mirror of
https://github.com/yunionio/cloudpods.git
synced 2026-09-19 02:37:24 +08:00
Qiu Jian
bc02b3b433
取消userCred.IsSystemAdmin()，在使用policy的应用中，通过userCred.IsAdminAllow判断是否是管理员且具备相应的权限。获取token时，需要传入policy.FilterPolicyCredential，将普通userCred转换成支持rbac的userCred 2. 在应用启动时候，必须设置 SetServiceType，否则退出
71 lines
2.9 KiB
Go
71 lines
2.9 KiB
Go
package db
|
|
|
|
import (
|
|
"context"
|
|
|
|
"yunion.io/x/jsonutils"
|
|
"yunion.io/x/onecloud/pkg/cloudcommon/consts"
|
|
"yunion.io/x/onecloud/pkg/cloudcommon/policy"
|
|
"yunion.io/x/onecloud/pkg/mcclient"
|
|
"yunion.io/x/sqlchemy"
|
|
)
|
|
|
|
type SSharableVirtualResourceBase struct {
|
|
SVirtualResourceBase
|
|
|
|
IsPublic bool `default:"false" nullable:"false" create:"admin_optional" list:"user"`
|
|
}
|
|
|
|
type SSharableVirtualResourceBaseManager struct {
|
|
SVirtualResourceBaseManager
|
|
}
|
|
|
|
func NewSharableVirtualResourceBaseManager(dt interface{}, tableName string, keyword string, keywordPlural string) SSharableVirtualResourceBaseManager {
|
|
return SSharableVirtualResourceBaseManager{SVirtualResourceBaseManager: NewVirtualResourceBaseManager(dt, tableName, keyword, keywordPlural)}
|
|
}
|
|
|
|
func (manager *SSharableVirtualResourceBaseManager) FilterByOwner(q *sqlchemy.SQuery, owner string) *sqlchemy.SQuery {
|
|
q = q.Filter(sqlchemy.OR(sqlchemy.Equals(q.Field("tenant_id"), owner), sqlchemy.IsTrue(q.Field("is_public"))))
|
|
q = q.Filter(sqlchemy.OR(sqlchemy.IsNull(q.Field("pending_deleted")), sqlchemy.IsFalse(q.Field("pending_deleted"))))
|
|
q = q.Filter(sqlchemy.OR(sqlchemy.IsNull(q.Field("is_system")), sqlchemy.IsFalse(q.Field("is_system"))))
|
|
return q
|
|
}
|
|
|
|
func (model *SSharableVirtualResourceBase) AllowGetDetails(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool {
|
|
return model.IsOwner(userCred) || model.IsPublic || userCred.IsAdminAllow(consts.GetServiceType(), model.KeywordPlural(), policy.PolicyActionGet)
|
|
}
|
|
|
|
func (model *SSharableVirtualResourceBase) IsSharable() bool {
|
|
return model.IsPublic
|
|
}
|
|
|
|
func (model *SSharableVirtualResourceBase) AllowPerformPublic(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
|
|
return userCred.IsAdminAllow(consts.GetServiceType(), model.GetModelManager().KeywordPlural(), policy.PolicyActionPerform, "public")
|
|
}
|
|
|
|
func (model *SSharableVirtualResourceBase) AllowPerformPrivate(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
|
|
return userCred.IsAdminAllow(consts.GetServiceType(), model.GetModelManager().KeywordPlural(), policy.PolicyActionPerform, "private")
|
|
}
|
|
|
|
func (model *SSharableVirtualResourceBase) PerformPublic(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) {
|
|
if !model.IsPublic {
|
|
_, err := model.GetModelManager().TableSpec().Update(model, func() error {
|
|
model.IsPublic = true
|
|
return nil
|
|
})
|
|
return nil, err
|
|
}
|
|
return nil, nil
|
|
}
|
|
|
|
func (model *SSharableVirtualResourceBase) PerformPrivate(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) {
|
|
if model.IsPublic {
|
|
_, err := model.GetModelManager().TableSpec().Update(model, func() error {
|
|
model.IsPublic = false
|
|
return nil
|
|
})
|
|
return nil, err
|
|
}
|
|
return nil, nil
|
|
}
|