[PATCH conductor] Redmine #3345: Initial user groups implementation
Tzu-Mainn Chen
tzumainn at redhat.com
Tue Jun 5 01:53:14 UTC 2012
ACK; makes sense to me, tests pass, nothing obvious breaks in conductor.
Mainn
----- Original Message -----
> From: "Scott Seago" <sseago at redhat.com>
> To: aeolus-devel at lists.fedorahosted.org
> Cc: "Scott Seago" <sseago at redhat.com>
> Sent: Monday, June 4, 2012 11:56:32 AM
> Subject: [PATCH conductor] Redmine #3345: Initial user groups implementation
>
> https://www.aeolusproject.org/redmine/issues/3345
>
> This includes models for user groups, refactoring necessary for
> linking
> permissions to groups, and updated permissions checks.
>
> Not yet included is UI to manage groups, or LDAP group integration.
> ---
> src/app/controllers/application_controller.rb | 32 ++++++--
> src/app/controllers/catalogs_controller.rb | 22 +++--
> src/app/controllers/deployables_controller.rb | 16 +++-
> src/app/controllers/deployments_controller.rb | 36 ++++++---
> .../controllers/hardware_profiles_controller.rb | 23 +++++-
> src/app/controllers/images_controller.rb | 3 +-
> src/app/controllers/instances_controller.rb | 32 +++++---
> src/app/controllers/logs_controller.rb | 10 ++-
> src/app/controllers/permissions_controller.rb | 30 ++++----
> src/app/controllers/pool_families_controller.rb | 11 ++-
> src/app/controllers/pools_controller.rb | 83
> +++++++++++++-------
> .../controllers/provider_accounts_controller.rb | 6 +-
> src/app/controllers/providers_controller.rb | 11 ++-
> src/app/controllers/realm_mappings_controller.rb | 5 +-
> src/app/controllers/realms_controller.rb | 6 +-
> src/app/helpers/mustache_helper.rb | 10 ++-
> src/app/models/deployment.rb | 16 ++--
> src/app/models/derived_permission.rb | 6 +-
> src/app/models/entity.rb | 29 +++++++
> src/app/models/instance.rb | 4 +-
> src/app/models/permission.rb | 21 ++++--
> src/app/models/permissioned_object.rb | 40 +++++++---
> src/app/models/pool.rb | 4 +-
> src/app/models/session_entity.rb | 47
> +++++++++++
> src/app/models/user.rb | 15 +++-
> src/app/models/user_group.rb | 45
> +++++++++++
> src/app/services/application_service.rb | 2 +-
> src/app/services/registration_service.rb | 2 +-
> src/app/views/permissions/_form.html.haml | 10 +--
> src/app/views/permissions/_permissions.html.haml | 6 +-
> src/app/views/pools/_pretty_list.html.haml | 2 +-
> src/config/initializers/session.rb | 23 ++++++
> src/config/initializers/warden.rb | 2 +-
> src/config/locales/en.yml | 1 +
> src/db/migrate/20110207101100_deployment_roles.rb | 80
> -------------------
> .../migrate/20111122203000_add_deployable_roles.rb | 82
> -------------------
> .../migrate/20120514121500_create_user_groups.rb | 37 +++++++++
> src/db/migrate/20120514131500_create_entities.rb | 38 +++++++++
> .../20120517131500_create_session_entities.rb | 32 ++++++++
> .../20120520151500_change_permission_user.rb | 79
> +++++++++++++++++++
> src/features/step_definitions/authentication.rb | 9 +-
> src/features/step_definitions/permission_steps.rb | 8 +-
> src/features/step_definitions/pool_family_steps.rb | 2 +-
> src/features/step_definitions/pool_steps.rb | 2 +-
> src/lib/tasks/dc_tasks.rake | 2 +-
> .../controllers/config_servers_controller_spec.rb | 4 +-
> .../controllers/permissions_controller_spec.rb | 2 +-
> .../provider_accounts_controller_spec.rb | 2 +-
> src/spec/factories/permission.rb | 16 ++--
> src/spec/factories/session.rb | 24 ++++++
> src/spec/models/deployable_spec.rb | 4 +-
> src/spec/models/deployment_spec.rb | 22 +++--
> src/spec/models/derived_permission_spec.rb | 50
> ++++++++++++
> src/spec/models/permission_spec.rb | 28 +++++--
> src/spec/services/registration_service_spec.rb | 4 +-
> src/spec/spec_helper.rb | 5 +
> 56 files changed, 776 insertions(+), 367 deletions(-)
> create mode 100644 src/app/models/entity.rb
> create mode 100644 src/app/models/session_entity.rb
> create mode 100644 src/app/models/user_group.rb
> create mode 100644 src/config/initializers/session.rb
> delete mode 100644 src/db/migrate/20110207101100_deployment_roles.rb
> delete mode 100644
> src/db/migrate/20111122203000_add_deployable_roles.rb
> create mode 100644
> src/db/migrate/20120514121500_create_user_groups.rb
> create mode 100644 src/db/migrate/20120514131500_create_entities.rb
> create mode 100644
> src/db/migrate/20120517131500_create_session_entities.rb
> create mode 100644
> src/db/migrate/20120520151500_change_permission_user.rb
> create mode 100644 src/spec/factories/session.rb
> create mode 100644 src/spec/models/derived_permission_spec.rb
>
> diff --git a/src/app/controllers/application_controller.rb
> b/src/app/controllers/application_controller.rb
> index fda6a06..6f280be 100644
> --- a/src/app/controllers/application_controller.rb
> +++ b/src/app/controllers/application_controller.rb
> @@ -24,7 +24,7 @@ require 'will_paginate/array'
> class ApplicationController < ActionController::Base
> # FIXME: not sure what we're doing aobut service layer w/
> deltacloud
> include ApplicationService
> - helper_method :current_user, :filter_view?
> + helper_method :current_session, :current_user, :filter_view?
> before_filter :read_breadcrumbs, :set_locale
>
> # General error handlers, must be in order from least specific
> @@ -99,8 +99,10 @@ class ApplicationController <
> ActionController::Base
>
> def get_nav_items
> if current_user.present?
> - @providers = Provider.list_for_user(current_user,
> Privilege::VIEW)
> - @pools = Pool.list_for_user(current_user, Privilege::VIEW)
> + @providers = Provider.list_for_user(current_session,
> current_user,
> + Privilege::VIEW)
> + @pools = Pool.list_for_user(current_session, current_user,
> + Privilege::VIEW)
> end
> end
>
> @@ -177,6 +179,9 @@ class ApplicationController <
> ActionController::Base
> def http_auth_user
> return unless request.authorization && request.authorization =~
> /^Basic (.*)/m
> authenticate!(:scope => :api)
> + request.session_options = request.session_options.dup
> + request.session_options[:expire_after] = 2.minutes
> + request.session_options.freeze
> # we use :api scope for authentication to avoid saving session.
> # But it's handy to set authenticated user in default scope, so
> we
> # can use current_user, instead of current_user(:api)
> @@ -184,6 +189,21 @@ class ApplicationController <
> ActionController::Base
> return user(:api)
> end
>
> + def current_session
> + @current_session ||= ActiveRecord::SessionStore::Session.
> + find_by_session_id(request.session_options[:id])
> + # FIXME: I shouldn't have to reload sessions here, but for some
> reason
> + # without reloading it wasn't working for non-admin permissions.
> + # If we ever need to add session_entities for _other_ users to
> the
> + # current session, this won't work
> + if @current_session and (!@current_session.session_entities.any?
> or
> +
> @current_session.session_entities.first.user
> != current_user)
> + SessionEntity.update_session(@current_session, current_user)
> + @current_session.reload
> + end
> + @current_session
> + end
> +
> def require_user
> return if current_user or http_auth_user
> respond_to do |format|
> @@ -309,7 +329,7 @@ class ApplicationController <
> ActionController::Base
> if "permissions" == params[:details_tab]
> require_privilege(Privilege::PERM_VIEW, perm_obj)
> end
> - if perm_obj.has_privilege(current_user, Privilege::PERM_VIEW)
> + if perm_obj.has_privilege(current_session, current_user,
> Privilege::PERM_VIEW)
> @roles = Role.find_all_by_scope(@permission_object.class.name)
> if @tabs
> @tabs << {:name => t('role_assignments'),
> @@ -343,9 +363,7 @@ class ApplicationController <
> ActionController::Base
> { :name => 'checkbox', :class => 'checkbox', :sortable =>
> false }
> end
> @permission_list_header += [
> - { :name => t('users.index.username') },
> - { :name => t('users.index.last_name'), :sortable => false },
> - { :name => t('users.index.first_name'), :sortable => false },
> + { :name => t('permissions.name')},
> { :name => t("role"), :sort_attr => :role},
> ]
> if @show_inherited
> diff --git a/src/app/controllers/catalogs_controller.rb
> b/src/app/controllers/catalogs_controller.rb
> index 270546d..e928988 100644
> --- a/src/app/controllers/catalogs_controller.rb
> +++ b/src/app/controllers/catalogs_controller.rb
> @@ -20,8 +20,12 @@ class CatalogsController < ApplicationController
> def index
> @title = t('catalogs.catalogs')
> clear_breadcrumbs
> - @catalogs = Catalog.apply_filters(:preset_filter_id =>
> params[:catalogs_preset_filter], :search_filter =>
> params[:catalogs_search]).list_for_user(current_user,
> Privilege::VIEW)
> - @can_create = Pool.list_for_user(current_user,
> Privilege::CREATE, Catalog).present?
> + @catalogs = Catalog.
> + apply_filters(:preset_filter_id =>
> params[:catalogs_preset_filter],
> + :search_filter => params[:catalogs_search]).
> + list_for_user(current_session, current_user, Privilege::VIEW)
> + @can_create = Pool.list_for_user(current_session, current_user,
> + Privilege::CREATE,
> Catalog).present?
> save_breadcrumb(catalogs_path(:viewstate => @viewstate ?
> @viewstate.id : nil))
> set_header
> set_admin_content_tabs 'catalogs'
> @@ -42,9 +46,9 @@ class CatalogsController < ApplicationController
> @catalog = Catalog.find(params[:id])
> @title = @catalog.name
> @deployables = @catalog.deployables.
> - list_for_user(current_user,
> Privilege::VIEW).
> - apply_filters(:preset_filter_id =>
> params[:deployables_preset_filter],
> - :search_filter =>
> params[:deployables_search])
> + list_for_user(current_session, current_user, Privilege::VIEW).
> + apply_filters(:preset_filter_id =>
> params[:deployables_preset_filter],
> + :search_filter => params[:deployables_search])
> require_privilege(Privilege::VIEW, @catalog)
> save_breadcrumb(catalog_path(@catalog), @catalog.name)
> @header = [
> @@ -143,12 +147,12 @@ class CatalogsController <
> ApplicationController
>
> def load_pools
> if @catalog.pool_family
> - @pools =
> @catalog.pool_family.pools.list_for_user(current_user,
> -
> Privilege::CREATE,
> - Catalog)
> + @pools = @catalog.pool_family.pools.
> + list_for_user(current_session, current_user,
> Privilege::CREATE, Catalog)
> @pools.unshift(@catalog.pool) unless
> @pools.include?(@catalog.pool)
> else
> - @pools = Pool.list_for_user(current_user, Privilege::CREATE,
> Catalog)
> + @pools = Pool.list_for_user(current_session, current_user,
> + Privilege::CREATE, Catalog)
> end
> end
> end
> diff --git a/src/app/controllers/deployables_controller.rb
> b/src/app/controllers/deployables_controller.rb
> index 1fb8fba..3e3b76a 100644
> --- a/src/app/controllers/deployables_controller.rb
> +++ b/src/app/controllers/deployables_controller.rb
> @@ -27,7 +27,8 @@ class DeployablesController < ApplicationController
> @catalog_entries = @deployables.collect { |d|
> d.catalog_entries.first }
> else
> save_breadcrumb(deployables_path)
> - @deployables =
> Deployable.without_catalog.list_for_user(current_user,
> Privilege::VIEW)
> + @deployables = Deployable.without_catalog.
> + list_for_user(current_session, current_user,
> Privilege::VIEW)
> end
> set_header
> end
> @@ -36,7 +37,8 @@ class DeployablesController < ApplicationController
> @deployable = Deployable.new(params[:deployable])
> if params[:create_from_image]
> @image =
> Aeolus::Image::Warehouse::Image.find(params[:create_from_image])
> - @hw_profiles =
> HardwareProfile.frontend.list_for_user(current_user,
> Privilege::VIEW)
> + @hw_profiles = HardwareProfile.frontend.
> + list_for_user(current_session, current_user,
> Privilege::VIEW)
> @deployable.name = @image.name
> @selected_catalogs = Array(params[:catalog_id])
> load_catalogs
> @@ -65,7 +67,8 @@ class DeployablesController < ApplicationController
> require_privilege(Privilege::VIEW, @deployable)
> save_breadcrumb(polymorphic_path([@catalog, @deployable]),
> @deployable.name)
> @providers = Provider.all
> - @catalogs_options = Catalog.list_for_user(current_user,
> Privilege::VIEW).select do |c|
> + @catalogs_options = Catalog.list_for_user(current_session,
> current_user,
> +
> Privilege::VIEW).select
> do |c|
> !@deployable.catalogs.include?(c) and
> @deployable.catalogs.first.pool_family == c.pool_family
> end
> @@ -179,7 +182,8 @@ class DeployablesController <
> ApplicationController
> if params[:create_from_image].present?
> @image =
> Aeolus::Image::Warehouse::Image.find(params[:create_from_image])
> load_catalogs
> - @hw_profiles =
> HardwareProfile.frontend.list_for_user(current_user,
> Privilege::VIEW)
> + @hw_profiles = HardwareProfile.frontend.
> + list_for_user(current_session, current_user,
> Privilege::VIEW)
> else
> @catalog = @selected_catalogs.first
> params.delete(:edit_xml) if params[:edit_xml]
> @@ -292,7 +296,9 @@ class DeployablesController <
> ApplicationController
>
> def load_catalogs
> @pool_family = PoolFamily.where(:name =>
> @image.environment).first
> - @catalogs = Catalog.list_for_user(current_user,
> Privilege::CREATE, Deployable).where('pool_family_id' =>
> @pool_family.id)
> + @catalogs = Catalog.list_for_user(current_session, current_user,
> + Privilege::CREATE,
> Deployable).
> + where('pool_family_id' => @pool_family.id)
> end
>
> def import_xml_from_url(url)
> diff --git a/src/app/controllers/deployments_controller.rb
> b/src/app/controllers/deployments_controller.rb
> index bb7f22f..77b7cb8 100644
> --- a/src/app/controllers/deployments_controller.rb
> +++ b/src/app/controllers/deployments_controller.rb
> @@ -81,7 +81,8 @@ class DeploymentsController < ApplicationController
>
> if @services.empty? or @services.all? {|s, a|
> s.parameters.empty?}
> # we can skip the launch-time parameters screen
> - @errors = @deployment.check_assemblies_matches(current_user)
> + @errors =
> @deployment.check_assemblies_matches(current_session,
> + current_user)
> set_errors_flash(@errors)
> @additional_quota = count_additional_quota(@deployment)
> render 'overview' and return
> @@ -109,7 +110,8 @@ class DeploymentsController <
> ApplicationController
>
> respond_to do |format|
> if @deployable.xml &&
> @deployment.valid_deployable_xml?(@deployable.xml) &&
> d_errors.empty?
> - @errors = @deployment.check_assemblies_matches(current_user)
> + @errors =
> @deployment.check_assemblies_matches(current_session,
> + current_user)
> set_errors_flash(@errors)
> @additional_quota = count_additional_quota(@deployment)
>
> @@ -149,7 +151,7 @@ class DeploymentsController <
> ApplicationController
> return unless check_deployable_images
>
> respond_to do |format|
> - if @deployment.create_and_launch(current_user)
> + if @deployment.create_and_launch(current_session,
> current_user)
> format.html do
> flash[:notice] = t "deployments.flash.notice.launched"
> redirect_to deployment_path(@deployment)
> @@ -343,7 +345,9 @@ class DeploymentsController <
> ApplicationController
>
> def launch_from_catalog
> @catalog = Catalog.find(params[:catalog_id])
> - @deployables = @catalog.deployables.list_for_user(current_user,
> Privilege::VIEW).paginate(:page => params[:page] || 1, :per_page =>
> 6)
> + @deployables = @catalog.deployables.
> + list_for_user(current_session, current_user, Privilege::VIEW).
> + paginate(:page => params[:page] || 1, :per_page => 6)
> require_privilege(Privilege::VIEW, @catalog)
> end
>
> @@ -379,13 +383,16 @@ class DeploymentsController <
> ApplicationController
> { :name => t("pools.index.owner"), :sortable => false },
> { :name => t("providers.provider"), :sortable => false }
> ]
> - @pools = Pool.list_for_user(current_user, Privilege::CREATE,
> Deployment)
> - @deployments = paginate_collection(Deployment.includes(:owner,
> :pool, :instances).
> -
> apply_filters(:preset_filter_id
> => params[:deployments_preset_filter], :search_filter =>
> params[:deployments_search]).
> -
> list_for_user(current_user,
> Privilege::VIEW).
> -
> where('deployments.pool_id'
> => @pools).
> -
> order(sort_column(Deployment,
> "deployments.name") +' '+ sort_direction),
> - params[:page], PER_PAGE)
> + @pools = Pool.list_for_user(current_session, current_user,
> + Privilege::CREATE, Deployment)
> + @deployments = paginate_collection(
> + Deployment.includes(:owner, :pool, :instances).
> + apply_filters(:preset_filter_id =>
> params[:deployments_preset_filter],
> + :search_filter =>
> params[:deployments_search]).
> + list_for_user(current_session, current_user,
> Privilege::VIEW).
> + where('deployments.pool_id' => @pools).
> + order(sort_column(Deployment, "deployments.name") +' '+
> sort_direction),
> + params[:page], PER_PAGE)
> end
>
> def count_additional_quota(deployment)
> @@ -407,8 +414,11 @@ class DeploymentsController <
> ApplicationController
> end
>
> def init_new_deployment_attrs
> - @deployables = Deployable.includes({:catalogs =>
> :pool}).list_for_user(current_user, Privilege::USE).select{|d|
> d.catalogs.collect{|c| c.pool}.include?(@pool)}
> - @pools = Pool.list_for_user(current_user, Privilege::CREATE,
> Deployment)
> + @deployables = Deployable.includes({:catalogs => :pool}).
> + list_for_user(current_session, current_user, Privilege::USE).
> + select{|d| d.catalogs.collect{|c| c.pool}.include?(@pool)}
> + @pools = Pool.list_for_user(current_session, current_user,
> + Privilege::CREATE, Deployment)
> @deployable = params[:deployable_id] ?
> Deployable.find(params[:deployable_id]) : nil
> @realms = FrontendRealm.all
> @hardware_profiles = HardwareProfile.all(
> diff --git a/src/app/controllers/hardware_profiles_controller.rb
> b/src/app/controllers/hardware_profiles_controller.rb
> index dc19c13..2b91d5d 100644
> --- a/src/app/controllers/hardware_profiles_controller.rb
> +++ b/src/app/controllers/hardware_profiles_controller.rb
> @@ -233,13 +233,28 @@ class HardwareProfilesController <
> ApplicationController
> sort_order = sort_direction
> sort_field = sort_column(HardwareProfile, 'name')
> if sort_field == "name"
> - @hardware_profiles = HardwareProfile.where('provider_id IS
> NULL', {}).apply_filters(:preset_filter_id =>
> params[:hardware_profiles_preset_filter], :search_filter =>
> params[:hardware_profiles_search]).list_for_user(current_user,
> Privilege::VIEW).order("hardware_profiles.name #{sort_direction}")
> + @hardware_profiles = HardwareProfile.where('provider_id IS
> NULL', {}).
> + apply_filters(:preset_filter_id =>
> + params[:hardware_profiles_preset_filter],
> + :search_filter =>
> params[:hardware_profiles_search]).
> + list_for_user(current_session, current_user,
> Privilege::VIEW).
> + order("hardware_profiles.name #{sort_direction}")
> else
> - @hardware_profiles = HardwareProfile.where('provider_id IS
> NULL', {}).apply_filters(:preset_filter_id =>
> params[:hardware_profiles_preset_filter], :search_filter =>
> params[:hardware_profiles_search]).list_for_user(current_user,
> Privilege::VIEW)
> + @hardware_profiles = HardwareProfile.where('provider_id IS
> NULL', {}).
> + apply_filters(:preset_filter_id =>
> + params[:hardware_profiles_preset_filter],
> + :search_filter =>
> params[:hardware_profiles_search]).
> + list_for_user(current_session, current_user,
> Privilege::VIEW)
> if sort_order == "asc"
> - @hardware_profiles.sort! {|x,y|
> x.get_property_map[sort_field].sort_value(true) <=>
> y.get_property_map[sort_field].sort_value(true)}
> + @hardware_profiles.sort! do |x,y|
> + x.get_property_map[sort_field].sort_value(true) <=>
> + y.get_property_map[sort_field].sort_value(true)
> + end
> else
> - @hardware_profiles.sort! {|x,y|
> y.get_property_map[sort_field].sort_value(false) <=>
> x.get_property_map[sort_field].sort_value(false)}
> + @hardware_profiles.sort! do |x,y|
> + y.get_property_map[sort_field].sort_value(false) <=>
> + x.get_property_map[sort_field].sort_value(false)
> + end
> end
> end
> end
> diff --git a/src/app/controllers/images_controller.rb
> b/src/app/controllers/images_controller.rb
> index a114f9d..5fb2143 100644
> --- a/src/app/controllers/images_controller.rb
> +++ b/src/app/controllers/images_controller.rb
> @@ -166,7 +166,8 @@ class ImagesController < ApplicationController
> def new
> @environment = PoolFamily.find(params[:environment])
> check_permissions
> - @accounts =
> @environment.provider_accounts.enabled.list_for_user(current_user,
> Privilege::USE)
> + @accounts = @environment.provider_accounts.enabled.
> + list_for_user(current_session, current_user, Privilege::USE)
> if @accounts.empty?
> flash.now[:error] = params[:tab] == 'import' ?
> t("images.flash.error.no_provider_accounts_for_import") :
> diff --git a/src/app/controllers/instances_controller.rb
> b/src/app/controllers/instances_controller.rb
> index 85a5235..ac78096 100644
> --- a/src/app/controllers/instances_controller.rb
> +++ b/src/app/controllers/instances_controller.rb
> @@ -228,7 +228,9 @@ class InstancesController < ApplicationController
> end
>
> def init_new_instance_attrs
> - @pools = Pool.list_for_user(current_user, Privilege::CREATE,
> Instance).where(:enabled => true)
> + @pools = Pool.list_for_user(current_session, current_user,
> + Privilege::CREATE, Instance).
> + where(:enabled => true)
> @realms = FrontendRealm.all
> @hardware_profiles = HardwareProfile.all(
> :include => :architecture,
> @@ -248,20 +250,30 @@ class InstancesController <
> ApplicationController
> {:name => t('instances.headers.created_by'), :sort_attr =>
> 'users.last_name'},
> ]
>
> - @pools = Pool.list_for_user(current_user, Privilege::CREATE,
> Instance)
> + @pools = Pool.list_for_user(current_session, current_user,
> + Privilege::CREATE, Instance)
> end
>
> def load_instances
> if params[:deployment_id].blank?
> - @instances =
> paginate_collection(Instance.includes(:owner).apply_filters(:preset_filter_id
> => params[:instances_preset_filter], :search_filter =>
> params[:instances_search]).
> -
> list_for_user(current_user,
> Privilege::VIEW).list(sort_column(Instance), sort_direction).
> -
> where("instances.pool_id"
> => @pools),
> - params[:page], PER_PAGE)
> + @instances = paginate_collection(
> + Instance.includes(:owner).
> + apply_filters(:preset_filter_id =>
> params[:instances_preset_filter],
> + :search_filter =>
> params[:instances_search]).
> + list_for_user(current_session, current_user,
> Privilege::VIEW).
> + list(sort_column(Instance), sort_direction).
> + where("instances.pool_id" => @pools),
> + params[:page], PER_PAGE)
> else
> - @instances =
> paginate_collection(Instance.includes(:owner).apply_filters(:preset_filter_id
> => params[:instances_preset_filter], :search_filter =>
> params[:instances_search]).
> -
> list(sort_column(Instance),
> sort_direction).list_for_user(current_user, Privilege::VIEW).
> -
> where("instances.pool_id"
> => @pools, "instances.deployment_id" => params[:deployment_id]),
> - params[:page], PER_PAGE)
> + @instances = paginate_collection(
> + Instance.includes(:owner).
> + apply_filters(:preset_filter_id =>
> params[:instances_preset_filter],
> + :search_filter =>
> params[:instances_search]).
> + list(sort_column(Instance), sort_direction).
> + list_for_user(current_session, current_user,
> Privilege::VIEW).
> + where("instances.pool_id" => @pools,
> + "instances.deployment_id" =>
> params[:deployment_id]),
> + params[:page], PER_PAGE)
> end
> end
>
> diff --git a/src/app/controllers/logs_controller.rb
> b/src/app/controllers/logs_controller.rb
> index 8b9e5c4..6f0cab4 100644
> --- a/src/app/controllers/logs_controller.rb
> +++ b/src/app/controllers/logs_controller.rb
> @@ -57,9 +57,11 @@ class LogsController < ApplicationController
> {:source => [:pool_family, :pool,
> :owner]},
> :conditions => conditions
> )
> - deployments = Deployment.unscoped.list_for_user(current_user,
> + deployments = Deployment.unscoped.list_for_user(current_session,
> + current_user,
> Privilege::VIEW)
> - instances = Instance.unscoped.list_for_user(current_user,
> Privilege::VIEW)
> + instances = Instance.unscoped.list_for_user(current_session,
> + current_user,
> Privilege::VIEW)
>
> pool_option, pool_option_id = @pool_select.split(":")
> provider_option, provider_option_id =
> @provider_select.split(":")
> @@ -110,7 +112,7 @@ class LogsController < ApplicationController
> @state_options = ([[t('logs.options.default_states'), ""]] +
> Deployment::STATES + Instance::STATES).uniq
> @pool_options = [[t('logs.options.default_pools'), ""]]
> - PoolFamily.list_for_user(current_user, Privilege::VIEW).
> + PoolFamily.list_for_user(current_session, current_user,
> Privilege::VIEW).
> find(:all, :include => :pools, :order => "name",
> :select => ["id", "name"]).each do |pool_family|
> @pool_options << [pool_family.name, "pool_family:" +
> pool_family.id.to_s]
> @@ -118,7 +120,7 @@ class LogsController < ApplicationController
> map{|x| [" -- " + x.name, "pool:" + x.id.to_s]}
> end
> @provider_options = [[t('logs.options.default_providers'), ""]]
> - Provider.list_for_user(current_user, Privilege::VIEW).
> + Provider.list_for_user(current_session, current_user,
> Privilege::VIEW).
> find(:all, :include => :provider_accounts, :order => "name",
> :select => ["id", "name"]).each do |provider|
> @provider_options << [provider.name, "provider:" +
> provider.id.to_s]
> diff --git a/src/app/controllers/permissions_controller.rb
> b/src/app/controllers/permissions_controller.rb
> index 9f984fa..acdbb2c 100644
> --- a/src/app/controllers/permissions_controller.rb
> +++ b/src/app/controllers/permissions_controller.rb
> @@ -40,7 +40,7 @@ class PermissionsController < ApplicationController
> @summary_text = t('permissions.new.choose_roles') + " " +
> @permission_object.class.model_name.human
> end
> load_headers
> - load_users
> + load_entities
> respond_to do |format|
> format.html
> format.js { render :partial => 'new' }
> @@ -51,17 +51,17 @@ class PermissionsController <
> ApplicationController
> set_permission_object
> added=[]
> not_added=[]
> - params[:user_role_selected].each do |user_role|
> - user_id,role_id = user_role.split(",")
> + params[:entity_role_selected].each do |entity_role|
> + entity_id,role_id = entity_role.split(",")
> unless role_id.nil?
> - permission = Permission.new(:user_id => user_id,
> + permission = Permission.new(:entity_id => entity_id,
> :role_id => role_id,
> :permission_object =>
> @permission_object)
> if permission.save
> - added << t('permissions.flash.fragment.user_and_role',
> :user => permission.user.login,
> + added << t('permissions.flash.fragment.user_and_role',
> :user => permission.entity.name,
> :role => t(permission.role.name, :scope=>
> :role_defs, :default =>
> permission.role.name))
> else
> - not_added << t('permissions.flash.fragment.user_and_role',
> :user => permission.user.login,
> + not_added << t('permissions.flash.fragment.user_and_role',
> :user => permission.entity.name,
> :role => t(permission.role.name, :scope=>
> :role_defs, :default =>
> permission.role.name) )
> end
> end
> @@ -96,11 +96,11 @@ class PermissionsController <
> ApplicationController
> unless permission.role == role
> permission.role = role
> if permission.save
> - modified <<
> t('permissions.flash.fragment.user_and_role_change', :user =>
> permission.user.login,
> + modified <<
> t('permissions.flash.fragment.user_and_role_change', :user =>
> permission.entity.name,
> :old_role => t(old_role.name, :scope=>
> :role_defs, :default => old_role.name),
> :role => t(permission.role.name,
> :scope=> :role_defs, :default =>
> permission.role.name))
> else
> - not_modified <<
> t('permissions.flash.fragment.user_and_role_change', :user =>
> permission.user.login,
> + not_modified <<
> t('permissions.flash.fragment.user_and_role_change', :user =>
> permission.entity.name,
> :old_role => t(old_role.name, :scope=>
> :role_defs, :default => old_role.name)
> ,
> :role => t(permission.role.name,
> :scope=> :role_defs, :default =>
> permission.role.name))
> end
> @@ -131,10 +131,10 @@ class PermissionsController <
> ApplicationController
>
> Permission.find(params[:permission_selected]).each do |p|
> if check_privilege(Privilege::PERM_SET, p.permission_object)
> && p.destroy
> - deleted << t('permissions.flash.fragment.user_and_role',
> :user => p.user.login,
> + deleted << t('permissions.flash.fragment.user_and_role',
> :user => p.entity.name,
> :role => t(p.role.name, :scope=> :role_defs,
> :default => p.role.name))
> else
> - not_deleted << t('permissions.flash.fragment.user_and_role',
> :user => p.user.login,
> + not_deleted << t('permissions.flash.fragment.user_and_role',
> :user => p.entity.name,
> :role => t(p.role.name, :scope=> :role_defs,
> :default => p.role.name))
> end
> end
> @@ -167,17 +167,15 @@ class PermissionsController <
> ApplicationController
>
> private
>
> - def load_users
> - sort_order = params[:sort_by].nil? ? "login" : params[:sort_by]
> - @users = paginate_collection(User.all(:order => sort_order),
> params[:page])
> + def load_entities
> + sort_order = params[:sort_by].nil? ? "name" : params[:sort_by]
> + @entities = paginate_collection(Entity.all(:order =>
> sort_order), params[:page])
> end
>
> def load_headers
> @header = [
> { :name => '', :sortable => false },
> - { :name => t('users.index.username') },
> - { :name => t('users.index.last_name'), :sortable => false },
> - { :name => t('users.index.first_name'), :sortable => false },
> + { :name => t('permissions.name') },
> { :name => t('role'), :sortable => false }
> ]
> end
> diff --git a/src/app/controllers/pool_families_controller.rb
> b/src/app/controllers/pool_families_controller.rb
> index 2d35080..dcbc59f 100644
> --- a/src/app/controllers/pool_families_controller.rb
> +++ b/src/app/controllers/pool_families_controller.rb
> @@ -115,9 +115,10 @@ class PoolFamiliesController <
> ApplicationController
> end
>
> @provider_accounts = ProviderAccount.
> - list_for_user(current_user, Privilege::USE).
> - where('provider_accounts.id not in (?)',
> @pool_family.provider_accounts.empty? ?
> - 0 :
> @pool_family.provider_accounts.map(&:id))
> + list_for_user(current_session, current_user, Privilege::USE).
> + where('provider_accounts.id not in (?)',
> + @pool_family.provider_accounts.empty? ?
> + 0 : @pool_family.provider_accounts.map(&:id))
>
> added = []
> not_added = []
> @@ -207,7 +208,9 @@ class PoolFamiliesController <
> ApplicationController
> end
>
> def load_pool_families
> - @pool_families = PoolFamily.list_for_user(current_user,
> Privilege::VIEW).order(sort_column(PoolFamily) + ' ' +
> sort_direction)
> + @pool_families = PoolFamily.list_for_user(current_session,
> current_user,
> + Privilege::VIEW).
> + order(sort_column(PoolFamily) + ' ' + sort_direction)
> end
>
> def load_pool_family_tabs
> diff --git a/src/app/controllers/pools_controller.rb
> b/src/app/controllers/pools_controller.rb
> index 5229dfd..20a5572 100644
> --- a/src/app/controllers/pools_controller.rb
> +++ b/src/app/controllers/pools_controller.rb
> @@ -43,31 +43,44 @@ class PoolsController < ApplicationController
> details_tab_name = params[:details_tab].blank? ? 'pools' :
> params[:details_tab]
> @details_tab = @tabs.find {|t| t[:id] == details_tab_name} ||
> @tabs.first[:name].downcase
>
> - @user_pools = Pool.list_for_user(current_user,
> Privilege::CREATE, Deployment)
> + @user_pools = Pool.list_for_user(current_session, current_user,
> + Privilege::CREATE, Deployment)
>
> if filter_view?
> case @details_tab[:id]
> when 'pools'
> - @pools = paginate_collection(Pool.includes(:deployments,
> :instances).
> - apply_filters(:preset_filter_id
> => params[:pools_preset_filter], :search_filter =>
> params[:pools_search]).
> - list_for_user(current_user,
> Privilege::VIEW).list(sort_column(Pool), sort_direction),
> - params[:page], PER_PAGE)
> + @pools = paginate_collection(
> + Pool.includes(:deployments, :instances).
> + apply_filters(:preset_filter_id =>
> params[:pools_preset_filter],
> + :search_filter => params[:pools_search]).
> + list_for_user(current_session, current_user,
> Privilege::VIEW).
> + list(sort_column(Pool), sort_direction),
> + params[:page], PER_PAGE)
> when 'instances'
> params[:instances_preset_filter] = "" unless
> params[:instances_preset_filter]
> - @instances =
> paginate_collection(Instance.includes({:provider_account =>
> :provider}).
> -
> apply_filters(:preset_filter_id
> => params[:instances_preset_filter], :search_filter =>
> params[:instances_search]).
> - list_for_user(current_user,
> Privilege::VIEW).list(sort_column(Instance), sort_direction),
> - params[:page], PER_PAGE)
> + @instances = paginate_collection(
> + Instance.includes({:provider_account => :provider}).
> + apply_filters(:preset_filter_id =>
> params[:instances_preset_filter],
> + :search_filter =>
> params[:instances_search]).
> + list_for_user(current_session, current_user,
> Privilege::VIEW).
> + list(sort_column(Instance), sort_direction),
> + params[:page], PER_PAGE)
> when 'deployments'
> - @deployments =
> paginate_collection(Deployment.includes(:pool, :instances).
> -
> apply_filters(:preset_filter_id
> => params[:deployments_preset_filter], :search_filter =>
> params[:deployments_search]).
> -
> list_for_user(current_user,
> Privilege::VIEW).list(sort_column(Deployment), sort_direction),
> - params[:page], PER_PAGE)
> + @deployments = paginate_collection(
> + Deployment.includes(:pool, :instances).
> + apply_filters(:preset_filter_id =>
> + params[:deployments_preset_filter],
> + :search_filter =>
> params[:deployments_search]).
> + list_for_user(current_session, current_user,
> Privilege::VIEW).
> + list(sort_column(Deployment), sort_direction),
> + params[:page], PER_PAGE)
> end
> else
> - @pools = paginate_collection(Pool.includes(:deployments,
> :instances, :quota, :catalogs).
> - list_for_user(current_user,
> Privilege::VIEW).list(sort_column(Pool), sort_direction),
> - params[:page], PER_PAGE)
> + @pools = paginate_collection(
> + Pool.includes(:deployments, :instances, :quota, :catalogs).
> + list_for_user(current_session, current_user,
> Privilege::VIEW).
> + list(sort_column(Pool), sort_direction),
> + params[:page], PER_PAGE)
> end
>
> statistics
> @@ -104,14 +117,18 @@ class PoolsController < ApplicationController
> @title = t('pools.header_show.pool_name', :name => @pool.name)
> save_breadcrumb(pool_path(@pool, :viewstate => viewstate_id),
> @pool.name)
> require_privilege(Privilege::VIEW, @pool)
> - @statistics = @pool.statistics(current_user)
> + @statistics = @pool.statistics(current_session, current_user)
>
> if params[:details_tab]
> case params[:details_tab]
> when 'images'
> - #this case covers fetching of unique images and
> constructing collection for filter table
> - @header = [{:name => "catalog"}, {:name => "deployable"},
> {:name => "image"}, {:name => "provider_image"}]
> - @catalog_images =
> @pool.catalog_images_collection(@pool.catalogs.list_for_user(current_user,
> Privilege::VIEW))
> + # this case covers fetching of unique images and
> constructing
> + # collection for filter table
> + @header = [{:name => "catalog"}, {:name => "deployable"},
> + {:name => "image"}, {:name =>
> "provider_image"}]
> + @catalog_images = @pool.catalog_images_collection(
> + @pool.catalogs.list_for_user(current_session,
> current_user,
> + Privilege::VIEW))
> when 'deployments'
> @view = filter_view? ? 'deployments/list' :
> 'deployments/pretty_view'
> end
> @@ -129,17 +146,24 @@ class PoolsController < ApplicationController
>
> details_tab_name = params[:details_tab].blank? ? 'deployments' :
> params[:details_tab]
> @details_tab = @tabs.find {|t| t[:id] == details_tab_name} ||
> @tabs.first[:name].downcase
> - @deployments =
> paginate_collection(@pool.deployments.includes(:owner, :pool,
> :instances, :events).
> -
> apply_filters(:preset_filter_id
> => params[:deployments_preset_filter], :search_filter =>
> params[:deployments_search]).
> -
> list_for_user(current_user,
> Privilege::VIEW),
> - params[:page], PER_PAGE) if
> @details_tab[:id] == 'deployments'
> + if @details_tab[:id] == 'deployments'
> + @deployments = paginate_collection(
> + @pool.deployments.includes(:owner, :pool, :instances,
> :events).
> + apply_filters(:preset_filter_id =>
> params[:deployments_preset_filter],
> + :search_filter =>
> params[:deployments_search]).
> + list_for_user(current_session, current_user,
> Privilege::VIEW),
> + params[:page], PER_PAGE)
> + end
> @view = @details_tab[:view]
> respond_to do |format|
> format.html { render :action => :show}
> format.js { render :partial => @view }
> format.json do
> - deployments =
> paginate_collection(@pool.deployments.list_for_user(current_user,
> Privilege::VIEW), params[:page], PER_PAGE).
> - map{
> |deployment| view_context.deployment_for_mustache(deployment) }
> + deployments = paginate_collection(
> + @pool.deployments.list_for_user(current_session,
> current_user,
> + Privilege::VIEW),
> + params[:page], PER_PAGE).
> + map{ |deployment|
> view_context.deployment_for_mustache(deployment) }
> render :json => @pool.as_json.merge({:deployments =>
> deployments})
> end
> end
> @@ -151,7 +175,8 @@ class PoolsController < ApplicationController
> @pool.pool_family = PoolFamily.find(params[:pool_family_id])
> unless params[:pool_family_id].blank?
> require_privilege(Privilege::CREATE, Pool, @pool.pool_family)
> @quota = Quota.new
> - @pool_families = PoolFamily.list_for_user(current_user,
> Privilege::CREATE, Pool)
> + @pool_families = PoolFamily.list_for_user(current_session,
> current_user,
> + Privilege::CREATE,
> Pool)
> respond_to do |format|
> format.html
> format.json { render :json => @pool }
> @@ -334,7 +359,9 @@ class PoolsController < ApplicationController
> # (But if it's nil, we want to show all instances)
> params[:state] = 'running' unless params.keys.include?('state')
> conditions = params[:state].present? ? ['state=?',
> params[:state]] : ''
> - @instances = @pool.instances.list_for_user(current_user,
> Privilege::VIEW).find(:all, :conditions => conditions)
> + @instances = @pool.instances.list_for_user(current_session,
> current_user,
> + Privilege::VIEW).
> + where(conditions)
> end
>
> def set_quota
> diff --git a/src/app/controllers/provider_accounts_controller.rb
> b/src/app/controllers/provider_accounts_controller.rb
> index 7b51356..095b534 100644
> --- a/src/app/controllers/provider_accounts_controller.rb
> +++ b/src/app/controllers/provider_accounts_controller.rb
> @@ -212,6 +212,10 @@ class ProviderAccountsController <
> ApplicationController
> end
>
> def load_accounts
> - @provider_accounts =
> ProviderAccount.apply_filters(:preset_filter_id =>
> params[:provider_accounts_preset_filter], :search_filter =>
> params[:provider_accounts_search]).list_for_user(current_user,
> Privilege::VIEW)
> + @provider_accounts = ProviderAccount.
> + apply_filters(:preset_filter_id =>
> + params[:provider_accounts_preset_filter],
> + :search_filter =>
> params[:provider_accounts_search]).
> + list_for_user(current_session, current_user, Privilege::VIEW)
> end
> end
> diff --git a/src/app/controllers/providers_controller.rb
> b/src/app/controllers/providers_controller.rb
> index e96ec34..4073dd8 100644
> --- a/src/app/controllers/providers_controller.rb
> +++ b/src/app/controllers/providers_controller.rb
> @@ -178,7 +178,8 @@ class ProvidersController < ApplicationController
> end
>
> def load_providers
> - @providers = Provider.list_for_user(current_user,
> Privilege::VIEW)
> + @providers = Provider.list_for_user(current_session,
> current_user,
> + Privilege::VIEW)
> end
>
> def disable_provider
> @@ -266,7 +267,13 @@ class ProvidersController <
> ApplicationController
> details_tab_name = params[:details_tab].blank? ? 'connectivity'
> : params[:details_tab]
> @details_tab = @tabs.find {|t| t[:id] == details_tab_name} ||
> @tabs.first[:name].downcase
>
> - @provider_accounts =
> @provider.provider_accounts.apply_filters(:preset_filter_id =>
> params[:provider_accounts_preset_filter], :search_filter =>
> params[:provider_accounts_search]).list_for_user(current_user,
> Privilege::VIEW) if @details_tab[:id] == 'accounts'
> + if @details_tab[:id] == 'accounts'
> + @provider_accounts = @provider.provider_accounts.
> + apply_filters(:preset_filter_id =>
> + params[:provider_accounts_preset_filter],
> + :search_filter =>
> params[:provider_accounts_search]).
> + list_for_user(current_session, current_user,
> Privilege::VIEW)
> + end
> #@permissions = @provider.permissions if @details_tab[:id] ==
> 'roles'
>
> @view = @details_tab[:view]
> diff --git a/src/app/controllers/realm_mappings_controller.rb
> b/src/app/controllers/realm_mappings_controller.rb
> index 41d53a1..ca68e0b 100644
> --- a/src/app/controllers/realm_mappings_controller.rb
> +++ b/src/app/controllers/realm_mappings_controller.rb
> @@ -53,11 +53,12 @@ class RealmMappingsController <
> ApplicationController
>
> def load_backend_targets
> @backend_targets = if @realm_target.realm_or_provider_type ==
> 'Realm'
> - Provider.list_for_user(current_user, Privilege::USE).collect
> do |provider|
> + Provider.list_for_user(current_session, current_user,
> + Privilege::USE).collect do |provider|
> provider.realms
> end.flatten
> else
> - Provider.list_for_user(current_user, Privilege::USE)
> + Provider.list_for_user(current_session, current_user,
> Privilege::USE)
> end
>
> end
> diff --git a/src/app/controllers/realms_controller.rb
> b/src/app/controllers/realms_controller.rb
> index 1ee37d8..695f1e2 100644
> --- a/src/app/controllers/realms_controller.rb
> +++ b/src/app/controllers/realms_controller.rb
> @@ -140,11 +140,13 @@ class RealmsController < ApplicationController
>
> def load_backend_realms
> #TODO: list only realms user has permission on
> - @backend_realms = Provider.list_for_user(current_user,
> Privilege::USE).collect do |provider|
> + @backend_realms = Provider.list_for_user(current_session,
> current_user,
> + Privilege::USE).collect
> do |provider|
> provider.realms
> end.flatten
>
> - @providers = Provider.list_for_user(current_user,
> Privilege::USE)
> + @providers = Provider.list_for_user(current_session,
> current_user,
> + Privilege::USE)
> end
>
> def load_realms
> diff --git a/src/app/helpers/mustache_helper.rb
> b/src/app/helpers/mustache_helper.rb
> index 78a663e..c4785dd 100644
> --- a/src/app/helpers/mustache_helper.rb
> +++ b/src/app/helpers/mustache_helper.rb
> @@ -20,7 +20,8 @@
> module MustacheHelper
>
> def user_info_for_mustache
> - user_pools = Pool.list_for_user(current_user, Privilege::CREATE,
> Deployment);
> + user_pools = Pool.list_for_user(current_session, current_user,
> + Privilege::CREATE, Deployment);
> user_instances = current_user.owned_instances
> user_available_quota =
> current_user.quota.maximum_running_instances
> {
> @@ -116,8 +117,11 @@ module MustacheHelper
> },
>
> :user_deployments => paginate_collection(pool.deployments.
> -
> list_for_user(current_user,
> Privilege::VIEW).
> - ascending_by_name,
> params[:page], PER_PAGE)
> +
> list_for_user(current_session,
> +
> current_user,
> +
> Privilege::VIEW).
> + ascending_by_name,
> params[:page],
> + PER_PAGE)
> }
> end
>
> diff --git a/src/app/models/deployment.rb
> b/src/app/models/deployment.rb
> index 78af946..0cf1137 100644
> --- a/src/app/models/deployment.rb
> +++ b/src/app/models/deployment.rb
> @@ -210,13 +210,13 @@ class Deployment < ActiveRecord::Base
> @launch_parameters = launch_parameters
> end
>
> - def create_and_launch(user)
> + def create_and_launch(session, user)
> begin
> rollback_active_record_state! do
> # deployment's attrs are not reset on rollback,
> # rollback_active_record_state! takes care of this
> transaction do
> - create_instances_with_params!(user)
> + create_instances_with_params!(session, user)
> launch!(user)
> end
> end
> @@ -332,11 +332,11 @@ class Deployment < ActiveRecord::Base
>
> # we try to create an instance for each assembly and check
> # if a match is found
> - def check_assemblies_matches(user)
> + def check_assemblies_matches(session, user)
> errs = []
> begin
> deployable_xml.assemblies.each do |assembly|
> - hw_profile = permissioned_frontend_hwprofile(user,
> assembly.hwp)
> + hw_profile = permissioned_frontend_hwprofile(session, user,
> assembly.hwp)
> raise I18n.t('deployments.flash.error.no_hwp_permission',
> :hwp => assembly.hwp) unless hw_profile
> instance = Instance.new(
> :deployment => self,
> @@ -503,8 +503,8 @@ class Deployment < ActiveRecord::Base
> end
> end
>
> - def permissioned_frontend_hwprofile(user, hwp_name)
> - HardwareProfile.list_for_user(user,
> Privilege::VIEW).where('hardware_profiles.name = :name AND
> provider_id IS NULL', {:name => hwp_name}).first
> + def permissioned_frontend_hwprofile(session, user, hwp_name)
> + HardwareProfile.list_for_user(session, user,
> Privilege::VIEW).where('hardware_profiles.name = :name AND
> provider_id IS NULL', {:name => hwp_name}).first
> end
>
> def inject_launch_parameters
> @@ -570,10 +570,10 @@ class Deployment < ActiveRecord::Base
> self[:pool_family_id] = pool.pool_family_id
> end
>
> - def create_instances_with_params!(user)
> + def create_instances_with_params!(session, user)
> errors = {}
> deployable_xml.assemblies.each do |assembly|
> - hw_profile = permissioned_frontend_hwprofile(user,
> assembly.hwp)
> + hw_profile = permissioned_frontend_hwprofile(session, user,
> assembly.hwp)
> raise I18n.t('deployments.flash.error.no_hwp_permission', :hwp
> => assembly.hwp) unless hw_profile
> Instance.transaction do
> instance = Instance.create!(
> diff --git a/src/app/models/derived_permission.rb
> b/src/app/models/derived_permission.rb
> index 06e7e8e..b7a2530 100644
> --- a/src/app/models/derived_permission.rb
> +++ b/src/app/models/derived_permission.rb
> @@ -47,9 +47,9 @@ class DerivedPermission < ActiveRecord::Base
> belongs_to :role
> validates_presence_of :role_id
>
> - # user is copied from source permission
> - belongs_to :user
> - validates_presence_of :user_id
> + # entity is copied from source permission
> + belongs_to :entity
> + validates_presence_of :entity_id
>
> validates_uniqueness_of :permission_id, :scope =>
> [:permission_object_id,
> :permission_object_type]
> diff --git a/src/app/models/entity.rb b/src/app/models/entity.rb
> new file mode 100644
> index 0000000..bbc56fe
> --- /dev/null
> +++ b/src/app/models/entity.rb
> @@ -0,0 +1,29 @@
> +#
> +# Copyright 2012 Red Hat, Inc.
> +#
> +# Licensed under the Apache License, Version 2.0 (the "License");
> +# you may not use this file except in compliance with the License.
> +# You may obtain a copy of the License at
> +#
> +# http://www.apache.org/licenses/LICENSE-2.0
> +#
> +# Unless required by applicable law or agreed to in writing,
> software
> +# distributed under the License is distributed on an "AS IS"
> BASIS,
> +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
> implied.
> +# See the License for the specific language governing permissions
> and
> +# limitations under the License.
> +#
> +
> +class Entity < ActiveRecord::Base
> + belongs_to :entity_target, :polymorphic => true
> + validates_presence_of :entity_target_id
> + has_many :session_entities, :dependent => :destroy
> + has_many :permissions, :dependent => :destroy
> + has_many :derived_permissions, :dependent => :destroy
> +
> + # type-specific associations
> + belongs_to :user, :class_name => "User", :foreign_key =>
> "entity_target_id"
> + belongs_to :user_group, :class_name => "UserGroup",
> + :foreign_key => "entity_target_id"
> +
> +end
> diff --git a/src/app/models/instance.rb b/src/app/models/instance.rb
> index 472b24c..fd14406 100644
> --- a/src/app/models/instance.rb
> +++ b/src/app/models/instance.rb
> @@ -275,14 +275,14 @@ class Instance < ActiveRecord::Base
> end
> end
>
> - def self.get_user_instances_stats(user)
> + def self.get_user_instances_stats(session, user)
> stats = {
> :running_instances => 0,
> :stopped_instances => 0,
> }
>
> instances = []
> - pools = Pool.list_for_user(user, Privilege::VIEW, Instance)
> + pools = Pool.list_for_user(session, user, Privilege::VIEW,
> Instance)
> pools.each{|pool| pool.instances.each {|i| instances << i}}
> instances.each do |i|
> if i.state == Instance::STATE_RUNNING
> diff --git a/src/app/models/permission.rb
> b/src/app/models/permission.rb
> index 89b2268..048f7a5 100644
> --- a/src/app/models/permission.rb
> +++ b/src/app/models/permission.rb
> @@ -31,14 +31,14 @@
>
> class Permission < ActiveRecord::Base
> belongs_to :role
> - belongs_to :user
> + belongs_to :entity
>
> validates_presence_of :role_id
>
> - validates_presence_of :user_id
> - validates_uniqueness_of :user_id, :scope =>
> [:permission_object_id,
> -
> :permission_object_type,
> - :role_id]
> + validates_presence_of :entity_id
> + validates_uniqueness_of :entity_id, :scope =>
> [:permission_object_id,
> +
> :permission_object_type,
> + :role_id]
>
> belongs_to :permission_object, :polymorphic => true
> # type-specific associations
> @@ -67,6 +67,13 @@ class Permission < ActiveRecord::Base
>
> after_save :update_derived_permissions
>
> + def user
> + entity.user
> + end
> + def user_group
> + entity.user_group
> + end
> +
> def update_derived_permissions
> new_derived_permission_objects =
> permission_object.derived_subtree(role)
> old_derived_permissions = derived_permissions
> @@ -74,7 +81,7 @@ class Permission < ActiveRecord::Base
> if
> new_derived_permission_objects.delete(derived_perm.permission_object)
> # object is in both old and new list -- update as necessary
> derived_perm.role = role
> - derived_perm.user_id = user_id
> + derived_perm.entity_id = entity_id
> derived_perm.save!
> else
> # object is in old but not new list -- remove it
> @@ -85,7 +92,7 @@ class Permission < ActiveRecord::Base
> unless DerivedPermission.where(:permission_id => id,
> :permission_object_id =>
> perm_obj.id,
> :permission_object_type =>
> perm_obj.class.name).any?
> - derived_perm = DerivedPermission.new(:user_id => user_id,
> + derived_perm = DerivedPermission.new(:entity_id =>
> entity_id,
> :role_id => role_id,
> :permission_object =>
> perm_obj,
> :permission => self)
> diff --git a/src/app/models/permissioned_object.rb
> b/src/app/models/permissioned_object.rb
> index ecab307..4f881ee 100644
> --- a/src/app/models/permissioned_object.rb
> +++ b/src/app/models/permissioned_object.rb
> @@ -16,24 +16,30 @@
>
> module PermissionedObject
>
> - def has_privilege(user, action, target_type=nil)
> - return false if user.nil? or action.nil?
> + def has_privilege(session, user, action, target_type=nil)
> + return false if session.nil? or user.nil? or action.nil?
> target_type = self.class.default_privilege_target_type if
> target_type.nil?
> - if derived_permissions.includes(:role => :privileges).where(
> - ["derived_permissions.user_id=:user and
> + if derived_permissions.includes(:role => :privileges,
> + :entity =>
> :session_entities).where(
> + ["session_entities.user_id=:user and
> + session_entities.session_id=:session and
> privileges.target_type=:target_type and
> privileges.action=:action",
> { :user => user.id,
> + :session => session.id,
> :target_type => target_type.name,
> :action => action}]).any?
> return true
> else
> BasePermissionObject.general_permission_scope.permissions.
> - includes(:role => :privileges).where(
> - ["permissions.user_id=:user and
> + includes(:role => :privileges,
> + :entity => :session_entities).where(
> + ["session_entities.user_id=:user and
> + session_entities.session_id=:session and
> privileges.target_type=:target_type and
> privileges.action=:action",
> { :user => user.id,
> + :session => session.id,
> :target_type => target_type.name,
> :action => action}]).any?
> end
> @@ -58,7 +64,7 @@ module PermissionedObject
> perm_obj.permissions.each do |permission|
> if
> permission.role.privilege_target_match(self.class.default_privilege_target_type)
> unless old_derived_permissions.delete(permission.id)
> - derived_permissions.create(:user_id =>
> permission.user_id,
> + derived_permissions.create(:entity_id =>
> permission.entity_id,
> :role_id =>
> permission.role_id,
> :permission => permission)
> end
> @@ -81,7 +87,8 @@ module PermissionedObject
> { :assign => true,
> :scope =>
> self.class.default_privilege_target_type.name}])
> roles.each do |role|
> - Permission.create!(:role => role, :user => user,
> :permission_object => self)
> + Permission.create!(:role => role, :entity => user.entity,
> + :permission_object => self)
> end
> self.reload
> end
> @@ -106,16 +113,23 @@ module PermissionedObject
> def self.default_privilege_target_type
> self
> end
> - def self.list_for_user(user, action,
> target_type=self.default_privilege_target_type)
> - return where("1=0") if user.nil? or action.nil? or
> target_type.nil?
> - if
> BasePermissionObject.general_permission_scope.has_privilege(user,
> action, target_type)
> + def self.list_for_user(session, user, action,
> +
> target_type=self.default_privilege_target_type)
> + if session.nil? or user.nil? or action.nil? or
> target_type.nil?
> + return where("1=0")
> + end
> + if BasePermissionObject.general_permission_scope.
> + has_privilege(session, user, action, target_type)
> scoped
> else
> - includes([:derived_permissions => {:role =>
> :privileges}]).
> - where("derived_permissions.user_id=:user and
> + includes([:derived_permissions => {:role => :privileges,
> + :entity =>
> :session_entities}]).
> + where("session_entities.user_id=:user and
> + session_entities.session_id=:session and
> privileges.target_type=:target_type and
> privileges.action=:action",
> {:user => user.id,
> + :session => session.id,
> :target_type => target_type.name,
> :action => action})
> end
> diff --git a/src/app/models/pool.rb b/src/app/models/pool.rb
> index 24b4b68..1745325 100644
> --- a/src/app/models/pool.rb
> +++ b/src/app/models/pool.rb
> @@ -98,7 +98,7 @@ class Pool < ActiveRecord::Base
> end
>
> # TODO: Implement Alerts and Updates
> - def statistics(user = nil)
> + def statistics(session=nil, user = nil)
> # TODO - Need to set up cache invalidation before this is safe
> #Rails.cache.fetch("pool-#{id}-statistics") do
> max = quota.maximum_running_instances
> @@ -106,7 +106,7 @@ class Pool < ActiveRecord::Base
> avail = max - total unless max.nil?
> all_failed = instances.failed
> failed = (user.nil? || all_failed.empty? ? all_failed :
> - all_failed.list_for_user(user, Privilege::VIEW))
> + all_failed.list_for_user(session, user,
> Privilege::VIEW))
> pool_family_quota_percent = pool_family.quota.percentage_used
> quota.running_instances
> statistics = {
> :cloud_providers =>
> instances.includes(:provider_account).collect{|i|
> i.provider_account}.uniq.count,
> diff --git a/src/app/models/session_entity.rb
> b/src/app/models/session_entity.rb
> new file mode 100644
> index 0000000..e7bf869
> --- /dev/null
> +++ b/src/app/models/session_entity.rb
> @@ -0,0 +1,47 @@
> +#
> +# Copyright 2012 Red Hat, Inc.
> +#
> +# Licensed under the Apache License, Version 2.0 (the "License");
> +# you may not use this file except in compliance with the License.
> +# You may obtain a copy of the License at
> +#
> +# http://www.apache.org/licenses/LICENSE-2.0
> +#
> +# Unless required by applicable law or agreed to in writing,
> software
> +# distributed under the License is distributed on an "AS IS"
> BASIS,
> +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
> implied.
> +# See the License for the specific language governing permissions
> and
> +# limitations under the License.
> +#
> +
> +class SessionEntity < ActiveRecord::Base
> + belongs_to :user
> + belongs_to :session, :class_name =>
> "ActiveRecord::SessionStore::Session"
> + belongs_to :entity
> +
> + validates_presence_of :user_id
> + validates_presence_of :session_id
> + validates_presence_of :entity_id
> + validates_uniqueness_of :entity_id, :scope => [:user_id,
> :session_id]
> +
> + def self.update_session(session, user)
> + self.transaction do
> + # skips callbacks, which should be fine here
> + self.delete_all(:session_id => session.id)
> + self.add_to_session(session, user)
> + end
> + end
> +
> + def self.add_to_session(session, user)
> + return unless user
> + # create mapping for user-level permissions
> + SessionEntity.create!(:session => session, :user => user,
> + :entity => user.entity)
> + # create mappings for local groups
> + user.user_groups.each do |ug|
> + SessionEntity.create!(:session => session, :user => user,
> + :entity => ug.entity)
> + end
> + # TODO: add entities for ldap groups
> + end
> +end
> diff --git a/src/app/models/user.rb b/src/app/models/user.rb
> index 66565a7..6c1cfb7 100644
> --- a/src/app/models/user.rb
> +++ b/src/app/models/user.rb
> @@ -58,16 +58,21 @@ class User < ActiveRecord::Base
> # for them
> attr_accessor :ignore_password
>
> - has_many :permissions, :dependent => :destroy
> - has_many :derived_permissions, :dependent => :destroy
> + has_many :permissions, :through => :entity
> + has_many :derived_permissions, :through => :entities
> has_many :owned_instances, :class_name => "Instance", :foreign_key
> => "owner_id"
> has_many :deployments, :foreign_key => "owner_id"
> has_many :view_states
> + has_and_belongs_to_many :user_groups, :join_table =>
> "members_user_groups",
> + :foreign_key => "member_id"
> + has_one :entity, :as => :entity_target, :dependent => :destroy
> + has_many :session_entities, :dependent => :destroy
>
> belongs_to :quota, :autosave => true, :dependent => :destroy
> accepts_nested_attributes_for :quota
>
> before_validation :strip_whitespace
> + after_save :update_entity
>
> validates_presence_of :quota
> validates_length_of :first_name, :maximum => 255, :allow_blank =>
> true
> @@ -161,4 +166,10 @@ class User < ActiveRecord::Base
> def strip_whitespace
> self.login = self.login.strip unless self.login.nil?
> end
> +
> + def update_entity
> + self.entity = Entity.new(:entity_target => self) unless
> self.entity
> + self.entity.name = "#{self.first_name} #{self.last_name}
> (#{self.login})"
> + self.entity.save!
> + end
> end
> diff --git a/src/app/models/user_group.rb
> b/src/app/models/user_group.rb
> new file mode 100644
> index 0000000..293d0db
> --- /dev/null
> +++ b/src/app/models/user_group.rb
> @@ -0,0 +1,45 @@
> +#
> +# Copyright 2012 Red Hat, Inc.
> +#
> +# Licensed under the Apache License, Version 2.0 (the "License");
> +# you may not use this file except in compliance with the License.
> +# You may obtain a copy of the License at
> +#
> +# http://www.apache.org/licenses/LICENSE-2.0
> +#
> +# Unless required by applicable law or agreed to in writing,
> software
> +# distributed under the License is distributed on an "AS IS"
> BASIS,
> +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
> implied.
> +# See the License for the specific language governing permissions
> and
> +# limitations under the License.
> +#
> +
> +class UserGroup < ActiveRecord::Base
> + # name will correspond to the group name if we're using LDAP,
> otherwise it's
> + # entered by the admin creating the group
> +
> + # members association is only maintained for local groups
> + has_and_belongs_to_many :members, :join_table =>
> "members_user_groups",
> + :class_name => "User",
> + :association_foreign_key =>
> "member_id"
> + has_one :entity, :as => :entity_target, :dependent => :destroy
> +
> + MEMBERSHIP_SOURCE_LDAP = "LDAP"
> + MEMBERSHIP_SOURCE_LOCAL = "local"
> + MEMBERSHIP_SOURCES = [MEMBERSHIP_SOURCE_LOCAL,
> MEMBERSHIP_SOURCE_LDAP]
> +
> + validates_presence_of :name
> + # scope name by membership_source to prevent errors if users are
> later added
> + # to external ldap groups that have the same name as local groups
> + validates_uniqueness_of :name, :scope => :membership_source
> +
> + validates_presence_of :membership_source
> + validates_inclusion_of :membership_source, :in =>
> MEMBERSHIP_SOURCES
> + after_save :update_entity
> +
> + def update_entity
> + self.entity = Entity.new(:entity_target => self) unless
> self.entity
> + self.entity.name = "#{self.name} (#{self.membership_source})"
> + self.entity.save!
> + end
> +end
> diff --git a/src/app/services/application_service.rb
> b/src/app/services/application_service.rb
> index 94c8011..e8490b5 100644
> --- a/src/app/services/application_service.rb
> +++ b/src/app/services/application_service.rb
> @@ -45,7 +45,7 @@ module ApplicationService
> end
> perm_obj=@perm_obj if perm_obj.nil?
> perm_obj=BasePermissionObject.general_permission_scope if
> perm_obj.nil?
> - perm_obj.has_privilege(current_user, action, target_type)
> + perm_obj.has_privilege(current_session, current_user, action,
> target_type)
> end
>
> # Require a given privilege level to view this page
> diff --git a/src/app/services/registration_service.rb
> b/src/app/services/registration_service.rb
> index d67ab0d..a4753f9 100644
> --- a/src/app/services/registration_service.rb
> +++ b/src/app/services/registration_service.rb
> @@ -39,7 +39,7 @@ class RegistrationService
> obj_key, role_key = x.split(/, ?/)
> default_obj = MetadataObject.lookup(obj_key)
> default_role = MetadataObject.lookup(role_key)
> - Permission.create!(:user => @user, :role =>
> default_role, :permission_object => default_obj)
> + Permission.create!(:entity => @user.entity, :role =>
> default_role, :permission_object => default_obj)
> end
> return true
> rescue ActiveRecord::RecordInvalid => e
> diff --git a/src/app/views/permissions/_form.html.haml
> b/src/app/views/permissions/_form.html.haml
> index 6027f39..95aa05d 100644
> --- a/src/app/views/permissions/_form.html.haml
> +++ b/src/app/views/permissions/_form.html.haml
> @@ -5,12 +5,10 @@
> = hidden_field_tag :use_tabs, @use_tabs
> = link_to t('cancel'), @return_path, :class => 'button danger'
> = restful_submit_tag t('permissions.form.grant_access'), "create",
> permissions_path, 'POST', :id => 'save_button', :class =>
> 'button'
> -= filter_table(@header, @users) do |user|
> += filter_table(@header, @entities) do |entity|
> %tr{:class => cycle('nostripe','stripe')}
> %td
> -# - selected = params[:select] == 'all'
> - -# = check_box_tag "user_selected[]", user.id, selected, :id
> => "user_checkbox_#{user.id}"
> - %td= link_to user.login, user_path(user)
> - %td= user.last_name
> - %td= user.first_name
> - %td= select_tag "user_role_selected[]", options_for_select([['',
> "#{user.id},"]] + @roles.map {|r| [t(r.name, :scope=> :role_defs,
> :default => r.name), "#{user.id},#{r.id}" ] }, :disabled =>
> @permission_object.permissions.where(:user_id=>user.id).collect {|p|
> "#{user.id},#{p.role.id}"}), :id => "user_role_selected_#{user.id}"
> + -# = check_box_tag "entity_selected[]", entity.id, selected,
> :id => "entity_checkbox_#{entity.id}"
> + %td= link_to entity.name, (entity.user ? user_path(entity.user)
> : user_group_path(entity.user_group))
> + %td= select_tag "entity_role_selected[]",
> options_for_select([['', "#{entity.id},"]] + @roles.map {|r|
> [t(r.name, :scope=> :role_defs, :default => r.name),
> "#{entity.id},#{r.id}" ] }, :disabled =>
> @permission_object.permissions.where(:entity_id=>entity.id).collect
> {|p| "#{entity.id},#{p.role.id}"}), :id =>
> "entity_role_selected_#{entity.id}"
> diff --git a/src/app/views/permissions/_permissions.html.haml
> b/src/app/views/permissions/_permissions.html.haml
> index 1ace6c8..b1e18f7 100644
> --- a/src/app/views/permissions/_permissions.html.haml
> +++ b/src/app/views/permissions/_permissions.html.haml
> @@ -34,11 +34,9 @@
> - if check_privilege(Privilege::PERM_SET)
> - selected = params[:select] == 'all'
> = check_box_tag "permission_selected[]", permission.id,
> selected, :id => "permission_checkbox_#{permission.id}"
> - %td= link_to permission.user.login, user_path(permission.user)
> - %td= permission.user.last_name
> - %td= permission.user.first_name
> + %td= link_to permission.entity.name, (permission.entity.user ?
> user_path(permission.entity.user) :
> user_group_path(permission.entity.user_group))
> - if not(@show_inherited or @show_global) &&
> check_privilege(Privilege::PERM_SET)
> - %td= select_tag "permission_role_selected[]",
> options_for_select(@roles.map {|r| [ t(r.name, :scope=> :role_defs,
> :default => r.name), "#{permission.id},#{r.id}" ] }, :selected =>
> "#{permission.id},#{permission.role.id}", :disabled =>
> @permission_object.permissions.where(["user_id = ? and role_id !=
> ?", permission.user_id, permission.role_id]).collect {|p|
> "#{permission.id},#{p.role.id}"}), :id =>
> "permission_role_selected_#{permission.id}"
> + %td= select_tag "permission_role_selected[]",
> options_for_select(@roles.map {|r| [ t(r.name, :scope=> :role_defs,
> :default => r.name), "#{permission.id},#{r.id}" ] }, :selected =>
> "#{permission.id},#{permission.role.id}", :disabled =>
> @permission_object.permissions.where(["entity_id = ? and role_id !=
> ?", permission.entity_id, permission.role_id]).collect {|p|
> "#{permission.id},#{p.role.id}"}), :id =>
> "permission_role_selected_#{permission.id}"
> :javascript
> $("#permission_role_selected_#{permission.id}").change(function
> () { $("#perm_edit_button").click(); } );
>
> diff --git a/src/app/views/pools/_pretty_list.html.haml
> b/src/app/views/pools/_pretty_list.html.haml
> index 7061af6..4e16b69 100644
> --- a/src/app/views/pools/_pretty_list.html.haml
> +++ b/src/app/views/pools/_pretty_list.html.haml
> @@ -7,7 +7,7 @@
> %header{:class => "pool-header-#{pool.id}"}
> = render :partial => 'pretty_list_header', :mustache =>
> pool_for_mustache(pool)
> %div.content
> - - deployments =
> paginate_collection(pool.deployments.includes(:owner, :pool,
> :instances, :events).list_for_user(current_user,
> Privilege::VIEW).ascending_by_name, params[:page], PER_PAGE)
> + - deployments =
> paginate_collection(pool.deployments.includes(:owner, :pool,
> :instances, :events).list_for_user(current_session, current_user,
> Privilege::VIEW).ascending_by_name, params[:page], PER_PAGE)
> = render :partial => 'deployments', :locals => {:pool =>
> pool, :deployments => deployments}
> %ul.content.actions
> %li
> diff --git a/src/config/initializers/session.rb
> b/src/config/initializers/session.rb
> new file mode 100644
> index 0000000..6d82968
> --- /dev/null
> +++ b/src/config/initializers/session.rb
> @@ -0,0 +1,23 @@
> +#
> +# Copyright 2012 Red Hat, Inc.
> +#
> +# Licensed under the Apache License, Version 2.0 (the "License");
> +# you may not use this file except in compliance with the License.
> +# You may obtain a copy of the License at
> +#
> +# http://www.apache.org/licenses/LICENSE-2.0
> +#
> +# Unless required by applicable law or agreed to in writing,
> software
> +# distributed under the License is distributed on an "AS IS"
> BASIS,
> +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
> implied.
> +# See the License for the specific language governing permissions
> and
> +# limitations under the License.
> +#
> +
> +module ActiveRecord
> + class SessionStore
> + class Session
> + has_many :session_entities, :dependent => :destroy
> + end
> + end
> +end
> diff --git a/src/config/initializers/warden.rb
> b/src/config/initializers/warden.rb
> index 37ff2ad..80751ad 100644
> --- a/src/config/initializers/warden.rb
> +++ b/src/config/initializers/warden.rb
> @@ -29,7 +29,7 @@ Rails.configuration.middleware.use
> RailsWarden::Manager do |config|
> config.scope_defaults(
> :api,
> :strategies => [SETTINGS_CONFIG[:auth][:strategy].to_sym],
> - :store => false,
> + :store => true,
> :action => 'unauthenticated'
> )
> end
> diff --git a/src/config/locales/en.yml b/src/config/locales/en.yml
> index b198935..dda1b0f 100644
> --- a/src/config/locales/en.yml
> +++ b/src/config/locales/en.yml
> @@ -1247,6 +1247,7 @@ en:
> inherited_access: "Inherited Access"
> inherited_from: "Inherited From"
> revoke_access: "Revoke Access"
> + name: Name
> form:
> grant_access: Grant Access
> new:
> diff --git a/src/db/migrate/20110207101100_deployment_roles.rb
> b/src/db/migrate/20110207101100_deployment_roles.rb
> deleted file mode 100644
> index 8c1f18f..0000000
> --- a/src/db/migrate/20110207101100_deployment_roles.rb
> +++ /dev/null
> @@ -1,80 +0,0 @@
> -#
> -# Copyright 2011 Red Hat, Inc.
> -#
> -# Licensed under the Apache License, Version 2.0 (the "License");
> -# you may not use this file except in compliance with the License.
> -# You may obtain a copy of the License at
> -#
> -# http://www.apache.org/licenses/LICENSE-2.0
> -#
> -# Unless required by applicable law or agreed to in writing,
> software
> -# distributed under the License is distributed on an "AS IS"
> BASIS,
> -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
> implied.
> -# See the License for the specific language governing permissions
> and
> -# limitations under the License.
> -#
> -
> -class DeploymentRoles < ActiveRecord::Migration
> - VIEW = "view"
> - USE = "use"
> - MOD = "modify"
> - CRE = "create"
> - VPRM = "view_perms"
> - GPRM = "set_perms"
> - NEW_ROLES = {
> - Deployment =>
> - {"Deployment Controller" => [false, {Deployment => [VIEW,USE],
> - Instance => [VIEW]}],
> - "Deployment Owner" => [true, {Deployment =>
> [VIEW,USE,MOD, VPRM,GPRM],
> - Instance =>
> [VIEW,USE,MOD]}]},
> - Pool =>
> - {"Pool User" => [false, {Pool => [VIEW],
> - Instance => [
> CRE],
> - Deployment => [
> CRE],
> - Quota => [VIEW]}],
> - "Pool Owner" => [true, {Pool => [VIEW,
> MOD, VPRM,GPRM],
> - Instance =>
> [VIEW,USE,MOD,CRE],
> - Deployment =>
> [VIEW,USE,MOD,CRE],
> - Quota =>
> [VIEW]}]},
> - BasePermissionObject =>
> - {"Pool Administrator" => [false, {Pool => [VIEW,
> MOD,CRE,VPRM,GPRM],
> - Instance =>
> [VIEW,USE,MOD,CRE,VPRM,GPRM],
> - Deployment =>
> [VIEW,USE,MOD,CRE,VPRM,GPRM],
> - Quota => [VIEW,
> MOD],
> - PoolFamily => [VIEW,
> MOD,CRE,VPRM,GPRM]}],
> - "Administrator" => [false, {Provider => [VIEW,
> MOD,CRE,VPRM,GPRM],
> - ProviderAccount =>
> [VIEW,USE,MOD,CRE,VPRM,GPRM],
> - HardwareProfile => [
> MOD,CRE,VPRM,GPRM],
> - Realm => [
> USE,MOD,CRE,VPRM,GPRM],
> - User => [VIEW,
> MOD,CRE],
> - Pool => [VIEW,
> MOD,CRE,VPRM,GPRM],
> - Instance =>
> [VIEW,USE,MOD,CRE,VPRM,GPRM],
> - Deployment =>
> [VIEW,USE,MOD,CRE,VPRM,GPRM],
> - Quota => [VIEW,
> MOD],
> - PoolFamily => [VIEW,
> MOD,CRE,VPRM,GPRM],
> - BasePermissionObject => [
> MOD, VPRM,GPRM]}]}}
> - def self.up
> - unless Role.all.size == 0
> - Role.transaction do
> - NEW_ROLES.each do |role_scope, scoped_hash|
> - scoped_hash.each do |role_name, role_def|
> - role = Role.find_or_initialize_by_name(role_name)
> - role.update_attributes({:name => role_name, :scope =>
> role_scope.name,
> - :assign_to_owner =>
> role_def[0]})
> - role.privileges = {}
> - role.save!
> - role_def[1].each do |priv_type, priv_actions|
> - priv_actions.each do |action|
> - Privilege.create!(:role => role, :target_type =>
> priv_type.name,
> - :action => action)
> - end
> - end
> - end
> - end
> - end
> - end
> - end
> -
> - def self.down
> - end
> -end
> diff --git a/src/db/migrate/20111122203000_add_deployable_roles.rb
> b/src/db/migrate/20111122203000_add_deployable_roles.rb
> deleted file mode 100644
> index 80911e9..0000000
> --- a/src/db/migrate/20111122203000_add_deployable_roles.rb
> +++ /dev/null
> @@ -1,82 +0,0 @@
> -#
> -# Copyright 2011 Red Hat, Inc.
> -#
> -# Licensed under the Apache License, Version 2.0 (the "License");
> -# you may not use this file except in compliance with the License.
> -# You may obtain a copy of the License at
> -#
> -# http://www.apache.org/licenses/LICENSE-2.0
> -#
> -# Unless required by applicable law or agreed to in writing,
> software
> -# distributed under the License is distributed on an "AS IS"
> BASIS,
> -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
> implied.
> -# See the License for the specific language governing permissions
> and
> -# limitations under the License.
> -#
> -
> -class AddDeployableRoles < ActiveRecord::Migration
> - VIEW = "view"
> - USE = "use"
> - MOD = "modify"
> - CRE = "create"
> - VPRM = "view_perms"
> - GPRM = "set_perms"
> - NEW_ROLES = {
> - Deployable =>
> - {"Deployable User" => [false, {Deployable =>
> [VIEW,USE]},
> - "CatalogEntry User"],
> - "Deployable Owner" => [true, {Deployable =>
> [VIEW,USE,MOD,VPRM,GPRM]},
> - "CatalogEntry Owner"]},
> - BasePermissionObject =>
> - {"Deployable Administrator" => [false, {Deployable =>
> [VIEW,USE,MOD,CRE,VPRM,GPRM]},
> - "CatalogEntry Administrator"],
> - "Deployable Global User" => [false, {Deployable=>
> [VIEW,USE]},
> - "CatalogEntry Global User"],
> - "Administrator" => [false, {Provider => [VIEW,
> MOD,CRE,VPRM,GPRM],
> - ProviderAccount =>
> [VIEW,USE,MOD,CRE,VPRM,GPRM],
> - HardwareProfile => [VIEW,
> MOD,CRE,VPRM,GPRM],
> - Realm => [
> USE,MOD,CRE,VPRM,GPRM],
> - User => [VIEW,
> MOD,CRE],
> - Pool => [VIEW,
> MOD,CRE,VPRM,GPRM],
> - Instance =>
> [VIEW,USE,MOD,CRE,VPRM,GPRM],
> - Deployment =>
> [VIEW,USE,MOD,CRE,VPRM,GPRM],
> - Quota => [VIEW,
> MOD],
> - PoolFamily => [VIEW,
> MOD,CRE,VPRM,GPRM],
> - Catalog =>
> [VIEW,USE,MOD,CRE,VPRM,GPRM],
> - Deployable =>
> [VIEW,USE,MOD,CRE,VPRM,GPRM],
> - BasePermissionObject => [
> MOD, VPRM,GPRM]}]}}
> - def self.up
> - unless Role.all.size == 0
> - Role.transaction do
> - NEW_ROLES.each do |role_scope, scoped_hash|
> - scoped_hash.each do |role_name, role_def|
> - role = Role.find_or_initialize_by_name(role_def[2] ?
> role_def[2] : role_name)
> - role.update_attributes({:name => role_name, :scope =>
> role_scope.name,
> - :assign_to_owner =>
> role_def[0]})
> - role.privileges = {}
> - role.save!
> - role_def[1].each do |priv_type, priv_actions|
> - priv_actions.each do |action|
> - Privilege.create!(:role => role, :target_type =>
> priv_type.name,
> - :action => action)
> - end
> - end
> - end
> - end
> -
> -
> MetadataObject.remove("self_service_default_catalog_entry_obj")
> -
> MetadataObject.remove("self_service_default_catalog_entry_role")
> - MetadataObject.set("self_service_default_deployable_obj",
> -
> BasePermissionObject.general_permission_scope)
> - MetadataObject.set("self_service_default_deployable_role",
> - Role.find_by_name("Deployable Global
> User"))
> - MetadataObject.set("self_service_perms_list",
> -
> "[self_service_default_pool,self_service_default_role],
> [self_service_default_deployable_obj,self_service_default_deployable_role],
> [self_service_default_pool_global_user_obj,self_service_default_pool_global_user_role],
> [self_service_default_catalog_global_user_obj,self_service_default_catalog_global_user_role],[self_service_default_hwp_global_user_obj,self_service_default_hwp_global_user_role]
> ")
> -
> - end
> - end
> - end
> -
> - def self.down
> - end
> -end
> diff --git a/src/db/migrate/20120514121500_create_user_groups.rb
> b/src/db/migrate/20120514121500_create_user_groups.rb
> new file mode 100644
> index 0000000..abd32c4
> --- /dev/null
> +++ b/src/db/migrate/20120514121500_create_user_groups.rb
> @@ -0,0 +1,37 @@
> +#
> +# Copyright 2012 Red Hat, Inc.
> +#
> +# Licensed under the Apache License, Version 2.0 (the "License");
> +# you may not use this file except in compliance with the License.
> +# You may obtain a copy of the License at
> +#
> +# http://www.apache.org/licenses/LICENSE-2.0
> +#
> +# Unless required by applicable law or agreed to in writing,
> software
> +# distributed under the License is distributed on an "AS IS"
> BASIS,
> +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
> implied.
> +# See the License for the specific language governing permissions
> and
> +# limitations under the License.
> +#
> +class CreateUserGroups < ActiveRecord::Migration
> + def self.up
> + create_table :user_groups do |t|
> + t.string :name, :null => false
> + t.string :description
> + # membership_source will be 'ldap' or 'local'
> + t.string :membership_source, :null => false
> + t.integer :lock_version, :default => 0
> +
> + t.timestamps
> + end
> + create_table :members_user_groups, :id => false do |t|
> + t.integer :user_group_id, :null => false
> + t.integer :member_id, :null => false
> + end
> + end
> +
> + def self.down
> + drop_table :members_user_groups
> + drop_table :user_groups
> + end
> +end
> diff --git a/src/db/migrate/20120514131500_create_entities.rb
> b/src/db/migrate/20120514131500_create_entities.rb
> new file mode 100644
> index 0000000..1270ffe
> --- /dev/null
> +++ b/src/db/migrate/20120514131500_create_entities.rb
> @@ -0,0 +1,38 @@
> +#
> +# Copyright 2012 Red Hat, Inc.
> +#
> +# Licensed under the Apache License, Version 2.0 (the "License");
> +# you may not use this file except in compliance with the License.
> +# You may obtain a copy of the License at
> +#
> +# http://www.apache.org/licenses/LICENSE-2.0
> +#
> +# Unless required by applicable law or agreed to in writing,
> software
> +# distributed under the License is distributed on an "AS IS"
> BASIS,
> +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
> implied.
> +# See the License for the specific language governing permissions
> and
> +# limitations under the License.
> +#
> +class CreateEntities < ActiveRecord::Migration
> + def self.up
> + create_table :entities do |t|
> + t.string :name
> + t.references :entity_target, :polymorphic => true, :null =>
> false
> +
> + t.integer :lock_version, :default => 0
> +
> + t.timestamps
> + end
> +
> + User.all.each do |u|
> + u.save!
> + end
> + UserGroup.all.each do |ug|
> + ug.save!
> + end
> + end
> +
> + def self.down
> + drop_table :entities
> + end
> +end
> diff --git a/src/db/migrate/20120517131500_create_session_entities.rb
> b/src/db/migrate/20120517131500_create_session_entities.rb
> new file mode 100644
> index 0000000..0180018
> --- /dev/null
> +++ b/src/db/migrate/20120517131500_create_session_entities.rb
> @@ -0,0 +1,32 @@
> +#
> +# Copyright 2012 Red Hat, Inc.
> +#
> +# Licensed under the Apache License, Version 2.0 (the "License");
> +# you may not use this file except in compliance with the License.
> +# You may obtain a copy of the License at
> +#
> +# http://www.apache.org/licenses/LICENSE-2.0
> +#
> +# Unless required by applicable law or agreed to in writing,
> software
> +# distributed under the License is distributed on an "AS IS"
> BASIS,
> +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
> implied.
> +# See the License for the specific language governing permissions
> and
> +# limitations under the License.
> +#
> +class CreateSessionEntities < ActiveRecord::Migration
> + def self.up
> + create_table :session_entities do |t|
> + t.references :user, :null => false
> + t.references :session, :null => false
> + t.references :entity, :null => false
> +
> + t.integer :lock_version, :default => 0
> +
> + t.timestamps
> + end
> + end
> +
> + def self.down
> + drop_table :session_entities
> + end
> +end
> diff --git a/src/db/migrate/20120520151500_change_permission_user.rb
> b/src/db/migrate/20120520151500_change_permission_user.rb
> new file mode 100644
> index 0000000..d6af52b
> --- /dev/null
> +++ b/src/db/migrate/20120520151500_change_permission_user.rb
> @@ -0,0 +1,79 @@
> +#
> +# Copyright 2012 Red Hat, Inc.
> +#
> +# Licensed under the Apache License, Version 2.0 (the "License");
> +# you may not use this file except in compliance with the License.
> +# You may obtain a copy of the License at
> +#
> +# http://www.apache.org/licenses/LICENSE-2.0
> +#
> +# Unless required by applicable law or agreed to in writing,
> software
> +# distributed under the License is distributed on an "AS IS"
> BASIS,
> +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
> implied.
> +# See the License for the specific language governing permissions
> and
> +# limitations under the License.
> +#
> +
> +class ChangePermissionUser < ActiveRecord::Migration
> + def self.up
> + add_column :permissions, :entity_id, :integer
> + add_column :derived_permissions, :entity_id, :integer
> +
> + Permission.reset_column_information
> + DerivedPermission.reset_column_information
> +
> + Permission.skip_callback(:save, :after,
> :update_derived_permissions)
> + counter = 0
> + total_perms = Permission.count
> + Permission.all.each do |p|
> + puts "updating permission #{counter +=1} of #{total_perms}"
> + p.entity_id = User.find(p.user_id).entity.id
> + p.save!
> + end
> + Permission.set_callback(:save, :after,
> :update_derived_permissions)
> + counter = 0
> + total_perms = DerivedPermission.count
> + DerivedPermission.all.each do |p|
> + puts "updating derived permission #{counter +=1} of
> #{total_perms}"
> + p.entity_id = User.find(p.user_id).entity.id
> + p.save!
> + end
> +
> + change_column :permissions, :entity_id, :integer, :null => false
> + change_column :derived_permissions, :entity_id, :integer, :null
> => false
> +
> + remove_column :permissions, :user_id
> + remove_column :derived_permissions, :user_id
> + end
> +
> + def self.down
> + add_column :permissions, :user_id, :integer
> + add_column :derived_permissions, :user_id, :integer
> +
> + Permission.reset_column_information
> + DerivedPermission.reset_column_information
> +
> + Permission.skip_callback(:save, :after,
> :update_derived_permissions)
> + Permission.all.each do |p|
> + entity = Entity.find(p.entity_id)
> + if entity.entity_target.class == User
> + p.user_id = entity.entity_target.id
> + p.save!
> + end
> + end
> + Permission.set_callback(:save, :after,
> :update_derived_permissions)
> + DerivedPermission.all.each do |p|
> + entity = Entity.find(p.entity_id)
> + if entity.entity_target.class == User
> + p.user_id = entity.entity_target.id
> + p.save!
> + end
> + end
> +
> + change_column :permissions, :user_id, :integer, :null => false
> + change_column :derived_permissions, :user_id, :integer, :null =>
> false
> +
> + remove_column :permissions, :entity_id
> + remove_column :derived_permissions, :entity_id
> + end
> +end
> diff --git a/src/features/step_definitions/authentication.rb
> b/src/features/step_definitions/authentication.rb
> index 533966a..1556400 100644
> --- a/src/features/step_definitions/authentication.rb
> +++ b/src/features/step_definitions/authentication.rb
> @@ -45,8 +45,9 @@ Given /^I am a registered user$/ do
> end
>
> Given /^I am an authorised user$/ do
> - @admin_permission = FactoryGirl.create :admin_permission
> - @user = @admin_permission.user
> + @admin_user = FactoryGirl.create :admin_user
> + @user = @admin_user
> + @admin_permission = FactoryGirl.create :admin_permission, :entity
> => @user.entity
> end
>
>
> @@ -55,8 +56,7 @@ When /^I login$/ do
> end
>
> When /^I login as authorised user$/ do
> - admin_user = @admin_permission.user
> - login(admin_user.login, admin_user.password)
> + login(@admin_user.login, @admin_user.password)
> page.should have_content('Login successful!')
> end
>
> @@ -67,6 +67,7 @@ end
> Given /^I am logged in$/ do
> # Warden test helper method
> login_as user
> + visit path_to("the homepage")
> end
>
> Given /^I have successfully logged in$/ do
> diff --git a/src/features/step_definitions/permission_steps.rb
> b/src/features/step_definitions/permission_steps.rb
> index 43d3ac1..8620156 100644
> --- a/src/features/step_definitions/permission_steps.rb
> +++ b/src/features/step_definitions/permission_steps.rb
> @@ -18,7 +18,7 @@ Given /^a user "([^\"]*)" exists$/ do |login|
> end
>
> Given /^there is not a permission for the user "([^\"]*)"$/ do
> |login|
> - Permission.first(:include => 'user', :conditions => ['users.login
> = ?', login]).should be_nil
> + Permission.first(:include => ['entity' => ['session_entities' =>
> 'user']], :conditions => ['users.login = ?', login]).should be_nil
> end
>
> Given /^there is a permission for the user "([^\"]*)"$/ do |login|
> @@ -26,12 +26,12 @@ Given /^there is a permission for the user
> "([^\"]*)"$/ do |login|
> end
>
> Given /^there is a permission for the user "([^\"]*)" on the pool
> "([^\"]*)"$/ do |login, pool_name|
> - @pool_user_permission = FactoryGirl.create(:pool_user_permission,
> :user_id => @user.id,
> + @pool_user_permission = FactoryGirl.create(:pool_user_permission,
> :entity_id => @user.entity.id,
> :permission_object =>
> Pool.find_by_name(pool_name))
> end
>
> Given /^there is a permission for the user "([^\"]*)" on the pool
> family "([^\"]*)"$/ do |login, pool_family_name|
> - @pool_family_admin_permission =
> FactoryGirl.create(:pool_family_admin_permission, :user_id =>
> @user.id,
> + @pool_family_admin_permission =
> FactoryGirl.create(:pool_family_admin_permission, :entity_id =>
> @user.entity.id,
> :permission_object =>
> PoolFamily.find_by_name(pool_family_name))
> end
>
> @@ -42,5 +42,5 @@ end
>
> When /^(?:|I )select "([^"]*)" role for the user "([^"]*)"$/ do
> |role_name, user_name|
> user = User.find_by_login(user_name)
> - select(role_name, :from => "user_role_selected_#{user.id}")
> + select(role_name, :from =>
> "entity_role_selected_#{user.entity.id}")
> end
> diff --git a/src/features/step_definitions/pool_family_steps.rb
> b/src/features/step_definitions/pool_family_steps.rb
> index dc316ab..dcbb869 100644
> --- a/src/features/step_definitions/pool_family_steps.rb
> +++ b/src/features/step_definitions/pool_family_steps.rb
> @@ -74,5 +74,5 @@ end
>
> Given /^I can view pool family "([^"]*)"$/ do |arg1|
> pool_family = PoolFamily.find_by_name(arg1) ||
> FactoryGirl.create(:pool_family, :name => arg1)
> - perm = FactoryGirl.create(:pool_family_user_permission,
> :permission_object => pool_family, :user => @user)
> + perm = FactoryGirl.create(:pool_family_user_permission,
> :permission_object => pool_family, :entity => @user.entity)
> end
> diff --git a/src/features/step_definitions/pool_steps.rb
> b/src/features/step_definitions/pool_steps.rb
> index 8e73121..f575dc2 100644
> --- a/src/features/step_definitions/pool_steps.rb
> +++ b/src/features/step_definitions/pool_steps.rb
> @@ -15,7 +15,7 @@
> #
> Given /^I have Pool Creator permissions on a pool named "([^\"]*)"$/
> do |name|
> @pool = FactoryGirl.create(:pool, :name => name)
> - FactoryGirl.create(:pool_creator_permission, :user => @user,
> :permission_object => @pool)
> + FactoryGirl.create(:pool_creator_permission, :entity =>
> @user.entity, :permission_object => @pool)
> end
>
> Then /^there should be (\d+) pools$/ do |number|
> diff --git a/src/lib/tasks/dc_tasks.rake
> b/src/lib/tasks/dc_tasks.rake
> index 083e3e8..b3581c0 100644
> --- a/src/lib/tasks/dc_tasks.rake
> +++ b/src/lib/tasks/dc_tasks.rake
> @@ -95,7 +95,7 @@ namespace :dc do
> end
> permission = Permission.new(:role =>
> Role.find_by_name('base.admin'),
> :permission_object =>
> BasePermissionObject.general_permission_scope,
> - :user => user)
> + :entity => user.entity)
> if permission.save
> puts "Granting administrator privileges for #{args.login}..."
> else
> diff --git a/src/spec/controllers/config_servers_controller_spec.rb
> b/src/spec/controllers/config_servers_controller_spec.rb
> index 53b89df..65d5de0 100644
> --- a/src/spec/controllers/config_servers_controller_spec.rb
> +++ b/src/spec/controllers/config_servers_controller_spec.rb
> @@ -28,7 +28,7 @@ describe ConfigServersController do
> @provider_account = @config_server.provider_account
> @admin_permission = Permission.create :role =>
> Role.find(:first, :conditions => ['name = ?',
> 'base.provider.admin']),
> :permission_object =>
> @provider_account.provider,
> - :user =>
> FactoryGirl.create(:provider_admin_user)
> + :entity =>
> FactoryGirl.create(:provider_admin_user).entity
> @admin = @admin_permission.user
> end
>
> @@ -51,7 +51,7 @@ describe ConfigServersController do
> @provider_account = Factory :mock_provider_account
> @admin_permission = Permission.create :role =>
> Role.find(:first, :conditions => ['name = ?',
> 'base.provider.admin']),
> :permission_object =>
> @provider_account.provider,
> - :user =>
> FactoryGirl.create(:provider_admin_user)
> + :entity =>
> FactoryGirl.create(:provider_admin_user).entity
> @admin = @admin_permission.user
> end
>
> diff --git a/src/spec/controllers/permissions_controller_spec.rb
> b/src/spec/controllers/permissions_controller_spec.rb
> index 050fdf8..95dad2c 100644
> --- a/src/spec/controllers/permissions_controller_spec.rb
> +++ b/src/spec/controllers/permissions_controller_spec.rb
> @@ -31,7 +31,7 @@ describe PermissionsController do
>
> @old_role = FactoryGirl.create(:role)
> @new_role = FactoryGirl.create(:role)
> - @permission = FactoryGirl.create(:permission, :user => @admin,
> :role => @old_role, :permission_object => @deployable)
> + @permission = FactoryGirl.create(:permission, :entity =>
> @admin.entity, :role => @old_role, :permission_object =>
> @deployable)
>
> post :multi_update, :permission_object_id => @deployable.id,
> :permission_object_type => @deployable.class.to_s,
> :permission_role_selected =>
> ["#{@permission.id},#{@new_role.id}"],
> :polymorphic_path_extras => { 'catalog_id' => @catalog.id}
> diff --git
> a/src/spec/controllers/provider_accounts_controller_spec.rb
> b/src/spec/controllers/provider_accounts_controller_spec.rb
> index a875938..fe0ad13 100644
> --- a/src/spec/controllers/provider_accounts_controller_spec.rb
> +++ b/src/spec/controllers/provider_accounts_controller_spec.rb
> @@ -26,7 +26,7 @@ describe ProviderAccountsController do
>
> @admin_permission = Permission.create :role => Role.find(:first,
> :conditions => ['name = ?', 'base.provider.admin']),
> :permission_object =>
> @provider,
> - :user =>
> FactoryGirl.create(:provider_admin_user)
> + :entity =>
> FactoryGirl.create(:provider_admin_user).entity
> @admin = @admin_permission.user
> end
>
> diff --git a/src/spec/factories/permission.rb
> b/src/spec/factories/permission.rb
> index ef2005e..e401fe8 100644
> --- a/src/spec/factories/permission.rb
> +++ b/src/spec/factories/permission.rb
> @@ -17,49 +17,49 @@
> FactoryGirl.define do
>
> factory :permission do
> - after_build { |p| p.user.permissions << p }
> + after_build { |p| p.entity.permissions << p }
> end
>
> factory :admin_permission, :parent => :permission do
> role { |r| Role.first(:conditions => ['name = ?', 'base.admin'])
> || FactoryGirl.create(:role, :name => 'base.admin') }
> permission_object { |r|
> BasePermissionObject.general_permission_scope }
> - user { |r| r.association(:admin_user) }
> + entity { |r| FactoryGirl.create(:admin_user).entity }
> end
>
> factory :provider_admin_permission, :parent => :permission do
> role { |r| Role.first(:conditions => ['name = ?',
> 'base.provider.admin']) || FactoryGirl.create(:role, :name =>
> 'base.provider.admin') }
> permission_object { |r| r.association(:mock_provider) }
> - user { |r| r.association(:provider_admin_user) }
> + entity { |r| FactoryGirl.create(:provider_admin_user).entity }
> end
>
> factory :pool_creator_permission, :parent => :permission do
> role { |r| Role.first(:conditions => ['name = ?',
> 'base.pool.creator']) || FactoryGirl.create(:role, :name =>
> 'base.pool.creator') }
> permission_object { |r|
> BasePermissionObject.general_permission_scope }
> - user { |r| r.association(:pool_creator_user) }
> + entity { |r| FactoryGirl.create(:pool_creator_user).entity }
> end
>
> factory :pool_user_permission, :parent => :permission do
> role { |r| Role.first(:conditions => ['name = ?', 'pool.user'])
> || FactoryGirl.create(:role, :name => 'pool.user') }
> permission_object { |r| r.association(:pool) }
> - user { |r| r.association(:pool_user) }
> + entity { |r| FactoryGirl.create(:pool_user).entity }
> end
>
> factory :pool_user2_permission, :parent => :permission do
> role { |r| Role.first(:conditions => ['name = ?', 'pool.user'])
> || FactoryGirl.create(:role, :name => 'pool.user') }
> permission_object { |r| r.association(:pool) }
> - user { |r| r.association(:pool_user2) }
> + entity { |r| FactoryGirl.create(:pool_user2).entity }
> end
>
> factory :pool_family_user_permission, :parent => :permission do
> role { |r| Role.first(:conditions => ['name = ?',
> 'pool_family.user']) || FactoryGirl.create(:role, :name =>
> 'pool_family.user') }
> permission_object { |r| r.association(:pool_family) }
> - user { |r| r.association(:pool_family_user) }
> + entity { |r| FactoryGirl.create(:pool_family_user).entity }
> end
>
> factory :pool_family_admin_permission, :parent => :permission do
> role { |r| Role.first(:conditions => ['name = ?',
> 'pool_family.admin']) || FactoryGirl.create(:role, :name =>
> 'pool_family.admin') }
> permission_object { |r| r.association(:pool_family) }
> - user { |r| r.association(:pool_family_user) }
> + entity { |r| FactoryGirl.create(:pool_family_user).entity }
> end
>
> end
> diff --git a/src/spec/factories/session.rb
> b/src/spec/factories/session.rb
> new file mode 100644
> index 0000000..78ff011
> --- /dev/null
> +++ b/src/spec/factories/session.rb
> @@ -0,0 +1,24 @@
> +#
> +# Copyright 2012 Red Hat, Inc.
> +#
> +# Licensed under the Apache License, Version 2.0 (the "License");
> +# you may not use this file except in compliance with the License.
> +# You may obtain a copy of the License at
> +#
> +# http://www.apache.org/licenses/LICENSE-2.0
> +#
> +# Unless required by applicable law or agreed to in writing,
> software
> +# distributed under the License is distributed on an "AS IS"
> BASIS,
> +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
> implied.
> +# See the License for the specific language governing permissions
> and
> +# limitations under the License.
> +#
> +
> +FactoryGirl.define do
> +
> + factory :session, :class => ActiveRecord::SessionStore::Session
> do
> + session_id 'ee73441902cb9445483e498cb05dc398'
> + data
> 'BAh7CSIZd2FyZGVuLnVzZXIudXNlci5rZXlpFSIXamF2YXNjcmlwdF9lbmFi\nbGVkVCIQX2NzcmZfdG9rZW4iMVJWYkl2bjBoUEhZdi83aUpmU2FybFdQVWx0\nT0pvNHZOQXFkaXFaNURKRXc9IhBicmVhZGNydW1ic1sGewk6CmNsYXNzIg1j\nYXRhbG9nczoOdmlld3N0YXRlMDoJbmFtZSINQ2F0YWxvZ3M6CXBhdGgiDi9j\nYXRhbG9ncw==\n'
> + end
> +
> +end
> diff --git a/src/spec/models/deployable_spec.rb
> b/src/spec/models/deployable_spec.rb
> index a98eed7..6bc8ffd 100644
> --- a/src/spec/models/deployable_spec.rb
> +++ b/src/spec/models/deployable_spec.rb
> @@ -79,11 +79,11 @@ describe Deployable do
> catalog2 = FactoryGirl.create :catalog
> catalog1.pool.should_not == catalog2.pool
> admin = FactoryGirl.create :admin_user
> - pool1_perm = Permission.create(:user => admin,
> + pool1_perm = Permission.create(:entity => admin.entity,
> :role => Role.first(:conditions
> =>
> ['name = ?',
> 'pool.admin']),
> :permission_object =>
> catalog1.pool)
> - pool2_perm = Permission.create(:user => admin,
> + pool2_perm = Permission.create(:entity => admin.entity,
> :role => Role.first(:conditions
> =>
> ['name = ?',
> 'pool.deployable.admin']),
> :permission_object =>
> catalog2.pool)
> diff --git a/src/spec/models/deployment_spec.rb
> b/src/spec/models/deployment_spec.rb
> index 7cf64f2..3ffbae9 100644
> --- a/src/spec/models/deployment_spec.rb
> +++ b/src/spec/models/deployment_spec.rb
> @@ -219,13 +219,15 @@ describe Deployment do
> admin_perms = FactoryGirl.create :admin_permission
> @user_for_launch = admin_perms.user
> @user_for_launch.quota.maximum_running_instances = 1
> + @session = FactoryGirl.create :session
> + SessionEntity.update_session(@session, @user_for_launch)
> @deployment.stub(:common_provider_accounts_for).and_return(["test","test"])
> end
>
> it "return error when user quota was reached" do
> Instance.any_instance.stub(:matches).and_return(["test","test"])
> @deployment.stub!(:find_match_with_common_account).and_return([[],
> true, []])
> - errors =
> @deployment.check_assemblies_matches(@user_for_launch)
> + errors = @deployment.check_assemblies_matches(@session,
> @user_for_launch)
> errors.should have(1).items
> errors.last.should include
> I18n.t('instances.errors.user_quota_reached')
> end
> @@ -243,19 +245,21 @@ describe Deployment do
> @deployment.pool.pool_family.provider_accounts =
> [@provider_account2, @provider_account1]
> admin_perms = FactoryGirl.create :admin_permission
> @user_for_launch = admin_perms.user
> + @session = FactoryGirl.create :session
> + SessionEntity.update_session(@session, @user_for_launch)
> end
>
> it "should return errors when checking assemblies matches which
> are not launchable" do
> - @deployment.check_assemblies_matches(@user_for_launch).should
> be_empty
> + @deployment.check_assemblies_matches(@session,
> @user_for_launch).should be_empty
> @deployment.pool.pool_family.provider_accounts.destroy_all
> -
> @deployment.check_assemblies_matches(@user_for_launch).should_not
> be_empty
> + @deployment.check_assemblies_matches(@session,
> @user_for_launch).should_not be_empty
> end
>
> it "should launch instances when launching deployment" do
> @deployment.instances.should be_empty
>
> Taskomatic.stub!(:create_instance!).and_return(true)
> - @deployment.create_and_launch(@user_for_launch)
> + @deployment.create_and_launch(@session, @user_for_launch)
> @deployment.errors.should be_empty
> @deployment.instances.count.should == 2
> end
> @@ -268,7 +272,7 @@ describe Deployment do
> Taskomatic.stub!(:create_dcloud_instance).and_return(true)
> Taskomatic.stub!(:handle_dcloud_error).and_return(true)
> Taskomatic.stub!(:handle_instance_state).and_return(true)
> - @deployment.create_and_launch(@user_for_launch)
> + @deployment.create_and_launch(@session, @user_for_launch)
> @deployment.errors.should be_empty
> @deployment.reload
> @deployment.instances.count.should == 2
> @@ -277,7 +281,7 @@ describe Deployment do
> @provider_account1.priority = 30
> @provider_account1.save!
> deployment2 = Factory.create(:deployment, :pool_id =>
> @pool.id)
> - deployment2.create_and_launch(@user_for_launch)
> + deployment2.create_and_launch(@session, @user_for_launch)
> deployment2.errors.should be_empty
> deployment2.reload
> deployment2.instances.count.should == 2
> @@ -296,7 +300,7 @@ describe Deployment do
> Taskomatic.stub!(:create_dcloud_instance).and_return(true)
> Taskomatic.stub!(:handle_dcloud_error).and_return(true)
> Taskomatic.stub!(:handle_instance_state).and_return(true)
> - @deployment.create_and_launch(@user_for_launch)
> + @deployment.create_and_launch(@session, @user_for_launch)
> @deployment.errors.should be_empty
> @deployment.reload
> @deployment.instances.count.should == 2
> @@ -308,7 +312,7 @@ describe Deployment do
> @deployment.instances.should be_empty
> @deployment.pool.pool_family.provider_accounts.destroy_all
> Taskomatic.stub!(:create_instance!).and_return(true)
> - @deployment.create_and_launch(@user_for_launch)
> + @deployment.create_and_launch(@session, @user_for_launch)
> @deployment.errors.should_not be_empty
> lambda { Deployment.find(@deployment.id) }.should
> raise_error(ActiveRecord::RecordNotFound)
> end
> @@ -321,7 +325,7 @@ describe Deployment do
> it "should set create_failed status for instances if
> instance's launch raises an exception" do
> @deployment.instances.should be_empty
> Taskomatic.stub!(:create_dcloud_instance).and_raise("an
> exception")
> - @deployment.create_and_launch(@user_for_launch)
> + @deployment.create_and_launch(@session, @user_for_launch)
> @deployment.reload
> @deployment.instances.should_not be_empty
> @deployment.instances.each {|i| i.state.should ==
> Instance::STATE_CREATE_FAILED}
> diff --git a/src/spec/models/derived_permission_spec.rb
> b/src/spec/models/derived_permission_spec.rb
> new file mode 100644
> index 0000000..9952330
> --- /dev/null
> +++ b/src/spec/models/derived_permission_spec.rb
> @@ -0,0 +1,50 @@
> +#
> +# Copyright 2011 Red Hat, Inc.
> +#
> +# Licensed under the Apache License, Version 2.0 (the "License");
> +# you may not use this file except in compliance with the License.
> +# You may obtain a copy of the License at
> +#
> +# http://www.apache.org/licenses/LICENSE-2.0
> +#
> +# Unless required by applicable law or agreed to in writing,
> software
> +# distributed under the License is distributed on an "AS IS"
> BASIS,
> +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
> implied.
> +# See the License for the specific language governing permissions
> and
> +# limitations under the License.
> +#
> +
> +require 'spec_helper'
> +
> +describe DerivedPermission do
> +
> + before(:each) do
> + @admin_permission = FactoryGirl.create :admin_permission
> + @provider_admin_permission = FactoryGirl.create
> :provider_admin_permission
> + @pool_creator_permission = FactoryGirl.create
> :pool_creator_permission
> + @pool_user_permission = FactoryGirl.create :pool_user_permission
> +
> + @admin = @admin_permission.user
> + @provider_admin = @provider_admin_permission.user
> + @pool_user = @pool_user_permission.user
> +
> + @provider = @provider_admin_permission.provider
> + @pool = @pool_user_permission.pool
> + @instance = Factory.create(:instance, :pool_id => @pool.id)
> + end
> +
> + it "derived permissions created for instance" do
> + derived_perms_count = @instance.derived_permissions.size
> + @pool_perm = Permission.create(:entity => @admin.entity,
> + :role => Role.first(:conditions
> =>
> + ['name = ?',
> 'pool.admin']),
> + :permission_object => @pool)
> + @instance.reload
> + inst_perm_sources = @instance.derived_permissions.collect {|p|
> p.permission}
> + inst_perm_sources.size.should == (derived_perms_count + 1)
> + inst_perm_sources.include?(@pool_user_permission).should be_true
> + inst_perm_sources.include?(@pool_perm).should be_true
> + instance2 = Factory.create(:instance, :pool_id => @pool.id)
> + instance2.derived_permissions.collect {|p|
> p.permission}.include?(@pool_perm).should be_true
> + end
> +end
> diff --git a/src/spec/models/permission_spec.rb
> b/src/spec/models/permission_spec.rb
> index df13e3f..ce92bd6 100644
> --- a/src/spec/models/permission_spec.rb
> +++ b/src/spec/models/permission_spec.rb
> @@ -31,44 +31,56 @@ describe Permission do
>
> @provider = @provider_admin_permission.provider
> @pool = @pool_user_permission.pool
> + @session = FactoryGirl.create :session
> + SessionEntity.update_session(@session, @admin)
> + SessionEntity.add_to_session(@session, @provider_admin)
> + SessionEntity.add_to_session(@session, @pool_user)
> end
>
> it "Admin should be able to create users" do
> -
> BasePermissionObject.general_permission_scope.has_privilege(@admin,
> +
> BasePermissionObject.general_permission_scope.has_privilege(@session,
> +
> @admin,
> Privilege::CREATE,
> User).should
> be_true
> end
>
> it "Provider Admin should NOT be able to create users" do
> -
> BasePermissionObject.general_permission_scope.has_privilege(@provider_admin,
> +
> BasePermissionObject.general_permission_scope.has_privilege(@session,
> +
> @provider_admin,
> Privilege::CREATE,
> User).should
> be_false
> end
>
> it "Pool User should NOT be able to create users" do
> -
> BasePermissionObject.general_permission_scope.has_privilege(@pool_user,
> +
> BasePermissionObject.general_permission_scope.has_privilege(@session,
> +
> @pool_user,
> Privilege::CREATE,
> User).should
> be_false
> end
>
> it "Provider Admin should be able to edit provider" do
> - @provider.has_privilege(@provider_admin,
> Privilege::MODIFY).should be_true
> + @provider.has_privilege(@session, @provider_admin,
> + Privilege::MODIFY).should be_true
> end
>
> it "Admin should be able to edit provider" do
> - @provider.has_privilege(@admin, Privilege::MODIFY).should
> be_true
> + @provider.has_privilege(@session, @admin,
> Privilege::MODIFY).should be_true
> end
>
> it "Pool User should NOT be able to edit provider" do
> - @provider.has_privilege(@pool_user, Privilege::MODIFY).should
> be_false
> + @provider.has_privilege(@session, @pool_user,
> + Privilege::MODIFY).should be_false
> end
>
> it "Pool User should be able to create instances in @pool" do
> - @pool.has_privilege(@pool_user, Privilege::CREATE,
> Instance).should be_true
> + @pool.has_privilege(@session, @pool_user,
> + Privilege::CREATE, Instance).should be_true
> end
>
> it "Pool User should NOT be able to create instances in another
> pool" do
> - FactoryGirl.create(:tpool).has_privilege(@pool_user,
> Privilege::CREATE, Instance).should be_false
> + FactoryGirl.create(:tpool).has_privilege(@session, @pool_user,
> + Privilege::CREATE,
> Instance).
> + should be_false
> end
>
> end
> diff --git a/src/spec/services/registration_service_spec.rb
> b/src/spec/services/registration_service_spec.rb
> index 51a8c25..b7c33cc 100644
> --- a/src/spec/services/registration_service_spec.rb
> +++ b/src/spec/services/registration_service_spec.rb
> @@ -37,6 +37,8 @@ describe RegistrationService do
>
> it "should register a user with default pool/quota/role perms
> when default settings set" do
> @user = FactoryGirl.create :user
> + @session = FactoryGirl.create :session
> + SessionEntity.update_session(@session, @user)
> @pool = MetadataObject.lookup("self_service_default_pool")
> @role = MetadataObject.lookup("self_service_default_role")
> @quota = FactoryGirl.create :quota
> @@ -45,7 +47,7 @@ describe RegistrationService do
> @registration_service = RegistrationService.new(@user)
> @registration_service.save
>
> - @pools = Pool.list_for_user(@user, Privilege::CREATE,
> Instance)
> + @pools = Pool.list_for_user(@session, @user,
> Privilege::CREATE, Instance)
> @pools.length.should == 1
> @pools[0].name.should == "Default"
>
> diff --git a/src/spec/spec_helper.rb b/src/spec/spec_helper.rb
> index 00cb1fd..372d7b7 100644
> --- a/src/spec/spec_helper.rb
> +++ b/src/spec/spec_helper.rb
> @@ -56,6 +56,11 @@ def mock_warden(user)
> :authenticate! => user,
> :user => user,
> :raw_session => nil)
> + request.session_options[:id] = 'ee73441902cb9445483e498cb05dc398'
> + @session = ActiveRecord::SessionStore::Session.
> + find_by_session_id('ee73441902cb9445483e498cb05dc398')
> + @session = FactoryGirl.create :session unless @session
> + SessionEntity.update_session(@session, user) if user
> end
>
> RSpec.configure do |config|
> --
> 1.7.6.5
>
>
More information about the aeolus-devel
mailing list