fix conflict

pkg/cloudcommon/auth.go

@@ -3,13 +3,14 @@ package cloudcommon
 import (
 	"fmt"
 	"os"
-
 	"time"
+
 	"yunion.io/x/onecloud/pkg/cloudcommon/policy"
 	"yunion.io/x/onecloud/pkg/mcclient/auth"
 )
 
 func InitAuth(options *Options, authComplete auth.AuthCompletedCallback) {
+
 	if len(options.AuthURL) == 0 {
 		fmt.Println("Missing AuthURL")
 		os.Exit(1)

pkg/cloudcommon/db/db_dispatcher.go

@@ -65,7 +65,7 @@ func (dispatcher *DBModelDispatcher) Filter(f appsrv.FilterHandler) appsrv.Filte
 }
 
 func fetchUserCredential(ctx context.Context) mcclient.TokenCredential {
-	token := auth.FetchUserCredential(ctx)
+	token := auth.FetchUserCredential(ctx, policy.FilterPolicyCredential)
 	if token == nil && !consts.IsRbacEnabled() {
 		log.Fatalf("user token credential not found?")
 	}
@@ -113,7 +113,7 @@ func listFields(manager IModelManager, userCred mcclient.TokenCredential) []stri
 		if !utils.IsInStringArray(list, []string{"user", "admin", ""}) {
 			log.Warningf("Invalid list value %s for field %s", list, col.Name())
 		}
-		if list == "user" || (list == "admin" && userCred.IsSystemAdmin()) {
+		if list == "user" || (list == "admin" && IsAdminAllowList(userCred, manager)) {
 			ret = append(ret, col.Name())
 		}
 	}
@@ -127,7 +127,7 @@ func searchFields(manager IModelManager, userCred mcclient.TokenCredential) []st
 		tags := col.Tags()
 		list := tags["list"]
 		search := tags["search"]
-		if list == "user" || search == "user" || ((list == "admin" || search == "admin") && userCred.IsSystemAdmin()) {
+		if list == "user" || search == "user" || ((list == "admin" || search == "admin") && IsAdminAllowList(userCred, manager)) {
 			ret = append(ret, col.Name())
 		}
 	}
@@ -140,7 +140,7 @@ func getDetailFields(manager IModelManager, userCred mcclient.TokenCredential) [
 		tags := col.Tags()
 		list := tags["list"]
 		get := tags["get"]
-		if list == "user" || get == "user" || ((list == "admin" || get == "admin") && userCred.IsSystemAdmin()) {
+		if list == "user" || get == "user" || ((list == "admin" || get == "admin") && userCred.IsAdminAllow(consts.GetServiceType(), manager.KeywordPlural(), policy.PolicyActionGet)) {
 			ret = append(ret, col.Name())
 		}
 	}
@@ -152,7 +152,7 @@ func createRequireFields(manager IModelManager, userCred mcclient.TokenCredentia
 	for _, col := range manager.TableSpec().Columns() {
 		tags := col.Tags()
 		create, _ := tags["create"]
-		if create == "required" || (create == "admin_required" && userCred.IsSystemAdmin()) {
+		if create == "required" || (create == "admin_required" && IsAdminAllowCreate(userCred, manager)) {
 			ret = append(ret, col.Name())
 		}
 	}
@@ -166,7 +166,7 @@ func createFields(manager IModelManager, userCred mcclient.TokenCredential) []st
 		tags := col.Tags()
 		create, _ := tags["create"]
 		update := tags["update"]
-		if update == "user" || (update == "admin" && userCred.IsSystemAdmin()) || create == "required" || create == "optional" || ((create == "admin_required" || create == "admin_optional") && userCred.IsSystemAdmin()) {
+		if update == "user" || (update == "admin" && IsAdminAllowCreate(userCred, manager)) || create == "required" || create == "optional" || ((create == "admin_required" || create == "admin_optional") && IsAdminAllowCreate(userCred, manager)) {
 			ret = append(ret, col.Name())
 		}
 	}
@@ -179,7 +179,7 @@ func updateFields(manager IModelManager, userCred mcclient.TokenCredential) []st
 	for _, col := range manager.TableSpec().Columns() {
 		tags := col.Tags()
 		update := tags["update"]
-		if update == "user" || (update == "admin" && userCred.IsSystemAdmin()) {
+		if update == "user" || (update == "admin" && userCred.IsAdminAllow(consts.GetServiceType(), manager.KeywordPlural(), policy.PolicyActionUpdate)) {
 			ret = append(ret, col.Name())
 		}
 	}
@@ -315,7 +315,7 @@ func query2List(manager IModelManager, ctx context.Context, userCred mcclient.To
 	}
 	listF := listFields(manager, userCred)
 	fieldFilter := jsonutils.GetQueryStringArray(query, "field")
-	if len(fieldFilter) > 0 && userCred.IsSystemAdmin() {
+	if len(fieldFilter) > 0 && IsAdminAllowList(userCred, manager) {
 		// only sysadmin can specify list Fields
 		listF = fieldFilter
 	}
@@ -733,7 +733,7 @@ func fetchOwnerProjectId(ctx context.Context, manager IModelManager, userCred mc
 			isAllow = true
 		}
 	} else {
-		isAllow = userCred.IsSystemAdmin()
+		isAllow = userCred.IsAdminAllow(consts.GetServiceType(), policy.PolicyDelegation, "")
 	}
 	if !isAllow {
 		return "", httperrors.NewForbiddenError("Delegation not allowed")

pkg/cloudcommon/db/enabledstatusstandalone.go

@@ -23,7 +23,7 @@ func NewEnabledStatusStandaloneResourceBaseManager(dt interface{}, tableName str
 }
 
 func (self *SEnabledStatusStandaloneResourceBase) AllowPerformEnable(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
-	return userCred.IsSystemAdmin()
+	return IsAdminAllowPerform(userCred, self, "enable")
 }
 
 func (self *SEnabledStatusStandaloneResourceBase) PerformEnable(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) {
@@ -42,7 +42,7 @@ func (self *SEnabledStatusStandaloneResourceBase) PerformEnable(ctx context.Cont
 }
 
 func (self *SEnabledStatusStandaloneResourceBase) AllowPerformDisable(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
-	return userCred.IsSystemAdmin()
+	return IsAdminAllowPerform(userCred, self, "disable")
 }
 
 func (self *SEnabledStatusStandaloneResourceBase) PerformDisable(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) {

pkg/cloudcommon/db/interface.go

@@ -22,6 +22,7 @@ type IModelManager interface {
 	KeywordPlural() string
 	Alias() string
 	AliasPlural() string
+	SetAlias(alias string, aliasPlural string)
 
 	ValidateName(name string) error
 
@@ -69,6 +70,8 @@ type IModel interface {
 
 	GetName() string
 
+	KeywordPlural() string
+
 	GetModelManager() IModelManager
 	SetModelManager(IModelManager)
 
@@ -164,7 +167,7 @@ type IVirtualModel interface {
 	IStandaloneModel
 
 	IsOwner(userCred mcclient.TokenCredential) bool
-	IsAdmin(userCred mcclient.TokenCredential) bool
+	// IsAdmin(userCred mcclient.TokenCredential) bool
 }
 
 type ISharableVirtualModelManager interface {

pkg/cloudcommon/db/jointbase.go

@@ -191,7 +191,7 @@ func (self *SJointResourceBase) AllowGetJointDetails(ctx context.Context, userCr
 	master := item.Master()
 	switch master.(type) {
 	case IVirtualModel:
-		return master.(IVirtualModel).IsOwner(userCred)
+		return master.(IVirtualModel).IsOwner(userCred) || IsAdminAllowGet(userCred, master)
 	default: // case item implemented customized AllowGetDetails, eg hostjoints
 		return item.AllowGetDetails(ctx, userCred, query)
 	}
@@ -201,7 +201,7 @@ func (self *SJointResourceBase) AllowUpdateJointItem(ctx context.Context, userCr
 	master := item.Master()
 	switch master.(type) {
 	case IVirtualModel:
-		return master.(IVirtualModel).IsOwner(userCred)
+		return master.(IVirtualModel).IsOwner(userCred) || IsAdminAllowUpdate(userCred, master)
 	default: // case item implemented customized AllowGetDetails, eg hostjoints
 		return item.AllowUpdateItem(ctx, userCred)
 	}

pkg/cloudcommon/db/keystonecache.go

@@ -64,7 +64,7 @@ func NewKeystoneCacheObject(id string, name string, domainId string, domain stri
 }*/
 
 func (manager *SKeystoneCacheObjectManager) BatchFetchNames(idStrs []string) []string {
-	t := manager.tableSpec.Instance()
+	t := manager.TableSpec().Instance()
 	results, err := t.Query(t.Field("name")).In("id", idStrs).AllStringMap()
 	if err != nil {
 		return nil

pkg/cloudcommon/db/metadata.go

@@ -65,7 +65,7 @@ raise Exception('get_object_idstr: failed to generate obj ID')
 return idstr */
 
 func (manager *SMetadataManager) GetStringValue(model IModel, key string, userCred mcclient.TokenCredential) string {
-	if strings.HasPrefix(key, SYSTEM_ADMIN_PREFIX) && (userCred == nil || !userCred.IsSystemAdmin()) {
+	if strings.HasPrefix(key, SYSTEM_ADMIN_PREFIX) && (userCred == nil || !IsAdminAllowGetSpec(userCred, model, "metadata")) {
 		return ""
 	}
 	idStr := GetObjectIdstr(model)
@@ -78,7 +78,7 @@ func (manager *SMetadataManager) GetStringValue(model IModel, key string, userCr
 }
 
 func (manager *SMetadataManager) GetJsonValue(model IModel, key string, userCred mcclient.TokenCredential) jsonutils.JSONObject {
-	if strings.HasPrefix(key, SYSTEM_ADMIN_PREFIX) && (userCred == nil || !userCred.IsSystemAdmin()) {
+	if strings.HasPrefix(key, SYSTEM_ADMIN_PREFIX) && (userCred == nil || !IsAdminAllowGetSpec(userCred, model, "metadata")) {
 		return nil
 	}
 	idStr := GetObjectIdstr(model)
@@ -194,7 +194,7 @@ func (manager *SMetadataManager) GetAll(obj IModel, keys []string, userCred mccl
 	for _, rec := range records {
 		if len(rec.Value) > 0 {
 			if strings.HasPrefix(rec.Key, SYSTEM_ADMIN_PREFIX) {
-				if userCred != nil && userCred.IsSystemAdmin() {
+				if userCred != nil && IsAdminAllowGetSpec(userCred, obj, "metadata") {
 					key := rec.Key[len(SYSTEM_ADMIN_PREFIX):]
 					ret[key] = rec.Value
 				}

pkg/cloudcommon/db/modelbase.go

@@ -151,7 +151,7 @@ func (manager *SModelBaseManager) PerformAction(ctx context.Context, userCred mc
 }
 
 func (manager *SModelBaseManager) AllowPerformCheckCreateData(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
-	return userCred.IsSystemAdmin()
+	return IsAdminAllowClassPerform(userCred, manager, "check-create-data")
 }
 
 func (manager *SModelBaseManager) InitializeData() error {
@@ -178,6 +178,10 @@ func (model *SModelBase) Keyword() string {
 	return model.GetModelManager().Keyword()
 }
 
+func (model *SModelBase) KeywordPlural() string {
+	return model.GetModelManager().KeywordPlural()
+}
+
 func (model *SModelBase) GetName() string {
 	return ""
 }

pkg/cloudcommon/db/opslog.go

@@ -185,13 +185,6 @@ var _ IModel = (*SOpsLog)(nil)
 
 func init() {
 	OpsLog = &SOpsLogManager{NewModelBaseManager(SOpsLog{}, "opslog_tbl", "event", "events")}
-
-}
-
-func (manager *SOpsLogManager) SetKeyword(kw, kwPlural string) *SOpsLogManager {
-	manager.keyword = kw
-	manager.keywordPlural = kwPlural
-	return manager
 }
 
 func (opslog *SOpsLog) GetId() string {
@@ -304,7 +297,7 @@ func (manager *SOpsLogManager) ListItemFilter(ctx context.Context, q *sqlchemy.S
 		queryDict.RemoveIgnoreCase("action")
 		q = q.Filter(sqlchemy.In(q.Field("action"), action))
 	}
-	if !userCred.IsSystemAdmin() {
+	if !IsAdminAllowList(userCred, manager) {
 		q = q.Filter(sqlchemy.OR(sqlchemy.AND(sqlchemy.IsNotNull(q.Field("owner_tenant_id")), sqlchemy.Equals(q.Field("owner_tenant_id"), userCred.GetProjectId())), sqlchemy.Equals(q.Field("tenant_id"), userCred.GetProjectId())))
 	}
 	since, _ := query.GetTime("since")
@@ -335,7 +328,7 @@ func (manager *SOpsLogManager) AllowCreateItem(ctx context.Context, userCred mcc
 }
 
 func (self *SOpsLog) AllowGetDetails(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool {
-	return userCred.IsSystemAdmin() || userCred.GetProjectId() == self.ProjectId || userCred.GetProjectId() == self.OwnerProjectId
+	return IsAdminAllowGet(userCred, self) || userCred.GetProjectId() == self.ProjectId || userCred.GetProjectId() == self.OwnerProjectId
 }
 
 func (self *SOpsLog) AllowUpdateItem(ctx context.Context, userCred mcclient.TokenCredential) bool {

pkg/cloudcommon/db/quotas/handler.go

@@ -72,7 +72,7 @@ func queryQuota(ctx context.Context, projectId string) (*jsonutils.JSONDict, err
 }
 
 func getQuotaHanlder(ctx context.Context, w http.ResponseWriter, r *http.Request) {
-	userCred := auth.FetchUserCredential(ctx)
+	userCred := auth.FetchUserCredential(ctx, policy.FilterPolicyCredential)
 	params := appctx.AppContextParams(ctx)
 
 	projectId := params["<tenantid>"]
@@ -93,7 +93,7 @@ func getQuotaHanlder(ctx context.Context, w http.ResponseWriter, r *http.Request
 				policy.PolicyDelegation, policy.PolicyActionGet)
 			isAllow = result == rbacutils.AdminAllow
 		} else {
-			isAllow = userCred.IsSystemAdmin()
+			isAllow = userCred.IsAdminAllow(consts.GetServiceType(), policy.PolicyDelegation, policy.PolicyActionGet)
 		}
 		if !isAllow {
 			httperrors.ForbiddenError(w, "not allow to delegate query quota")
@@ -133,14 +133,15 @@ func getQuotaHanlder(ctx context.Context, w http.ResponseWriter, r *http.Request
 }
 
 func setQuotaHanlder(ctx context.Context, w http.ResponseWriter, r *http.Request) {
-	userCred := auth.FetchUserCredential(ctx)
+	userCred := auth.FetchUserCredential(ctx, policy.FilterPolicyCredential)
 
 	var isAllow bool
 	if consts.IsRbacEnabled() {
 		isAllow = policy.PolicyManager.Allow(true, userCred, consts.GetServiceType(),
 			"quotas", policy.PolicyActionUpdate) == rbacutils.AdminAllow
 	} else {
-		isAllow = userCred.IsSystemAdmin()
+		isAllow = userCred.IsAdminAllow(consts.GetServiceType(),
+			"quotas", policy.PolicyActionUpdate)
 	}
 	if !isAllow {
 		httperrors.ForbiddenError(w, "not allow to set quota")
@@ -196,14 +197,15 @@ func setQuotaHanlder(ctx context.Context, w http.ResponseWriter, r *http.Request
 }
 
 func checkQuotaHanlder(ctx context.Context, w http.ResponseWriter, r *http.Request) {
-	userCred := auth.FetchUserCredential(ctx)
+	userCred := auth.FetchUserCredential(ctx, policy.FilterPolicyCredential)
 
 	isAllow := false
 	if consts.IsRbacEnabled() {
 		isAllow = policy.PolicyManager.Allow(true, userCred, consts.GetServiceType(),
 			policy.PolicyDelegation, policy.PolicyActionGet) == rbacutils.AdminAllow
 	} else {
-		isAllow = userCred.IsSystemAdmin()
+		isAllow = userCred.IsAdminAllow(consts.GetServiceType(),
+			policy.PolicyDelegation, policy.PolicyActionGet)
 	}
 	if !isAllow {
 		httperrors.ForbiddenError(w, "not allow to delegate check quota")

pkg/cloudcommon/db/rbac.go

@@ -122,3 +122,35 @@ func isObjectRbacAllowed(manager IModelManager, model IModel, userCred mcclient.
 func isJointObjectRbacAllowed(manager IJointModelManager, item IJointModel, userCred mcclient.TokenCredential, action string, extra ...string) bool {
 	return isObjectRbacAllowed(manager, item.Master(), userCred, action, extra...)
 }
+
+func IsAdminAllowList(userCred mcclient.TokenCredential, manager IModelManager) bool {
+	return userCred.IsAdminAllow(consts.GetServiceType(), manager.KeywordPlural(), policy.PolicyActionList)
+}
+
+func IsAdminAllowCreate(userCred mcclient.TokenCredential, manager IModelManager) bool {
+	return userCred.IsAdminAllow(consts.GetServiceType(), manager.KeywordPlural(), policy.PolicyActionCreate)
+}
+
+func IsAdminAllowClassPerform(userCred mcclient.TokenCredential, manager IModelManager, action string) bool {
+	return userCred.IsAdminAllow(consts.GetServiceType(), manager.KeywordPlural(), policy.PolicyActionPerform, action)
+}
+
+func IsAdminAllowGet(userCred mcclient.TokenCredential, obj IModel) bool {
+	return userCred.IsAdminAllow(consts.GetServiceType(), obj.KeywordPlural(), policy.PolicyActionGet)
+}
+
+func IsAdminAllowGetSpec(userCred mcclient.TokenCredential, obj IModel, spec string) bool {
+	return userCred.IsAdminAllow(consts.GetServiceType(), obj.KeywordPlural(), policy.PolicyActionGet, spec)
+}
+
+func IsAdminAllowPerform(userCred mcclient.TokenCredential, obj IModel, action string) bool {
+	return userCred.IsAdminAllow(consts.GetServiceType(), obj.KeywordPlural(), policy.PolicyActionPerform, action)
+}
+
+func IsAdminAllowUpdate(userCred mcclient.TokenCredential, obj IModel) bool {
+	return userCred.IsAdminAllow(consts.GetServiceType(), obj.KeywordPlural(), policy.PolicyActionUpdate)
+}
+
+func IsAdminAllowDelete(userCred mcclient.TokenCredential, obj IModel) bool {
+	return userCred.IsAdminAllow(consts.GetServiceType(), obj.KeywordPlural(), policy.PolicyActionDelete)
+}

pkg/cloudcommon/db/sharablevirtual.go

@@ -30,7 +30,7 @@ func (manager *SSharableVirtualResourceBaseManager) FilterByOwner(q *sqlchemy.SQ
 }
 
 func (model *SSharableVirtualResourceBase) AllowGetDetails(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool {
-	return model.IsOwner(userCred) || model.IsPublic
+	return model.IsOwner(userCred) || model.IsPublic || IsAdminAllowGet(userCred, model)
 }
 
 func (model *SSharableVirtualResourceBase) IsSharable() bool {
@@ -38,11 +38,11 @@ func (model *SSharableVirtualResourceBase) IsSharable() bool {
 }
 
 func (model *SSharableVirtualResourceBase) AllowPerformPublic(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
-	return userCred.IsSystemAdmin()
+	return IsAdminAllowPerform(userCred, model, "public")
 }
 
 func (model *SSharableVirtualResourceBase) AllowPerformPrivate(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
-	return userCred.IsSystemAdmin()
+	return IsAdminAllowPerform(userCred, model, "private")
 }
 
 func (model *SSharableVirtualResourceBase) PerformPublic(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) {

pkg/cloudcommon/db/standalone.go

@@ -146,7 +146,7 @@ func (model *SStandaloneResourceBase) GetMetadataJson(key string, userCred mccli
 }
 
 func (model *SStandaloneResourceBase) SetMetadata(ctx context.Context, key string, value interface{}, userCred mcclient.TokenCredential) error {
-	if Metadata.IsSystemAdminKey(key) && !userCred.IsSystemAdmin() {
+	if Metadata.IsSystemAdminKey(key) && !IsAdminAllowPerform(userCred, model, "metadata") {
 		return httperrors.NewNotSufficientPrivilegeError("cannot set system key")
 	}
 	return Metadata.SetValue(ctx, model, key, value, userCred)
@@ -154,7 +154,7 @@ func (model *SStandaloneResourceBase) SetMetadata(ctx context.Context, key strin
 
 func (model *SStandaloneResourceBase) SetAllMetadata(ctx context.Context, dictstore map[string]interface{}, userCred mcclient.TokenCredential) error {
 	for k := range dictstore {
-		if Metadata.IsSystemAdminKey(k) && !userCred.IsSystemAdmin() {
+		if Metadata.IsSystemAdminKey(k) && !IsAdminAllowPerform(userCred, model, "metadata") {
 			return httperrors.NewNotSufficientPrivilegeError("not allow to set system key %s", k)
 		}
 	}
@@ -174,7 +174,7 @@ func (model *SStandaloneResourceBase) GetAllMetadata(userCred mcclient.TokenCred
 }
 
 func (model *SStandaloneResourceBase) AllowGetDetailsMetadata(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool {
-	return userCred.IsSystemAdmin()
+	return IsAdminAllowGetSpec(userCred, model, "metadata")
 }
 
 func (model *SStandaloneResourceBase) GetDetailsMetadata(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) (jsonutils.JSONObject, error) {
@@ -187,7 +187,7 @@ func (model *SStandaloneResourceBase) GetDetailsMetadata(ctx context.Context, us
 }
 
 func (model *SStandaloneResourceBase) AllowPerformMetadata(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
-	return userCred.IsSystemAdmin()
+	return IsAdminAllowPerform(userCred, model, "metadata")
 }
 
 func (model *SStandaloneResourceBase) PerformMetadata(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) {

pkg/cloudcommon/db/statusstandalone.go

@@ -50,7 +50,7 @@ func (model *SStatusStandaloneResourceBase) SetStatus(userCred mcclient.TokenCre
 }
 
 func (model *SStatusStandaloneResourceBase) AllowPerformStatus(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
-	return userCred.IsSystemAdmin()
+	return IsAdminAllowPerform(userCred, model, "status")
 }
 
 func (model *SStatusStandaloneResourceBase) PerformStatus(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) {

pkg/cloudcommon/db/taskman/tasks.go

@@ -70,7 +70,7 @@ type STask struct {
 }
 
 func (manager *STaskManager) AllowListItems(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool {
-	return userCred.IsSystemAdmin()
+	return true
 }
 
 func (manager *STaskManager) AllowCreateItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
@@ -115,7 +115,7 @@ func (manager *STaskManager) FilterByOwner(q *sqlchemy.SQuery, owner string) *sq
 }
 
 func (self *STask) AllowGetDetails(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool {
-	return userCred.IsSystemAdmin() || userCred.GetProjectId() == self.UserCred.GetProjectId()
+	return db.IsAdminAllowGet(userCred, self) || userCred.GetProjectId() == self.UserCred.GetProjectId()
 }
 
 func (self *STask) AllowUpdateItem(ctx context.Context, userCred mcclient.TokenCredential) bool {

pkg/cloudcommon/db/tenantcache.go

@@ -90,8 +90,8 @@ func (manager *STenantCacheManager) fetchTenantFromKeystone(ctx context.Context,
 }
 
 func (manager *STenantCacheManager) Save(ctx context.Context, idStr string, name string, domainId string, domain string) (*STenant, error) {
-	lockman.LockRawObject(ctx, manager.keyword, idStr)
-	defer lockman.ReleaseRawObject(ctx, manager.keyword, idStr)
+	lockman.LockRawObject(ctx, manager.KeywordPlural(), idStr)
+	defer lockman.ReleaseRawObject(ctx, manager.KeywordPlural(), idStr)
 
 	objo, err := manager.FetchById(idStr)
 	if err != nil && err != sql.ErrNoRows {

pkg/cloudcommon/db/usercache.go

@@ -53,8 +53,8 @@ func (manager *SUserCacheManager) FetchUserByName(idStr string) (*SUser, error)
 }
 
 func (manager *SUserCacheManager) Save(ctx context.Context, idStr string, name string, domainId string, domain string) (*SUser, error) {
-	lockman.LockRawObject(ctx, manager.keyword, idStr)
-	defer lockman.ReleaseRawObject(ctx, manager.keyword, idStr)
+	lockman.LockRawObject(ctx, manager.KeywordPlural(), idStr)
+	defer lockman.ReleaseRawObject(ctx, manager.KeywordPlural(), idStr)
 
 	obj, err := manager.FetchUserById(idStr)
 	if err != nil && err != sql.ErrNoRows {

pkg/cloudcommon/db/virtualjointbase.go

@@ -27,7 +27,7 @@ func NewVirtualJointResourceBaseManager(dt interface{}, tableName string, keywor
 }
 
 func (manager *SVirtualJointResourceBaseManager) AllowListItems(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool {
-	if jsonutils.QueryBoolean(query, "admin", false) && !userCred.IsSystemAdmin() {
+	if jsonutils.QueryBoolean(query, "admin", false) && !IsAdminAllowList(userCred, manager) {
 		return false
 	}
 	return true
@@ -36,7 +36,7 @@ func (manager *SVirtualJointResourceBaseManager) AllowListItems(ctx context.Cont
 
 func (manager *SVirtualJointResourceBaseManager) AllowListDescendent(ctx context.Context, userCred mcclient.TokenCredential, master IStandaloneModel, query jsonutils.JSONObject) bool {
 	masterVirtual := master.(IVirtualModel)
-	if masterVirtual.IsOwner(userCred) {
+	if masterVirtual.IsOwner(userCred) || IsAdminAllowList(userCred, manager) {
 		return true
 	}
 	return false
@@ -62,12 +62,12 @@ func (manager *SVirtualJointResourceBaseManager) AllowAttach(ctx context.Context
 
 func (self *SVirtualJointResourceBase) AllowGetDetails(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool {
 	masterVirtual := self.Master().(IVirtualModel)
-	return masterVirtual.IsOwner(userCred)
+	return masterVirtual.IsOwner(userCred) || IsAdminAllowGet(userCred, self)
 }
 
 func (self *SVirtualJointResourceBase) AllowUpdateItem(ctx context.Context, userCred mcclient.TokenCredential) bool {
 	masterVirtual := self.Master().(IVirtualModel)
-	return masterVirtual.IsOwner(userCred)
+	return masterVirtual.IsOwner(userCred) || IsAdminAllowUpdate(userCred, self)
 }
 
 func (manager *SVirtualJointResourceBaseManager) ListItemFilter(ctx context.Context, q *sqlchemy.SQuery, userCred mcclient.TokenCredential, query jsonutils.JSONObject) (*sqlchemy.SQuery, error) {
@@ -96,7 +96,7 @@ func (manager *SVirtualJointResourceBaseManager) ListItemFilter(ctx context.Cont
 		sqlchemy.IsFalse(masterTable.Field("deleted"))))
 	q = q.Join(slaveTable, sqlchemy.AND(sqlchemy.Equals(slaveField, slaveTable.Field("id")),
 		sqlchemy.IsFalse(slaveTable.Field("deleted"))))
-	if jsonutils.QueryBoolean(query, "admin", false) && userCred.IsSystemAdmin() {
+	if jsonutils.QueryBoolean(query, "admin", false) && IsAdminAllowList(userCred, manager) {
 		isSystem := jsonutils.QueryBoolean(query, "system", false)
 		if !isSystem {
 			if len(slaveQueryId) == 0 {

pkg/cloudcommon/db/virtualresource.go

@@ -37,12 +37,12 @@ type SVirtualResourceBase struct {
 }
 
 func (model *SVirtualResourceBase) IsOwner(userCred mcclient.TokenCredential) bool {
-	return userCred.IsSystemAdmin() || userCred.GetProjectId() == model.ProjectId
+	return userCred.GetProjectId() == model.ProjectId
 }
 
-func (model *SVirtualResourceBase) IsAdmin(userCred mcclient.TokenCredential) bool {
+/*func (model *SVirtualResourceBase) IsAdmin(userCred mcclient.TokenCredential) bool {
 	return userCred.IsSystemAdmin() || (userCred.GetProjectId() == model.ProjectId && userCred.IsAdmin())
-}
+}*/
 
 func (model *SVirtualResourceBase) GetOwnerProjectId() string {
 	return model.ProjectId
@@ -110,7 +110,7 @@ func (manager *SVirtualResourceBaseManager) ListItemFilter(ctx context.Context,
 
 func (manager *SVirtualResourceBaseManager) ValidateCreateData(ctx context.Context, userCred mcclient.TokenCredential, ownerProjId string, query jsonutils.JSONObject, data *jsonutils.JSONDict) (*jsonutils.JSONDict, error) {
 	isSystem, err := data.Bool("is_system")
-	if err == nil && isSystem && !userCred.IsSystemAdmin() {
+	if err == nil && isSystem && !IsAdminAllowCreate(userCred, manager) {
 		return nil, httperrors.NewNotSufficientPrivilegeError("non-admin user not allowed to create system object")
 	}
 	return manager.SStandaloneResourceBaseManager.ValidateCreateData(ctx, userCred, ownerProjId, query, data)
@@ -129,14 +129,14 @@ func (model *SVirtualResourceBase) CustomizeCreate(ctx context.Context, userCred
 
 func (manager *SVirtualResourceBaseManager) AllowListItems(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool {
 	isAdmin, err := query.Bool("admin")
-	if err == nil && isAdmin && !userCred.IsSystemAdmin() {
+	if err == nil && isAdmin && !IsAdminAllowList(userCred, manager) {
 		return false
 	}
 	return true
 }
 
 func (model *SVirtualResourceBase) AllowGetDetails(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool {
-	return model.IsOwner(userCred)
+	return model.IsOwner(userCred) || IsAdminAllowGet(userCred, model)
 }
 
 func (manager *SVirtualResourceBaseManager) AllowCreateItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
@@ -144,19 +144,19 @@ func (manager *SVirtualResourceBaseManager) AllowCreateItem(ctx context.Context,
 }
 
 func (model *SVirtualResourceBase) AllowUpdateItem(ctx context.Context, userCred mcclient.TokenCredential) bool {
-	return model.IsOwner(userCred)
+	return model.IsOwner(userCred) || IsAdminAllowUpdate(userCred, model)
 }
 
 func (model *SVirtualResourceBase) AllowDeleteItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
-	return model.IsOwner(userCred)
+	return model.IsOwner(userCred) || IsAdminAllowDelete(userCred, model)
 }
 
 func (model *SVirtualResourceBase) AllowGetDetailsMetadata(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool {
-	return model.IsOwner(userCred)
+	return model.IsOwner(userCred) || IsAdminAllowGetSpec(userCred, model, "metadata")
 }
 
 func (model *SVirtualResourceBase) AllowPerformMetadata(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
-	return model.IsOwner(userCred)
+	return model.IsOwner(userCred) || IsAdminAllowPerform(userCred, model, "metadata")
 }
 
 func (model *SVirtualResourceBase) GetTenantCache(ctx context.Context) (*STenant, error) {
@@ -165,7 +165,7 @@ func (model *SVirtualResourceBase) GetTenantCache(ctx context.Context) (*STenant
 }
 
 func (model *SVirtualResourceBase) getMoreDetails(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, extra *jsonutils.JSONDict) *jsonutils.JSONDict {
-	if userCred.IsSystemAdmin() {
+	if IsAdminAllowGet(userCred, model) {
 		// log.Debugf("GetCustomizeColumns")
 		tobj, err := model.GetTenantCache(ctx)
 		if err == nil {
@@ -197,7 +197,7 @@ func (model *SVirtualResourceBase) GetExtraDetails(ctx context.Context, userCred
 }
 
 func (model *SVirtualResourceBase) AllowPerformChangeOwner(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
-	return userCred.IsSystemAdmin()
+	return IsAdminAllowPerform(userCred, model, "change-owner")
 }
 
 func (model *SVirtualResourceBase) PerformChangeOwner(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) {

pkg/cloudcommon/options.go

@@ -63,6 +63,10 @@ func (this *DBOptions) GetDBConnection() (dialect, connstr string, err error) {
 }
 
 func ParseOptions(optStruct interface{}, optionsRef *Options, args []string, configFileName string) {
+	if len(consts.GetServiceType()) == 0 {
+		log.Fatalf("ServiceType not initialized!")
+	}
+
 	serviceName := path.Base(args[0])
 	parser, err := structarg.NewArgumentParser(optStruct,
 		serviceName,

pkg/cloudcommon/policy/policy.go

@@ -48,6 +48,30 @@ var (
 			Action:   PolicyActionGet,
 			Result:   rbacutils.UserAllow,
 		},
+		{
+			Service:  "compute",
+			Resource: "storages",
+			Action:   PolicyActionList,
+			Result:   rbacutils.UserAllow,
+		},
+		{
+			Service:  "compute",
+			Resource: "storages",
+			Action:   PolicyActionGet,
+			Result:   rbacutils.UserAllow,
+		},
+		{
+			Service:  "compute",
+			Resource: "schedtags",
+			Action:   PolicyActionList,
+			Result:   rbacutils.UserAllow,
+		},
+		{
+			Service:  "compute",
+			Resource: "schedtags",
+			Action:   PolicyActionGet,
+			Result:   rbacutils.UserAllow,
+		},
 		{
 			Service:  "compute",
 			Resource: "cloudregions",
@@ -90,6 +114,12 @@ var (
 			Action:   PolicyActionCreate,
 			Result:   rbacutils.UserAllow,
 		},
+		{
+			Service:  "yunionconf",
+			Resource: "parameters",
+			Action:   PolicyActionGet,
+			Result:   rbacutils.OwnerAllow,
+		},
 	}
 )
 
@@ -278,7 +308,7 @@ func (manager *SPolicyManager) explainPolicy(userCred mcclient.TokenCredential,
 	if !consts.IsRbacEnabled() {
 		if !isAdmin {
 			return reqStrs, rbacutils.OwnerAllow, nil
-		} else if isAdmin && userCred.IsSystemAdmin() {
+		} else if isAdmin && userCred.HasSystemAdminPrivelege() {
 			return reqStrs, rbacutils.AdminAllow, nil
 		} else {
 			return reqStrs, rbacutils.Deny, httperrors.NewForbiddenError("operation not allowed")
@@ -305,7 +335,7 @@ func (manager *SPolicyManager) ExplainRpc(userCred mcclient.TokenCredential, par
 }
 
 func (manager *SPolicyManager) IsAdminCapable(userCred mcclient.TokenCredential) bool {
-	if !consts.IsRbacEnabled() && userCred.IsSystemAdmin() {
+	if !consts.IsRbacEnabled() && userCred.HasSystemAdminPrivelege() {
 		return true
 	}
 

pkg/cloudcommon/policy/token.go

@@ -0,0 +1,145 @@
+package policy
+
+import (
+	"time"
+
+	"yunion.io/x/jsonutils"
+	"yunion.io/x/pkg/gotypes"
+
+	"yunion.io/x/onecloud/pkg/cloudcommon/consts"
+	"yunion.io/x/onecloud/pkg/mcclient"
+	"yunion.io/x/onecloud/pkg/util/rbacutils"
+)
+
+type SPolicyTokenCredential struct {
+	Token mcclient.TokenCredential
+}
+
+func (self *SPolicyTokenCredential) String() string {
+	return self.Token.String()
+}
+
+func (self *SPolicyTokenCredential) IsZero() bool {
+	return self.Token.IsZero()
+}
+
+func (self *SPolicyTokenCredential) GetProjectId() string {
+	return self.Token.GetProjectId()
+}
+
+func (self *SPolicyTokenCredential) GetTenantId() string {
+	return self.Token.GetTenantId()
+}
+
+func (self *SPolicyTokenCredential) GetUserId() string {
+	return self.Token.GetUserId()
+}
+
+func (self *SPolicyTokenCredential) GetServiceURL(service, region, zone, endpointType string) (string, error) {
+	return self.Token.GetServiceURL(service, region, zone, endpointType)
+}
+
+func (self *SPolicyTokenCredential) GetServiceURLs(service, region, zone, endpointType string) ([]string, error) {
+	return self.Token.GetServiceURLs(service, region, zone, endpointType)
+}
+
+func (self *SPolicyTokenCredential) GetTokenString() string {
+	return self.Token.GetTokenString()
+}
+
+func (self *SPolicyTokenCredential) GetDomainId() string {
+	return self.Token.GetDomainId()
+}
+
+func (self *SPolicyTokenCredential) GetDomainName() string {
+	return self.Token.GetDomainName()
+}
+
+func (self *SPolicyTokenCredential) GetTenantName() string {
+	return self.Token.GetTenantName()
+}
+
+func (self *SPolicyTokenCredential) GetProjectName() string {
+	return self.Token.GetProjectName()
+}
+
+func (self *SPolicyTokenCredential) GetUserName() string {
+	return self.Token.GetUserName()
+}
+
+func (self *SPolicyTokenCredential) GetRoles() []string {
+	return self.Token.GetRoles()
+}
+
+func (self *SPolicyTokenCredential) GetExpires() time.Time {
+	return self.Token.GetExpires()
+}
+
+func (self *SPolicyTokenCredential) IsValid() bool {
+	return self.Token.IsValid()
+}
+
+func (self *SPolicyTokenCredential) ValidDuration() time.Duration {
+	return self.Token.ValidDuration()
+}
+
+func (self *SPolicyTokenCredential) GetRegions() []string {
+	return self.Token.GetRegions()
+}
+
+func (self *SPolicyTokenCredential) GetServiceCatalog() mcclient.IServiceCatalog {
+	return self.Token.GetServiceCatalog()
+}
+
+func (self *SPolicyTokenCredential) GetCatalogData(serviceTypes []string, region string) jsonutils.JSONObject {
+	return self.Token.GetCatalogData(serviceTypes, region)
+}
+
+func (self *SPolicyTokenCredential) GetInternalServices(region string) []string {
+	return self.Token.GetInternalServices(region)
+}
+
+func (self *SPolicyTokenCredential) GetExternalServices(region string) []mcclient.ExternalService {
+	return self.Token.GetExternalServices(region)
+}
+
+func (self *SPolicyTokenCredential) GetEndpoints(region string, endpointType string) []mcclient.Endpoint {
+	return self.Token.GetEndpoints(region, endpointType)
+}
+
+func (self *SPolicyTokenCredential) ToJson() jsonutils.JSONObject {
+	return self.Token.ToJson()
+}
+
+func (self *SPolicyTokenCredential) HasSystemAdminPrivelege() bool {
+	if consts.IsRbacEnabled() {
+		return PolicyManager.IsAdminCapable(self.Token)
+	}
+	return self.Token.HasSystemAdminPrivelege()
+}
+
+func (self *SPolicyTokenCredential) IsAdminAllow(service string, resource string, action string, extra ...string) bool {
+	if consts.IsRbacEnabled() {
+		result := PolicyManager.Allow(true, self.Token, service, resource, action, extra...)
+		return result == rbacutils.AdminAllow
+	}
+	return self.Token.IsAdminAllow(service, resource, action, extra...)
+}
+
+func init() {
+	gotypes.RegisterSerializable(mcclient.TokenCredentialType, func() gotypes.ISerializable {
+		return &SPolicyTokenCredential{}
+	})
+}
+
+func FilterPolicyCredential(token mcclient.TokenCredential) mcclient.TokenCredential {
+	if !consts.IsRbacEnabled() {
+		return token
+	}
+	switch token.(type) {
+	case *SPolicyTokenCredential:
+		return token
+	default:
+		return &SPolicyTokenCredential{Token: token}
+	}
+}