproviders := []SCloudprovider{} q := CloudproviderManager.Query().Equals("cloudaccount_id", self.Id) diff --git a/pkg/compute/models/cloudproviders.go b/pkg/compute/models/cloudproviders.go index 9ba07a5600..959166aed1 100644 --- a/pkg/compute/models/cloudproviders.go +++ b/pkg/compute/models/cloudproviders.go @@ -40,7 +40,6 @@ const ( type SCloudproviderManager struct { db.SEnabledStatusStandaloneResourceBaseManager - SInfrastructureManager } var CloudproviderManager *SCloudproviderManager @@ -58,7 +57,6 @@ func init() { type SCloudprovider struct { db.SEnabledStatusStandaloneResourceBase - SInfrastructure AccessUrl string `width:"64" charset:"ascii" nullable:"true" list:"admin" update:"admin" create:"admin_optional"` // Hostname string `width:"64" charset:"ascii" nullable:"true"` // Column(VARCHAR(64, charset='ascii'), nullable=False) @@ -87,6 +85,26 @@ func (self *SCloudprovider) GetOwnerProjectId() string { return self.ProjectId } +func (self *SCloudproviderManager) AllowListItems(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionList) +} + +func (self *SCloudproviderManager) AllowCreateItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionCreate) +} + +func (self *SCloudprovider) AllowGetDetails(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionGet) +} + +func (self *SCloudprovider) AllowUpdateItem(ctx context.Context, userCred mcclient.TokenCredential) bool { + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionUpdate) +} + +func (self *SCloudprovider) AllowDeleteItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionDelete) +} + func (self *SCloudprovider) ValidateDeleteCondition(ctx context.Context) error { if self.Enabled { return httperrors.NewInvalidStatusError("provider is enabled") diff --git a/pkg/compute/models/cloudregions.go b/pkg/compute/models/cloudregions.go index 374682c40e..5f6f34c269 100644 --- a/pkg/compute/models/cloudregions.go +++ b/pkg/compute/models/cloudregions.go @@ -25,7 +25,6 @@ const ( type SCloudregionManager struct { db.SEnabledStatusStandaloneResourceBaseManager - SInfrastructureManager } var CloudregionManager *SCloudregionManager @@ -43,7 +42,6 @@ func init() { type SCloudregion struct { db.SEnabledStatusStandaloneResourceBase - SInfrastructure Latitude float32 `list:"user"` Longitude float32 `list:"user"` @@ -54,6 +52,22 @@ func (manager *SCloudregionManager) AllowListItems(ctx context.Context, userCred return true } +func (self *SCloudregionManager) AllowCreateItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionCreate) +} + +func (self *SCloudregion) AllowGetDetails(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionGet) +} + +func (self *SCloudregion) AllowUpdateItem(ctx context.Context, userCred mcclient.TokenCredential) bool { + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionUpdate) +} + +func (self *SCloudregion) AllowDeleteItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionDelete) +} + func (self *SCloudregion) CustomizeCreate(ctx context.Context, userCred mcclient.TokenCredential, ownerProjId string, query jsonutils.JSONObject, data jsonutils.JSONObject) error { idstr, _ := data.GetString("id") if len(idstr) > 0 { diff --git a/pkg/compute/models/dynamicschedtags.go b/pkg/compute/models/dynamicschedtags.go index 9770802575..0a1ab9e640 100644 --- a/pkg/compute/models/dynamicschedtags.go +++ b/pkg/compute/models/dynamicschedtags.go @@ -17,7 +17,6 @@ import ( type SDynamicschedtagManager struct { db.SStandaloneResourceBaseManager - SInfrastructureManager } var DynamicschedtagManager *SDynamicschedtagManager @@ -39,7 +38,6 @@ func init() { // type SDynamicschedtag struct { db.SStandaloneResourceBase - SInfrastructure Condition string `width:"256" charset:"ascii" nullable:"false" list:"user" create:"required" update:"admin"` SchedtagId string `width:"36" charset:"ascii" nullable:"false" list:"user" create:"required" update:"admin"` @@ -47,6 +45,26 @@ type SDynamicschedtag struct { Enabled bool `nullable:"false" default:"true" create:"optional" list:"user" update:"user"` } +func (self *SDynamicschedtagManager) AllowListItems(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionList) +} + +func (self *SDynamicschedtagManager) AllowCreateItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionCreate) +} + +func (self *SDynamicschedtag) AllowGetDetails(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionGet) +} + +func (self *SDynamicschedtag) AllowUpdateItem(ctx context.Context, userCred mcclient.TokenCredential) bool { + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionUpdate) +} + +func (self *SDynamicschedtag) AllowDeleteItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionDelete) +} + func validateDynamicSchedtagInputData(data *jsonutils.JSONDict, create bool) error { condStr := jsonutils.GetAnyString(data, []string{"condition"}) if len(condStr) == 0 && create { diff --git a/pkg/compute/models/hosts.go b/pkg/compute/models/hosts.go index 5edbc95027..dc47e1ace2 100644 --- a/pkg/compute/models/hosts.go +++ b/pkg/compute/models/hosts.go @@ -90,7 +90,6 @@ var NIC_TYPES = []string{NIC_TYPE_IPMI, NIC_TYPE_ADMIN} type SHostManager struct { db.SEnabledStatusStandaloneResourceBaseManager - SInfrastructureManager } var HostManager *SHostManager @@ -109,7 +108,6 @@ func init() { type SHost struct { db.SEnabledStatusStandaloneResourceBase - SInfrastructure SManagedResourceBase Rack string `width:"16" charset:"ascii" nullable:"true" get:"admin" update:"admin" create:"admin_optional"` // Column(VARCHAR(16, charset='ascii'), nullable=True) @@ -161,17 +159,24 @@ func (manager *SHostManager) GetContextManager() []db.IModelManager { return []db.IModelManager{ZoneManager} } -func (manager *SHostManager) AllowCreateItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - // allow create host without zone_id - /*zoneId, err := data.GetString("zone_id") - if err != nil { - return false - } - _, err = ZoneManager.FetchById(zoneId) - if err != nil { - return false - }*/ - return userCred.IsAdminAllow(consts.GetServiceType(), manager.KeywordPlural(), policy.PolicyActionCreate) +func (self *SHostManager) AllowListItems(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionList) +} + +func (self *SHostManager) AllowCreateItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionCreate) +} + +func (self *SHost) AllowGetDetails(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionGet) +} + +func (self *SHost) AllowUpdateItem(ctx context.Context, userCred mcclient.TokenCredential) bool { + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionUpdate) +} + +func (self *SHost) AllowDeleteItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionDelete) } func (manager *SHostManager) ListItemFilter(ctx context.Context, q *sqlchemy.SQuery, userCred mcclient.TokenCredential, query jsonutils.JSONObject) (*sqlchemy.SQuery, error) { diff --git a/pkg/compute/models/inframanagers.go b/pkg/compute/models/inframanagers.go index 96c9a5607f..4a60c48cfb 100644 --- a/pkg/compute/models/inframanagers.go +++ b/pkg/compute/models/inframanagers.go @@ -1,35 +1,9 @@ package models -import ( - "context" - "yunion.io/x/jsonutils" - "yunion.io/x/onecloud/pkg/cloudcommon/consts" - "yunion.io/x/onecloud/pkg/cloudcommon/policy" - "yunion.io/x/onecloud/pkg/mcclient" -) - -type SInfrastructureManager struct { +type TSInfrastructureManager struct { } -type SInfrastructure struct { +type TSInfrastructure struct { } -func (self *SInfrastructureManager) AllowListItems(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), "*", policy.PolicyActionList) -} -func (self *SInfrastructureManager) AllowCreateItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), "*", policy.PolicyActionCreate) -} - -func (self *SInfrastructure) AllowGetDetails(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), "*", policy.PolicyActionGet) -} - -func (self *SInfrastructure) AllowUpdateItem(ctx context.Context, userCred mcclient.TokenCredential) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), "*", policy.PolicyActionUpdate) -} - -func (self *SInfrastructure) AllowDeleteItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), "*", policy.PolicyActionDelete) -} diff --git a/pkg/compute/models/loadbalanceragents.go b/pkg/compute/models/loadbalanceragents.go index b7a0a1f455..a92e50513e 100644 --- a/pkg/compute/models/loadbalanceragents.go +++ b/pkg/compute/models/loadbalanceragents.go @@ -22,7 +22,6 @@ import ( type SLoadbalancerAgentManager struct { db.SStandaloneResourceBaseManager - SInfrastructureManager } var LoadbalancerAgentManager *SLoadbalancerAgentManager @@ -48,7 +47,6 @@ func init() { // type SLoadbalancerAgent struct { db.SStandaloneResourceBase - SInfrastructure HbLastSeen time.Time `nullable:"true" list:"admin" update:"admin"` HbTimeout int `nullable:"true" list:"admin" update:"admin" create:"optional" default:"3600"` @@ -239,6 +237,27 @@ func (p *SLoadbalancerAgentParams) IsZero() bool { return false } + +func (self *SLoadbalancerAgentManager) AllowListItems(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionList) +} + +func (self *SLoadbalancerAgentManager) AllowCreateItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionCreate) +} + +func (self *SLoadbalancerAgent) AllowGetDetails(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionGet) +} + +func (self *SLoadbalancerAgent) AllowUpdateItem(ctx context.Context, userCred mcclient.TokenCredential) bool { + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionUpdate) +} + +func (self *SLoadbalancerAgent) AllowDeleteItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionDelete) +} + func (man *SLoadbalancerAgentManager) ValidateCreateData(ctx context.Context, userCred mcclient.TokenCredential, ownerProjId string, query jsonutils.JSONObject, data *jsonutils.JSONDict) (*jsonutils.JSONDict, error) { { keyV := map[string]validators.IValidator{ @@ -355,10 +374,6 @@ func (man *SLoadbalancerAgentManager) CleanPendingDeleteLoadbalancers(ctx contex } } -func (man *SLoadbalancerAgentManager) AllowCreateItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), man.KeywordPlural(), policy.PolicyActionCreate) -} - func (lbagent *SLoadbalancerAgent) ValidateUpdateData(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data *jsonutils.JSONDict) (*jsonutils.JSONDict, error) { { keyV := map[string]validators.IValidator{ diff --git a/pkg/compute/models/schedpolicies.go b/pkg/compute/models/schedpolicies.go index edf88f4832..000445cf14 100644 --- a/pkg/compute/models/schedpolicies.go +++ b/pkg/compute/models/schedpolicies.go @@ -18,7 +18,6 @@ import ( type SSchedpolicyManager struct { db.SStandaloneResourceBaseManager - SInfrastructureManager } var SchedpolicyManager *SSchedpolicyManager @@ -37,7 +36,6 @@ func init() { // sched policy is called before calling scheduler, add additional preferences for schedtags type SSchedpolicy struct { db.SStandaloneResourceBase - SInfrastructure Condition string `width:"256" charset:"ascii" nullable:"false" list:"user" create:"required" update:"user"` SchedtagId string `width:"36" charset:"ascii" nullable:"false" list:"user" create:"required" update:"user"` @@ -64,6 +62,26 @@ func validateSchedpolicyInputData(data *jsonutils.JSONDict, create bool) error { return nil } +func (self *SSchedpolicyManager) AllowListItems(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionList) +} + +func (self *SSchedpolicyManager) AllowCreateItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionCreate) +} + +func (self *SSchedpolicy) AllowGetDetails(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionGet) +} + +func (self *SSchedpolicy) AllowUpdateItem(ctx context.Context, userCred mcclient.TokenCredential) bool { + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionUpdate) +} + +func (self *SSchedpolicy) AllowDeleteItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionDelete) +} + func (manager *SSchedpolicyManager) ValidateCreateData(ctx context.Context, userCred mcclient.TokenCredential, ownerProjId string, query jsonutils.JSONObject, data *jsonutils.JSONDict) (*jsonutils.JSONDict, error) { err := validateSchedpolicyInputData(data, true) if err != nil { diff --git a/pkg/compute/models/schedtags.go b/pkg/compute/models/schedtags.go index 2c06f65eb8..43557ff2f9 100644 --- a/pkg/compute/models/schedtags.go +++ b/pkg/compute/models/schedtags.go @@ -12,6 +12,8 @@ import ( "yunion.io/x/onecloud/pkg/mcclient" "yunion.io/x/pkg/utils" "yunion.io/x/sqlchemy" + "yunion.io/x/onecloud/pkg/cloudcommon/consts" + "yunion.io/x/onecloud/pkg/cloudcommon/policy" ) type SchedStrategyType string @@ -30,7 +32,6 @@ var STRATEGY_LIST = []string{STRATEGY_REQUIRE, STRATEGY_EXCLUDE, STRATEGY_PREFER type SSchedtagManager struct { db.SStandaloneResourceBaseManager - SInfrastructureManager } var SchedtagManager *SSchedtagManager @@ -48,7 +49,6 @@ func init() { type SSchedtag struct { db.SStandaloneResourceBase - SInfrastructure DefaultStrategy string `width:"16" charset:"ascii" nullable:"true" default:"" list:"user" update:"admin" create:"admin_optional"` // Column(VARCHAR(16, charset='ascii'), nullable=True, default='') } @@ -61,6 +61,18 @@ func (self *SSchedtag) AllowGetDetails(ctx context.Context, userCred mcclient.To return true } +func (self *SSchedtagManager) AllowCreateItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionCreate) +} + +func (self *SSchedtag) AllowUpdateItem(ctx context.Context, userCred mcclient.TokenCredential) bool { + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionUpdate) +} + +func (self *SSchedtag) AllowDeleteItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionDelete) +} + func (manager *SSchedtagManager) ValidateSchedtags(userCred mcclient.TokenCredential, schedtags map[string]string) (map[string]string, error) { ret := make(map[string]string) for tag, act := range schedtags { diff --git a/pkg/compute/models/storagecachedimages.go b/pkg/compute/models/storagecachedimages.go index 29d5889890..693fa088a0 100644 --- a/pkg/compute/models/storagecachedimages.go +++ b/pkg/compute/models/storagecachedimages.go @@ -32,7 +32,6 @@ const ( type SStoragecachedimageManager struct { db.SJointResourceBaseManager - SInfrastructureManager } var StoragecachedimageManager *SStoragecachedimageManager @@ -54,7 +53,6 @@ func init() { type SStoragecachedimage struct { db.SJointResourceBase - SInfrastructure StoragecacheId string `width:"36" charset:"ascii" nullable:"false" list:"admin" create:"admin_required" key_index:"true"` CachedimageId string `width:"36" charset:"ascii" nullable:"false" list:"admin" create:"admin_required" key_index:"true"` @@ -75,6 +73,26 @@ func (joint *SStoragecachedimage) Slave() db.IStandaloneModel { return db.JointSlave(joint) } +func (self *SStoragecachedimageManager) AllowListItems(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionList) +} + +func (self *SStoragecachedimageManager) AllowCreateItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionCreate) +} + +func (self *SStoragecachedimage) AllowGetDetails(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionGet) +} + +func (self *SStoragecachedimage) AllowUpdateItem(ctx context.Context, userCred mcclient.TokenCredential) bool { + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionUpdate) +} + +func (self *SStoragecachedimage) AllowDeleteItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionDelete) +} + func (self *SStoragecachedimage) getStorageHostId() (string, error) { var s SStorage storage := StorageManager.Query() diff --git a/pkg/compute/models/storagecaches.go b/pkg/compute/models/storagecaches.go index 78f33ad971..f21faa1dbc 100644 --- a/pkg/compute/models/storagecaches.go +++ b/pkg/compute/models/storagecaches.go @@ -21,7 +21,6 @@ import ( type SStoragecacheManager struct { db.SStandaloneResourceBaseManager - SInfrastructureManager } var StoragecacheManager *SStoragecacheManager @@ -39,12 +38,31 @@ func init() { type SStoragecache struct { db.SStandaloneResourceBase - SInfrastructure SManagedResourceBase Path string `width:"256" charset:"utf8" nullable:"true" list:"admin" update:"admin" create:"admin_optional"` // = Column(VARCHAR(256, charset='utf8'), nullable=True) } +func (self *SStoragecacheManager) AllowListItems(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionList) +} + +func (self *SStoragecacheManager) AllowCreateItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionCreate) +} + +func (self *SStoragecache) AllowGetDetails(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionGet) +} + +func (self *SStoragecache) AllowUpdateItem(ctx context.Context, userCred mcclient.TokenCredential) bool { + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionUpdate) +} + +func (self *SStoragecache) AllowDeleteItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionDelete) +} + func (self *SStoragecache) getStorages() []SStorage { storages := make([]SStorage, 0) q := StorageManager.Query().Equals("storagecache_id", self.Id) diff --git a/pkg/compute/models/storages.go b/pkg/compute/models/storages.go index 7a76c6e995..2f79e92b27 100644 --- a/pkg/compute/models/storages.go +++ b/pkg/compute/models/storages.go @@ -87,7 +87,6 @@ var ( type SStorageManager struct { db.SEnabledStatusStandaloneResourceBaseManager - SInfrastructureManager } var StorageManager *SStorageManager @@ -105,7 +104,6 @@ func init() { type SStorage struct { db.SEnabledStatusStandaloneResourceBase - SInfrastructure SManagedResourceBase Capacity int `nullable:"false" list:"admin" update:"admin" create:"admin_required"` // Column(Integer, nullable=False) # capacity of disk in MB @@ -124,6 +122,26 @@ func (manager *SStorageManager) GetContextManager() []db.IModelManager { return []db.IModelManager{ZoneManager, StoragecacheManager} } +func (manager *SStorageManager) AllowListItems(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { + return true +} + +func (self *SStorageManager) AllowCreateItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionCreate) +} + +func (self *SStorage) AllowGetDetails(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionGet) +} + +func (self *SStorage) AllowUpdateItem(ctx context.Context, userCred mcclient.TokenCredential) bool { + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionUpdate) +} + +func (self *SStorage) AllowDeleteItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionDelete) +} + func (manager *SStorageManager) ValidateCreateData(ctx context.Context, userCred mcclient.TokenCredential, ownerProjId string, query jsonutils.JSONObject, data *jsonutils.JSONDict) (*jsonutils.JSONDict, error) { storageType, _ := data.GetString("storage_type") mediumType, _ := data.GetString("medium_type") @@ -181,9 +199,6 @@ func (self *SStorage) IsLocal() bool { return self.StorageType == STORAGE_LOCAL || self.StorageType == STORAGE_BAREMETAL } -func (manager *SStorageManager) AllowListItems(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { - return true -} func (self *SStorage) getMoreDetails(extra *jsonutils.JSONDict) *jsonutils.JSONDict { used := self.GetUsedCapacity(tristate.True) diff --git a/pkg/compute/models/vcenters.go b/pkg/compute/models/vcenters.go index 79b298ccb2..f4ebc43687 100644 --- a/pkg/compute/models/vcenters.go +++ b/pkg/compute/models/vcenters.go @@ -11,7 +11,6 @@ import ( type SVCenterManager struct { db.SEnabledStatusStandaloneResourceBaseManager - SInfrastructureManager } var VCenterManager *SVCenterManager @@ -29,7 +28,6 @@ func init() { type SVCenter struct { db.SEnabledStatusStandaloneResourceBase - SInfrastructure Hostname string `width:"64" charset:"ascii" nullable:"false" list:"admin"` // = Column(VARCHAR(64, charset='ascii'), nullable=False) Port int `nullable:"false" list:"admin"` // = Column(Integer, nullable=False) diff --git a/pkg/compute/models/vpcs.go b/pkg/compute/models/vpcs.go index 532dd2a512..c5fa194e16 100644 --- a/pkg/compute/models/vpcs.go +++ b/pkg/compute/models/vpcs.go @@ -35,7 +35,6 @@ const ( type SVpcManager struct { db.SEnabledStatusStandaloneResourceBaseManager - SInfrastructureManager } var VpcManager *SVpcManager @@ -53,7 +52,6 @@ func init() { type SVpc struct { db.SEnabledStatusStandaloneResourceBase - SInfrastructure SManagedResourceBase IsDefault bool `default:"false" list:"admin" create:"admin_optional"` @@ -67,6 +65,26 @@ func (manager *SVpcManager) GetContextManager() []db.IModelManager { return []db.IModelManager{CloudregionManager} } +func (self *SVpcManager) AllowListItems(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionList) +} + +func (self *SVpcManager) AllowCreateItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionCreate) +} + +func (self *SVpc) AllowGetDetails(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionGet) +} + +func (self *SVpc) AllowUpdateItem(ctx context.Context, userCred mcclient.TokenCredential) bool { + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionUpdate) +} + +func (self *SVpc) AllowDeleteItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionDelete) +} + func (self *SVpc) GetCloudRegionId() string { if len(self.CloudregionId) == 0 { return "default" diff --git a/pkg/compute/models/wires.go b/pkg/compute/models/wires.go index 61d1da68e3..00364f0dfc 100644 --- a/pkg/compute/models/wires.go +++ b/pkg/compute/models/wires.go @@ -15,11 +15,12 @@ import ( "yunion.io/x/pkg/util/compare" "yunion.io/x/pkg/util/netutils" "yunion.io/x/sqlchemy" + "yunion.io/x/onecloud/pkg/cloudcommon/consts" + "yunion.io/x/onecloud/pkg/cloudcommon/policy" ) type SWireManager struct { db.SStandaloneResourceBaseManager - SInfrastructureManager } var WireManager *SWireManager @@ -39,7 +40,6 @@ func init() { type SWire struct { db.SStandaloneResourceBase - SInfrastructure Bandwidth int `list:"admin" update:"admin" nullable:"false" create:"admin_required"` // = Column(Integer, nullable=False) # bandwidth of network in Mbps ScheduleRank int `list:"admin" update:"admin"` // = Column(Integer, default=0, nullable=True) @@ -51,6 +51,26 @@ func (manager *SWireManager) GetContextManager() []db.IModelManager { return []db.IModelManager{ZoneManager, VpcManager} } +func (self *SWireManager) AllowListItems(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionList) +} + +func (self *SWireManager) AllowCreateItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionCreate) +} + +func (self *SWire) AllowGetDetails(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionGet) +} + +func (self *SWire) AllowUpdateItem(ctx context.Context, userCred mcclient.TokenCredential) bool { + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionUpdate) +} + +func (self *SWire) AllowDeleteItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionDelete) +} + func (manager *SWireManager) ValidateCreateData(ctx context.Context, userCred mcclient.TokenCredential, ownerProjId string, query jsonutils.JSONObject, data *jsonutils.JSONDict) (*jsonutils.JSONDict, error) { bandwidth, err := data.Int("bandwidth") if err != nil || bandwidth == 0 { diff --git a/pkg/compute/models/zones.go b/pkg/compute/models/zones.go index 6f7ff2649c..50b6f5a351 100644 --- a/pkg/compute/models/zones.go +++ b/pkg/compute/models/zones.go @@ -12,6 +12,8 @@ import ( "yunion.io/x/pkg/tristate" "yunion.io/x/pkg/util/compare" "yunion.io/x/sqlchemy" + "yunion.io/x/onecloud/pkg/cloudcommon/consts" + "yunion.io/x/onecloud/pkg/cloudcommon/policy" ) const ( @@ -23,7 +25,6 @@ const ( type SZoneManager struct { db.SStatusStandaloneResourceBaseManager - SInfrastructureManager } var ZoneManager *SZoneManager @@ -42,7 +43,6 @@ func init() { type SZone struct { db.SStatusStandaloneResourceBase - SInfrastructure Location string `width:"256" charset:"utf8" get:"user" update:"admin"` // = Column(VARCHAR(256, charset='utf8')) Contacts string `width:"256" charset:"utf8" get:"user" update:"admin"` // = Column(VARCHAR(256, charset='utf8')) @@ -57,6 +57,22 @@ func (manager *SZoneManager) GetContextManager() []db.IModelManager { return []db.IModelManager{CloudregionManager} } +func (self *SZoneManager) AllowCreateItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionCreate) +} + +func (self *SZone) AllowGetDetails(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionGet) +} + +func (self *SZone) AllowUpdateItem(ctx context.Context, userCred mcclient.TokenCredential) bool { + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionUpdate) +} + +func (self *SZone) AllowDeleteItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { + return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionDelete) +} + func (manager *SZoneManager) AllowListItems(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { return true } From 0a7b736336031a6e83559dc129deb153a265144b Mon Sep 17 00:00:00 2001 From: Qiu Jian Date: Sat, 1 Dec 2018 01:12:12 +0800 Subject: [PATCH 12/15] allow zone_id empty for hosts --- pkg/compute/models/hosts.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pkg/compute/models/hosts.go b/pkg/compute/models/hosts.go index dc47e1ace2..af12e6dd4c 100644 --- a/pkg/compute/models/hosts.go +++ b/pkg/compute/models/hosts.go @@ -1943,7 +1943,7 @@ func (manager *SHostManager) ValidateSizeParams(data *jsonutils.JSONDict) (*json func (manager *SHostManager) ValidateCreateData(ctx context.Context, userCred mcclient.TokenCredential, ownerProjId string, query jsonutils.JSONObject, data *jsonutils.JSONDict) (*jsonutils.JSONDict, error) { zoneId, _ := data.GetString("zone_id") - if len(zoneId) == 0 || ZoneManager.Query().Equals("id", zoneId).Count() == 0 { + if len(zoneId) > 0 && ZoneManager.Query().Equals("id", zoneId).Count() == 0 { return nil, httperrors.NewInputParameterError("Zone id %s not found", zoneId) } mangerUri, err := data.GetString("manager_uri") From 80478ca92c06649b3d7e697bc107f1d17f0a67de Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E5=B1=88=E8=BD=A9?= Date: Sat, 1 Dec 2018 11:23:43 +0800 Subject: [PATCH 13/15] =?UTF-8?q?=E9=81=BF=E5=85=8Deip=E5=85=B3=E8=81=94?= =?UTF-8?q?=E4=B8=BB=E6=9C=BA=E6=88=96=E8=A7=A3=E7=BB=91=E5=A4=B1=E8=B4=A5?= =?UTF-8?q?=E5=90=8E=EF=BC=8C=E4=B8=8D=E8=83=BD=E5=86=8D=E6=AC=A1=E6=93=8D?= =?UTF-8?q?=E4=BD=9C?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- pkg/compute/models/guests.go | 6 ++++-- pkg/compute/tasks/eip_associate_task.go | 8 ++++---- pkg/compute/tasks/eip_dissociate_task.go | 7 +++---- 3 files changed, 11 insertions(+), 10 deletions(-) diff --git a/pkg/compute/models/guests.go b/pkg/compute/models/guests.go index cedc5019c7..b0c25ebcc5 100644 --- a/pkg/compute/models/guests.go +++ b/pkg/compute/models/guests.go @@ -103,8 +103,10 @@ const ( VM_RESTORE_STATE = "restore_state" VM_RESTORE_FAILED = "restore_failed" - VM_ASSOCIATE_EIP = "associate_eip" - VM_DISSOCIATE_EIP = "dissociate_eip" + VM_ASSOCIATE_EIP = "associate_eip" + VM_ASSOCIATE_EIP_FAILED = "associate_eip_failed" + VM_DISSOCIATE_EIP = "dissociate_eip" + VM_DISSOCIATE_EIP_FAILED = "dissociate_eip_failed" VM_REMOVE_STATEFILE = "remove_state" diff --git a/pkg/compute/tasks/eip_associate_task.go b/pkg/compute/tasks/eip_associate_task.go index f4d3aa4e41..483fb0f686 100644 --- a/pkg/compute/tasks/eip_associate_task.go +++ b/pkg/compute/tasks/eip_associate_task.go @@ -1,8 +1,8 @@ package tasks import ( - "fmt" "context" + "fmt" "yunion.io/x/jsonutils" @@ -20,10 +20,10 @@ func init() { } func (self *EipAssociateTask) TaskFail(ctx context.Context, eip *models.SElasticip, msg string, vm *models.SGuest) { - eip.SetStatus(self.UserCred, models.EIP_STATUS_ASSOCIATE_FAIL, msg) + eip.SetStatus(self.UserCred, models.EIP_STATUS_READY, msg) self.SetStageFailed(ctx, msg) if vm != nil { - vm.StartSyncstatus(ctx, self.UserCred, "") + vm.SetStatus(self.UserCred, models.VM_ASSOCIATE_EIP_FAILED, msg) } } @@ -69,4 +69,4 @@ func (self *EipAssociateTask) OnInit(ctx context.Context, obj db.IStandaloneMode server.StartSyncstatus(ctx, self.UserCred, "") self.SetStageComplete(ctx, nil) -} \ No newline at end of file +} diff --git a/pkg/compute/tasks/eip_dissociate_task.go b/pkg/compute/tasks/eip_dissociate_task.go index 30658ead59..f91d7569eb 100644 --- a/pkg/compute/tasks/eip_dissociate_task.go +++ b/pkg/compute/tasks/eip_dissociate_task.go @@ -1,9 +1,8 @@ package tasks - import ( - "fmt" "context" + "fmt" "yunion.io/x/jsonutils" @@ -21,10 +20,10 @@ func init() { } func (self *EipDissociateTask) TaskFail(ctx context.Context, eip *models.SElasticip, msg string, vm *models.SGuest) { - eip.SetStatus(self.UserCred, models.EIP_STATUS_DISSOCIATE_FAIL, msg) + eip.SetStatus(self.UserCred, models.EIP_STATUS_READY, msg) self.SetStageFailed(ctx, msg) if vm != nil { - vm.StartSyncstatus(ctx, self.UserCred, "") + vm.SetStatus(self.UserCred, models.VM_DISSOCIATE_EIP_FAILED, msg) } } From e42f1a77441d12c073fb3c325ad28e329557aafe Mon Sep 17 00:00:00 2001 From: Qiu Jian Date: Sat, 1 Dec 2018 12:05:41 +0800 Subject: [PATCH 14/15] recode --- pkg/cloudcommon/db/db_dispatcher.go | 10 +-- pkg/cloudcommon/db/enabledstatusstandalone.go | 6 +- pkg/cloudcommon/db/jointbase.go | 6 +- pkg/cloudcommon/db/metadata.go | 8 +- pkg/cloudcommon/db/modelbase.go | 4 +- pkg/cloudcommon/db/opslog.go | 6 +- pkg/cloudcommon/db/rbac.go | 32 ++++++++ pkg/cloudcommon/db/sharablevirtual.go | 8 +- pkg/cloudcommon/db/standalone.go | 10 +-- pkg/cloudcommon/db/statusstandalone.go | 4 +- pkg/cloudcommon/db/taskman/tasks.go | 4 +- pkg/cloudcommon/db/virtualjointbase.go | 12 ++- pkg/cloudcommon/db/virtualresource.go | 20 +++-- pkg/compute/models/baremetalagents.go | 20 +++-- pkg/compute/models/cachedimages.go | 14 ++-- pkg/compute/models/cloudaccounts.go | 20 +++-- pkg/compute/models/cloudproviders.go | 18 ++--- pkg/compute/models/cloudregions.go | 12 ++- pkg/compute/models/disks.go | 16 ++-- pkg/compute/models/dnsrecords.go | 10 +-- pkg/compute/models/dynamicschedtags.go | 14 ++-- pkg/compute/models/elasticips.go | 12 ++- pkg/compute/models/guest_actions.go | 78 +++++++++---------- pkg/compute/models/guests.go | 12 ++- pkg/compute/models/hostjoints.go | 16 ++-- pkg/compute/models/hosts.go | 54 +++++++------ pkg/compute/models/isolated_devices.go | 6 +- pkg/compute/models/keypairs.go | 12 ++- pkg/compute/models/loadbalanceracls.go | 4 +- pkg/compute/models/loadbalanceragents.go | 16 ++-- pkg/compute/models/loadbalancerbackends.go | 4 +- .../models/loadbalancerlistenerrules.go | 4 +- pkg/compute/models/loadbalancerlisteners.go | 4 +- pkg/compute/models/loadbalancers.go | 4 +- pkg/compute/models/networks.go | 18 ++--- pkg/compute/models/reservedips.go | 4 +- pkg/compute/models/schedpolicies.go | 14 ++-- pkg/compute/models/schedtags.go | 8 +- pkg/compute/models/secgrouprules.go | 6 +- pkg/compute/models/snapshots.go | 10 +-- pkg/compute/models/storagecachedimages.go | 14 ++-- pkg/compute/models/storagecaches.go | 16 ++-- pkg/compute/models/storages.go | 25 +++--- pkg/compute/models/vpcs.go | 14 ++-- pkg/compute/models/wires.go | 12 ++- pkg/compute/models/zones.go | 10 +-- pkg/yunionconf/models/parameters.go | 14 ++-- 47 files changed, 295 insertions(+), 350 deletions(-) diff --git a/pkg/cloudcommon/db/db_dispatcher.go b/pkg/cloudcommon/db/db_dispatcher.go index 70ce2f8c91..630af1dcd2 100644 --- a/pkg/cloudcommon/db/db_dispatcher.go +++ b/pkg/cloudcommon/db/db_dispatcher.go @@ -113,7 +113,7 @@ func listFields(manager IModelManager, userCred mcclient.TokenCredential) []stri if !utils.IsInStringArray(list, []string{"user", "admin", ""}) { log.Warningf("Invalid list value %s for field %s", list, col.Name()) } - if list == "user" || (list == "admin" && userCred.IsAdminAllow(consts.GetServiceType(), manager.KeywordPlural(), policy.PolicyActionList)) { + if list == "user" || (list == "admin" && IsAdminAllowList(userCred, manager)) { ret = append(ret, col.Name()) } } @@ -127,7 +127,7 @@ func searchFields(manager IModelManager, userCred mcclient.TokenCredential) []st tags := col.Tags() list := tags["list"] search := tags["search"] - if list == "user" || search == "user" || ((list == "admin" || search == "admin") && userCred.IsAdminAllow(consts.GetServiceType(), manager.KeywordPlural(), policy.PolicyActionList)) { + if list == "user" || search == "user" || ((list == "admin" || search == "admin") && IsAdminAllowList(userCred, manager)) { ret = append(ret, col.Name()) } } @@ -152,7 +152,7 @@ func createRequireFields(manager IModelManager, userCred mcclient.TokenCredentia for _, col := range manager.TableSpec().Columns() { tags := col.Tags() create, _ := tags["create"] - if create == "required" || (create == "admin_required" && userCred.IsAdminAllow(consts.GetServiceType(), manager.KeywordPlural(), policy.PolicyActionCreate)) { + if create == "required" || (create == "admin_required" && IsAdminAllowCreate(userCred, manager)) { ret = append(ret, col.Name()) } } @@ -166,7 +166,7 @@ func createFields(manager IModelManager, userCred mcclient.TokenCredential) []st tags := col.Tags() create, _ := tags["create"] update := tags["update"] - if update == "user" || (update == "admin" && userCred.IsAdminAllow(consts.GetServiceType(), manager.KeywordPlural(), policy.PolicyActionCreate)) || create == "required" || create == "optional" || ((create == "admin_required" || create == "admin_optional") && userCred.IsAdminAllow(consts.GetServiceType(), manager.KeywordPlural(), policy.PolicyActionCreate)) { + if update == "user" || (update == "admin" && IsAdminAllowCreate(userCred, manager)) || create == "required" || create == "optional" || ((create == "admin_required" || create == "admin_optional") && IsAdminAllowCreate(userCred, manager)) { ret = append(ret, col.Name()) } } @@ -315,7 +315,7 @@ func query2List(manager IModelManager, ctx context.Context, userCred mcclient.To } listF := listFields(manager, userCred) fieldFilter := jsonutils.GetQueryStringArray(query, "field") - if len(fieldFilter) > 0 && userCred.IsAdminAllow(consts.GetServiceType(), manager.KeywordPlural(), policy.PolicyActionList) { + if len(fieldFilter) > 0 && IsAdminAllowList(userCred, manager) { // only sysadmin can specify list Fields listF = fieldFilter } diff --git a/pkg/cloudcommon/db/enabledstatusstandalone.go b/pkg/cloudcommon/db/enabledstatusstandalone.go index ad6da79d6f..6a456a429b 100644 --- a/pkg/cloudcommon/db/enabledstatusstandalone.go +++ b/pkg/cloudcommon/db/enabledstatusstandalone.go @@ -5,8 +5,6 @@ import ( "yunion.io/x/jsonutils" "yunion.io/x/log" - "yunion.io/x/onecloud/pkg/cloudcommon/consts" - "yunion.io/x/onecloud/pkg/cloudcommon/policy" "yunion.io/x/onecloud/pkg/mcclient" ) @@ -25,7 +23,7 @@ func NewEnabledStatusStandaloneResourceBaseManager(dt interface{}, tableName str } func (self *SEnabledStatusStandaloneResourceBase) AllowPerformEnable(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.GetModelManager().KeywordPlural(), policy.PolicyActionPerform, "enable") + return IsAdminAllowPerform(userCred, self, "enable") } func (self *SEnabledStatusStandaloneResourceBase) PerformEnable(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -44,7 +42,7 @@ func (self *SEnabledStatusStandaloneResourceBase) PerformEnable(ctx context.Cont } func (self *SEnabledStatusStandaloneResourceBase) AllowPerformDisable(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.GetModelManager().KeywordPlural(), policy.PolicyActionPerform, "disable") + return IsAdminAllowPerform(userCred, self, "disable") } func (self *SEnabledStatusStandaloneResourceBase) PerformDisable(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { diff --git a/pkg/cloudcommon/db/jointbase.go b/pkg/cloudcommon/db/jointbase.go index 14094ae5e4..17a3276b1d 100644 --- a/pkg/cloudcommon/db/jointbase.go +++ b/pkg/cloudcommon/db/jointbase.go @@ -8,8 +8,6 @@ import ( "yunion.io/x/jsonutils" "yunion.io/x/log" - "yunion.io/x/onecloud/pkg/cloudcommon/consts" - "yunion.io/x/onecloud/pkg/cloudcommon/policy" "yunion.io/x/onecloud/pkg/mcclient" "yunion.io/x/pkg/util/reflectutils" "yunion.io/x/sqlchemy" @@ -193,7 +191,7 @@ func (self *SJointResourceBase) AllowGetJointDetails(ctx context.Context, userCr master := item.Master() switch master.(type) { case IVirtualModel: - return master.(IVirtualModel).IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), master.KeywordPlural(), policy.PolicyActionGet) + return master.(IVirtualModel).IsOwner(userCred) || IsAdminAllowGet(userCred, master) default: // case item implemented customized AllowGetDetails, eg hostjoints return item.AllowGetDetails(ctx, userCred, query) } @@ -203,7 +201,7 @@ func (self *SJointResourceBase) AllowUpdateJointItem(ctx context.Context, userCr master := item.Master() switch master.(type) { case IVirtualModel: - return master.(IVirtualModel).IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), master.KeywordPlural(), policy.PolicyActionUpdate) + return master.(IVirtualModel).IsOwner(userCred) || IsAdminAllowUpdate(userCred, master) default: // case item implemented customized AllowGetDetails, eg hostjoints return item.AllowUpdateItem(ctx, userCred) } diff --git a/pkg/cloudcommon/db/metadata.go b/pkg/cloudcommon/db/metadata.go index 88463b21f9..b6ac604efe 100644 --- a/pkg/cloudcommon/db/metadata.go +++ b/pkg/cloudcommon/db/metadata.go @@ -11,9 +11,7 @@ import ( "yunion.io/x/onecloud/pkg/mcclient" "yunion.io/x/pkg/util/stringutils" - "yunion.io/x/onecloud/pkg/cloudcommon/consts" "yunion.io/x/onecloud/pkg/cloudcommon/db/lockman" - "yunion.io/x/onecloud/pkg/cloudcommon/policy" ) const ( @@ -67,7 +65,7 @@ raise Exception('get_object_idstr: failed to generate obj ID') return idstr */ func (manager *SMetadataManager) GetStringValue(model IModel, key string, userCred mcclient.TokenCredential) string { - if strings.HasPrefix(key, SYSTEM_ADMIN_PREFIX) && (userCred == nil || !userCred.IsAdminAllow(consts.GetServiceType(), model.GetModelManager().KeywordPlural(), policy.PolicyActionGet, "metadata")) { + if strings.HasPrefix(key, SYSTEM_ADMIN_PREFIX) && (userCred == nil || !IsAdminAllowGetSpec(userCred, model, "metadata")) { return "" } idStr := GetObjectIdstr(model) @@ -80,7 +78,7 @@ func (manager *SMetadataManager) GetStringValue(model IModel, key string, userCr } func (manager *SMetadataManager) GetJsonValue(model IModel, key string, userCred mcclient.TokenCredential) jsonutils.JSONObject { - if strings.HasPrefix(key, SYSTEM_ADMIN_PREFIX) && (userCred == nil || !userCred.IsAdminAllow(consts.GetServiceType(), model.GetModelManager().KeywordPlural(), policy.PolicyActionGet, "metadata")) { + if strings.HasPrefix(key, SYSTEM_ADMIN_PREFIX) && (userCred == nil || !IsAdminAllowGetSpec(userCred, model, "metadata")) { return nil } idStr := GetObjectIdstr(model) @@ -196,7 +194,7 @@ func (manager *SMetadataManager) GetAll(obj IModel, keys []string, userCred mccl for _, rec := range records { if len(rec.Value) > 0 { if strings.HasPrefix(rec.Key, SYSTEM_ADMIN_PREFIX) { - if userCred != nil && userCred.IsAdminAllow(consts.GetServiceType(), obj.GetModelManager().KeywordPlural(), policy.PolicyActionGet, "metadata") { + if userCred != nil && IsAdminAllowGetSpec(userCred, obj, "metadata") { key := rec.Key[len(SYSTEM_ADMIN_PREFIX):] ret[key] = rec.Value } diff --git a/pkg/cloudcommon/db/modelbase.go b/pkg/cloudcommon/db/modelbase.go index bd5db2cdb8..1af11f2982 100644 --- a/pkg/cloudcommon/db/modelbase.go +++ b/pkg/cloudcommon/db/modelbase.go @@ -6,8 +6,6 @@ import ( "fmt" "yunion.io/x/jsonutils" - "yunion.io/x/onecloud/pkg/cloudcommon/consts" - "yunion.io/x/onecloud/pkg/cloudcommon/policy" "yunion.io/x/onecloud/pkg/mcclient" "yunion.io/x/sqlchemy" ) @@ -153,7 +151,7 @@ func (manager *SModelBaseManager) PerformAction(ctx context.Context, userCred mc } func (manager *SModelBaseManager) AllowPerformCheckCreateData(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), manager.KeywordPlural(), policy.PolicyActionPerform, "check-create-data") + return IsAdminAllowClassPerform(userCred, manager, "check-create-data") } func (manager *SModelBaseManager) InitializeData() error { diff --git a/pkg/cloudcommon/db/opslog.go b/pkg/cloudcommon/db/opslog.go index 45c147eb9e..4cb4101063 100644 --- a/pkg/cloudcommon/db/opslog.go +++ b/pkg/cloudcommon/db/opslog.go @@ -9,8 +9,6 @@ import ( "yunion.io/x/jsonutils" "yunion.io/x/log" - "yunion.io/x/onecloud/pkg/cloudcommon/consts" - "yunion.io/x/onecloud/pkg/cloudcommon/policy" "yunion.io/x/onecloud/pkg/mcclient" "yunion.io/x/onecloud/pkg/util/logclient" "yunion.io/x/pkg/util/stringutils" @@ -288,7 +286,7 @@ func (manager *SOpsLogManager) ListItemFilter(ctx context.Context, q *sqlchemy.S queryDict.RemoveIgnoreCase("action") q = q.Filter(sqlchemy.In(q.Field("action"), action)) } - if !userCred.IsAdminAllow(consts.GetServiceType(), manager.KeywordPlural(), policy.PolicyActionList) { + if !IsAdminAllowList(userCred, manager) { q = q.Filter(sqlchemy.OR(sqlchemy.AND(sqlchemy.IsNotNull(q.Field("owner_tenant_id")), sqlchemy.Equals(q.Field("owner_tenant_id"), userCred.GetProjectId())), sqlchemy.Equals(q.Field("tenant_id"), userCred.GetProjectId()))) } since, _ := query.GetTime("since") @@ -319,7 +317,7 @@ func (manager *SOpsLogManager) AllowCreateItem(ctx context.Context, userCred mcc } func (self *SOpsLog) AllowGetDetails(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.GetModelManager().KeywordPlural(), policy.PolicyActionGet) || userCred.GetProjectId() == self.ProjectId || userCred.GetProjectId() == self.OwnerProjectId + return IsAdminAllowGet(userCred, self) || userCred.GetProjectId() == self.ProjectId || userCred.GetProjectId() == self.OwnerProjectId } func (self *SOpsLog) AllowUpdateItem(ctx context.Context, userCred mcclient.TokenCredential) bool { diff --git a/pkg/cloudcommon/db/rbac.go b/pkg/cloudcommon/db/rbac.go index 76c2fd2152..83da4b9753 100644 --- a/pkg/cloudcommon/db/rbac.go +++ b/pkg/cloudcommon/db/rbac.go @@ -122,3 +122,35 @@ func isObjectRbacAllowed(manager IModelManager, model IModel, userCred mcclient. func isJointObjectRbacAllowed(manager IJointModelManager, item IJointModel, userCred mcclient.TokenCredential, action string, extra ...string) bool { return isObjectRbacAllowed(manager, item.Master(), userCred, action, extra...) } + +func IsAdminAllowList(userCred mcclient.TokenCredential, manager IModelManager) bool { + return userCred.IsAdminAllow(consts.GetServiceType(), manager.KeywordPlural(), policy.PolicyActionList) +} + +func IsAdminAllowCreate(userCred mcclient.TokenCredential, manager IModelManager) bool { + return userCred.IsAdminAllow(consts.GetServiceType(), manager.KeywordPlural(), policy.PolicyActionCreate) +} + +func IsAdminAllowClassPerform(userCred mcclient.TokenCredential, manager IModelManager, action string) bool { + return userCred.IsAdminAllow(consts.GetServiceType(), manager.KeywordPlural(), policy.PolicyActionPerform, action) +} + +func IsAdminAllowGet(userCred mcclient.TokenCredential, obj IModel) bool { + return userCred.IsAdminAllow(consts.GetServiceType(), obj.KeywordPlural(), policy.PolicyActionGet) +} + +func IsAdminAllowGetSpec(userCred mcclient.TokenCredential, obj IModel, spec string) bool { + return userCred.IsAdminAllow(consts.GetServiceType(), obj.KeywordPlural(), policy.PolicyActionGet, spec) +} + +func IsAdminAllowPerform(userCred mcclient.TokenCredential, obj IModel, action string) bool { + return userCred.IsAdminAllow(consts.GetServiceType(), obj.KeywordPlural(), policy.PolicyActionPerform, action) +} + +func IsAdminAllowUpdate(userCred mcclient.TokenCredential, obj IModel) bool { + return userCred.IsAdminAllow(consts.GetServiceType(), obj.KeywordPlural(), policy.PolicyActionUpdate) +} + +func IsAdminAllowDelete(userCred mcclient.TokenCredential, obj IModel) bool { + return userCred.IsAdminAllow(consts.GetServiceType(), obj.KeywordPlural(), policy.PolicyActionDelete) +} \ No newline at end of file diff --git a/pkg/cloudcommon/db/sharablevirtual.go b/pkg/cloudcommon/db/sharablevirtual.go index d8c78a98df..bf048007f4 100644 --- a/pkg/cloudcommon/db/sharablevirtual.go +++ b/pkg/cloudcommon/db/sharablevirtual.go @@ -4,8 +4,6 @@ import ( "context" "yunion.io/x/jsonutils" - "yunion.io/x/onecloud/pkg/cloudcommon/consts" - "yunion.io/x/onecloud/pkg/cloudcommon/policy" "yunion.io/x/onecloud/pkg/mcclient" "yunion.io/x/sqlchemy" ) @@ -32,7 +30,7 @@ func (manager *SSharableVirtualResourceBaseManager) FilterByOwner(q *sqlchemy.SQ } func (model *SSharableVirtualResourceBase) AllowGetDetails(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { - return model.IsOwner(userCred) || model.IsPublic || userCred.IsAdminAllow(consts.GetServiceType(), model.KeywordPlural(), policy.PolicyActionGet) + return model.IsOwner(userCred) || model.IsPublic || IsAdminAllowGet(userCred, model) } func (model *SSharableVirtualResourceBase) IsSharable() bool { @@ -40,11 +38,11 @@ func (model *SSharableVirtualResourceBase) IsSharable() bool { } func (model *SSharableVirtualResourceBase) AllowPerformPublic(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), model.GetModelManager().KeywordPlural(), policy.PolicyActionPerform, "public") + return IsAdminAllowPerform(userCred, model, "public") } func (model *SSharableVirtualResourceBase) AllowPerformPrivate(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), model.GetModelManager().KeywordPlural(), policy.PolicyActionPerform, "private") + return IsAdminAllowPerform(userCred, model, "private") } func (model *SSharableVirtualResourceBase) PerformPublic(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { diff --git a/pkg/cloudcommon/db/standalone.go b/pkg/cloudcommon/db/standalone.go index 9d8d11f080..935e53d74c 100644 --- a/pkg/cloudcommon/db/standalone.go +++ b/pkg/cloudcommon/db/standalone.go @@ -7,8 +7,6 @@ import ( "yunion.io/x/jsonutils" "yunion.io/x/log" - "yunion.io/x/onecloud/pkg/cloudcommon/consts" - "yunion.io/x/onecloud/pkg/cloudcommon/policy" "yunion.io/x/onecloud/pkg/httperrors" "yunion.io/x/onecloud/pkg/mcclient" "yunion.io/x/pkg/util/regutils" @@ -149,7 +147,7 @@ func (model *SStandaloneResourceBase) GetMetadataJson(key string, userCred mccli } func (model *SStandaloneResourceBase) SetMetadata(ctx context.Context, key string, value interface{}, userCred mcclient.TokenCredential) error { - if Metadata.IsSystemAdminKey(key) && !userCred.IsAdminAllow(consts.GetServiceType(), model.GetModelManager().KeywordPlural(), policy.PolicyActionPerform, "metadata") { + if Metadata.IsSystemAdminKey(key) && !IsAdminAllowPerform(userCred, model, "metadata") { return httperrors.NewNotSufficientPrivilegeError("cannot set system key") } return Metadata.SetValue(ctx, model, key, value, userCred) @@ -157,7 +155,7 @@ func (model *SStandaloneResourceBase) SetMetadata(ctx context.Context, key strin func (model *SStandaloneResourceBase) SetAllMetadata(ctx context.Context, dictstore map[string]interface{}, userCred mcclient.TokenCredential) error { for k := range dictstore { - if Metadata.IsSystemAdminKey(k) && !userCred.IsAdminAllow(consts.GetServiceType(), model.GetModelManager().KeywordPlural(), policy.PolicyActionPerform, "metadata") { + if Metadata.IsSystemAdminKey(k) && !IsAdminAllowPerform(userCred, model, "metadata") { return httperrors.NewNotSufficientPrivilegeError(fmt.Sprintf("not allow to set system key %s", k)) } } @@ -177,7 +175,7 @@ func (model *SStandaloneResourceBase) GetAllMetadata(userCred mcclient.TokenCred } func (model *SStandaloneResourceBase) AllowGetDetailsMetadata(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), model.GetModelManager().KeywordPlural(), policy.PolicyActionGet, "metadata") + return IsAdminAllowGetSpec(userCred, model, "metadata") } func (model *SStandaloneResourceBase) GetDetailsMetadata(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -190,7 +188,7 @@ func (model *SStandaloneResourceBase) GetDetailsMetadata(ctx context.Context, us } func (model *SStandaloneResourceBase) AllowPerformMetadata(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), model.GetModelManager().KeywordPlural(), policy.PolicyActionPerform, "metadata") + return IsAdminAllowPerform(userCred, model, "metadata") } func (model *SStandaloneResourceBase) PerformMetadata(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { diff --git a/pkg/cloudcommon/db/statusstandalone.go b/pkg/cloudcommon/db/statusstandalone.go index 7f436d2c4c..5d3a6e66b3 100644 --- a/pkg/cloudcommon/db/statusstandalone.go +++ b/pkg/cloudcommon/db/statusstandalone.go @@ -6,8 +6,6 @@ import ( "strings" "yunion.io/x/jsonutils" - "yunion.io/x/onecloud/pkg/cloudcommon/consts" - "yunion.io/x/onecloud/pkg/cloudcommon/policy" "yunion.io/x/onecloud/pkg/mcclient" "yunion.io/x/onecloud/pkg/util/logclient" ) @@ -52,7 +50,7 @@ func (model *SStatusStandaloneResourceBase) SetStatus(userCred mcclient.TokenCre } func (model *SStatusStandaloneResourceBase) AllowPerformStatus(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), model.GetModelManager().KeywordPlural(), policy.PolicyActionPerform, "status") + return IsAdminAllowPerform(userCred, model, "status") } func (model *SStatusStandaloneResourceBase) PerformStatus(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { diff --git a/pkg/cloudcommon/db/taskman/tasks.go b/pkg/cloudcommon/db/taskman/tasks.go index 177bb0a203..aeac7ef0e0 100644 --- a/pkg/cloudcommon/db/taskman/tasks.go +++ b/pkg/cloudcommon/db/taskman/tasks.go @@ -18,11 +18,9 @@ import ( "yunion.io/x/pkg/utils" "yunion.io/x/sqlchemy" - "yunion.io/x/onecloud/pkg/cloudcommon/consts" "yunion.io/x/onecloud/pkg/cloudcommon/db" "yunion.io/x/onecloud/pkg/cloudcommon/db/lockman" "yunion.io/x/onecloud/pkg/cloudcommon/db/quotas" - "yunion.io/x/onecloud/pkg/cloudcommon/policy" ) const ( @@ -117,7 +115,7 @@ func (manager *STaskManager) FilterByOwner(q *sqlchemy.SQuery, owner string) *sq } func (self *STask) AllowGetDetails(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.GetModelManager().KeywordPlural(), policy.PolicyActionGet) || userCred.GetProjectId() == self.UserCred.GetProjectId() + return db.IsAdminAllowGet(userCred, self) || userCred.GetProjectId() == self.UserCred.GetProjectId() } func (self *STask) AllowUpdateItem(ctx context.Context, userCred mcclient.TokenCredential) bool { diff --git a/pkg/cloudcommon/db/virtualjointbase.go b/pkg/cloudcommon/db/virtualjointbase.go index 5a0e571e5d..ce5b3ce8ba 100644 --- a/pkg/cloudcommon/db/virtualjointbase.go +++ b/pkg/cloudcommon/db/virtualjointbase.go @@ -10,8 +10,6 @@ import ( "yunion.io/x/pkg/util/reflectutils" "yunion.io/x/sqlchemy" - "yunion.io/x/onecloud/pkg/cloudcommon/consts" - "yunion.io/x/onecloud/pkg/cloudcommon/policy" "yunion.io/x/onecloud/pkg/httperrors" "yunion.io/x/onecloud/pkg/mcclient" ) @@ -29,7 +27,7 @@ func NewVirtualJointResourceBaseManager(dt interface{}, tableName string, keywor } func (manager *SVirtualJointResourceBaseManager) AllowListItems(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { - if jsonutils.QueryBoolean(query, "admin", false) && !userCred.IsAdminAllow(consts.GetServiceType(), manager.KeywordPlural(), policy.PolicyActionList) { + if jsonutils.QueryBoolean(query, "admin", false) && !IsAdminAllowList(userCred, manager) { return false } return true @@ -38,7 +36,7 @@ func (manager *SVirtualJointResourceBaseManager) AllowListItems(ctx context.Cont func (manager *SVirtualJointResourceBaseManager) AllowListDescendent(ctx context.Context, userCred mcclient.TokenCredential, master IStandaloneModel, query jsonutils.JSONObject) bool { masterVirtual := master.(IVirtualModel) - if masterVirtual.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), masterVirtual.KeywordPlural(), policy.PolicyActionList) { + if masterVirtual.IsOwner(userCred) || IsAdminAllowList(userCred, manager) { return true } return false @@ -64,12 +62,12 @@ func (manager *SVirtualJointResourceBaseManager) AllowAttach(ctx context.Context func (self *SVirtualJointResourceBase) AllowGetDetails(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { masterVirtual := self.Master().(IVirtualModel) - return masterVirtual.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), masterVirtual.KeywordPlural(), policy.PolicyActionGet) + return masterVirtual.IsOwner(userCred) || IsAdminAllowGet(userCred, self) } func (self *SVirtualJointResourceBase) AllowUpdateItem(ctx context.Context, userCred mcclient.TokenCredential) bool { masterVirtual := self.Master().(IVirtualModel) - return masterVirtual.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), masterVirtual.KeywordPlural(), policy.PolicyActionUpdate) + return masterVirtual.IsOwner(userCred) || IsAdminAllowUpdate(userCred, self) } func (manager *SVirtualJointResourceBaseManager) ListItemFilter(ctx context.Context, q *sqlchemy.SQuery, userCred mcclient.TokenCredential, query jsonutils.JSONObject) (*sqlchemy.SQuery, error) { @@ -98,7 +96,7 @@ func (manager *SVirtualJointResourceBaseManager) ListItemFilter(ctx context.Cont sqlchemy.IsFalse(masterTable.Field("deleted")))) q = q.Join(slaveTable, sqlchemy.AND(sqlchemy.Equals(slaveField, slaveTable.Field("id")), sqlchemy.IsFalse(slaveTable.Field("deleted")))) - if jsonutils.QueryBoolean(query, "admin", false) && userCred.IsAdminAllow(consts.GetServiceType(), manager.KeywordPlural(), policy.PolicyActionList) { + if jsonutils.QueryBoolean(query, "admin", false) && IsAdminAllowList(userCred, manager) { isSystem := jsonutils.QueryBoolean(query, "system", false) if !isSystem { if len(slaveQueryId) == 0 { diff --git a/pkg/cloudcommon/db/virtualresource.go b/pkg/cloudcommon/db/virtualresource.go index a9e31f0263..4aec78a2d3 100644 --- a/pkg/cloudcommon/db/virtualresource.go +++ b/pkg/cloudcommon/db/virtualresource.go @@ -12,9 +12,7 @@ import ( "yunion.io/x/pkg/utils" "yunion.io/x/sqlchemy" - "yunion.io/x/onecloud/pkg/cloudcommon/consts" "yunion.io/x/onecloud/pkg/cloudcommon/db/lockman" - "yunion.io/x/onecloud/pkg/cloudcommon/policy" "yunion.io/x/onecloud/pkg/httperrors" "yunion.io/x/onecloud/pkg/mcclient" ) @@ -113,7 +111,7 @@ func (manager *SVirtualResourceBaseManager) ListItemFilter(ctx context.Context, func (manager *SVirtualResourceBaseManager) ValidateCreateData(ctx context.Context, userCred mcclient.TokenCredential, ownerProjId string, query jsonutils.JSONObject, data *jsonutils.JSONDict) (*jsonutils.JSONDict, error) { isSystem, err := data.Bool("is_system") - if err == nil && isSystem && !userCred.IsAdminAllow(consts.GetServiceType(), manager.KeywordPlural(), policy.PolicyActionCreate) { + if err == nil && isSystem && !IsAdminAllowCreate(userCred, manager) { return nil, httperrors.NewNotSufficientPrivilegeError("non-admin user not allowed to create system object") } return manager.SStandaloneResourceBaseManager.ValidateCreateData(ctx, userCred, ownerProjId, query, data) @@ -132,14 +130,14 @@ func (model *SVirtualResourceBase) CustomizeCreate(ctx context.Context, userCred func (manager *SVirtualResourceBaseManager) AllowListItems(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { isAdmin, err := query.Bool("admin") - if err == nil && isAdmin && !userCred.IsAdminAllow(consts.GetServiceType(), manager.KeywordPlural(), policy.PolicyActionList) { + if err == nil && isAdmin && !IsAdminAllowList(userCred, manager) { return false } return true } func (model *SVirtualResourceBase) AllowGetDetails(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { - return model.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), model.KeywordPlural(), policy.PolicyActionGet) + return model.IsOwner(userCred) || IsAdminAllowGet(userCred, model) } func (manager *SVirtualResourceBaseManager) AllowCreateItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { @@ -147,19 +145,19 @@ func (manager *SVirtualResourceBaseManager) AllowCreateItem(ctx context.Context, } func (model *SVirtualResourceBase) AllowUpdateItem(ctx context.Context, userCred mcclient.TokenCredential) bool { - return model.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), model.KeywordPlural(), policy.PolicyActionUpdate) + return model.IsOwner(userCred) || IsAdminAllowUpdate(userCred, model) } func (model *SVirtualResourceBase) AllowDeleteItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return model.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), model.KeywordPlural(), policy.PolicyActionDelete) + return model.IsOwner(userCred) || IsAdminAllowDelete(userCred, model) } func (model *SVirtualResourceBase) AllowGetDetailsMetadata(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { - return model.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), model.KeywordPlural(), policy.PolicyActionGet, "metadata") + return model.IsOwner(userCred) || IsAdminAllowGetSpec(userCred, model, "metadata") } func (model *SVirtualResourceBase) AllowPerformMetadata(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return model.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), model.KeywordPlural(), policy.PolicyActionPerform, "metadata") + return model.IsOwner(userCred) || IsAdminAllowPerform(userCred, model, "metadata") } func (model *SVirtualResourceBase) GetTenantCache(ctx context.Context) (*STenant, error) { @@ -168,7 +166,7 @@ func (model *SVirtualResourceBase) GetTenantCache(ctx context.Context) (*STenant } func (model *SVirtualResourceBase) getMoreDetails(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, extra *jsonutils.JSONDict) *jsonutils.JSONDict { - if userCred.IsAdminAllow(consts.GetServiceType(), model.GetModelManager().KeywordPlural(), policy.PolicyActionGet) { + if IsAdminAllowGet(userCred, model) { // log.Debugf("GetCustomizeColumns") tobj, err := model.GetTenantCache(ctx) if err == nil { @@ -200,7 +198,7 @@ func (model *SVirtualResourceBase) GetExtraDetails(ctx context.Context, userCred } func (model *SVirtualResourceBase) AllowPerformChangeOwner(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), model.GetModelManager().KeywordPlural(), policy.PolicyActionPerform, "change-owner") + return IsAdminAllowPerform(userCred, model, "change-owner") } func (model *SVirtualResourceBase) PerformChangeOwner(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { diff --git a/pkg/compute/models/baremetalagents.go b/pkg/compute/models/baremetalagents.go index 5bbf758354..5a0bd97232 100644 --- a/pkg/compute/models/baremetalagents.go +++ b/pkg/compute/models/baremetalagents.go @@ -5,9 +5,7 @@ import ( "fmt" "yunion.io/x/jsonutils" - "yunion.io/x/onecloud/pkg/cloudcommon/consts" "yunion.io/x/onecloud/pkg/cloudcommon/db" - "yunion.io/x/onecloud/pkg/cloudcommon/policy" "yunion.io/x/onecloud/pkg/httperrors" "yunion.io/x/onecloud/pkg/mcclient" "yunion.io/x/pkg/util/regutils" @@ -39,23 +37,23 @@ func init() { } func (self *SBaremetalagentManager) AllowListItems(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionList) + return db.IsAdminAllowList(userCred, self) } func (self *SBaremetalagentManager) AllowCreateItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionCreate) + return db.IsAdminAllowCreate(userCred, self) } func (self *SBaremetalagent) AllowGetDetails(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionGet) + return db.IsAdminAllowGet(userCred, self) } func (self *SBaremetalagent) AllowUpdateItem(ctx context.Context, userCred mcclient.TokenCredential) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionUpdate) + return db.IsAdminAllowUpdate(userCred, self) } func (self *SBaremetalagent) AllowDeleteItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionDelete) + return db.IsAdminAllowDelete(userCred, self) } func (self *SBaremetalagent) ValidateDeleteCondition(ctx context.Context) error { @@ -100,7 +98,7 @@ func (manager *SBaremetalagentManager) ValidateCreateData(ctx context.Context, u } func (self *SBaremetalagent) AllowPerformEnable(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.GetModelManager().KeywordPlural(), policy.PolicyActionPerform, "enable") + return db.IsAdminAllowPerform(userCred, self, "enable") } func (self *SBaremetalagent) PerformEnable(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -115,7 +113,7 @@ func (self *SBaremetalagent) PerformEnable(ctx context.Context, userCred mcclien } func (self *SBaremetalagent) AllowPerformDisable(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.GetModelManager().KeywordPlural(), policy.PolicyActionPerform, "disable") + return db.IsAdminAllowPerform(userCred, self, "disable") } func (self *SBaremetalagent) PerformDisable(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -130,7 +128,7 @@ func (self *SBaremetalagent) PerformDisable(ctx context.Context, userCred mcclie } func (self *SBaremetalagent) AllowPerformOnline(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.GetModelManager().KeywordPlural(), policy.PolicyActionPerform, "online") + return db.IsAdminAllowPerform(userCred, self, "online") } func (self *SBaremetalagent) PerformOnline(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -145,7 +143,7 @@ func (self *SBaremetalagent) PerformOnline(ctx context.Context, userCred mcclien } func (self *SBaremetalagent) AllowPerformOffline(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.GetModelManager().KeywordPlural(), policy.PolicyActionPerform, "offline") + return db.IsAdminAllowPerform(userCred, self, "offline") } func (self *SBaremetalagent) PerformOffline(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { diff --git a/pkg/compute/models/cachedimages.go b/pkg/compute/models/cachedimages.go index 1a4ac36bfb..c3fce4e476 100644 --- a/pkg/compute/models/cachedimages.go +++ b/pkg/compute/models/cachedimages.go @@ -16,10 +16,8 @@ import ( "yunion.io/x/pkg/util/timeutils" "yunion.io/x/sqlchemy" - "yunion.io/x/onecloud/pkg/cloudcommon/consts" "yunion.io/x/onecloud/pkg/cloudcommon/db" "yunion.io/x/onecloud/pkg/cloudcommon/db/lockman" - "yunion.io/x/onecloud/pkg/cloudcommon/policy" "yunion.io/x/onecloud/pkg/compute/options" ) @@ -57,23 +55,23 @@ type SCachedimage struct { } func (self *SCachedimageManager) AllowListItems(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionList) + return db.IsAdminAllowList(userCred, self) } func (self *SCachedimageManager) AllowCreateItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionCreate) + return db.IsAdminAllowCreate(userCred, self) } func (self *SCachedimage) AllowGetDetails(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionGet) + return db.IsAdminAllowGet(userCred, self) } func (self *SCachedimage) AllowUpdateItem(ctx context.Context, userCred mcclient.TokenCredential) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionUpdate) + return db.IsAdminAllowUpdate(userCred, self) } func (self *SCachedimage) AllowDeleteItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionDelete) + return db.IsAdminAllowDelete(userCred, self) } func (self *SCachedimage) ValidateDeleteCondition(ctx context.Context) error { @@ -260,7 +258,7 @@ func (self *SCachedimage) GetCustomizeColumns(ctx context.Context, userCred mccl } func (self *SCachedimage) AllowPerformRefresh(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.GetModelManager().KeywordPlural(), policy.PolicyActionPerform, "refresh") + return db.IsAdminAllowPerform(userCred, self, "refresh") } func (self *SCachedimage) PerformRefresh(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { diff --git a/pkg/compute/models/cloudaccounts.go b/pkg/compute/models/cloudaccounts.go index 9b3b51f2ff..b879a96343 100644 --- a/pkg/compute/models/cloudaccounts.go +++ b/pkg/compute/models/cloudaccounts.go @@ -13,10 +13,8 @@ import ( "yunion.io/x/pkg/utils" "yunion.io/x/sqlchemy" - "yunion.io/x/onecloud/pkg/cloudcommon/consts" "yunion.io/x/onecloud/pkg/cloudcommon/db" "yunion.io/x/onecloud/pkg/cloudcommon/db/taskman" - "yunion.io/x/onecloud/pkg/cloudcommon/policy" "yunion.io/x/onecloud/pkg/cloudprovider" "yunion.io/x/onecloud/pkg/httperrors" "yunion.io/x/onecloud/pkg/mcclient" @@ -59,23 +57,23 @@ type SCloudaccount struct { } func (self *SCloudaccountManager) AllowListItems(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionList) + return db.IsAdminAllowList(userCred, self) } func (self *SCloudaccountManager) AllowCreateItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionCreate) + return db.IsAdminAllowCreate(userCred, self) } func (self *SCloudaccount) AllowGetDetails(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionGet) + return db.IsAdminAllowGet(userCred, self) } func (self *SCloudaccount) AllowUpdateItem(ctx context.Context, userCred mcclient.TokenCredential) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionUpdate) + return db.IsAdminAllowUpdate(userCred, self) } func (self *SCloudaccount) AllowDeleteItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionDelete) + return db.IsAdminAllowDelete(userCred, self) } func (self *SCloudaccount) GetCloudproviders() []SCloudprovider { @@ -219,7 +217,7 @@ func (self *SCloudaccount) CanSync() bool { } func (self *SCloudaccount) AllowPerformSync(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.GetModelManager().KeywordPlural(), policy.PolicyActionPerform, "sync") + return db.IsAdminAllowPerform(userCred, self, "sync") } func (self *SCloudaccount) PerformSync(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -238,7 +236,7 @@ func (self *SCloudaccount) PerformSync(ctx context.Context, userCred mcclient.To } func (self *SCloudaccount) AllowPerformUpdateCredential(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.GetModelManager().KeywordPlural(), policy.PolicyActionPerform, "update-credential") + return db.IsAdminAllowPerform(userCred, self, "update-credential") } func (self *SCloudaccount) PerformUpdateCredential(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -464,7 +462,7 @@ func (self *SCloudaccount) ImportSubAccount(ctx context.Context, userCred mcclie } func (self *SCloudaccount) AllowPerformImport(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.GetModelManager().KeywordPlural(), policy.PolicyActionPerform, "import") + return db.IsAdminAllowPerform(userCred, self, "import") } func (self *SCloudaccount) PerformImport(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -638,7 +636,7 @@ func (self *SCloudaccount) GetBalance() (float64, error) { } func (self *SCloudaccount) AllowGetDetailsBalance(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.GetModelManager().KeywordPlural(), policy.PolicyActionGet, "balance") + return db.IsAdminAllowGetSpec(userCred, self, "balance") } func (self *SCloudaccount) GetDetailsBalance(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) (jsonutils.JSONObject, error) { diff --git a/pkg/compute/models/cloudproviders.go b/pkg/compute/models/cloudproviders.go index 959166aed1..307a258c79 100644 --- a/pkg/compute/models/cloudproviders.go +++ b/pkg/compute/models/cloudproviders.go @@ -12,10 +12,8 @@ import ( "yunion.io/x/pkg/utils" "yunion.io/x/sqlchemy" - "yunion.io/x/onecloud/pkg/cloudcommon/consts" "yunion.io/x/onecloud/pkg/cloudcommon/db" "yunion.io/x/onecloud/pkg/cloudcommon/db/taskman" - "yunion.io/x/onecloud/pkg/cloudcommon/policy" "yunion.io/x/onecloud/pkg/cloudprovider" "yunion.io/x/onecloud/pkg/compute/options" "yunion.io/x/onecloud/pkg/httperrors" @@ -86,23 +84,23 @@ func (self *SCloudprovider) GetOwnerProjectId() string { } func (self *SCloudproviderManager) AllowListItems(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionList) + return db.IsAdminAllowList(userCred, self) } func (self *SCloudproviderManager) AllowCreateItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionCreate) + return db.IsAdminAllowCreate(userCred, self) } func (self *SCloudprovider) AllowGetDetails(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionGet) + return db.IsAdminAllowGet(userCred, self) } func (self *SCloudprovider) AllowUpdateItem(ctx context.Context, userCred mcclient.TokenCredential) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionUpdate) + return db.IsAdminAllowUpdate(userCred, self) } func (self *SCloudprovider) AllowDeleteItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionDelete) + return db.IsAdminAllowDelete(userCred, self) } func (self *SCloudprovider) ValidateDeleteCondition(ctx context.Context) error { @@ -317,7 +315,7 @@ func (sr *SSyncRange) Normalize() error { } func (self *SCloudprovider) AllowPerformSync(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "sync") + return db.IsAdminAllowPerform(userCred, self, "sync") } func (self *SCloudprovider) PerformSync(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -350,7 +348,7 @@ func (self *SCloudprovider) StartSyncCloudProviderInfoTask(ctx context.Context, } func (self *SCloudprovider) AllowPerformChangeProject(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "change-project") + return db.IsAdminAllowPerform(userCred, self, "change-project") } func (self *SCloudprovider) PerformChangeProject(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -601,7 +599,7 @@ func (self *SCloudprovider) GetBalance() (float64, error) { } func (self *SCloudprovider) AllowGetDetailsBalance(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionGet, "balance") + return db.IsAdminAllowGetSpec(userCred, self, "balance") } func (self *SCloudprovider) GetDetailsBalance(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) (jsonutils.JSONObject, error) { diff --git a/pkg/compute/models/cloudregions.go b/pkg/compute/models/cloudregions.go index 5f6f34c269..7f36857f22 100644 --- a/pkg/compute/models/cloudregions.go +++ b/pkg/compute/models/cloudregions.go @@ -12,9 +12,7 @@ import ( "yunion.io/x/pkg/util/compare" "yunion.io/x/sqlchemy" - "yunion.io/x/onecloud/pkg/cloudcommon/consts" "yunion.io/x/onecloud/pkg/cloudcommon/db" - "yunion.io/x/onecloud/pkg/cloudcommon/policy" "yunion.io/x/onecloud/pkg/cloudprovider" ) @@ -53,19 +51,19 @@ func (manager *SCloudregionManager) AllowListItems(ctx context.Context, userCred } func (self *SCloudregionManager) AllowCreateItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionCreate) + return db.IsAdminAllowCreate(userCred, self) } func (self *SCloudregion) AllowGetDetails(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionGet) + return db.IsAdminAllowGet(userCred, self) } func (self *SCloudregion) AllowUpdateItem(ctx context.Context, userCred mcclient.TokenCredential) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionUpdate) + return db.IsAdminAllowUpdate(userCred, self) } func (self *SCloudregion) AllowDeleteItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionDelete) + return db.IsAdminAllowDelete(userCred, self) } func (self *SCloudregion) CustomizeCreate(ctx context.Context, userCred mcclient.TokenCredential, ownerProjId string, query jsonutils.JSONObject, data jsonutils.JSONObject) error { @@ -264,7 +262,7 @@ func (manager *SCloudregionManager) newFromCloudRegion(cloudRegion cloudprovider } func (self *SCloudregion) AllowPerformDefaultVpc(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "default-vpc") + return db.IsAdminAllowPerform(userCred, self, "default-vpc") } func (self *SCloudregion) PerformDefaultVpc(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { diff --git a/pkg/compute/models/disks.go b/pkg/compute/models/disks.go index f2c0e24168..aa145d2d66 100644 --- a/pkg/compute/models/disks.go +++ b/pkg/compute/models/disks.go @@ -19,11 +19,9 @@ import ( "yunion.io/x/pkg/utils" "yunion.io/x/sqlchemy" - "yunion.io/x/onecloud/pkg/cloudcommon/consts" "yunion.io/x/onecloud/pkg/cloudcommon/db" "yunion.io/x/onecloud/pkg/cloudcommon/db/quotas" "yunion.io/x/onecloud/pkg/cloudcommon/db/taskman" - "yunion.io/x/onecloud/pkg/cloudcommon/policy" "yunion.io/x/onecloud/pkg/cloudprovider" "yunion.io/x/onecloud/pkg/compute/options" "yunion.io/x/onecloud/pkg/httperrors" @@ -444,7 +442,7 @@ func (self *SDisk) StartAllocate(ctx context.Context, host *SHost, storage *SSto } func (self *SDisk) AllowGetDetailsConvertSnapshot(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { - return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionGet, "convert-snapshot") + return self.IsOwner(userCred) || db.IsAdminAllowPerform(userCred, self, "convert-snapshot") } func (self *SDisk) GetDetailsConvertSnapshot(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -501,7 +499,7 @@ func (self *SDisk) CleanUpDiskSnapshots(ctx context.Context, userCred mcclient.T } func (self *SDisk) AllowPerformCreateSnapshot(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "create-snapshot") + return self.IsOwner(userCred) || db.IsAdminAllowPerform(userCred, self, "create-snapshot") } func (self *SDisk) PerformCreateSnapshot(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -515,7 +513,7 @@ func (self *SDisk) PerformCreateSnapshot(ctx context.Context, userCred mcclient. } func (self *SDisk) AllowPerformDiskReset(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "disk-reset") + return self.IsOwner(userCred) || db.IsAdminAllowPerform(userCred, self, "disk-reset") } func (self *SDisk) PerformDiskReset(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -562,7 +560,7 @@ func (self *SDisk) StartResetDisk(ctx context.Context, userCred mcclient.TokenCr } func (self *SDisk) AllowPerformResize(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "resize") + return self.IsOwner(userCred) || db.IsAdminAllowPerform(userCred, self, "resize") } func (self *SDisk) PerformResize(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -653,7 +651,7 @@ func (self *SDisk) PrepareSaveImage(ctx context.Context, userCred mcclient.Token } func (self *SDisk) AllowPerformSave(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "save") + return self.IsOwner(userCred) || db.IsAdminAllowPerform(userCred, self, "save") } func (self *SDisk) PerformSave(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -1141,7 +1139,7 @@ func (self *SDisk) RealDelete(ctx context.Context, userCred mcclient.TokenCreden } func (self *SDisk) AllowPerformPurge(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "purge") + return self.IsOwner(userCred) || db.IsAdminAllowPerform(userCred, self, "purge") } func (self *SDisk) PerformPurge(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -1317,7 +1315,7 @@ func (self *SDisk) isInit() bool { } func (self *SDisk) AllowPerformCancelDelete(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "cancel-delete") + return db.IsAdminAllowPerform(userCred, self, "cancel-delete") } func (self *SDisk) PerformCancelDelete(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { diff --git a/pkg/compute/models/dnsrecords.go b/pkg/compute/models/dnsrecords.go index 74590ae471..a5843c5a69 100644 --- a/pkg/compute/models/dnsrecords.go +++ b/pkg/compute/models/dnsrecords.go @@ -11,9 +11,7 @@ import ( "yunion.io/x/pkg/util/regutils" "yunion.io/x/sqlchemy" - "yunion.io/x/onecloud/pkg/cloudcommon/consts" "yunion.io/x/onecloud/pkg/cloudcommon/db" - "yunion.io/x/onecloud/pkg/cloudcommon/policy" "yunion.io/x/onecloud/pkg/httperrors" "yunion.io/x/onecloud/pkg/mcclient" ) @@ -385,7 +383,7 @@ func (rec *SDnsRecord) AddInfo(userCred mcclient.TokenCredential, data jsonutils } func (rec *SDnsRecord) AllowPerformAddRecords(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return rec.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), rec.KeywordPlural(), policy.PolicyActionPerform, "add-records") + return rec.IsOwner(userCred) || db.IsAdminAllowPerform(userCred, rec, "add-records") } func (rec *SDnsRecord) PerformAddRecords(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -404,7 +402,7 @@ func (rec *SDnsRecord) PerformAddRecords(ctx context.Context, userCred mcclient. } func (rec *SDnsRecord) AllowPerformRemoveRecords(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return rec.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), rec.KeywordPlural(), policy.PolicyActionPerform, "remove-records") + return rec.IsOwner(userCred) || db.IsAdminAllowPerform(userCred, rec, "remove-records") } func (rec *SDnsRecord) PerformRemoveRecords(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -413,7 +411,7 @@ func (rec *SDnsRecord) PerformRemoveRecords(ctx context.Context, userCred mcclie } func (rec *SDnsRecord) AllowPerformEnable(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return rec.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), rec.KeywordPlural(), policy.PolicyActionPerform, "enable") + return rec.IsOwner(userCred) || db.IsAdminAllowPerform(userCred, rec, "enable") } func (rec *SDnsRecord) PerformEnable(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -431,7 +429,7 @@ func (rec *SDnsRecord) PerformEnable(ctx context.Context, userCred mcclient.Toke } func (rec *SDnsRecord) AllowPerformDisable(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return rec.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), rec.KeywordPlural(), policy.PolicyActionPerform, "disable") + return rec.IsOwner(userCred) || db.IsAdminAllowPerform(userCred, rec, "disable") } func (rec *SDnsRecord) PerformDisable(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { diff --git a/pkg/compute/models/dynamicschedtags.go b/pkg/compute/models/dynamicschedtags.go index 0a1ab9e640..54443b2f18 100644 --- a/pkg/compute/models/dynamicschedtags.go +++ b/pkg/compute/models/dynamicschedtags.go @@ -7,9 +7,7 @@ import ( "yunion.io/x/log" "database/sql" - "yunion.io/x/onecloud/pkg/cloudcommon/consts" "yunion.io/x/onecloud/pkg/cloudcommon/db" - "yunion.io/x/onecloud/pkg/cloudcommon/policy" "yunion.io/x/onecloud/pkg/httperrors" "yunion.io/x/onecloud/pkg/mcclient" "yunion.io/x/onecloud/pkg/util/conditionparser" @@ -46,23 +44,23 @@ type SDynamicschedtag struct { } func (self *SDynamicschedtagManager) AllowListItems(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionList) + return db.IsAdminAllowList(userCred, self) } func (self *SDynamicschedtagManager) AllowCreateItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionCreate) + return db.IsAdminAllowCreate(userCred, self) } func (self *SDynamicschedtag) AllowGetDetails(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionGet) + return db.IsAdminAllowGet(userCred, self) } func (self *SDynamicschedtag) AllowUpdateItem(ctx context.Context, userCred mcclient.TokenCredential) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionUpdate) + return db.IsAdminAllowUpdate(userCred, self) } func (self *SDynamicschedtag) AllowDeleteItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionDelete) + return db.IsAdminAllowDelete(userCred, self) } func validateDynamicSchedtagInputData(data *jsonutils.JSONDict, create bool) error { @@ -152,7 +150,7 @@ func (manager *SDynamicschedtagManager) getAllEnabledDynamicSchedtags() []SDynam } func (self *SDynamicschedtag) AllowPerformEvaluate(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "evaluate") + return db.IsAdminAllowPerform(userCred, self, "evaluate") } func (self *SDynamicschedtag) PerformEvaluate(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { diff --git a/pkg/compute/models/elasticips.go b/pkg/compute/models/elasticips.go index 840f29bd35..861c5849a9 100644 --- a/pkg/compute/models/elasticips.go +++ b/pkg/compute/models/elasticips.go @@ -13,12 +13,10 @@ import ( "yunion.io/x/pkg/utils" "yunion.io/x/sqlchemy" - "yunion.io/x/onecloud/pkg/cloudcommon/consts" "yunion.io/x/onecloud/pkg/cloudcommon/db" "yunion.io/x/onecloud/pkg/cloudcommon/db/lockman" "yunion.io/x/onecloud/pkg/cloudcommon/db/quotas" "yunion.io/x/onecloud/pkg/cloudcommon/db/taskman" - "yunion.io/x/onecloud/pkg/cloudcommon/policy" "yunion.io/x/onecloud/pkg/cloudprovider" "yunion.io/x/onecloud/pkg/httperrors" "yunion.io/x/onecloud/pkg/mcclient" @@ -495,7 +493,7 @@ func (self *SElasticip) StartEipDeallocateTask(ctx context.Context, userCred mcc } func (self *SElasticip) AllowPerformAssociate(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "associate") + return self.IsOwner(userCred) || db.IsAdminAllowPerform(userCred, self, "associate") } func (self *SElasticip) PerformAssociate(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -595,7 +593,7 @@ func (self *SElasticip) StartEipAssociateTask(ctx context.Context, userCred mccl } func (self *SElasticip) AllowPerformDissociate(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "dissociate") + return self.IsOwner(userCred) || db.IsAdminAllowPerform(userCred, self, "dissociate") } func (self *SElasticip) PerformDissociate(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -649,7 +647,7 @@ func (self *SElasticip) GetIEip() (cloudprovider.ICloudEIP, error) { } func (self *SElasticip) AllowPerformSync(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "sync") + return self.IsOwner(userCred) || db.IsAdminAllowPerform(userCred, self, "sync") } func (self *SElasticip) PerformSync(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -733,7 +731,7 @@ func (manager *SElasticipManager) allocateEipAndAssociateVM(ctx context.Context, } func (self *SElasticip) AllowPerformChangeBandwidth(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "change-bandwidth") + return self.IsOwner(userCred) || db.IsAdminAllowPerform(userCred, self, "change-bandwidth") } func (self *SElasticip) PerformChangeBandwidth(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -836,7 +834,7 @@ func (manager *SElasticipManager) TotalCount(projectId string, rangeObj db.IStan } func (self *SElasticip) AllowPerformPurge(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionDelete) + return db.IsAdminAllowPerform(userCred, self, "purge") } func (self *SElasticip) PerformPurge(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { diff --git a/pkg/compute/models/guest_actions.go b/pkg/compute/models/guest_actions.go index 83d92064c6..961c0ec84d 100644 --- a/pkg/compute/models/guest_actions.go +++ b/pkg/compute/models/guest_actions.go @@ -23,8 +23,6 @@ import ( "yunion.io/x/jsonutils" "yunion.io/x/log" - "yunion.io/x/onecloud/pkg/cloudcommon/consts" - "yunion.io/x/onecloud/pkg/cloudcommon/policy" "yunion.io/x/pkg/util/fileutils" "yunion.io/x/pkg/util/regutils" "yunion.io/x/pkg/utils" @@ -32,7 +30,7 @@ import ( ) func (self *SGuest) AllowGetDetailsVnc(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { - return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionGet, "vnc") + return self.IsOwner(userCred) || db.IsAdminAllowGetSpec(userCred, self, "vnc") } func (self *SGuest) GetDetailsVnc(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -53,7 +51,7 @@ func (self *SGuest) GetDetailsVnc(ctx context.Context, userCred mcclient.TokenCr } func (self *SGuest) AllowGetDetailsMonitor(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { - return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionGet, "monitor") + return self.IsOwner(userCred) || db.IsAdminAllowGetSpec(userCred, self, "monitor") } func (self *SGuest) GetDetailsMonitor(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -68,7 +66,7 @@ func (self *SGuest) GetDetailsMonitor(ctx context.Context, userCred mcclient.Tok } func (self *SGuest) AllowGetDetailsDesc(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { - return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionGet, "desc") + return self.IsOwner(userCred) || db.IsAdminAllowGetSpec(userCred, self, "desc") } func (self *SGuest) GetDetailsDesc(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -81,7 +79,7 @@ func (self *SGuest) GetDetailsDesc(ctx context.Context, userCred mcclient.TokenC } func (self *SGuest) AllowPerformSaveImage(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "save-image") + return self.IsOwner(userCred) || db.IsAdminAllowPerform(userCred, self, "save-image") } func (self *SGuest) PerformSaveImage(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -119,7 +117,7 @@ func (self *SGuest) StartGuestSaveImage(ctx context.Context, userCred mcclient.T } func (self *SGuest) AllowPerformSync(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "sync") + return self.IsOwner(userCred) || db.IsAdminAllowPerform(userCred, self, "sync") } func (self *SGuest) PerformSync(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -161,7 +159,7 @@ func (self *SGuest) CheckQemuVersion(qemuVer, compareVer string) bool { } func (self *SGuest) AllowPerformMigrate(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "migrate") + return self.IsOwner(userCred) || db.IsAdminAllowPerform(userCred, self, "migrate") } func (self *SGuest) PerformMigrate(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -188,7 +186,7 @@ func (self *SGuest) PerformMigrate(ctx context.Context, userCred mcclient.TokenC var preferHostId string preferHost, _ := data.GetString("prefer_host") if len(preferHost) > 0 { - if !userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "assign-host") { + if !db.IsAdminAllowPerform(userCred, self, "assign-host") { return nil, httperrors.NewBadRequestError("Only system admin can assign host") } iHost, _ := HostManager.FetchByIdOrName(userCred, preferHost) @@ -221,7 +219,7 @@ func (self *SGuest) StartMigrateTask(ctx context.Context, userCred mcclient.Toke } func (self *SGuest) AllowPerformLiveMigrate(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "live-migrate") + return self.IsOwner(userCred) || db.IsAdminAllowPerform(userCred, self, "live-migrate") } func (self *SGuest) PerformLiveMigrate(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -251,7 +249,7 @@ func (self *SGuest) PerformLiveMigrate(ctx context.Context, userCred mcclient.To var preferHostId string preferHost, _ := data.GetString("prefer_host") if len(preferHost) > 0 { - if !userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "assign-host") { + if !db.IsAdminAllowPerform(userCred, self, "assign-host") { return nil, httperrors.NewBadRequestError("Only system admin can assign host") } iHost, _ := HostManager.FetchByIdOrName(userCred, preferHost) @@ -284,7 +282,7 @@ func (self *SGuest) StartGuestLiveMigrateTask(ctx context.Context, userCred mccl } func (self *SGuest) AllowPerformDeploy(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "deploy") + return self.IsOwner(userCred) || db.IsAdminAllowPerform(userCred, self, "deploy") } func (self *SGuest) PerformDeploy(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -347,7 +345,7 @@ func (self *SGuest) PerformDeploy(ctx context.Context, userCred mcclient.TokenCr } func (self *SGuest) AllowPerformAttachdisk(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "attachdisk") + return self.IsOwner(userCred) || db.IsAdminAllowPerform(userCred, self, "attachdisk") } func (self *SGuest) ValidateAttachDisk(ctx context.Context, disk *SDisk) error { @@ -427,7 +425,7 @@ func (self *SGuest) StartSyncTask(ctx context.Context, userCred mcclient.TokenCr } func (self *SGuest) AllowPerformSuspend(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "suspend") + return self.IsOwner(userCred) || db.IsAdminAllowPerform(userCred, self, "suspend") } func (self *SGuest) PerformSuspend(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -450,7 +448,7 @@ func (self *SGuest) AllowPerformStart(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "start") + return self.IsOwner(userCred) || db.IsAdminAllowPerform(userCred, self, "start") } func (self *SGuest) PerformStart(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, @@ -626,11 +624,11 @@ func (self *SGuest) StartDeleteGuestTask(ctx context.Context, userCred mcclient. } func (self *SGuest) AllowPerformAssignSecgroup(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "assign-secgroup") + return self.IsOwner(userCred) || db.IsAdminAllowPerform(userCred, self, "assign-secgroup") } func (self *SGuest) AllowPerformRevokeSecgroup(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "revoke-secgroup") + return self.IsOwner(userCred) || db.IsAdminAllowPerform(userCred, self, "revoke-secgroup") } func (self *SGuest) PerformRevokeSecgroup(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -681,7 +679,7 @@ func (self *SGuest) PerformAssignSecgroup(ctx context.Context, userCred mcclient } func (self *SGuest) AllowPerformPurge(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionDelete) + return db.IsAdminAllowPerform(userCred, self, "purge") } func (self *SGuest) PerformPurge(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -709,7 +707,7 @@ func (self *SGuest) setKeypairId(userCred mcclient.TokenCredential, keypairId st } func (self *SGuest) AllowPerformRebuildRoot(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "rebuild-root") + return self.IsOwner(userCred) || db.IsAdminAllowPerform(userCred, self, "rebuild-root") } func (self *SGuest) PerformRebuildRoot(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -816,7 +814,7 @@ func (self *SGuest) DetachDisk(ctx context.Context, disk *SDisk, userCred mcclie } func (self *SGuest) AllowPerformCreatedisk(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "createdisk") + return self.IsOwner(userCred) || db.IsAdminAllowPerform(userCred, self, "createdisk") } func (self *SGuest) PerformCreatedisk(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -887,7 +885,7 @@ func (self *SGuest) PerformCreatedisk(ctx context.Context, userCred mcclient.Tok } func (self *SGuest) AllowPerformDetachdisk(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "detachdisk") + return self.IsOwner(userCred) || db.IsAdminAllowPerform(userCred, self, "detachdisk") } func (self *SGuest) PerformDetachdisk(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -933,7 +931,7 @@ func (self *SGuest) PerformDetachdisk(ctx context.Context, userCred mcclient.Tok } func (self *SGuest) AllowPerformDetachIsolatedDevice(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "detach-isolated-device") + return self.IsOwner(userCred) || db.IsAdminAllowPerform(userCred, self, "detach-isolated-device") } func (self *SGuest) PerformDetachIsolatedDevice(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -983,7 +981,7 @@ func (self *SGuest) detachIsolateDevice(userCred mcclient.TokenCredential, dev * } func (self *SGuest) AllowPerformAttachIsolatedDevice(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "attach-isolated-device") + return self.IsOwner(userCred) || db.IsAdminAllowPerform(userCred, self, "attach-isolated-device") } func (self *SGuest) PerformAttachIsolatedDevice(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -1021,7 +1019,7 @@ func (self *SGuest) PerformAttachIsolatedDevice(ctx context.Context, userCred mc } func (self *SGuest) AllowPerformDetachnetwork(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "detachnetwork") + return self.IsOwner(userCred) || db.IsAdminAllowPerform(userCred, self, "detachnetwork") } func (self *SGuest) PerformDetachnetwork(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -1043,7 +1041,7 @@ func (self *SGuest) PerformDetachnetwork(ctx context.Context, userCred mcclient. } func (self *SGuest) AllowPerformAttachnetwork(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "attachnetwork") + return self.IsOwner(userCred) || db.IsAdminAllowPerform(userCred, self, "attachnetwork") } func (self *SGuest) PerformAttachnetwork(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -1094,7 +1092,7 @@ func (self *SGuest) PerformAttachnetwork(ctx context.Context, userCred mcclient. } func (self *SGuest) AllowPerformChangeBandwidth(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "change-bandwidth") + return self.IsOwner(userCred) || db.IsAdminAllowPerform(userCred, self, "change-bandwidth") } func (self *SGuest) PerformChangeBandwidth(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -1128,7 +1126,7 @@ func (self *SGuest) PerformChangeBandwidth(ctx context.Context, userCred mcclien } func (self *SGuest) AllowPerformChangeConfig(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "change-config") + return self.IsOwner(userCred) || db.IsAdminAllowPerform(userCred, self, "change-config") } func (self *SGuest) PerformChangeConfig(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -1319,7 +1317,7 @@ func (self *SGuest) DoPendingDelete(ctx context.Context, userCred mcclient.Token } func (model *SGuest) AllowPerformCancelDelete(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), model.KeywordPlural(), policy.PolicyActionPerform, "cancel-delete") + return db.IsAdminAllowPerform(userCred, model, "cancel-delete") } func (self *SGuest) PerformCancelDelete(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -1355,7 +1353,7 @@ func (self *SGuest) AllowPerformReset(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "reset") + return self.IsOwner(userCred) || db.IsAdminAllowPerform(userCred, self, "reset") } func (self *SGuest) PerformReset(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, @@ -1369,7 +1367,7 @@ func (self *SGuest) PerformReset(ctx context.Context, userCred mcclient.TokenCre } func (self *SGuest) AllowPerformDiskSnapshot(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "disk-snapshot") + return self.IsOwner(userCred) || db.IsAdminAllowPerform(userCred, self, "disk-snapshot") } func (self *SGuest) PerformDiskSnapshot(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -1423,7 +1421,7 @@ func (self *SGuest) PerformDiskSnapshot(ctx context.Context, userCred mcclient.T } func (self *SGuest) AllowPerformSyncstatus(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "syncstatus") + return self.IsOwner(userCred) || db.IsAdminAllowPerform(userCred, self, "syncstatus") } func (self *SGuest) PerformSyncstatus(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -1467,7 +1465,7 @@ func (self *SGuest) AllowPerformStop(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "stop") + return self.IsOwner(userCred) || db.IsAdminAllowPerform(userCred, self, "stop") } func (self *SGuest) PerformStop(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, @@ -1484,7 +1482,7 @@ func (self *SGuest) AllowPerformRestart(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "restart") + return self.IsOwner(userCred) || db.IsAdminAllowPerform(userCred, self, "restart") } func (self *SGuest) PerformRestart(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -1497,7 +1495,7 @@ func (self *SGuest) PerformRestart(ctx context.Context, userCred mcclient.TokenC } func (self *SGuest) AllowPerformSendkeys(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "sendkeys") + return self.IsOwner(userCred) || db.IsAdminAllowPerform(userCred, self, "sendkeys") } func (self *SGuest) PerformSendkeys(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -1571,7 +1569,7 @@ func (self *SGuest) SendMonitorCommand(ctx context.Context, userCred mcclient.To } func (self *SGuest) AllowPerformAssociateEip(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "associate-eip") + return self.IsOwner(userCred) || db.IsAdminAllowPerform(userCred, self, "associate-eip") } func (self *SGuest) PerformAssociateEip(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -1639,7 +1637,7 @@ func (self *SGuest) PerformAssociateEip(ctx context.Context, userCred mcclient.T } func (self *SGuest) AllowPerformDissociateEip(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "dissociate-eip") + return self.IsOwner(userCred) || db.IsAdminAllowPerform(userCred, self, "dissociate-eip") } func (self *SGuest) PerformDissociateEip(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -1663,7 +1661,7 @@ func (self *SGuest) PerformDissociateEip(ctx context.Context, userCred mcclient. } func (self *SGuest) AllowPerformCreateEip(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "create-eip") + return self.IsOwner(userCred) || db.IsAdminAllowPerform(userCred, self, "create-eip") } func (self *SGuest) PerformCreateEip(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -1718,7 +1716,7 @@ func (self *SGuest) setUserData(ctx context.Context, userCred mcclient.TokenCred } func (self *SGuest) AllowPerformUserData(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "userdata") + return self.IsOwner(userCred) || db.IsAdminAllowPerform(userCred, self, "userdata") } func (self *SGuest) PerformUserData(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -1740,7 +1738,7 @@ func (self *SGuest) PerformUserData(ctx context.Context, userCred mcclient.Token } func (self *SGuest) AllowPerformSetExtraOption(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "set-extra-option") + return db.IsAdminAllowPerform(userCred, self, "set-extra-option") } func (self *SGuest) PerformSetExtraOption(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -1768,7 +1766,7 @@ func (self *SGuest) SetExtraOptions(ctx context.Context, userCred mcclient.Token } func (self *SGuest) AllowPerformDelExtraOption(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "del-extra-option") + return db.IsAdminAllowPerform(userCred, self, "del-extra-option") } func (self *SGuest) PerformDelExtraOption(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { diff --git a/pkg/compute/models/guests.go b/pkg/compute/models/guests.go index 011b3ae613..1a1145d5eb 100644 --- a/pkg/compute/models/guests.go +++ b/pkg/compute/models/guests.go @@ -22,11 +22,9 @@ import ( "yunion.io/x/pkg/utils" "yunion.io/x/sqlchemy" - "yunion.io/x/onecloud/pkg/cloudcommon/consts" "yunion.io/x/onecloud/pkg/cloudcommon/db" "yunion.io/x/onecloud/pkg/cloudcommon/db/lockman" "yunion.io/x/onecloud/pkg/cloudcommon/db/quotas" - "yunion.io/x/onecloud/pkg/cloudcommon/policy" "yunion.io/x/onecloud/pkg/cloudprovider" "yunion.io/x/onecloud/pkg/compute/options" "yunion.io/x/onecloud/pkg/compute/sshkeys" @@ -209,7 +207,7 @@ type SGuest struct { func (manager *SGuestManager) AllowListItems(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { if query.Contains("host") || query.Contains("wire") || query.Contains("zone") { - if !userCred.IsAdminAllow(consts.GetServiceType(), manager.KeywordPlural(), policy.PolicyActionList) { + if !db.IsAdminAllowList(userCred, manager) { return false } } @@ -921,7 +919,7 @@ func (self *SGuest) getExtBandwidth() int { func (self *SGuest) GetCustomizeColumns(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) *jsonutils.JSONDict { extra := self.SVirtualResourceBase.GetCustomizeColumns(ctx, userCred, query) - if userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionGet) { + if db.IsAdminAllowGet(userCred, self) { host := self.GetHost() if host != nil { extra.Add(jsonutils.NewString(host.Name), "host") @@ -1014,7 +1012,7 @@ func (self *SGuest) GetExtraDetails(ctx context.Context, userCred mcclient.Token if metaData, err := self.GetAllMetadata(userCred); err == nil { extra.Add(jsonutils.Marshal(metaData), "metadata") } - if userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionGet) { + if db.IsAdminAllowGet(userCred, self) { host := self.GetHost() if host != nil { extra.Add(jsonutils.NewString(host.GetName()), "host") @@ -2213,10 +2211,10 @@ func (self *SGuest) AllowDeleteItem(ctx context.Context, userCred mcclient.Token overridePendingDelete = jsonutils.QueryBoolean(data, "override_pending_delete", false) purge = jsonutils.QueryBoolean(data, "purge", false) } - if (overridePendingDelete || purge) && !userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionDelete) { + if (overridePendingDelete || purge) && !db.IsAdminAllowDelete(userCred, self) { return false } - return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionDelete) + return self.IsOwner(userCred) || db.IsAdminAllowDelete(userCred, self) } func (self *SGuest) CustomizeDelete(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) error { diff --git a/pkg/compute/models/hostjoints.go b/pkg/compute/models/hostjoints.go index b8d7dac8f3..ccc1aaabab 100644 --- a/pkg/compute/models/hostjoints.go +++ b/pkg/compute/models/hostjoints.go @@ -6,9 +6,7 @@ import ( "yunion.io/x/jsonutils" "yunion.io/x/onecloud/pkg/mcclient" - "yunion.io/x/onecloud/pkg/cloudcommon/consts" "yunion.io/x/onecloud/pkg/cloudcommon/db" - "yunion.io/x/onecloud/pkg/cloudcommon/policy" ) type SHostJointsManager struct { @@ -33,29 +31,29 @@ type SHostJointsBase struct { } func (manager *SHostJointsManager) AllowListItems(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), manager.KeywordPlural(), policy.PolicyActionList) + return db.IsAdminAllowList(userCred, manager) } func (manager *SHostJointsManager) AllowCreateItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), manager.KeywordPlural(), policy.PolicyActionCreate) + return db.IsAdminAllowCreate(userCred, manager) } func (manager *SHostJointsManager) AllowListDescendent(ctx context.Context, userCred mcclient.TokenCredential, model db.IStandaloneModel, query jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), manager.KeywordPlural(), policy.PolicyActionList) + return db.IsAdminAllowList(userCred, manager) } func (manager *SHostJointsManager) AllowAttach(ctx context.Context, userCred mcclient.TokenCredential, master db.IStandaloneModel, slave db.IStandaloneModel) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), manager.KeywordPlural(), policy.PolicyActionDelete) + return db.IsAdminAllowCreate(userCred, manager) } func (self *SHostJointsBase) AllowGetDetails(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.GetModelManager().KeywordPlural(), policy.PolicyActionGet) + return db.IsAdminAllowGet(userCred, self) } func (self *SHostJointsBase) AllowUpdateItem(ctx context.Context, userCred mcclient.TokenCredential) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.GetModelManager().KeywordPlural(), policy.PolicyActionUpdate) + return db.IsAdminAllowUpdate(userCred, self) } func (self *SHostJointsBase) AllowDeleteItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.GetModelManager().KeywordPlural(), policy.PolicyActionDelete) + return db.IsAdminAllowDelete(userCred, self) } diff --git a/pkg/compute/models/hosts.go b/pkg/compute/models/hosts.go index af12e6dd4c..8ae5e880a5 100644 --- a/pkg/compute/models/hosts.go +++ b/pkg/compute/models/hosts.go @@ -20,11 +20,9 @@ import ( "yunion.io/x/pkg/utils" "yunion.io/x/sqlchemy" - "yunion.io/x/onecloud/pkg/cloudcommon/consts" "yunion.io/x/onecloud/pkg/cloudcommon/db" "yunion.io/x/onecloud/pkg/cloudcommon/db/lockman" "yunion.io/x/onecloud/pkg/cloudcommon/db/taskman" - "yunion.io/x/onecloud/pkg/cloudcommon/policy" "yunion.io/x/onecloud/pkg/cloudprovider" "yunion.io/x/onecloud/pkg/compute/baremetal" "yunion.io/x/onecloud/pkg/compute/options" @@ -160,23 +158,23 @@ func (manager *SHostManager) GetContextManager() []db.IModelManager { } func (self *SHostManager) AllowListItems(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionList) + return db.IsAdminAllowList(userCred, self) } func (self *SHostManager) AllowCreateItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionCreate) + return db.IsAdminAllowCreate(userCred, self) } func (self *SHost) AllowGetDetails(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionGet) + return db.IsAdminAllowGet(userCred, self) } func (self *SHost) AllowUpdateItem(ctx context.Context, userCred mcclient.TokenCredential) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionUpdate) + return db.IsAdminAllowUpdate(userCred, self) } func (self *SHost) AllowDeleteItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionDelete) + return db.IsAdminAllowDelete(userCred, self) } func (manager *SHostManager) ListItemFilter(ctx context.Context, q *sqlchemy.SQuery, userCred mcclient.TokenCredential, query jsonutils.JSONObject) (*sqlchemy.SQuery, error) { @@ -1792,7 +1790,7 @@ func (self *SHost) GetExtraDetails(ctx context.Context, userCred mcclient.TokenC } func (self *SHost) AllowGetDetailsVnc(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionGet, "vnc") + return db.IsAdminAllowGetSpec(userCred, self, "vnc") } func (self *SHost) GetDetailsVnc(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -1807,7 +1805,7 @@ func (self *SHost) GetDetailsVnc(ctx context.Context, userCred mcclient.TokenCre } func (self *SHost) AllowGetDetailsIpmi(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionGet, "ipmi") + return db.IsAdminAllowGetSpec(userCred, self, "ipmi") } func (self *SHost) GetDetailsIpmi(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -2098,7 +2096,7 @@ func (self *SHost) AllowPerformStart(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "start") + return db.IsAdminAllowPerform(userCred, self, "start") } func (self *SHost) PerformStart(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, @@ -2133,7 +2131,7 @@ func (self *SHost) AllowPerformStop(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "stop") + return db.IsAdminAllowPerform(userCred, self, "stop") } func (self *SHost) PerformStop(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, @@ -2183,7 +2181,7 @@ func (self *SHost) AllowPerformMaintenance(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "maintenance") + return db.IsAdminAllowPerform(userCred, self, "maintenance") } @@ -2223,7 +2221,7 @@ func (self *SHost) AllowPerformUnmaintenance(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "unmaintenance") + return db.IsAdminAllowPerform(userCred, self, "unmaintenance") } func (self *SHost) PerformUnmaintenance(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -2285,7 +2283,7 @@ func (self *SHost) AllowPerformOffline(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "offline") + return db.IsAdminAllowPerform(userCred, self, "offline") } func (self *SHost) PerformOffline(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -2304,7 +2302,7 @@ func (self *SHost) AllowPerformOnline(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "online") + return db.IsAdminAllowPerform(userCred, self, "online") } func (self *SHost) PerformOnline(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -2337,7 +2335,7 @@ func (self *SHost) AllowPerformPing(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "ping") + return db.IsAdminAllowPerform(userCred, self, "ping") } func (self *SHost) PerformPing(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -2364,7 +2362,7 @@ func (self *SHost) AllowPerformPrepare(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "prepare") + return db.IsAdminAllowPerform(userCred, self, "prepare") } func (self *SHost) PerformPrepare(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -2400,7 +2398,7 @@ func (self *SHost) AllowPerformAddNetif(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "add-netif") + return db.IsAdminAllowPerform(userCred, self, "add-netif") } func (self *SHost) PerformAddNetif(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -2552,7 +2550,7 @@ func (self *SHost) AllowPerformEnableNetif(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "enable-netif") + return db.IsAdminAllowPerform(userCred, self, "enable-netif") } func (self *SHost) PerformEnableNetif(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -2626,7 +2624,7 @@ func (self *SHost) AllowPerformDisableNetif(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "disable-netif") + return db.IsAdminAllowPerform(userCred, self, "disable-netif") } func (self *SHost) PerformDisableNetif(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -2680,7 +2678,7 @@ func (self *SHost) AllowPerformRemoveNetif(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "remove-netif") + return db.IsAdminAllowPerform(userCred, self, "remove-netif") } func (self *SHost) PerformRemoveNetif(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -2734,7 +2732,7 @@ func (self *SHost) AllowPerformSyncstatus(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "syncstatus") + return db.IsAdminAllowPerform(userCred, self, "syncstatus") } func (self *SHost) PerformSyncstatus(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -2746,7 +2744,7 @@ func (self *SHost) AllowPerformReset(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "reset") + return db.IsAdminAllowPerform(userCred, self, "reset") } func (self *SHost) PerformReset(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -2776,7 +2774,7 @@ func (self *SHost) AllowPerformRemoveAllNetifs(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "remove-all-netifs") + return db.IsAdminAllowPerform(userCred, self, "remove-all-netifs") } func (self *SHost) PerformRemoveAllNetifs(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -2793,7 +2791,7 @@ func (self *SHost) AllowPerformDisable(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "disable") + return db.IsAdminAllowPerform(userCred, self, "disable") } func (self *SHost) PerformDisable(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -2816,7 +2814,7 @@ func (self *SHost) AllowPerformCacheImage(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "cache-image") + return db.IsAdminAllowPerform(userCred, self, "cache-image") } func (self *SHost) PerformCacheImage(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -2848,7 +2846,7 @@ func (self *SHost) AllowPerformConvertHypervisor(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "convert-hypervisor") + return db.IsAdminAllowPerform(userCred, self, "convert-hypervisor") } func (self *SHost) isAlterNameUnique(name string) bool { @@ -2914,7 +2912,7 @@ func (self *SHost) AllowPerformUndoConvert(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "undo-convert") + return db.IsAdminAllowPerform(userCred, self, "undo-convert") } func (self *SHost) PerformUndoConvert(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { diff --git a/pkg/compute/models/isolated_devices.go b/pkg/compute/models/isolated_devices.go index 7e55afb02b..7a9a8738de 100644 --- a/pkg/compute/models/isolated_devices.go +++ b/pkg/compute/models/isolated_devices.go @@ -7,9 +7,7 @@ import ( "yunion.io/x/jsonutils" "yunion.io/x/log" - "yunion.io/x/onecloud/pkg/cloudcommon/consts" "yunion.io/x/onecloud/pkg/cloudcommon/db" - "yunion.io/x/onecloud/pkg/cloudcommon/policy" "yunion.io/x/onecloud/pkg/httperrors" "yunion.io/x/onecloud/pkg/mcclient" "yunion.io/x/pkg/util/regutils" @@ -82,7 +80,7 @@ type SIsolatedDevice struct { func (manager *SIsolatedDeviceManager) AllowListItems(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { host, _ := query.GetString("host") - if len(host) > 0 && !userCred.IsAdminAllow(consts.GetServiceType(), manager.KeywordPlural(), policy.PolicyActionList) { + if len(host) > 0 && !db.IsAdminAllowList(userCred, manager) { return false } return true @@ -94,7 +92,7 @@ func (manager *SIsolatedDeviceManager) ExtraSearchConditions(ctx context.Context } func (manager *SIsolatedDeviceManager) AllowCreateItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), manager.KeywordPlural(), policy.PolicyActionCreate) + return db.IsAdminAllowCreate(userCred, manager) } func (manager *SIsolatedDeviceManager) ListItemFilter(ctx context.Context, q *sqlchemy.SQuery, userCred mcclient.TokenCredential, query jsonutils.JSONObject) (*sqlchemy.SQuery, error) { diff --git a/pkg/compute/models/keypairs.go b/pkg/compute/models/keypairs.go index 67ae5c7638..e4bc4f3f77 100644 --- a/pkg/compute/models/keypairs.go +++ b/pkg/compute/models/keypairs.go @@ -8,9 +8,7 @@ import ( "yunion.io/x/sqlchemy" "golang.org/x/crypto/ssh" - "yunion.io/x/onecloud/pkg/cloudcommon/consts" "yunion.io/x/onecloud/pkg/cloudcommon/db" - "yunion.io/x/onecloud/pkg/cloudcommon/policy" "yunion.io/x/onecloud/pkg/httperrors" "yunion.io/x/onecloud/pkg/mcclient" "yunion.io/x/onecloud/pkg/util/seclib2" @@ -49,7 +47,7 @@ func (manager *SKeypairManager) ListItemFilter(ctx context.Context, q *sqlchemy. if err != nil { return nil, err } - if jsonutils.QueryBoolean(query, "admin", false) && userCred.IsAdminAllow(consts.GetServiceType(), manager.KeywordPlural(), policy.PolicyActionList) { + if jsonutils.QueryBoolean(query, "admin", false) && db.IsAdminAllowList(userCred, manager) { user, _ := query.GetString("user") if len(user) > 0 { uc, _ := db.UserCacheManager.FetchUserByIdOrName(user) @@ -73,7 +71,7 @@ func (self *SKeypair) IsOwner(userCred mcclient.TokenCredential) bool { } func (self *SKeypair) AllowGetDetails(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { - return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionGet) + return self.IsOwner(userCred) || db.IsAdminAllowGet(userCred, self) } func (self *SKeypair) GetCustomizeColumns(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) *jsonutils.JSONDict { @@ -87,7 +85,7 @@ func (self *SKeypair) GetExtraDetails(ctx context.Context, userCred mcclient.Tok extra := self.SStandaloneResourceBase.GetExtraDetails(ctx, userCred, query) extra.Add(jsonutils.NewInt(int64(len(self.PrivateKey))), "private_key_len") extra.Add(jsonutils.NewInt(int64(self.GetLinkedGuestsCount())), "linked_guest_count") - if userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionGet) { + if db.IsAdminAllowGet(userCred, self) { extra.Add(jsonutils.NewString(self.OwnerId), "owner_id") uc, _ := db.UserCacheManager.FetchUserById(self.OwnerId) if uc != nil { @@ -102,11 +100,11 @@ func (manager *SKeypairManager) AllowCreateItem(ctx context.Context, userCred mc } func (self *SKeypair) AllowUpdateItem(ctx context.Context, userCred mcclient.TokenCredential) bool { - return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionUpdate) + return self.IsOwner(userCred) || db.IsAdminAllowUpdate(userCred, self) } func (self *SKeypair) AllowDeleteItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionDelete) + return self.IsOwner(userCred) || db.IsAdminAllowDelete(userCred, self) } func (self *SKeypair) GetLinkedGuestsCount() int { diff --git a/pkg/compute/models/loadbalanceracls.go b/pkg/compute/models/loadbalanceracls.go index d177401fe9..17b0511f77 100644 --- a/pkg/compute/models/loadbalanceracls.go +++ b/pkg/compute/models/loadbalanceracls.go @@ -12,9 +12,7 @@ import ( "yunion.io/x/pkg/gotypes" "yunion.io/x/sqlchemy" - "yunion.io/x/onecloud/pkg/cloudcommon/consts" "yunion.io/x/onecloud/pkg/cloudcommon/db" - "yunion.io/x/onecloud/pkg/cloudcommon/policy" "yunion.io/x/onecloud/pkg/cloudcommon/validators" "yunion.io/x/onecloud/pkg/httperrors" "yunion.io/x/onecloud/pkg/mcclient" @@ -138,7 +136,7 @@ func (lbacl *SLoadbalancerAcl) ValidateUpdateData(ctx context.Context, userCred } func (lbacl *SLoadbalancerAcl) AllowPerformPatch(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data *jsonutils.JSONDict) bool { - return lbacl.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), lbacl.KeywordPlural(), policy.PolicyActionPerform, "patch") + return lbacl.IsOwner(userCred) || db.IsAdminAllowPerform(userCred, lbacl, "patch") } // PerformPatch patches acl entries by adding then deleting the specified acls. diff --git a/pkg/compute/models/loadbalanceragents.go b/pkg/compute/models/loadbalanceragents.go index a92e50513e..11cd9154f1 100644 --- a/pkg/compute/models/loadbalanceragents.go +++ b/pkg/compute/models/loadbalanceragents.go @@ -12,9 +12,7 @@ import ( "yunion.io/x/log" "yunion.io/x/pkg/gotypes" - "yunion.io/x/onecloud/pkg/cloudcommon/consts" "yunion.io/x/onecloud/pkg/cloudcommon/db" - "yunion.io/x/onecloud/pkg/cloudcommon/policy" "yunion.io/x/onecloud/pkg/cloudcommon/validators" "yunion.io/x/onecloud/pkg/httperrors" "yunion.io/x/onecloud/pkg/mcclient" @@ -239,23 +237,23 @@ func (p *SLoadbalancerAgentParams) IsZero() bool { func (self *SLoadbalancerAgentManager) AllowListItems(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionList) + return db.IsAdminAllowList(userCred, self) } func (self *SLoadbalancerAgentManager) AllowCreateItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionCreate) + return db.IsAdminAllowCreate(userCred, self) } func (self *SLoadbalancerAgent) AllowGetDetails(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionGet) + return db.IsAdminAllowGet(userCred, self) } func (self *SLoadbalancerAgent) AllowUpdateItem(ctx context.Context, userCred mcclient.TokenCredential) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionUpdate) + return db.IsAdminAllowUpdate(userCred, self) } func (self *SLoadbalancerAgent) AllowDeleteItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionDelete) + return db.IsAdminAllowDelete(userCred, self) } func (man *SLoadbalancerAgentManager) ValidateCreateData(ctx context.Context, userCred mcclient.TokenCredential, ownerProjId string, query jsonutils.JSONObject, data *jsonutils.JSONDict) (*jsonutils.JSONDict, error) { @@ -417,7 +415,7 @@ func (lbagent *SLoadbalancerAgent) ValidateUpdateData(ctx context.Context, userC } func (lbagent *SLoadbalancerAgent) AllowPerformHb(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data *jsonutils.JSONDict) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), lbagent.KeywordPlural(), policy.PolicyActionPerform, "hb") + return db.IsAdminAllowPerform(userCred, lbagent, "hb") } func (lbagent *SLoadbalancerAgent) PerformHb(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data *jsonutils.JSONDict) (*jsonutils.JSONDict, error) { @@ -443,7 +441,7 @@ func (lbagent *SLoadbalancerAgent) IsActive() bool { } func (lbagent *SLoadbalancerAgent) AllowPerformParamsPatch(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data *jsonutils.JSONDict) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), lbagent.KeywordPlural(), policy.PolicyActionPerform, "params-patch") + return db.IsAdminAllowPerform(userCred, lbagent, "params-patch") } func (lbagent *SLoadbalancerAgent) PerformParamsPatch(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data *jsonutils.JSONDict) (*jsonutils.JSONDict, error) { diff --git a/pkg/compute/models/loadbalancerbackends.go b/pkg/compute/models/loadbalancerbackends.go index 2ebc741a75..4eb5dcba9d 100644 --- a/pkg/compute/models/loadbalancerbackends.go +++ b/pkg/compute/models/loadbalancerbackends.go @@ -7,9 +7,7 @@ import ( "yunion.io/x/jsonutils" "yunion.io/x/sqlchemy" - "yunion.io/x/onecloud/pkg/cloudcommon/consts" "yunion.io/x/onecloud/pkg/cloudcommon/db" - "yunion.io/x/onecloud/pkg/cloudcommon/policy" "yunion.io/x/onecloud/pkg/cloudcommon/validators" "yunion.io/x/onecloud/pkg/mcclient" ) @@ -139,7 +137,7 @@ func (man *SLoadbalancerBackendManager) ValidateCreateData(ctx context.Context, } baseName = guest.Name case LB_BACKEND_HOST: - if !userCred.IsAdminAllow(consts.GetServiceType(), man.KeywordPlural(), policy.PolicyActionCreate) { + if !db.IsAdminAllowCreate(userCred, man) { return nil, fmt.Errorf("only sysadmin can specify host as backend") } backendV := validators.NewModelIdOrNameValidator("backend", "host", userCred.GetProjectId()) diff --git a/pkg/compute/models/loadbalancerlistenerrules.go b/pkg/compute/models/loadbalancerlistenerrules.go index a78f271e25..3e3d3bccc8 100644 --- a/pkg/compute/models/loadbalancerlistenerrules.go +++ b/pkg/compute/models/loadbalancerlistenerrules.go @@ -8,9 +8,7 @@ import ( "yunion.io/x/log" "yunion.io/x/sqlchemy" - "yunion.io/x/onecloud/pkg/cloudcommon/consts" "yunion.io/x/onecloud/pkg/cloudcommon/db" - "yunion.io/x/onecloud/pkg/cloudcommon/policy" "yunion.io/x/onecloud/pkg/cloudcommon/validators" "yunion.io/x/onecloud/pkg/httperrors" "yunion.io/x/onecloud/pkg/mcclient" @@ -128,7 +126,7 @@ func (man *SLoadbalancerListenerRuleManager) ValidateCreateData(ctx context.Cont } func (lbr *SLoadbalancerListenerRule) AllowPerformStatus(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return lbr.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), lbr.KeywordPlural(), policy.PolicyActionPerform, "status") + return lbr.IsOwner(userCred) || db.IsAdminAllowPerform(userCred, lbr, "status") } func (lbr *SLoadbalancerListenerRule) ValidateUpdateData(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data *jsonutils.JSONDict) (*jsonutils.JSONDict, error) { diff --git a/pkg/compute/models/loadbalancerlisteners.go b/pkg/compute/models/loadbalancerlisteners.go index 6a115282fa..ea16d3e9a4 100644 --- a/pkg/compute/models/loadbalancerlisteners.go +++ b/pkg/compute/models/loadbalancerlisteners.go @@ -9,10 +9,8 @@ import ( "yunion.io/x/log" "yunion.io/x/sqlchemy" - "yunion.io/x/onecloud/pkg/cloudcommon/consts" "yunion.io/x/onecloud/pkg/cloudcommon/db" "yunion.io/x/onecloud/pkg/cloudcommon/db/lockman" - "yunion.io/x/onecloud/pkg/cloudcommon/policy" "yunion.io/x/onecloud/pkg/cloudcommon/validators" "yunion.io/x/onecloud/pkg/httperrors" "yunion.io/x/onecloud/pkg/mcclient" @@ -297,7 +295,7 @@ func (man *SLoadbalancerListenerManager) validateAcl(aclStatusV *validators.Vali } func (lblis *SLoadbalancerListener) AllowPerformStatus(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return lblis.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), lblis.KeywordPlural(), policy.PolicyActionPerform, "status") + return lblis.IsOwner(userCred) || db.IsAdminAllowPerform(userCred, lblis, "status") } func (lblis *SLoadbalancerListener) ValidateUpdateData(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data *jsonutils.JSONDict) (*jsonutils.JSONDict, error) { diff --git a/pkg/compute/models/loadbalancers.go b/pkg/compute/models/loadbalancers.go index 00ce2c2219..c77e689677 100644 --- a/pkg/compute/models/loadbalancers.go +++ b/pkg/compute/models/loadbalancers.go @@ -9,10 +9,8 @@ import ( "yunion.io/x/pkg/util/netutils" "yunion.io/x/sqlchemy" - "yunion.io/x/onecloud/pkg/cloudcommon/consts" "yunion.io/x/onecloud/pkg/cloudcommon/db" "yunion.io/x/onecloud/pkg/cloudcommon/db/lockman" - "yunion.io/x/onecloud/pkg/cloudcommon/policy" "yunion.io/x/onecloud/pkg/cloudcommon/validators" "yunion.io/x/onecloud/pkg/httperrors" "yunion.io/x/onecloud/pkg/mcclient" @@ -134,7 +132,7 @@ func (man *SLoadbalancerManager) ValidateCreateData(ctx context.Context, userCre } func (lb *SLoadbalancer) AllowPerformStatus(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return lb.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), lb.KeywordPlural(), policy.PolicyActionPerform, "status") + return lb.IsOwner(userCred) || db.IsAdminAllowPerform(userCred, lb, "status") } func (lb *SLoadbalancer) PostCreate(ctx context.Context, userCred mcclient.TokenCredential, ownerProjId string, query jsonutils.JSONObject, data jsonutils.JSONObject) { diff --git a/pkg/compute/models/networks.go b/pkg/compute/models/networks.go index d6316a8ff1..be63d8d010 100644 --- a/pkg/compute/models/networks.go +++ b/pkg/compute/models/networks.go @@ -17,10 +17,8 @@ import ( "yunion.io/x/pkg/utils" "yunion.io/x/sqlchemy" - "yunion.io/x/onecloud/pkg/cloudcommon/consts" "yunion.io/x/onecloud/pkg/cloudcommon/db" "yunion.io/x/onecloud/pkg/cloudcommon/db/taskman" - "yunion.io/x/onecloud/pkg/cloudcommon/policy" "yunion.io/x/onecloud/pkg/cloudprovider" "yunion.io/x/onecloud/pkg/compute/options" "yunion.io/x/onecloud/pkg/httperrors" @@ -136,7 +134,7 @@ func (self *SNetwork) GetVpc() *SVpc { } func (manager *SNetworkManager) AllowCreateItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), manager.KeywordPlural(), policy.PolicyActionCreate) + return db.IsAdminAllowCreate(userCred, manager) } func (self *SNetwork) ValidateDeleteCondition(ctx context.Context) error { @@ -629,7 +627,7 @@ func (manager *SNetworkManager) allNetworksQ(rangeObj db.IStandaloneModel) *sqlc func (manager *SNetworkManager) totalPortCountQ(userCred mcclient.TokenCredential, rangeObj db.IStandaloneModel) *sqlchemy.SQuery { q := manager.allNetworksQ(rangeObj) networks := manager.Query().SubQuery() - if userCred != nil && !userCred.IsAdminAllow(consts.GetServiceType(), manager.KeywordPlural(), policy.PolicyActionList) { + if userCred != nil && !db.IsAdminAllowList(userCred, manager) { q = q.Filter(sqlchemy.OR( sqlchemy.Equals(networks.Field("tenant_id"), userCred.GetProjectId()), sqlchemy.IsTrue(networks.Field("is_public")))) @@ -762,7 +760,7 @@ func isValidNetworkInfo(userCred mcclient.TokenCredential, netConfig *SNetworkCo } if netConfig.Reserved { // the privilege to access reserved ip - if !userCred.IsAdminAllow(consts.GetServiceType(), ReservedipManager.KeywordPlural(), policy.PolicyActionGet) { + if !db.IsAdminAllowList(userCred, ReservedipManager) { return httperrors.NewForbiddenError("Only system admin allowed to use reserved ip") } if ReservedipManager.GetReservedIP(net, netConfig.Address) == nil { @@ -879,7 +877,7 @@ func (self *SNetwork) GetCustomizeColumns(ctx context.Context, userCred mcclient } func (self *SNetwork) AllowPerformReserveIp(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "reserve-ip") + return self.IsOwner(userCred) || db.IsAdminAllowPerform(userCred, self, "reserve-ip") } func (self *SNetwork) PerformReserveIp(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -906,7 +904,7 @@ func (self *SNetwork) PerformReserveIp(ctx context.Context, userCred mcclient.To } func (self *SNetwork) AllowPerformReleaseReservedIp(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "release-reserved-ip") + return self.IsOwner(userCred) || db.IsAdminAllowPerform(userCred, self, "release-reserved-ip") } func (self *SNetwork) PerformReleaseReservedIp(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -923,7 +921,7 @@ func (self *SNetwork) PerformReleaseReservedIp(ctx context.Context, userCred mcc } func (self *SNetwork) AllowGetDetailsReservedIps(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { - return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionGet, "reserved-ips") + return self.IsOwner(userCred) || db.IsAdminAllowGetSpec(userCred, self, "reserved-ips") } func (self *SNetwork) GetDetailsReservedIps(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -1214,7 +1212,7 @@ func isOverlapNetworks(nets []SNetwork, startIp netutils.IPV4Addr, endIp netutil } func (self *SNetwork) CustomizeCreate(ctx context.Context, userCred mcclient.TokenCredential, ownerProjId string, query jsonutils.JSONObject, data jsonutils.JSONObject) error { - if userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionCreate) && ownerProjId == userCred.GetProjectId() { + if db.IsAdminAllowCreate(userCred, self.GetModelManager()) && ownerProjId == userCred.GetProjectId() { self.IsPublic = true } else { self.IsPublic = false @@ -1399,7 +1397,7 @@ func (self *SNetwork) ValidateUpdateCondition(ctx context.Context) error { } func (self *SNetwork) AllowPerformPurge(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionDelete) + return db.IsAdminAllowPerform(userCred, self, "purge") } func (self *SNetwork) PerformPurge(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { diff --git a/pkg/compute/models/reservedips.go b/pkg/compute/models/reservedips.go index 80ca7fa632..1acb41a388 100644 --- a/pkg/compute/models/reservedips.go +++ b/pkg/compute/models/reservedips.go @@ -6,9 +6,7 @@ import ( "yunion.io/x/jsonutils" "yunion.io/x/log" - "yunion.io/x/onecloud/pkg/cloudcommon/consts" "yunion.io/x/onecloud/pkg/cloudcommon/db" - "yunion.io/x/onecloud/pkg/cloudcommon/policy" "yunion.io/x/onecloud/pkg/httperrors" "yunion.io/x/onecloud/pkg/mcclient" "yunion.io/x/sqlchemy" @@ -41,7 +39,7 @@ type SReservedip struct { } func (manager *SReservedipManager) AllowListItems(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), manager.KeywordPlural(), policy.PolicyActionList) + return db.IsAdminAllowList(userCred, manager) } func (manager *SReservedipManager) AllowCreateItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { diff --git a/pkg/compute/models/schedpolicies.go b/pkg/compute/models/schedpolicies.go index 000445cf14..e4a54dafef 100644 --- a/pkg/compute/models/schedpolicies.go +++ b/pkg/compute/models/schedpolicies.go @@ -7,9 +7,7 @@ import ( "database/sql" "yunion.io/x/log" - "yunion.io/x/onecloud/pkg/cloudcommon/consts" "yunion.io/x/onecloud/pkg/cloudcommon/db" - "yunion.io/x/onecloud/pkg/cloudcommon/policy" "yunion.io/x/onecloud/pkg/httperrors" "yunion.io/x/onecloud/pkg/mcclient" "yunion.io/x/onecloud/pkg/util/conditionparser" @@ -63,23 +61,23 @@ func validateSchedpolicyInputData(data *jsonutils.JSONDict, create bool) error { } func (self *SSchedpolicyManager) AllowListItems(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionList) + return db.IsAdminAllowList(userCred, self) } func (self *SSchedpolicyManager) AllowCreateItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionCreate) + return db.IsAdminAllowCreate(userCred, self) } func (self *SSchedpolicy) AllowGetDetails(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionGet) + return db.IsAdminAllowGet(userCred, self) } func (self *SSchedpolicy) AllowUpdateItem(ctx context.Context, userCred mcclient.TokenCredential) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionUpdate) + return db.IsAdminAllowUpdate(userCred, self) } func (self *SSchedpolicy) AllowDeleteItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionDelete) + return db.IsAdminAllowDelete(userCred, self) } func (manager *SSchedpolicyManager) ValidateCreateData(ctx context.Context, userCred mcclient.TokenCredential, ownerProjId string, query jsonutils.JSONObject, data *jsonutils.JSONDict) (*jsonutils.JSONDict, error) { @@ -141,7 +139,7 @@ func (manager *SSchedpolicyManager) getAllEnabledPolicies() []SSchedpolicy { } func (self *SSchedpolicy) AllowPerformEvaluate(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "evaluate") + return db.IsAdminAllowPerform(userCred, self, "evaluate") } func (self *SSchedpolicy) PerformEvaluate(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { diff --git a/pkg/compute/models/schedtags.go b/pkg/compute/models/schedtags.go index 43557ff2f9..b4605d7e9a 100644 --- a/pkg/compute/models/schedtags.go +++ b/pkg/compute/models/schedtags.go @@ -12,8 +12,6 @@ import ( "yunion.io/x/onecloud/pkg/mcclient" "yunion.io/x/pkg/utils" "yunion.io/x/sqlchemy" - "yunion.io/x/onecloud/pkg/cloudcommon/consts" - "yunion.io/x/onecloud/pkg/cloudcommon/policy" ) type SchedStrategyType string @@ -62,15 +60,15 @@ func (self *SSchedtag) AllowGetDetails(ctx context.Context, userCred mcclient.To } func (self *SSchedtagManager) AllowCreateItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionCreate) + return db.IsAdminAllowCreate(userCred, self) } func (self *SSchedtag) AllowUpdateItem(ctx context.Context, userCred mcclient.TokenCredential) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionUpdate) + return db.IsAdminAllowUpdate(userCred, self) } func (self *SSchedtag) AllowDeleteItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionDelete) + return db.IsAdminAllowDelete(userCred, self) } func (manager *SSchedtagManager) ValidateSchedtags(userCred mcclient.TokenCredential, schedtags map[string]string) (map[string]string, error) { diff --git a/pkg/compute/models/secgrouprules.go b/pkg/compute/models/secgrouprules.go index 93ae01adee..c8a23f2ec1 100644 --- a/pkg/compute/models/secgrouprules.go +++ b/pkg/compute/models/secgrouprules.go @@ -9,9 +9,7 @@ import ( "yunion.io/x/jsonutils" "yunion.io/x/log" - "yunion.io/x/onecloud/pkg/cloudcommon/consts" "yunion.io/x/onecloud/pkg/cloudcommon/db" - "yunion.io/x/onecloud/pkg/cloudcommon/policy" "yunion.io/x/onecloud/pkg/httperrors" "yunion.io/x/onecloud/pkg/mcclient" "yunion.io/x/pkg/util/compare" @@ -80,14 +78,14 @@ func (manager *SSecurityGroupRuleManager) AllowListItems(ctx context.Context, us func (self *SSecurityGroupRule) AllowUpdateItem(ctx context.Context, userCred mcclient.TokenCredential) bool { if secgroup := self.GetSecGroup(); secgroup != nil { - return secgroup.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionUpdate) + return secgroup.IsOwner(userCred) || db.IsAdminAllowUpdate(userCred, self) } return false } func (self *SSecurityGroupRule) AllowDeleteItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { if secgroup := self.GetSecGroup(); secgroup != nil { - return secgroup.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionDelete) + return secgroup.IsOwner(userCred) || db.IsAdminAllowDelete(userCred, self) } return false } diff --git a/pkg/compute/models/snapshots.go b/pkg/compute/models/snapshots.go index b586fd9bff..09e557f0c8 100644 --- a/pkg/compute/models/snapshots.go +++ b/pkg/compute/models/snapshots.go @@ -11,10 +11,8 @@ import ( "yunion.io/x/pkg/util/compare" "yunion.io/x/sqlchemy" - "yunion.io/x/onecloud/pkg/cloudcommon/consts" "yunion.io/x/onecloud/pkg/cloudcommon/db" "yunion.io/x/onecloud/pkg/cloudcommon/db/taskman" - "yunion.io/x/onecloud/pkg/cloudcommon/policy" "yunion.io/x/onecloud/pkg/cloudprovider" "yunion.io/x/onecloud/pkg/compute/options" "yunion.io/x/onecloud/pkg/httperrors" @@ -325,7 +323,7 @@ func (self *SSnapshotManager) CreateSnapshot(ctx context.Context, userCred mccli } func (self *SSnapshot) AllowDeleteItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionDelete) + return self.IsOwner(userCred) || db.IsAdminAllowDelete(userCred, self) } func (self *SSnapshot) StartSnapshotDeleteTask(ctx context.Context, userCred mcclient.TokenCredential, reloadDisk bool, parentTaskId string) error { @@ -366,7 +364,7 @@ func (self *SSnapshot) CustomizeDelete(ctx context.Context, userCred mcclient.To } func (self *SSnapshot) AllowPerformDeleted(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionDelete) + return self.IsOwner(userCred) || db.IsAdminAllowPerform(userCred, self, "deleted") } func (self *SSnapshot) PerformDeleted(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -403,7 +401,7 @@ func (self *SSnapshotManager) GetConvertSnapshot(deleteSnapshot *SSnapshot) (*SS } func (self *SSnapshotManager) AllowPerformDeleteDiskSnapshots(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "delete-disk-snapshots") + return db.IsAdminAllowClassPerform(userCred, self, "delete-disk-snapshots") } func (self *SSnapshotManager) PerformDeleteDiskSnapshots(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -588,7 +586,7 @@ func (self *SSnapshot) GetISnapshotRegion() (cloudprovider.ICloudRegion, error) } func (self *SSnapshot) AllowPerformPurge(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionDelete) + return db.IsAdminAllowPerform(userCred, self, "purge") } func (self *SSnapshot) PerformPurge(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { diff --git a/pkg/compute/models/storagecachedimages.go b/pkg/compute/models/storagecachedimages.go index 693fa088a0..d20b97c6f1 100644 --- a/pkg/compute/models/storagecachedimages.go +++ b/pkg/compute/models/storagecachedimages.go @@ -11,10 +11,8 @@ import ( "yunion.io/x/pkg/utils" "yunion.io/x/sqlchemy" - "yunion.io/x/onecloud/pkg/cloudcommon/consts" "yunion.io/x/onecloud/pkg/cloudcommon/db" "yunion.io/x/onecloud/pkg/cloudcommon/db/lockman" - "yunion.io/x/onecloud/pkg/cloudcommon/policy" "yunion.io/x/onecloud/pkg/httperrors" "yunion.io/x/onecloud/pkg/mcclient" ) @@ -74,23 +72,23 @@ func (joint *SStoragecachedimage) Slave() db.IStandaloneModel { } func (self *SStoragecachedimageManager) AllowListItems(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionList) + return db.IsAdminAllowList(userCred, self) } func (self *SStoragecachedimageManager) AllowCreateItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionCreate) + return db.IsAdminAllowCreate(userCred, self) } func (self *SStoragecachedimage) AllowGetDetails(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionGet) + return db.IsAdminAllowGet(userCred, self) } func (self *SStoragecachedimage) AllowUpdateItem(ctx context.Context, userCred mcclient.TokenCredential) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionUpdate) + return db.IsAdminAllowUpdate(userCred, self) } func (self *SStoragecachedimage) AllowDeleteItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionDelete) + return db.IsAdminAllowDelete(userCred, self) } func (self *SStoragecachedimage) getStorageHostId() (string, error) { @@ -147,7 +145,7 @@ func (self *SStoragecachedimage) GetExtraDetails(ctx context.Context, userCred m } func (manager *SStoragecachedimageManager) AllowListDescendent(ctx context.Context, userCred mcclient.TokenCredential, model db.IStandaloneModel, query jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), manager.KeywordPlural(), policy.PolicyActionList) + return db.IsAdminAllowList(userCred, manager) } func (self *SStoragecachedimage) GetCachedimage() *SCachedimage { diff --git a/pkg/compute/models/storagecaches.go b/pkg/compute/models/storagecaches.go index f21faa1dbc..34d05d628c 100644 --- a/pkg/compute/models/storagecaches.go +++ b/pkg/compute/models/storagecaches.go @@ -9,10 +9,8 @@ import ( "yunion.io/x/log" "yunion.io/x/sqlchemy" - "yunion.io/x/onecloud/pkg/cloudcommon/consts" "yunion.io/x/onecloud/pkg/cloudcommon/db" "yunion.io/x/onecloud/pkg/cloudcommon/db/taskman" - "yunion.io/x/onecloud/pkg/cloudcommon/policy" "yunion.io/x/onecloud/pkg/cloudprovider" "yunion.io/x/onecloud/pkg/httperrors" "yunion.io/x/onecloud/pkg/mcclient" @@ -44,23 +42,23 @@ type SStoragecache struct { } func (self *SStoragecacheManager) AllowListItems(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionList) + return db.IsAdminAllowList(userCred, self) } func (self *SStoragecacheManager) AllowCreateItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionCreate) + return db.IsAdminAllowCreate(userCred, self) } func (self *SStoragecache) AllowGetDetails(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionGet) + return db.IsAdminAllowGet(userCred, self) } func (self *SStoragecache) AllowUpdateItem(ctx context.Context, userCred mcclient.TokenCredential) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionUpdate) + return db.IsAdminAllowUpdate(userCred, self) } func (self *SStoragecache) AllowDeleteItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionDelete) + return db.IsAdminAllowDelete(userCred, self) } func (self *SStoragecache) getStorages() []SStorage { @@ -312,7 +310,7 @@ func (self *SStoragecache) ValidateDeleteCondition(ctx context.Context) error { } func (self *SStoragecache) AllowPerformUncacheImage(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "uncache-image") + return db.IsAdminAllowPerform(userCred, self, "uncache-image") } func (self *SStoragecache) PerformUncacheImage(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -349,7 +347,7 @@ func (self *SStoragecache) PerformUncacheImage(ctx context.Context, userCred mcc } func (self *SStoragecache) AllowPerformCacheImage(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "cache-image") + return db.IsAdminAllowPerform(userCred, self, "cache-image") } func (self *SStoragecache) PerformCacheImage(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { diff --git a/pkg/compute/models/storages.go b/pkg/compute/models/storages.go index 2f79e92b27..1c14dc5162 100644 --- a/pkg/compute/models/storages.go +++ b/pkg/compute/models/storages.go @@ -5,17 +5,16 @@ import ( "yunion.io/x/jsonutils" "yunion.io/x/log" - "yunion.io/x/onecloud/pkg/cloudcommon/consts" - "yunion.io/x/onecloud/pkg/cloudcommon/db" - "yunion.io/x/onecloud/pkg/cloudcommon/policy" - "yunion.io/x/onecloud/pkg/cloudprovider" - "yunion.io/x/onecloud/pkg/compute/options" - "yunion.io/x/onecloud/pkg/httperrors" - "yunion.io/x/onecloud/pkg/mcclient" "yunion.io/x/pkg/tristate" "yunion.io/x/pkg/util/compare" "yunion.io/x/pkg/utils" "yunion.io/x/sqlchemy" + + "yunion.io/x/onecloud/pkg/cloudcommon/db" + "yunion.io/x/onecloud/pkg/cloudprovider" + "yunion.io/x/onecloud/pkg/compute/options" + "yunion.io/x/onecloud/pkg/httperrors" + "yunion.io/x/onecloud/pkg/mcclient" ) const ( @@ -127,19 +126,19 @@ func (manager *SStorageManager) AllowListItems(ctx context.Context, userCred mcc } func (self *SStorageManager) AllowCreateItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionCreate) + return db.IsAdminAllowCreate(userCred, self) } func (self *SStorage) AllowGetDetails(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionGet) + return db.IsAdminAllowGet(userCred, self) } func (self *SStorage) AllowUpdateItem(ctx context.Context, userCred mcclient.TokenCredential) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionUpdate) + return db.IsAdminAllowUpdate(userCred, self) } func (self *SStorage) AllowDeleteItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionDelete) + return db.IsAdminAllowDelete(userCred, self) } func (manager *SStorageManager) ValidateCreateData(ctx context.Context, userCred mcclient.TokenCredential, ownerProjId string, query jsonutils.JSONObject, data *jsonutils.JSONDict) (*jsonutils.JSONDict, error) { @@ -709,7 +708,7 @@ func (self *SStorage) SetStoragecache(cache *SStoragecache) error { } func (self *SStorage) AllowPerformCacheImage(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "cache-image") + return db.IsAdminAllowPerform(userCred, self, "cache-image") } func (self *SStorage) GetStoragecache() *SStoragecache { @@ -731,7 +730,7 @@ func (self *SStorage) PerformCacheImage(ctx context.Context, userCred mcclient.T } func (self *SStorage) AllowPerformUncacheImage(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionPerform, "uncache-image") + return db.IsAdminAllowPerform(userCred, self, "uncache-image") } func (self *SStorage) PerformUncacheImage(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { diff --git a/pkg/compute/models/vpcs.go b/pkg/compute/models/vpcs.go index c5fa194e16..50dcdeb1e0 100644 --- a/pkg/compute/models/vpcs.go +++ b/pkg/compute/models/vpcs.go @@ -11,10 +11,8 @@ import ( "yunion.io/x/pkg/util/netutils" "yunion.io/x/sqlchemy" - "yunion.io/x/onecloud/pkg/cloudcommon/consts" "yunion.io/x/onecloud/pkg/cloudcommon/db" "yunion.io/x/onecloud/pkg/cloudcommon/db/taskman" - "yunion.io/x/onecloud/pkg/cloudcommon/policy" "yunion.io/x/onecloud/pkg/cloudprovider" "yunion.io/x/onecloud/pkg/httperrors" "yunion.io/x/onecloud/pkg/mcclient" @@ -66,23 +64,23 @@ func (manager *SVpcManager) GetContextManager() []db.IModelManager { } func (self *SVpcManager) AllowListItems(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionList) + return db.IsAdminAllowList(userCred, self) } func (self *SVpcManager) AllowCreateItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionCreate) + return db.IsAdminAllowCreate(userCred, self) } func (self *SVpc) AllowGetDetails(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionGet) + return db.IsAdminAllowGet(userCred, self) } func (self *SVpc) AllowUpdateItem(ctx context.Context, userCred mcclient.TokenCredential) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionUpdate) + return db.IsAdminAllowUpdate(userCred, self) } func (self *SVpc) AllowDeleteItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionDelete) + return db.IsAdminAllowDelete(userCred, self) } func (self *SVpc) GetCloudRegionId() string { @@ -476,7 +474,7 @@ func (self *SVpc) getIPRange() netutils.IPV4AddrRange { } func (self *SVpc) AllowPerformPurge(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionDelete) + return db.IsAdminAllowPerform(userCred, self, "purge") } func (self *SVpc) PerformPurge(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { diff --git a/pkg/compute/models/wires.go b/pkg/compute/models/wires.go index 00364f0dfc..9d9cc82dec 100644 --- a/pkg/compute/models/wires.go +++ b/pkg/compute/models/wires.go @@ -15,8 +15,6 @@ import ( "yunion.io/x/pkg/util/compare" "yunion.io/x/pkg/util/netutils" "yunion.io/x/sqlchemy" - "yunion.io/x/onecloud/pkg/cloudcommon/consts" - "yunion.io/x/onecloud/pkg/cloudcommon/policy" ) type SWireManager struct { @@ -52,23 +50,23 @@ func (manager *SWireManager) GetContextManager() []db.IModelManager { } func (self *SWireManager) AllowListItems(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionList) + return db.IsAdminAllowList(userCred, self) } func (self *SWireManager) AllowCreateItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionCreate) + return db.IsAdminAllowCreate(userCred, self) } func (self *SWire) AllowGetDetails(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionGet) + return db.IsAdminAllowGet(userCred, self) } func (self *SWire) AllowUpdateItem(ctx context.Context, userCred mcclient.TokenCredential) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionUpdate) + return db.IsAdminAllowUpdate(userCred, self) } func (self *SWire) AllowDeleteItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionDelete) + return db.IsAdminAllowDelete(userCred, self) } func (manager *SWireManager) ValidateCreateData(ctx context.Context, userCred mcclient.TokenCredential, ownerProjId string, query jsonutils.JSONObject, data *jsonutils.JSONDict) (*jsonutils.JSONDict, error) { diff --git a/pkg/compute/models/zones.go b/pkg/compute/models/zones.go index 50b6f5a351..2a85c27899 100644 --- a/pkg/compute/models/zones.go +++ b/pkg/compute/models/zones.go @@ -12,8 +12,6 @@ import ( "yunion.io/x/pkg/tristate" "yunion.io/x/pkg/util/compare" "yunion.io/x/sqlchemy" - "yunion.io/x/onecloud/pkg/cloudcommon/consts" - "yunion.io/x/onecloud/pkg/cloudcommon/policy" ) const ( @@ -58,19 +56,19 @@ func (manager *SZoneManager) GetContextManager() []db.IModelManager { } func (self *SZoneManager) AllowCreateItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionCreate) + return db.IsAdminAllowCreate(userCred, self) } func (self *SZone) AllowGetDetails(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionGet) + return db.IsAdminAllowGet(userCred, self) } func (self *SZone) AllowUpdateItem(ctx context.Context, userCred mcclient.TokenCredential) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionUpdate) + return db.IsAdminAllowUpdate(userCred, self) } func (self *SZone) AllowDeleteItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsAdminAllow(consts.GetServiceType(), self.KeywordPlural(), policy.PolicyActionDelete) + return db.IsAdminAllowDelete(userCred, self) } func (manager *SZoneManager) AllowListItems(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { diff --git a/pkg/yunionconf/models/parameters.go b/pkg/yunionconf/models/parameters.go index dbb11026be..90f40903fa 100644 --- a/pkg/yunionconf/models/parameters.go +++ b/pkg/yunionconf/models/parameters.go @@ -74,7 +74,7 @@ func getNamespaceInContext(userCred mcclient.TokenCredential, query jsonutils.JS func getNamespace(userCred mcclient.TokenCredential, query jsonutils.JSONObject, data *jsonutils.JSONDict) (string, string, error) { var namespace, namespace_id string - if userCred.IsAdminAllow(consts.GetServiceType(), ParameterManager.KeywordPlural(), policy.PolicyActionGet) { + if db.IsAdminAllowGet(userCred, ParameterManager) { if name, nameId, e := getNamespaceInContext(userCred, query, data); e != nil { return "", "", e } else { @@ -94,7 +94,7 @@ func (manager *SParameterManager) AllowListItems(ctx context.Context, userCred m return true } - return userCred.IsAdminAllow(consts.GetServiceType(), manager.KeywordPlural(), policy.PolicyActionList) + return db.IsAdminAllowList(userCred, manager) } func (manager *SParameterManager) AllowCreateItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { @@ -102,7 +102,7 @@ func (manager *SParameterManager) AllowCreateItem(ctx context.Context, userCred return true } - return userCred.IsAdminAllow(consts.GetServiceType(), manager.KeywordPlural(), policy.PolicyActionCreate) + return db.IsAdminAllowCreate(userCred, manager) } func (manager *SParameterManager) ValidateCreateData(ctx context.Context, userCred mcclient.TokenCredential, ownerProjId string, query jsonutils.JSONObject, data *jsonutils.JSONDict) (*jsonutils.JSONDict, error) { @@ -148,7 +148,7 @@ func (manager *SParameterManager) FilterByName(q *sqlchemy.SQuery, name string) } func (manager *SParameterManager) ListItemFilter(ctx context.Context, q *sqlchemy.SQuery, userCred mcclient.TokenCredential, query jsonutils.JSONObject) (*sqlchemy.SQuery, error) { - if userCred.IsAdminAllow(consts.GetServiceType(), manager.KeywordPlural(), policy.PolicyActionList) { + if db.IsAdminAllowList(userCred, manager) { if id, _ := query.GetString("namespace_id"); len(id) > 0 { q = q.Equals("namespace_id", id) } else if id, _ := query.GetString("service_id"); len(id) > 0 { @@ -173,7 +173,7 @@ func (model *SParameter) IsOwner(userCred mcclient.TokenCredential) bool { } func (model *SParameter) AllowUpdateItem(ctx context.Context, userCred mcclient.TokenCredential) bool { - return model.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), model.KeywordPlural(), policy.PolicyActionUpdate) + return model.IsOwner(userCred) || db.IsAdminAllowUpdate(userCred, model) } func (model *SParameter) ValidateUpdateData(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data *jsonutils.JSONDict) (*jsonutils.JSONDict, error) { @@ -193,7 +193,7 @@ func (model *SParameter) ValidateUpdateData(ctx context.Context, userCred mcclie } func (model *SParameter) AllowDeleteItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return model.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), model.KeywordPlural(), policy.PolicyActionDelete) + return model.IsOwner(userCred) || db.IsAdminAllowDelete(userCred, model) } func (model *SParameter) CustomizeDelete(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) error { @@ -213,5 +213,5 @@ func (model *SParameter) Delete(ctx context.Context, userCred mcclient.TokenCred } func (model *SParameter) AllowGetDetails(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { - return model.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), model.KeywordPlural(), policy.PolicyActionGet) + return model.IsOwner(userCred) || db.IsAdminAllowGet(userCred, model) } From a95b396f2407b782d6d76dd02d6387591cb58a47 Mon Sep 17 00:00:00 2001 From: Qiu Jian Date: Sat, 1 Dec 2018 12:08:02 +0800 Subject: [PATCH 15/15] remove inframanager.go --- pkg/compute/models/inframanagers.go | 9 --------- 1 file changed, 9 deletions(-) delete mode 100644 pkg/compute/models/inframanagers.go diff --git a/pkg/compute/models/inframanagers.go b/pkg/compute/models/inframanagers.go deleted file mode 100644 index 4a60c48cfb..0000000000 --- a/pkg/compute/models/inframanagers.go +++ /dev/null @@ -1,9 +0,0 @@ -package models - -type TSInfrastructureManager struct { -} - -type TSInfrastructure struct { -} - -