From: Tomas Sedovic tsedovic@redhat.com
https://www.aeolusproject.org/redmine/issues/1844
https://bugzilla.redhat.com/show_bug.cgi?id=714790 --- src/app/controllers/deployments_controller.rb | 2 +- .../20110623142949_pool_self_service_role.rb | 52 ++++++++++++++++++++ src/db/seeds.rb | 9 +++- 3 files changed, 61 insertions(+), 2 deletions(-) create mode 100644 src/db/migrate/20110623142949_pool_self_service_role.rb
diff --git a/src/app/controllers/deployments_controller.rb b/src/app/controllers/deployments_controller.rb index 3c60506..8ad3d2c 100644 --- a/src/app/controllers/deployments_controller.rb +++ b/src/app/controllers/deployments_controller.rb @@ -21,7 +21,7 @@ class DeploymentsController < ApplicationController # It is expected that params[:pool_id] will be set on requests into this method def launch_new @pool = Pool.find(params[:pool_id]) or raise "Invalid pool" - require_privilege(Privilege::CREATE, Deployment) + require_privilege(Privilege::CREATE, Deployment, @pool) @deployment = Deployment.new(:pool_id => @pool.id) @suggested_deployables = SuggestedDeployable.list_for_user(current_user, Privilege::USE) init_new_deployment_attrs diff --git a/src/db/migrate/20110623142949_pool_self_service_role.rb b/src/db/migrate/20110623142949_pool_self_service_role.rb new file mode 100644 index 0000000..e357812 --- /dev/null +++ b/src/db/migrate/20110623142949_pool_self_service_role.rb @@ -0,0 +1,52 @@ +class PoolSelfServiceRole < ActiveRecord::Migration + VIEW = "view" + CRE = "create" + ROLE_NAME = "Pool Global User" + ROLE_DEF = [false, {Pool => [VIEW], + Instance => [ CRE], + Deployment => [ CRE], + Quota => [VIEW]}] + + def self.up + return if Role.all.empty? + + Role.transaction do + role = Role.find_or_initialize_by_name(ROLE_NAME) + role.update_attributes({:name => ROLE_NAME, :scope => BasePermissionObject.name, + :assign_to_owner => ROLE_DEF[0]}) + role.privileges = {} + role.save! + ROLE_DEF[1].each do |priv_type, priv_actions| + priv_actions.each do |action| + Privilege.create!(:role => role, :target_type => priv_type.name, + :action => action) + end + end + + MetadataObject.transaction do + settings = { + "self_service_default_pool_global_user_obj" => BasePermissionObject.general_permission_scope, + "self_service_default_pool_global_user_role" => Role.find_by_name("Pool Global User"), + "self_service_perms_list" => "[self_service_default_pool,self_service_default_role], [self_service_default_suggested_deployable_obj,self_service_default_suggested_deployable_role], [self_service_default_pool_global_user_obj,self_service_default_pool_global_user_role]" } + settings.each_pair { |key, value| MetadataObject.set(key, value) } + end + + Permission.transaction do + User.all.each do |user| + default_obj = MetadataObject.lookup("self_service_default_pool_global_user_obj") + default_role = MetadataObject.lookup("self_service_default_pool_global_user_role") + unless Permission.first(:conditions => {:user_id => user.id, + :role_id => default_role.id, + :permission_object_id => default_obj.id}) + Permission.create!(:user => user, + :role => default_role, + :permission_object => default_obj) + end + end + end + end + end + + def self.down + end +end diff --git a/src/db/seeds.rb b/src/db/seeds.rb index eee6904..67e566c 100644 --- a/src/db/seeds.rb +++ b/src/db/seeds.rb @@ -58,6 +58,10 @@ roles = PoolFamily => [VIEW, MOD,CRE,VPRM,GPRM]}], "SuggestedDeployable Administrator" => [false, {SuggestedDeployable => [VIEW,USE,MOD,CRE,VPRM,GPRM]}], "SuggestedDeployable Global User" => [false, {SuggestedDeployable=> [VIEW,USE]}], + "Pool Global User" => [false, {Pool => [VIEW], + Instance => [ CRE], + Deployment => [ CRE], + Quota => [VIEW]}], "Administrator" => [false, {Provider => [VIEW, MOD,CRE,VPRM,GPRM], ProviderAccount => [VIEW,USE,MOD,CRE,VPRM,GPRM], HardwareProfile => [ MOD,CRE,VPRM,GPRM], @@ -98,6 +102,7 @@ default_quota = Quota.create default_pool = Pool.find_by_name("default_pool") default_role = Role.find_by_name("Pool User") default_suggested_deployable_role = Role.find_by_name("SuggestedDeployable Global User") +default_pool_global_user_role = Role.find_by_name("Pool Global User")
settings = {"allow_self_service_logins" => "true", "self_service_default_quota" => default_quota, @@ -105,9 +110,11 @@ settings = {"allow_self_service_logins" => "true", "self_service_default_role" => default_role, "self_service_default_suggested_deployable_obj" => BasePermissionObject.general_permission_scope, "self_service_default_suggested_deployable_role" => default_suggested_deployable_role, + "self_service_default_pool_global_user_obj" => BasePermissionObject.general_permission_scope, + "self_service_default_pool_global_user_role" => default_pool_global_user_role, # perm list in the format: # "[resource1_key, resource1_role], [resource2_key, resource2_role], ..." - "self_service_perms_list" => "[self_service_default_pool,self_service_default_role], [self_service_default_suggested_deployable_obj,self_service_default_suggested_deployable_role]"} + "self_service_perms_list" => "[self_service_default_pool,self_service_default_role], [self_service_default_suggested_deployable_obj,self_service_default_suggested_deployable_role], [self_service_default_pool_global_user_obj,self_service_default_pool_global_user_role]"} settings.each_pair do |key, value| MetadataObject.set(key, value) end