FYI for anyone trying to do a full install from our yum repo (even
though the solr puppet stuff isn't there yet), maybe this will make
things a _little_ simpler for a day or two until we get this sorted.
Details below, but basically there is an issue with rsolr 1.0.0 not
being compatible with the newest sunspot, so everyone should stick with
using:
rake gems:install
for now. We'll update the list as soon as this is resolved. Vit is
going to check in with upstream for fix options, otherwise we'll roll
the rpm back to 0.12.1.
-------- Forwarded Message --------
From: VÃt Ondruch <vondruch(a)redhat.com>
To: Mohammed Morsi <mmorsi(a)redhat.com>
Cc: Jason Guiditta <jguiditt(a)redhat.com>, Mike Orazi
<morazi(a)redhat.com>, athomas(a)redhat.com
Subject: Re: rsolr / sunspot compatibility issues
Date: Tue, 25 Jan 2011 17:27:01 +0100
Dne 24.1.2011 19:25, Mohammed Morsi napsal(a):
>
> * it seems sunspot 1.2.1 isn't compatible with rsolr 1.0.0, trying to
> use it in the context of aeolus (eg running 'rake sunspot:redindex' in
> the aeolus conductor project root) results in the following error:
>
> uninitialized constant RSolr::Message
>
> Looking at the rsolr git repo, RSolr::Message (previously defined in
> lib/rsolr/message.rb) was removed with commit
> 54e8100302ef6e27015a05442cd90bcb57ab961f which occured on 06/17/10,
> after the 0.12.1 release was cut on 02/10/10 but before the 1.0.0
> release on 01/05/11 (a few weeks ago).
>
> -Mo
>
>
I cannot reproduce your way, however djohnson found another:
[vondruch@dhcp-25-1 src (master *)]$ rm db/development.sqlite3
[vondruch@dhcp-25-1 src (master *)]$ rake db:migrate
(in /home/vondruch/projects/conductor/src)
== CreateSessions: migrating
=================================================
-- create_table(:sessions)
-> 0.0014s
-- add_index(:sessions, :session_id)
-> 0.0004s
-- add_index(:sessions, :updated_at)
-> 0.0006s
== CreateSessions: migrated (0.0026s)
========================================
...
== CreateDeployables: migrating
==============================================
-- create_table(:deployables)
-> 0.0014s
== CreateDeployables: migrated (0.0015s)
=====================================
[vondruch@dhcp-25-1 src (master *)]$ rake db:seed
(in /home/vondruch/projects/conductor/src)
rake aborted!
uninitialized constant RSolr::Message
(See full trace by running task with --trace)
[vondruch@dhcp-25-1 src (master *)]$ rake db:seed
(in /home/vondruch/projects/conductor/src)
rake aborted!
Validation failed: {{errors}}
(See full trace by running task with --trace)
[vondruch@dhcp-25-1 src (master *)]$
So as you see, it can be reproduced when you establish fresh db and runs
"rake db:seed". There is already different error second time.
I will take a look into this issue tomorrow. I will see if upstream has
some fix or we should revert rsolr, but I hope the upstream is the way.
Vit
2
1
27 Jan '11
ACK to the series
On 01/26/2011 03:42 PM, mtaylor(a)redhat.com wrote:
> From: Martyn Taylor<mtaylor(a)redhat.com>
>
> ---
> src/features/step_definitions/template_steps.rb | 12 ++++++
> src/features/template.feature | 43 +++++++++++++++++++++++
> 2 files changed, 55 insertions(+), 0 deletions(-)
>
> diff --git a/src/features/step_definitions/template_steps.rb b/src/features/step_definitions/template_steps.rb
> index 24dea3b..79a6739 100644
> --- a/src/features/step_definitions/template_steps.rb
> +++ b/src/features/step_definitions/template_steps.rb
> @@ -42,6 +42,18 @@ Given /^I jump on the "([^"]*)" template software page$/ do |name|
> visit url_for(:action => 'software', :controller => 'templates', :id => @template)
> end
>
> +Given /^there are these templates:$/ do |table|
> + table.hashes.each do |hash|
> + @template = Factory.build (:template, :name => hash['name'],
> + :platform => hash['platform'])
> + @template.save!
> + @template.platform_version = hash['platform_version']
> + @template.architecture = hash['architecture']
> + @template.summary = hash['summary']
> + @template.save!
> + end
> +end
> +
> Then /^I should have a template named "([^"]*)"$/ do |name|
> Template.first(:order => 'created_at DESC').xml.name.should eql(name)
> end
> diff --git a/src/features/template.feature b/src/features/template.feature
> index 272573a..b7d75a8 100644
> --- a/src/features/template.feature
> +++ b/src/features/template.feature
> @@ -124,3 +124,46 @@ Feature: Manage Templates
> And I press "Build"
> Then I should be on the templates page
> And I should see "Build imported template is not supported"
> +
> + Scenario: Search for templates
> + Given there are these templates:
> + | name | platform | platform_version | architecture | summary |
> + | Test1 | fedora | 13 | x86_64 | Test Template Fedora 13 64 bit Description |
> + | Mock | fedora | 14 | i386 | Test Template Fedora 14 Description |
> + | Other | fedora | 10.04 | i386 | Test Template Ubuntu 10.04 32 bit Description |
> + And I am on the image factory templates page
> + Then I should see the following:
> + | NAME | OS | VERSION | ARCH |
> + | Test1 | fedora | 13 | x86_64 |
> + | Mock | fedora | 14 | i386 |
> + | Other | fedora | 10.04 | i386 |
> + When I fill in "q" with "test"
> + And I press "Search"
> + Then I should see "Test1"
> + And I should see "Mock"
> + And I should see "Other"
> + When I fill in "q" with "Mock"
> + And I press "Search"
> + Then I should see "Mock"
> + And I should not see "Test1"
> + And I should not see "Other"
> + When I fill in "q" with "13"
> + And I press "Search"
> + Then I should see "Test1"
> + And I should not see "Other"
> + And I should not see "Mock"
> + When I fill in "q" with "x86_64"
> + And I press "Search"
> + Then I should see "Test1"
> + And I should not see "Other"
> + And I should not see "Mock"
> + When I fill in "q" with "fedora"
> + And I press "Search"
> + Then I should see "Test1"
> + And I should see "Other"
> + And I should see "Mock"
> + When I fill in "q" with "32 bit Description"
> + And I press "Search"
> + Then I should not see "Test1"
> + And I should see "Other"
> + And I should not see "Mock"
> \ No newline at end of file
1
0
27 Jan '11
From: Jan Provaznik <jprovazn(a)redhat.com>
The newer boxgrinder uses euca2ools instead of ec2-ami-tools to build and upload
ec2 images. Ec2-ami-tools used to automatically create a amazon s3 bucket where
images are uploaded, euca2ools doesn't. In future boxgrinder should take care of
creation bucket but this will take time, so hotfix is to create bucket from
conductor when cloudaccount is created.
---
src/app/models/cloud_account_observer.rb | 20 ++++++++++++++++++++
1 files changed, 20 insertions(+), 0 deletions(-)
diff --git a/src/app/models/cloud_account_observer.rb b/src/app/models/cloud_account_observer.rb
index a0826ea..b21aa30 100644
--- a/src/app/models/cloud_account_observer.rb
+++ b/src/app/models/cloud_account_observer.rb
@@ -1,9 +1,29 @@
class CloudAccountObserver < ActiveRecord::Observer
def after_create(account)
+ # FIXME: new boxgrinder doesn't create bucket for amis automatically,
+ # for now we create bucket from conductor
+ # remove this hotfix when fixed on boxgrinder side
+ if account.provider.cloud_type == 'ec2'
+ create_bucket(account)
+ end
if key = account.generate_auth_key
account.update_attribute(:instance_key, InstanceKey.create!(:pem => key.pem, :name => key.id, :instance_key_owner => account))
end
end
+
+ private
+
+ def create_bucket(account)
+ client = account.connect
+ bucket_name = "#{account.account_number}-imagefactory-amis"
+ # TODO (jprovazn): getting particular bucket takes long time (core fetches all
+ # buckets from provider), so we call directly create_bucket, if bucket exists,
+ # exception should be thrown (actually existing bucket is returned - this
+ # bug should be fixed soon)
+ # => so for now "rescue true" is dirty but only working solution
+ #client.create_bucket(:name => bucket_name) unless client.bucket(bucket_name)
+ client.create_bucket(:name => bucket_name) rescue true
+ end
end
CloudAccountObserver.instance
--
1.7.3.5
1
0
This is a TEMPORARY hack to get around the need to initialize rails in
the models. The addition of search has made this plugin fail because
the pool and quota models now require rails to be initialized in order
to load.
The right way to fix this is to create a REST API allowing us to call
into the conductor for our quota check.
Signed-off-by: Ian Main <imain(a)redhat.com>
---
src/app/util/condormatic.rb | 6 +++++-
1 files changed, 5 insertions(+), 1 deletions(-)
diff --git a/src/app/util/condormatic.rb b/src/app/util/condormatic.rb
index 79021ba..dc760f0 100644
--- a/src/app/util/condormatic.rb
+++ b/src/app/util/condormatic.rb
@@ -59,7 +59,11 @@ def condormatic_instance_create(task)
requirements += " && realm == \"#{realm.id}\"" if realm != nil
# We may need to add some stuff to the provider classads like pool id, provider id etc. This is mostly just
# to test and make sure this works for now.
- requirements += " && deltacloud_quota_check(\"#{job_name}\", other.cloud_account_id)"
+ #
+ # This is currently broken as the condor plugin loads models without initializing rails.
+ # However, recent changes have required that rails be initialized in order to load the
+ # pool and quota models.
+ #requirements += " && deltacloud_quota_check(\"#{job_name}\", other.cloud_account_id)"
requirements += "\n"
pipe.puts requirements
--
1.7.3.4
2
2
Hi,
this patch updates realms model so frontend realm can be associated with provider realm or provider.
It also adds basic UI for realms where use can define frontend realms.
2
8
26 Jan '11
From: Martyn Taylor <mtaylor(a)redhat.com>
---
.../admin/hardware_profiles_controller.rb | 133 +++++++++++++++++++-
src/app/models/hardware_profile.rb | 10 ++-
src/app/models/hardware_profile_property.rb | 2 +-
src/app/models/property_enum_entry.rb | 3 +
src/app/stylesheets/newui.scss | 5 +
src/app/views/admin/hardware_profiles/_form.haml | 29 +++++
src/app/views/admin/hardware_profiles/_list.haml | 35 +++---
.../_matching_provider_hardware_profiles.haml | 8 +-
.../views/admin/hardware_profiles/_properties.haml | 1 +
src/app/views/admin/hardware_profiles/create.haml | 6 +
src/app/views/admin/hardware_profiles/edit.haml | 7 +
src/app/views/admin/hardware_profiles/new.haml | 7 +
src/config/routes.rb | 3 +-
.../20090804135630_create_hardware_profiles.rb | 2 +-
src/features/hardware_profile.feature | 60 +++++++++
.../step_definitions/hardware_profile_steps.rb | 17 +++
src/features/support/paths.rb | 6 +
17 files changed, 306 insertions(+), 28 deletions(-)
create mode 100644 src/app/views/admin/hardware_profiles/_form.haml
create mode 100644 src/app/views/admin/hardware_profiles/create.haml
create mode 100644 src/app/views/admin/hardware_profiles/edit.haml
create mode 100644 src/app/views/admin/hardware_profiles/new.haml
diff --git a/src/app/controllers/admin/hardware_profiles_controller.rb b/src/app/controllers/admin/hardware_profiles_controller.rb
index 92edab0..dea2cac 100644
--- a/src/app/controllers/admin/hardware_profiles_controller.rb
+++ b/src/app/controllers/admin/hardware_profiles_controller.rb
@@ -1,7 +1,10 @@
class Admin::HardwareProfilesController < ApplicationController
before_filter :require_user
before_filter :set_params_and_header, :only => [:index, :show]
- before_filter :load_hardware_profiles, :only => [:show]
+ before_filter :load_hardware_profiles, :only => [:index, :show]
+ before_filter :load_hardware_profile, :only => [:show]
+ before_filter :setup_new_hardware_profile, :only => [:new]
+ before_filter :setup_hardware_profile, :only => [:new, :create, :edit, :update]
def index
@params = params
@@ -39,7 +42,77 @@ class Admin::HardwareProfilesController < ApplicationController
end
end
+ def new
+ end
+
+ def create
+ build_hardware_profile(params[:hardware_profile])
+ if params[:commit] == 'Save'
+ if @hardware_profile.save!
+ redirect_to admin_hardware_profiles_path
+ else
+ params.delete :commit
+ render :action => 'create'
+ end
+ else
+ matching_provider_hardware_profiles
+ render :action => 'new'
+ end
+ end
+
+ def delete
+ end
+
+ def edit
+ unless @hardware_profile
+ @hardware_profile = HardwareProfile.find(params[:id])
+ end
+ matching_provider_hardware_profiles
+ end
+
+ def update
+ if params[:commit] == "Reset"
+ redirect_to edit_admin_hardware_profile_url(@hardware_profile) and return
+ end
+
+ if params[:id]
+ @hardware_profile = HardwareProfile.find(params[:id])
+ build_hardware_profile(params[:hardware_profile])
+ end
+
+ if params[:commit] == "Check Matches"
+ matching_provider_hardware_profiles
+ render :edit and return
+ end
+
+ unless @hardware_profile.save!
+ render :action => 'edit' and return
+ else
+ flash[:notice] = "Hardware Profile updated!"
+ redirect_to admin_hardware_profiles_path
+ end
+ end
+
+ def multi_destroy
+ HardwareProfile.destroy(params[:hardware_profile_selected])
+ redirect_to admin_hardware_profiles_path
+ end
+
private
+ def setup_new_hardware_profile
+ if params[:hardware_profile]
+ begin
+ @hardware_profile = HardwareProfile.new(remove_irrelevant_params(params[:hardware_profile]))
+ end
+ else
+ @hardware_profile = HardwareProfile.new(:memory => HardwareProfileProperty.new(:name => "memory", :unit => "MB"),
+ :cpu => HardwareProfileProperty.new(:name => "cpu", :unit => "count"),
+ :storage => HardwareProfileProperty.new(:name => "storage", :unit => "GB"),
+ :architecture => HardwareProfileProperty.new(:name => "architecture", :unit => "label"))
+ end
+ matching_provider_hardware_profiles
+ end
+
def properties
@properties_header = [
{ :name => "Name", :sort_attr => :name},
@@ -63,8 +136,26 @@ class Admin::HardwareProfilesController < ApplicationController
{ :name => "Storage", :sort_attr => :storage },
{ :name => "Virtual CPU", :sort_attr => :cpus}
]
- @matching_hwps = HardwareProfile.all(:include => "aggregator_hardware_profiles",
- :conditions => {:hardware_profile_map => { :aggregator_hardware_profile_id => params[:id] }})
+
+ begin
+ @matching_hwps = HardwareProfile.matching_hwps((a)hardware_profile).map { |hwp| hwp[:hardware_profile] }
+ rescue
+ @matching_hwps = []
+ end
+ end
+
+ def setup_hardware_profile
+ @tab_captions = ['Matched Provider Hardware Profiles']
+ @details_tab = 'matching_provider_hardware_profiles'
+ @url_params = params
+ @header = [
+ { :name => "Name", :sort_attr => :name},
+ { :name => "Unit", :sort_attr => :unit},
+ { :name => "Kind", :sort_attr => :kind },
+ { :name => "Value (Default)", :sort_attr => :value},
+ { :name => "Enum Entries", :sort_attr => :false },
+ { :name => "Range First", :sort_attr => :range_first},
+ { :name => "Range Last", :sort_attr => :range_last }]
end
def set_params_and_header
@@ -81,4 +172,38 @@ class Admin::HardwareProfilesController < ApplicationController
def load_hardware_profiles
@hardware_profiles = HardwareProfile.all(:conditions => 'provider_id IS NULL')
end
-end
+
+ def load_hardware_profile
+ @hardware_profile = HardwareProfile.find(params[:id])
+ end
+
+ def build_hardware_profile(params)
+ if @hardware_profile.nil?
+ @hardware_profile = HardwareProfile.new
+ end
+
+ @hardware_profile.name = params[:name]
+ @hardware_profile.memory = create_hwpp((a)hardware_profile.memory, params[:memory_attributes])
+ @hardware_profile.storage = create_hwpp((a)hardware_profile.storage, params[:storage_attributes])
+ @hardware_profile.cpu = create_hwpp((a)hardware_profile.cpu, params[:cpu_attributes])
+ @hardware_profile.architecture = create_hwpp((a)hardware_profile.architecture, params[:architecture_attributes])
+ end
+
+ def create_hwpp(hwpp, params)
+ hwpp.nil? ? hardwareProfileProperty = HardwareProfileProperty.new : hardwareProfileProperty = hwpp
+
+ hardwareProfileProperty.name = params[:name]
+ hardwareProfileProperty.kind = params[:kind]
+ hardwareProfileProperty.value = params[:value]
+ hardwareProfileProperty.unit = params[:unit]
+ case hardwareProfileProperty.kind
+ when "range"
+ hardwareProfileProperty.range_first = params[:range_first]
+ hardwareProfileProperty.range_last = params[:range_last]
+ when "enum"
+ hardwareProfileProperty.property_enum_entries = params[:property_enum_entries].split(%r{,\s*}).map { |value| PropertyEnumEntry.new(:value => value, :hardware_profile_property => hardwareProfileProperty) }
+ end
+ hardwareProfileProperty
+ end
+
+end
\ No newline at end of file
diff --git a/src/app/models/hardware_profile.rb b/src/app/models/hardware_profile.rb
index 5e6e9e8..03ca8f7 100644
--- a/src/app/models/hardware_profile.rb
+++ b/src/app/models/hardware_profile.rb
@@ -41,13 +41,18 @@ class HardwareProfile < ActiveRecord::Base
belongs_to :memory, :class_name => "HardwareProfileProperty",
:dependent => :destroy
+
belongs_to :storage, :class_name => "HardwareProfileProperty",
:dependent => :destroy
+
belongs_to :cpu, :class_name => "HardwareProfileProperty",
:dependent => :destroy
+
belongs_to :architecture, :class_name => "HardwareProfileProperty",
:dependent => :destroy
+ accepts_nested_attributes_for :memory, :cpu, :storage, :architecture
+
has_and_belongs_to_many :aggregator_hardware_profiles,
:class_name => "HardwareProfile",
:join_table => "hardware_profile_map",
@@ -60,12 +65,13 @@ class HardwareProfile < ActiveRecord::Base
:foreign_key => "aggregator_hardware_profile_id",
:association_foreign_key => "provider_hardware_profile_id"
- validates_presence_of :external_key
- validates_uniqueness_of :external_key, :scope => [:provider_id]
+ validates_presence_of :external_key, :if => Proc.new { |hwp| !hwp.provider.nil? }
+ validates_uniqueness_of :external_key, :scope => [:provider_id], :if => Proc.new { |hwp| !hwp.provider.nil? }
validates_presence_of :name
validates_uniqueness_of :name, :scope => [:provider_id]
+
validates_associated :memory
validates_associated :storage
validates_associated :cpu
diff --git a/src/app/models/hardware_profile_property.rb b/src/app/models/hardware_profile_property.rb
index 46e4b8e..3f6bdfe 100644
--- a/src/app/models/hardware_profile_property.rb
+++ b/src/app/models/hardware_profile_property.rb
@@ -101,7 +101,7 @@ class HardwareProfileProperty < ActiveRecord::Base
def to_s
case kind
when FIXED
- value
+ value.to_s
when RANGE
range_first.to_s + " - " + range_last.to_s
when ENUM
diff --git a/src/app/models/property_enum_entry.rb b/src/app/models/property_enum_entry.rb
index ff497ef..81bb67e 100644
--- a/src/app/models/property_enum_entry.rb
+++ b/src/app/models/property_enum_entry.rb
@@ -32,4 +32,7 @@ class PropertyEnumEntry < ActiveRecord::Base
HardwareProfileProperty::STORAGE or
p.hardware_profile_property.name ==
HardwareProfileProperty::CPU }
+ def to_s
+ value.to_s + ", "
+ end
end
diff --git a/src/app/stylesheets/newui.scss b/src/app/stylesheets/newui.scss
index 513d510..d0fbcc9 100644
--- a/src/app/stylesheets/newui.scss
+++ b/src/app/stylesheets/newui.scss
@@ -1371,6 +1371,11 @@ $content-left: 180px;
float: left;
}
+#list {
+ float: left;
+ width: 100%;
+}
+
#details-view {
border: 1px solid;
position: absolute;
diff --git a/src/app/views/admin/hardware_profiles/_form.haml b/src/app/views/admin/hardware_profiles/_form.haml
new file mode 100644
index 0000000..21462ae
--- /dev/null
+++ b/src/app/views/admin/hardware_profiles/_form.haml
@@ -0,0 +1,29 @@
+=hwp_form.label :name
+=hwp_form.text_field :name
+%table
+ = sortable_table_header @header
+ - [:memory, :cpu, :storage, :architecture].each do |type|
+ - hwp_form.fields_for type do |hwpp_form|
+ %tr
+ %td
+ =hwpp_form.text_field(:name, :readonly => "readonly")
+ %td
+ =hwpp_form.text_field(:unit, :size => 5, :readonly => "readonly")
+ %td
+ -unless type == :architecture
+ =hwpp_form.select("kind", ["fixed", "range", "enum"], {})
+ -else
+ =hwpp_form.select("kind", ["fixed"], {})
+ %td
+ =hwpp_form.text_field(:value)
+ %td
+ -unless type == :architecture
+ =hwpp_form.text_field(:property_enum_entries)
+ %td
+ -unless type == :architecture
+ =hwpp_form.text_field(:range_first)
+ %td
+ -unless type == :architecture
+ =hwpp_form.text_field(:range_last)
+= hwp_form.submit 'Check Matches', :class => "submit formbutton"
+= hwp_form.submit 'Save', :class => 'submit formbutton'
\ No newline at end of file
diff --git a/src/app/views/admin/hardware_profiles/_list.haml b/src/app/views/admin/hardware_profiles/_list.haml
index 1001db3..e2f344e 100644
--- a/src/app/views/admin/hardware_profiles/_list.haml
+++ b/src/app/views/admin/hardware_profiles/_list.haml
@@ -1,5 +1,7 @@
- form_tag do
#object-actions
+ = link_to "New Hardware Profile", new_admin_hardware_profile_path, :class => 'button'
+ = restful_submit_tag "Delete", "destroy", multi_destroy_admin_hardware_profiles_path, "DELETE", :id => 'delete_button'
#selections
%p
@@ -8,19 +10,20 @@
%span> ,
= link_to "None", @url_params.merge(:select => 'none')
-%table
- = sortable_table_header @header
- - @hardware_profiles.each do |hwp|
- %tr
- %td
- - selected = @url_params[:select] == 'all'
- = check_box(:pool, "selected[#{hwp.id}]", :checked => selected)
- = link_to hwp.name, admin_hardware_profile_path(hwp)
- %td
- =hwp.architecture.to_s
- %td
- =hwp.memory.to_s
- %td
- =hwp.storage.to_s
- %td
- =hwp.cpu.to_s
+ #list
+ %table
+ = sortable_table_header @header
+ - @hardware_profiles.each do |hwp|
+ %tr
+ %td
+ - selected = @url_params[:select] == 'all'
+ %input{:name => "hardware_profile_selected[]", :type => "checkbox", :value => hwp.id, :id => "hardware_profile_checkbox_#{hwp.id}", :checked => selected }
+ = link_to hwp.name, admin_hardware_profile_path(hwp)
+ %td
+ =hwp.architecture.to_s
+ %td
+ =hwp.memory.to_s
+ %td
+ =hwp.storage.to_s
+ %td
+ =hwp.cpu.to_s
diff --git a/src/app/views/admin/hardware_profiles/_matching_provider_hardware_profiles.haml b/src/app/views/admin/hardware_profiles/_matching_provider_hardware_profiles.haml
index cfbb856..0f4ba7b 100644
--- a/src/app/views/admin/hardware_profiles/_matching_provider_hardware_profiles.haml
+++ b/src/app/views/admin/hardware_profiles/_matching_provider_hardware_profiles.haml
@@ -1,11 +1,13 @@
-%h3
- = @hardware_profile.name
+- if @hardware_profile
+ %h3
+ =(a)hardware_profile.name
%table
= sortable_table_header @provider_hwps_header
- @matching_hwps.each do |hwp|
%tr
%td
- = link_to hwp.provider.name, admin_provider_path(hwp.provider)
+ - if hwp.provider
+ = link_to hwp.provider.name, admin_provider_path(hwp.provider)
%td
= link_to hwp.name, admin_hardware_profile_path(hwp)
%td
diff --git a/src/app/views/admin/hardware_profiles/_properties.haml b/src/app/views/admin/hardware_profiles/_properties.haml
index 590edc5..bc91219 100644
--- a/src/app/views/admin/hardware_profiles/_properties.haml
+++ b/src/app/views/admin/hardware_profiles/_properties.haml
@@ -1,5 +1,6 @@
%h3
= @hardware_profile.name + "(" + (@hardware_profile.provider_id.nil? ? "Front End" : "Provider" ) + ")"
+= link_to 'Edit', edit_admin_hardware_profile_path(@hardware_profile), :class => 'button'
%table
= sortable_table_header @properties_header
- @hwp_properties.each do |hwpp|
diff --git a/src/app/views/admin/hardware_profiles/create.haml b/src/app/views/admin/hardware_profiles/create.haml
new file mode 100644
index 0000000..c26bbe9
--- /dev/null
+++ b/src/app/views/admin/hardware_profiles/create.haml
@@ -0,0 +1,6 @@
+%h3
+ Check Matching Hardware Profiles
+- content_for :list do
+ = render :partial => "form"
+- content_for :details do
+ = render :partial => 'layouts/details_pane'
\ No newline at end of file
diff --git a/src/app/views/admin/hardware_profiles/edit.haml b/src/app/views/admin/hardware_profiles/edit.haml
new file mode 100644
index 0000000..e32eebd
--- /dev/null
+++ b/src/app/views/admin/hardware_profiles/edit.haml
@@ -0,0 +1,7 @@
+- content_for :list do
+ %h3
+ Edit Hardware Profile
+ -form_for @hardware_profile, :url => admin_hardware_profile_path(@hardware_profile), :html => { :multipart => true } do |hwp_form|
+ = render :partial => "form", :locals => { :hwp_form => hwp_form }
+- content_for :details do
+ = render :partial => 'layouts/details_pane'
diff --git a/src/app/views/admin/hardware_profiles/new.haml b/src/app/views/admin/hardware_profiles/new.haml
new file mode 100644
index 0000000..3355c87
--- /dev/null
+++ b/src/app/views/admin/hardware_profiles/new.haml
@@ -0,0 +1,7 @@
+- content_for :list do
+ %h3
+ New Hardware Profile
+ -form_for @hardware_profile, :url => admin_hardware_profiles_path, :html => { :multipart => true } do |hwp_form|
+ = render :partial => "form", :locals => { :hwp_form => hwp_form }
+- content_for :details do
+ = render :partial => 'layouts/details_pane'
\ No newline at end of file
diff --git a/src/config/routes.rb b/src/config/routes.rb
index ad9fb67..ef7008b 100644
--- a/src/config/routes.rb
+++ b/src/config/routes.rb
@@ -48,7 +48,8 @@ ActionController::Routing::Routes.draw do |map|
map.connect '/set_layout', :controller => 'application', :action => 'set_layout'
map.namespace 'admin' do |r|
- r.resources :hardware_profiles, :realms
+ r.resources :realms
+ r.resources :hardware_profiles, :collection => { :multi_destroy => :delete }
r.resources :providers, :collection => { :multi_destroy => :delete }
r.resources :users, :collection => { :multi_destroy => :delete }
r.resources :provider_accounts, :collection => { :multi_destroy => :delete }
diff --git a/src/db/migrate/20090804135630_create_hardware_profiles.rb b/src/db/migrate/20090804135630_create_hardware_profiles.rb
index 5ad0435..ec4a50f 100644
--- a/src/db/migrate/20090804135630_create_hardware_profiles.rb
+++ b/src/db/migrate/20090804135630_create_hardware_profiles.rb
@@ -40,7 +40,7 @@ class CreateHardwareProfiles < ActiveRecord::Migration
end
create_table :hardware_profiles do |t|
- t.string :external_key, :null => false
+ t.string :external_key
t.string :name, :null => false, :limit => 1024
t.integer :memory_id
t.integer :storage_id
diff --git a/src/features/hardware_profile.feature b/src/features/hardware_profile.feature
index 5f63c96..134e1f3 100644
--- a/src/features/hardware_profile.feature
+++ b/src/features/hardware_profile.feature
@@ -77,3 +77,63 @@ Feature: Manage Pools
Then I should see "m1-small"
And I should not see "m1-large"
And I should not see "m1-xlarge"
+
+ Scenario: Create a new Hardware Profile
+ Given I am an authorised user
+ And I am on the hardware profiles page
+ When I follow "New Hardware Profile"
+ Then I should be on the new hardware profile page
+ When I fill in "name" with "Test Hardware Profile"
+ And I enter the following details for the Hardware Profile Properties
+ | name | kind | range_first | range_last | property_enum_entries | value | unit |
+ | memory | fixed | | | | 1740 | MB |
+ | cpu | range | 1 | 4 | | 2 | count |
+ | storage | enum | | | 250, 300, 350 | 300 | GB |
+ | architecture | fixed | | | | i386 | label |
+ And I press "Save"
+ Then I should be on the hardware profiles page
+ And I should see the following:
+ | Test Hardware Profile | 1740 | 1 - 4 | 250, 300, 350 | i386 |
+
+ Scenario: Check New Hardware Profile matching Provider Hardware Profiles
+ Given I am an authorised user
+ And there are the following provider hardware profiles:
+ | name | memory | cpu |storage | architecture |
+ | m1-small | 1740 | 1 | 250 | i386 |
+ | m1-medium | 1740 | 2 | 500 | i386 |
+ | m1-large | 2048 | 4 | 850 | x86_64 |
+ And I am on the new hardware profile page
+ When I fill in "name" with "Test Hardware Profile"
+ And I enter the following details for the Hardware Profile Properties
+ | name | kind | range_first | range_last | property_enum_entries | value | unit |
+ | memory | fixed | | | | 1740 | MB |
+ | cpu | range | 1 | 4 | | 2 | count |
+ | storage | range | 250 | 500 | | 300 | GB |
+ | architecture | fixed | | | | i386 | label |
+ And I press "Check Matches"
+ Then I should see the following:
+ | Name | Memory | CPU | Storage | Architecture |
+ | m1-small | 1740 | 1 | 250 | i386 |
+ | m1-medium | 1740 | 2 | 500 | i386 |
+
+ Scenario: Update a HardwareProfile
+ Given I am an authorised user
+ And there are the following aggregator hardware profiles:
+ | name | memory | cpu |storage | architecture |
+ | m1-small | 1740 | 2 | 160 | i386 |
+ And I am on the hardware profiles page
+ When I follow "m1-small"
+ Then I should see "Properties"
+ When I follow "edit"
+ Then I should be on the edit hardware profiles page
+ When I enter the following details for the Hardware Profile Properties
+ | name | kind | range_first | range_last | property_enum_entries | value |
+ | memory | fixed | | | | 1740 |
+ | cpu | range | 1 | 4 | | 1 |
+ | storage | range | 250 | 500 | | 300 |
+ | architecture | fixed | | | | i386 |
+ And I press "Save"
+ Then I should be on the hardware profiles page
+ Then I should see the following:
+ | Name | Memory | CPU | Storage | Architecture |
+ | m1-small | 1740 | 1 - 4 | 250 - 500 | i386 |
diff --git a/src/features/step_definitions/hardware_profile_steps.rb b/src/features/step_definitions/hardware_profile_steps.rb
index d29d136..a7a17bf 100644
--- a/src/features/step_definitions/hardware_profile_steps.rb
+++ b/src/features/step_definitions/hardware_profile_steps.rb
@@ -19,4 +19,21 @@ def create_hwp(hash, provider=nil)
cpu = Factory(:mock_hwp1_cpu, :value => hash[:cpu])
arch = Factory(:mock_hwp1_arch, :value => hash[:architecture])
Factory(:mock_hwp1, :name => hash[:name], :memory => memory, :cpu => cpu, :storage => storage, :architecture => arch, :provider => provider)
+end
+
+When /^I enter the following details for the Hardware Profile Properties$/ do |table|
+ table.hashes.each do |hash|
+ hash.each_pair do |key, value|
+ unless (hash[:name] == "architecture" && (key == "range_first" || key == "range_last" || key == "property_enum_entries")) || key == "name"
+ When "I fill in \"#{"hardware_profile_" + hash[:name] + "_attributes_" + key}\" with \"#{value}\""
+ end
+ end
+ end
+end
+
+Given /^there are the following provider hardware profiles:$/ do |table|
+ provider = Factory :mock_provider
+ table.hashes.each do |hash|
+ create_hwp(hash, provider)
+ end
end
\ No newline at end of file
diff --git a/src/features/support/paths.rb b/src/features/support/paths.rb
index c0c77dc..4bc7ba4 100644
--- a/src/features/support/paths.rb
+++ b/src/features/support/paths.rb
@@ -98,6 +98,12 @@ module NavigationHelpers
when /the hardware profiles page/
url_for admin_hardware_profiles_path
+ when /the new hardware profile page/
+ url_for new_admin_hardware_profile_path
+
+ when /the edit hardware profiles page/
+ url_for :action => 'edit', :controller => 'hardware_profiles', :only_path => true
+
when /^(.*)'s provider account page$/
admin_provider_account_path(CloudAccount.find_by_label($1))
--
1.7.2.3
2
1
Privileges are now a combination of a base action and a target object type (i.e. "modify" on Pool instead of the flat string "pool_modify"). In addition, the modeling has changed -- instead of a privileges model that was only low-level privileges with an explicit mapping to roles, the privileges model now tracks the privileges assigned to each role, with no separate mapping table.
This will require a database reload as the seeds.rb required substantial changes in role/privilege loading
Signed-off-by: Scott Seago <sseago(a)redhat.com>
---
.../admin/provider_accounts_controller.rb | 11 +-
src/app/controllers/admin/providers_controller.rb | 23 ++-
src/app/controllers/admin/settings_controller.rb | 15 +--
src/app/controllers/admin/users_controller.rb | 33 +---
src/app/controllers/application_controller.rb | 11 +-
src/app/controllers/builds_controller.rb | 10 +-
src/app/controllers/cloud_accounts_controller.rb | 20 ++--
src/app/controllers/dashboard_controller.rb | 10 --
.../controllers/hardware_profiles_controller.rb | 1 -
.../controllers/image_factory/builds_controller.rb | 8 +-
.../image_factory/templates_controller.rb | 67 ++++++---
src/app/controllers/instances_controller.rb | 12 +-
src/app/controllers/permissions_controller.rb | 4 +-
src/app/controllers/pools_controller.rb | 38 ++----
src/app/controllers/providers_controller.rb | 27 ++--
src/app/controllers/quotas_controller.rb | 8 +-
.../controllers/resources/instances_controller.rb | 10 +-
src/app/controllers/resources/pools_controller.rb | 15 +-
src/app/controllers/settings_controller.rb | 17 +--
src/app/controllers/templates_controller.rb | 50 ++++--
src/app/controllers/users_controller.rb | 79 ++++------
src/app/models/cloud_account.rb | 21 +++
src/app/models/instance.rb | 26 +++-
src/app/models/permission.rb | 6 +
src/app/models/permissioned_object.rb | 136 +++++++---------
src/app/models/privilege.rb | 168 +++++++++++++-------
src/app/models/role.rb | 7 +-
src/app/models/template.rb | 5 +
src/app/services/application_service.rb | 35 +++--
src/app/views/admin/users/_form.haml | 4 +-
src/app/views/admin/users/edit.haml | 2 +-
src/app/views/dashboard/summary.haml | 20 ++--
src/app/views/layouts/_main_nav.html.erb | 2 +-
src/app/views/permissions/list.haml | 6 +-
src/app/views/pools/show.haml | 2 +-
src/app/views/providers/accounts.haml | 4 +-
src/app/views/users/_form.haml | 4 +-
src/app/views/users/edit.haml | 2 +-
.../20110107000000_privilege_model_refactor.rb | 53 ++++++
src/db/seeds.rb | 163 ++++++++------------
src/features/support/custom.rb | 4 -
src/features/support/hooks.rb | 17 --
src/lib/tasks/cucumber.rake | 6 +-
src/spec/controllers/instance_controller_spec.rb | 12 +-
src/spec/controllers/users_controller_spec.rb | 7 -
src/spec/factories/base_permission_object.rb | 3 -
src/spec/factories/metadata_object.rb | 34 ----
src/spec/factories/permission.rb | 8 +-
src/spec/factories/pool.rb | 2 +-
src/spec/factories/pool_family.rb | 2 +-
src/spec/factories/user.rb | 5 +-
src/spec/fixtures/base_permission_objects.yml | 2 -
src/spec/fixtures/privileges.yml | 43 -----
src/spec/fixtures/roles.yml | 47 ------
src/spec/models/metadata_object_spec.rb | 2 +-
src/spec/models/permission_spec.rb | 58 +++++++
src/spec/models/pool_family_spec.rb | 4 +-
src/spec/services/registration_service_spec.rb | 14 +--
src/spec/spec_helper.rb | 2 +-
59 files changed, 707 insertions(+), 700 deletions(-)
create mode 100644 src/db/migrate/20110107000000_privilege_model_refactor.rb
delete mode 100644 src/spec/factories/base_permission_object.rb
delete mode 100644 src/spec/factories/metadata_object.rb
delete mode 100644 src/spec/fixtures/base_permission_objects.yml
delete mode 100644 src/spec/fixtures/privileges.yml
delete mode 100644 src/spec/fixtures/roles.yml
create mode 100644 src/spec/models/permission_spec.rb
diff --git a/src/app/controllers/admin/provider_accounts_controller.rb b/src/app/controllers/admin/provider_accounts_controller.rb
index 7a63d38..d422a53 100644
--- a/src/app/controllers/admin/provider_accounts_controller.rb
+++ b/src/app/controllers/admin/provider_accounts_controller.rb
@@ -18,6 +18,7 @@ class Admin::ProviderAccountsController < ApplicationController
def show
@tab_captions = ['Properties', 'Credentials', 'History', 'Permissions']
@account = CloudAccount.find(params[:id])
+ require_privilege(Privilege::VIEW, @account)
@details_tab = params[:details_tab].blank? ? 'properties' : params[:details_tab]
if params.delete :test_account
@@ -44,7 +45,7 @@ class Admin::ProviderAccountsController < ApplicationController
def create
@provider = Provider.find(params[:provider_id])
- require_privilege(Privilege::ACCOUNT_MODIFY, @provider)
+ require_privilege(Privilege::CREATE, CloudAccount, @provider)
@providers = Provider.all
@cloud_account = CloudAccount.new(params[:cloud_account])
@@ -83,13 +84,13 @@ class Admin::ProviderAccountsController < ApplicationController
@cloud_account = CloudAccount.find(params[:id])
@quota = @cloud_account.quota
@provider = @cloud_account.provider
- require_privilege(Privilege::ACCOUNT_MODIFY,@provider)
+ require_privilege(Privilege::MODIFY,@cloud_account)
end
def update
@cloud_account = CloudAccount.find(params[:id])
@provider = @cloud_account.provider
- require_privilege(Privilege::ACCOUNT_MODIFY, @provider)
+ require_privilege(Privilege::MODIFY,@cloud_account)
@quota = @cloud_account.quota
if params.delete :test_account
@@ -111,7 +112,9 @@ class Admin::ProviderAccountsController < ApplicationController
if (not params[:accounts_selected]) or (params[:accounts_selected].length == 0)
flash[:notice] = "You must select some accounts first."
else
- CloudAccount.destroy(params[:accounts_selected])
+ CloudAccount.find(params[:accounts_selected]).each do |account|
+ account.destroy if check_privilege(Privilege::MODIFY, account)
+ end
end
redirect_to admin_provider_accounts_url
end
diff --git a/src/app/controllers/admin/providers_controller.rb b/src/app/controllers/admin/providers_controller.rb
index 98ebc77..a898d72 100644
--- a/src/app/controllers/admin/providers_controller.rb
+++ b/src/app/controllers/admin/providers_controller.rb
@@ -17,20 +17,21 @@ class Admin::ProvidersController < ApplicationController
end
def new
- require_privilege(Privilege::PROVIDER_MODIFY)
+ require_privilege(Privilege::CREATE, Provider)
@provider = Provider.new
kick_condor
end
def edit
@provider = Provider.find_by_id(params[:id])
- require_privilege(Privilege::PROVIDER_MODIFY, @provider)
+ require_privilege(Privilege::MODIFY, @provider)
end
def show
load_providers
@provider = Provider.find(params[:id])
@url_params = params.clone
+ require_privilege(Privilege::VIEW, @provider)
@tab_captions = ['Properties', 'HW Profiles', 'Realms', 'Provider Accounts', 'Services','History','Permissions']
@details_tab = params[:details_tab].blank? ? 'properties' : params[:details_tab]
respond_to do |format|
@@ -45,7 +46,7 @@ class Admin::ProvidersController < ApplicationController
end
def create
- require_privilege(Privilege::PROVIDER_MODIFY)
+ require_privilege(Privilege::CREATE, Provider)
@provider = Provider.new(params[:provider])
if params[:test_connection]
test_connection(@provider)
@@ -64,8 +65,8 @@ class Admin::ProvidersController < ApplicationController
end
def update
- require_privilege(Privilege::PROVIDER_MODIFY)
@provider = Provider.find_by_id(params[:id])
+ require_privilege(Privilege::MODIFY, @provider)
previous_cloud_type = @provider.cloud_type
@provider.update_attributes(params[:provider])
if params[:test_connection]
@@ -89,7 +90,9 @@ class Admin::ProvidersController < ApplicationController
end
def multi_destroy
- Provider.destroy(params[:provider_selected])
+ Provider.find(params[:provider_selected]).each do |provider|
+ provider.destroy if check_privilege(Privilege::MODIFY, provider)
+ end
redirect_to admin_providers_url
end
@@ -111,7 +114,11 @@ class Admin::ProvidersController < ApplicationController
@url_params = params.clone
end
- def load_providers
- @providers = Provider.list_for_user(@current_user, Privilege::PROVIDER_VIEW)
- end
+ def load_providers
+ @header = [{ :name => "Provider name", :sort_attr => :name },
+ { :name => "Provider URL", :sort_attr => :name }
+ ]
+ @providers = Provider.list_for_user(@current_user, Privilege::VIEW)
+ @url_params = params.clone
+ end
end
diff --git a/src/app/controllers/admin/settings_controller.rb b/src/app/controllers/admin/settings_controller.rb
index accf398..a6f5cec 100644
--- a/src/app/controllers/admin/settings_controller.rb
+++ b/src/app/controllers/admin/settings_controller.rb
@@ -6,18 +6,12 @@ class Admin::SettingsController < ApplicationController
KEYS = [SELF_SERVICE_DEFAULT_QUOTA]
def self_service
- if !is_admin?
- raise PermissionError.new('You have insufficient privileges to perform action.')
- return
- end
+ require_privilege(Privilege::MODIFY)
@self_service_default_quota = MetadataObject.lookup(SELF_SERVICE_DEFAULT_QUOTA)
end
def general_settings
- if !is_admin?
- raise PermissionError.new('You have insufficient privileges to perform action.')
- return
- end
+ require_privilege(Privilege::MODIFY)
end
def update
@@ -47,9 +41,4 @@ class Admin::SettingsController < ApplicationController
redirect_to :action => 'self_service'
end
- private
- def is_admin?
- is_admin = @current_user.permissions.collect { |p| p.role }.find { |r| r.name == "Administrator" }
- return is_admin == nil ? false : true
- end
end
diff --git a/src/app/controllers/admin/users_controller.rb b/src/app/controllers/admin/users_controller.rb
index 1c48dcb..58aabf8 100644
--- a/src/app/controllers/admin/users_controller.rb
+++ b/src/app/controllers/admin/users_controller.rb
@@ -1,9 +1,9 @@
class Admin::UsersController < ApplicationController
before_filter :require_user
- before_filter :only_admin, :only => [:index, :multi_destroy]
before_filter :load_users, :only => [:show]
def index
+ require_privilege(Privilege::VIEW, User)
@params = params
@search_term = params[:q]
if @search_term.blank?
@@ -18,6 +18,7 @@ class Admin::UsersController < ApplicationController
end
def new
+ require_privilege(Privilege::CREATE, User) unless current_user.nil?
@user = User.new
@user.quota = Quota.new
end
@@ -27,8 +28,7 @@ class Admin::UsersController < ApplicationController
redirect_to :action => 'new' and return
end
- # TODO: Shouldn't it be if current_user.nil? instead?
- require_privilege(Privilege::USER_MODIFY) unless current_user.nil?
+ require_privilege(Privilege::MODIFY, User) unless current_user.nil?
@user = User.new(params[:user])
@registration = RegistrationService.new(@user)
@@ -48,6 +48,7 @@ class Admin::UsersController < ApplicationController
def show
@user = User.find_by_id(params[:id]) || current_user
+ require_privilege(Privilege::VIEW, User) unless current_user == @user
@quota_resources = @user.quota.quota_resources
@url_params = params.clone
@@ -66,15 +67,12 @@ class Admin::UsersController < ApplicationController
def edit
@user = User.find_by_id(params[:id]) || current_user
-
- if cannot_modify_different_user?(@user)
- flash[:notice] = "Invalid Permission to perform this operation"
- redirect_to dashboard_url and return
- end
+ require_privilege(Privilege::MODIFY, User) unless @user == current_user
end
def update
@user = User.find_by_id(params[:id]) || current_user
+ require_privilege(Privilege::MODIFY, User) unless @user == current_user
if params[:commit] == "Reset"
redirect_to edit_admin_user_url(@user) and return
@@ -82,20 +80,16 @@ class Admin::UsersController < ApplicationController
redirect_to dashboard_url and return unless @user
- if cannot_modify_different_user = cannot_modify_different_user?(@user)
- flash[:notice] = "Invalid Permission to perform this operation"
- redirect_to dashboard_url and return
- end
-
unless @user.update_attributes(params[:user])
render :action => 'edit' and return
else
flash[:notice] = "User updated!"
- redirect_to cannot_modify_different_user ? dashboard_url : admin_users_url
+ redirect_to (@user == current_user) ? dashboard_url : admin_users_url
end
end
def multi_destroy
+ require_privilege(Privilege::MODIFY, User)
User.destroy(params[:user_selected])
redirect_to admin_users_url
end
@@ -115,15 +109,4 @@ class Admin::UsersController < ApplicationController
end
end
- def only_admin
- unless current_user.permissions.collect { |p| p.role }.find { |r| r.name == "Administrator" }
- flash[:notice] = "Invalid Permission to perform this operation"
- redirect_to dashboard_url
- end
- end
-
- def cannot_modify_different_user?(user)
- user && user != current_user && !BasePermissionObject.general_permission_scope.can_modify_users(current_user)
- end
-
end
diff --git a/src/app/controllers/application_controller.rb b/src/app/controllers/application_controller.rb
index b77fe9c..5b6c500 100644
--- a/src/app/controllers/application_controller.rb
+++ b/src/app/controllers/application_controller.rb
@@ -60,13 +60,6 @@ class ApplicationController < ActionController::Base
'generic'
end
- perm_helper_string = ""
- Privilege::FULL_PRIVILEGE_LIST.each do |privilege|
- perm_helper_string += "def has_#{privilege}?(obj=@perm_obj); " +
- "check_privilege(\"#{privilege}\", obj) end; "
- end
- master_helper_module.module_eval perm_helper_string
-
helper_method :check_privilege
protected
@@ -162,8 +155,8 @@ class ApplicationController < ActionController::Base
def get_nav_items
if current_user.present?
- @providers = Provider.list_for_user(@current_user, Privilege::PROVIDER_VIEW)
- @pools = Pool.list_for_user(@current_user, Privilege::POOL_VIEW)
+ @providers = Provider.list_for_user(@current_user, Privilege::VIEW)
+ @pools = Pool.list_for_user(@current_user, Privilege::VIEW)
end
end
diff --git a/src/app/controllers/builds_controller.rb b/src/app/controllers/builds_controller.rb
index 7cf0ad6..5f33ba3 100644
--- a/src/app/controllers/builds_controller.rb
+++ b/src/app/controllers/builds_controller.rb
@@ -1,12 +1,12 @@
class BuildsController < ApplicationController
- before_filter [:require_user, :check_permission]
+ before_filter [:require_user]
def section_id
'build'
end
def index
- require_privilege(Privilege::IMAGE_VIEW)
+ require_privilege(Privilege::VIEW, Template)
order = get_order('templates.name')
@running_images = Image.all(:include => :template, :conditions => ['status IN (?)', Image::ACTIVE_STATES], :order => order)
@completed_images = Image.all(:include => :template, :conditions => {:status => Image::STATE_COMPLETE}, :order => order)
@@ -16,6 +16,7 @@ class BuildsController < ApplicationController
def new
raise "select template to build" unless id = params[:template_id]
@tpl = Template.find(id)
+ check_permission
if @tpl.imported
flash[:warning] = "Build imported template is not supported"
redirect_to templates_path
@@ -30,6 +31,7 @@ class BuildsController < ApplicationController
end
@tpl = Template.find(params[:template_id])
+ check_permission
@all_targets = Image.available_targets
if params[:targets].blank?
@@ -60,9 +62,11 @@ class BuildsController < ApplicationController
end
def edit
+ # FIXME: is @tpl defined here? do we need check_permission here?
end
def update
+ # FIXME: is @tpl defined here? do we need check_permission here?
end
private
@@ -82,6 +86,6 @@ class BuildsController < ApplicationController
end
def check_permission
- require_privilege(Privilege::IMAGE_MODIFY)
+ require_privilege(Privilege::MODIFY, @tpl)
end
end
diff --git a/src/app/controllers/cloud_accounts_controller.rb b/src/app/controllers/cloud_accounts_controller.rb
index 75a75d9..d292f57 100644
--- a/src/app/controllers/cloud_accounts_controller.rb
+++ b/src/app/controllers/cloud_accounts_controller.rb
@@ -31,19 +31,19 @@ class CloudAccountsController < ApplicationController
def index
@provider = Provider.find(params[:provider_id])
- require_privilege(Privilege::ACCOUNT_VIEW, @provider)
+ require_privilege(Privilege::VIEW, CloudAccount, @provider)
end
def new
@provider = Provider.find(params[:provider_id])
@cloud_account = CloudAccount.new
@quota = Quota.new
- require_privilege(Privilege::ACCOUNT_MODIFY, @provider)
+ require_privilege(Privilege::CREATE, CloudAccount, @provider)
end
def create
@provider = Provider.find(params[:provider_id])
- require_privilege(Privilege::ACCOUNT_MODIFY,@provider)
+ require_privilege(Privilege::CREATE, CloudAccount, @provider)
@cloud_account = CloudAccount.new(params[:cloud_account])
@cloud_account.provider = @provider
@cloud_account.quota = @quota = Quota.new
@@ -80,13 +80,13 @@ class CloudAccountsController < ApplicationController
@cloud_account = CloudAccount.find(params[:id])
@quota = @cloud_account.quota
@provider = @cloud_account.provider
- require_privilege(Privilege::ACCOUNT_MODIFY,@provider)
+ require_privilege(Privilege::MODIFY, @cloud_account)
end
def update_accounts
@provider = Provider.find(params[:provider][:id])
- require_privilege(Privilege::ACCOUNT_MODIFY, @provider)
- @providers = Provider.list_for_user(@current_user, Privilege::PROVIDER_VIEW)
+ require_privilege(Privilege::MODIFY, CloudAccount, @provider)
+ @providers = Provider.list_for_user(@current_user, Privilege::VIEW)
success = true
@provider.cloud_accounts.each do |cloud_account|
@@ -130,7 +130,7 @@ class CloudAccountsController < ApplicationController
def update
@cloud_account = CloudAccount.find(params[:id])
@provider = @cloud_account.provider
- require_privilege(Privilege::ACCOUNT_MODIFY, @provider)
+ require_privilege(Privilege::MODIFY, @cloud_account)
@quota = @cloud_account.quota
limit = params[:quota][:maximum_running_instances] if params[:quota]
@@ -145,7 +145,7 @@ class CloudAccountsController < ApplicationController
def key
@cloud_account = CloudAccount.find(params[:id])
- require_privilege(Privilege::ACCOUNT_MODIFY,@cloud_account.provider)
+ require_privilege(Privilege::MODIFY,@cloud_account)
unless @cloud_account.instance_key.nil?
render :text => @cloud_account.instance_key.pem
end
@@ -154,7 +154,7 @@ class CloudAccountsController < ApplicationController
def destroy
account = CloudAccount.find(params[:id])
provider = account.provider
- require_privilege(Privilege::ACCOUNT_MODIFY, provider)
+ require_privilege(Privilege::MODIFY, account)
if account.destroy
flash[:notice] = "Cloud Account destroyed"
else
@@ -176,6 +176,6 @@ class CloudAccountsController < ApplicationController
private
def load_providers
- @providers = Provider.list_for_user(@current_user, Privilege::PROVIDER_VIEW)
+ @providers = Provider.list_for_user(@current_user, Privilege::VIEW)
end
end
diff --git a/src/app/controllers/dashboard_controller.rb b/src/app/controllers/dashboard_controller.rb
index 8d37a12..5254dd7 100644
--- a/src/app/controllers/dashboard_controller.rb
+++ b/src/app/controllers/dashboard_controller.rb
@@ -70,16 +70,6 @@ class DashboardController < ApplicationController
@cloud_accounts = CloudAccount.find(:all)
- # Now need to check any permissions are set since default permission and pool
- # may not be set for the admin user
- if @current_user.permissions
- # FIXME remove general role based permission check, replace w/
- # more granular / per-permission-object permission checks on the
- # dashboard in the future (here and in dashboard views)
- @is_admin = @current_user.permissions.collect { |p| p.role }.
- find { |r| r.name == "Administrator" }
- end
-
render :action => 'monitor'
end
diff --git a/src/app/controllers/hardware_profiles_controller.rb b/src/app/controllers/hardware_profiles_controller.rb
index c3afae2..d18110c 100644
--- a/src/app/controllers/hardware_profiles_controller.rb
+++ b/src/app/controllers/hardware_profiles_controller.rb
@@ -23,7 +23,6 @@ class HardwareProfilesController < ApplicationController
def index
@hardware_profiles = HardwareProfile.find(:all)
- #require_privilege(Privilege::PROVIDER_VIEW, @hardware_profile) ?
end
def new
diff --git a/src/app/controllers/image_factory/builds_controller.rb b/src/app/controllers/image_factory/builds_controller.rb
index 97bd32f..a2018bc 100644
--- a/src/app/controllers/image_factory/builds_controller.rb
+++ b/src/app/controllers/image_factory/builds_controller.rb
@@ -1,9 +1,10 @@
class ImageFactory::BuildsController < ApplicationController
- before_filter [:require_user, :check_permission]
+ before_filter [:require_user]
def new
raise "select template to build" unless id = params[:template_id]
@tpl = Template.find(id)
+ check_permission
if @tpl.imported
flash[:warning] = "Build imported template is not supported"
redirect_to templates_path
@@ -13,6 +14,7 @@ class ImageFactory::BuildsController < ApplicationController
def create
@tpl = Template.find(params[:template_id])
+ check_permission
@all_targets = Image.available_targets
if params[:targets].blank?
@@ -43,9 +45,11 @@ class ImageFactory::BuildsController < ApplicationController
end
def edit
+ # FIXME: is @tpl defined here? do we need check_permission here?
end
def update
+ # FIXME: is @tpl defined here? do we need check_permission here?
end
private
@@ -65,6 +69,6 @@ class ImageFactory::BuildsController < ApplicationController
end
def check_permission
- require_privilege(Privilege::IMAGE_MODIFY)
+ require_privilege(Privilege::MODIFY, @tpl)
end
end
diff --git a/src/app/controllers/image_factory/templates_controller.rb b/src/app/controllers/image_factory/templates_controller.rb
index fbba625..1f019eb 100644
--- a/src/app/controllers/image_factory/templates_controller.rb
+++ b/src/app/controllers/image_factory/templates_controller.rb
@@ -2,7 +2,6 @@ require 'util/repository_manager'
class ImageFactory::TemplatesController < ApplicationController
before_filter :require_user
- before_filter :check_permission, :except => [:index, :show]
before_filter :load_templates, :only => [:index, :show]
def index
@@ -10,6 +9,7 @@ class ImageFactory::TemplatesController < ApplicationController
def show
@tpl = Template.find(params[:id])
+ require_privilege(Privilege::VIEW, @tpl)
@url_params = params.clone
@tab_captions = ['Properties', 'Images']
@details_tab = params[:details_tab].blank? ? 'properties' : params[:details_tab]
@@ -26,6 +26,7 @@ class ImageFactory::TemplatesController < ApplicationController
end
def new
+ check_create_permission
# can't use @template variable - is used by compass (or something other)
@tpl = Template.new(params[:tpl])
@repository_manager = RepositoryManager.new(:repositories => params[:repository] || @tpl.platform)
@@ -34,9 +35,11 @@ class ImageFactory::TemplatesController < ApplicationController
def add_selected
if params[:tpl] and not params[:tpl][:id].blank?
@tpl = Template.find(params[:tpl][:id])
+ check_edit_permission
@tpl.attributes = params[:tpl]
else
@tpl = Template.new(params[:tpl])
+ check_create_permission
end
@repository_manager = RepositoryManager.new(:repositories => params[:repository] || @tpl.platform)
@tpl.add_software(params[:packages].to_a + params[:selected_packages].to_a + params[:cached_packages].to_a,
@@ -46,11 +49,13 @@ class ImageFactory::TemplatesController < ApplicationController
def edit
@tpl = Template.find(params[:id])
+ check_edit_permission
@tpl.attributes = params[:tpl] unless params[:tpl].blank?
@repository_manager = RepositoryManager.new(:repositories => params[:repository] || @tpl.platform)
end
def create
+ check_create_permission
@tpl = Template.new(params[:tpl])
@tpl.packages = params[:packages]
if @tpl.save
@@ -65,6 +70,7 @@ class ImageFactory::TemplatesController < ApplicationController
def update
@tpl = Template.find(params[:id])
+ check_edit_permission
@tpl.packages = []
if @tpl.update_attributes(params[:tpl])
@@ -120,7 +126,13 @@ class ImageFactory::TemplatesController < ApplicationController
end
def managed_content
- @tpl = params[:template_id].blank? ? Template.new : Template.find(params[:template_id])
+ if params[:template_id].blank?
+ @tpl = Template.new
+ check_create_permission
+ else
+ @tpl = Template.find(params[:template_id])
+ check_edit_permission
+ end
@tpl.add_software(params[:packages].to_a + params[:selected_packages].to_a,
params[:groups].to_a + params[:selected_groups].to_a)
render :layout => false
@@ -133,9 +145,11 @@ class ImageFactory::TemplatesController < ApplicationController
else
errs = {}
Template.find(ids).each do |t|
- t.destroy
- unless t.destroyed?
- errs[t.name] = t.errors.full_messages.join(". ")
+ if check_permission(Privilege::MODIFY, t)
+ t.destroy
+ errs[t.name] = t.errors.full_messages.join(". ") unless t.destroyed?
+ else
+ errs[t.name] = "You don't have permission to delete #{t.name}"
end
end
if errs.empty?
@@ -148,9 +162,11 @@ class ImageFactory::TemplatesController < ApplicationController
end
def assembly
+ # FIXME: do we need perm check here?
end
def deployment_definition
+ # FIXME: do we need perm check here?
@all_targets = Image.available_targets
end
@@ -158,9 +174,11 @@ class ImageFactory::TemplatesController < ApplicationController
params[:packages].delete(params[:name]) unless params[:name].blank?
if params[:tpl] and not params[:tpl][:id].blank?
@tpl = Template.find(params[:tpl][:id])
+ check_edit_permission
@tpl.attributes = params[:tpl]
else
@tpl = Template.new(params[:tpl])
+ check_create_permission
end
@tpl.add_software(params[:packages].to_a, params[:groups].to_a)
@repository_manager = RepositoryManager.new(:repositories => params[:repository] || @tpl.platform)
@@ -168,9 +186,13 @@ class ImageFactory::TemplatesController < ApplicationController
end
def multi_destroy
- # FIXME: set correct check permission when we will have it
- require_privilege(Privilege::IMAGE_MODIFY)
- Template.destroy(params[:selected])
+ @tpl = Template.find(params[:selected])
+ if check_edit_permission
+ @tpl.destroy
+ errs[(a)tpl.name] = @tpl.errors.full_messages.join(". ") unless @tpl.destroyed?
+ else
+ errs[(a)tpl.name] = "You don't have permission to delete #{(a)tpl.name}"
+ end
redirect_to image_factory_templates_url
end
@@ -184,7 +206,6 @@ class ImageFactory::TemplatesController < ApplicationController
{:name => 'ARCH', :sort_attr => 'templates.architecture'},
{:name => 'STATUS', :sort_attr => 'status'},
]
- require_privilege(Privilege::IMAGE_VIEW)
@images = tpl.images
end
@@ -197,18 +218,22 @@ class ImageFactory::TemplatesController < ApplicationController
{:name => 'ARCH', :sort_attr => 'architecture'},
]
- # TODO: add template permission check
- require_privilege(Privilege::IMAGE_VIEW)
- @templates = Template.find(
- :all,
- :include => :images,
- :order => get_order('name')
- )
+ @templates = Template.list_for_user(current_user,
+ Privilege::VIEW,
+ :include => :images,
+ :order => get_order('name')
+ )
@url_params = params.clone
end
def set_package_vars(set_all = false)
- @tpl = params[:id].blank? ? Template.new : Template.find(params[:id])
+ if params[:id].blank?
+ @tpl = Template.new
+ check_create_permission
+ else
+ @tpl = Template.find(params[:id])
+ check_edit_permission
+ end
@tpl.attributes = params[:tpl] unless params[:tpl].nil?
@repository_manager = RepositoryManager.new(:repositories => params[:repository] || @tpl.platform)
@groups = @repository_manager.groups
@@ -230,8 +255,12 @@ class ImageFactory::TemplatesController < ApplicationController
flash.now[:error][:failures].merge!(errs)
end
- def check_permission
- require_privilege(Privilege::IMAGE_MODIFY)
+ def check_create_permission
+ require_privilege(Privilege::CREATE, Template)
+ end
+
+ def check_edit_permission
+ require_privilege(Privilege::MODIFY, @tpl)
end
def get_selected_id
diff --git a/src/app/controllers/instances_controller.rb b/src/app/controllers/instances_controller.rb
index 5e68b8e..e22aea4 100644
--- a/src/app/controllers/instances_controller.rb
+++ b/src/app/controllers/instances_controller.rb
@@ -35,7 +35,7 @@ class InstancesController < ApplicationController
end
def index
- @pools = Pool.list_for_user(@current_user, Privilege::INSTANCE_MODIFY)
+ @pools = Pool.list_for_user(@current_user, Privilege::MODIFY, :target_type => Instance)
@order_dir = params[:order_dir] == 'desc' ? 'desc' : 'asc'
@order_field = params[:order_field] || 'name'
@@ -69,7 +69,7 @@ class InstancesController < ApplicationController
def new
@instance = Instance.new(params[:instance])
- require_privilege(Privilege::INSTANCE_MODIFY, @instance.pool) if @instance.pool
+ require_privilege(Privilege::CREATE, Instance, @instance.pool) if @instance.pool
# FIXME: we need to list only templates for particular user,
# => TODO: add TEMPLATE_* permissions
@templates = Template.paginate(
@@ -81,7 +81,7 @@ class InstancesController < ApplicationController
def configure
@instance = Instance.new(params[:instance])
- require_privilege(Privilege::INSTANCE_MODIFY, @instance.pool)
+ require_privilege(Privilege::CREATE, Instance, @instance.pool)
@hardware_profiles = HardwareProfile.find(:all, :include => :architecture,
:conditions => {:provider_id => nil,
'hardware_profile_properties.value' => @instance.template.architecture})
@@ -97,7 +97,7 @@ class InstancesController < ApplicationController
@instance.state = Instance::STATE_NEW
@instance.owner = current_user
- require_privilege(Privilege::INSTANCE_MODIFY,
+ require_privilege(Privilege::CREATE, Instance,
Pool.find((a)instance.pool_id))
#FIXME: This should probably be in a transaction
if @instance.save!
@@ -131,7 +131,7 @@ class InstancesController < ApplicationController
end
@instance = Instance.find((params[:id] || []).first)
- require_privilege(Privilege::INSTANCE_CONTROL,@instance.pool)
+ require_privilege(Privilege::USE,@instance)
if params[:instance_details]
render :action => 'show'
@@ -190,7 +190,7 @@ class InstancesController < ApplicationController
def instance
@instance = Instance.find(params[:id])
- require_privilege(Privilege::INSTANCE_VIEW, @instance.pool)
+ require_privilege(Privilege::VIEW, @instance)
end
end
diff --git a/src/app/controllers/permissions_controller.rb b/src/app/controllers/permissions_controller.rb
index c326e14..622f776 100644
--- a/src/app/controllers/permissions_controller.rb
+++ b/src/app/controllers/permissions_controller.rb
@@ -65,7 +65,7 @@ class PermissionsController < ApplicationController
private
- def set_permission_object(privilege)
+ def set_permission_object(action)
if !params[:permission_object_type].nil?
@permission_object =
params[:permission_object_type].constantize.find(params[:permission_object_id])
@@ -83,7 +83,7 @@ class PermissionsController < ApplicationController
raise ActiveRecord::RecordNotFound if @permission_object.nil?
- require_privilege(privilege, @permission_object)
+ require_privilege(action, @permission_object)
end
end
diff --git a/src/app/controllers/pools_controller.rb b/src/app/controllers/pools_controller.rb
index 47cdc77..c553318 100644
--- a/src/app/controllers/pools_controller.rb
+++ b/src/app/controllers/pools_controller.rb
@@ -44,16 +44,19 @@ class PoolsController < ApplicationController
def show
@pool = Pool.find(params[:id])
+ require_privilege(Privilege::VIEW, @pool)
end
def edit
@pool = Pool.find(params[:id])
+ require_privilege(Privilege::MODIFY, @pool)
end
def list
#FIXME: clean this up, many error cases here
@pool = Pool.find(params[:id])
- require_privilege(Privilege::INSTANCE_VIEW,@pool)
+ # FIXME: really we need perm-filtered list here
+ require_privilege(Privilege::VIEW, @pool)
@pool.reload
@order_dir = params[:order_dir] == 'desc' ? 'desc' : 'asc'
@@ -74,23 +77,23 @@ class PoolsController < ApplicationController
def hardware_profiles
@pool = Pool.find(params[:id])
@hardware_profiles = @pool.hardware_profiles
- require_privilege(Privilege::POOL_VIEW, @pool)
+ require_privilege(Privilege::VIEW, @pool)
end
def realms
@pool = Pool.find(params[:id])
@realm_names = @pool.realms
- require_privilege(Privilege::POOL_VIEW,@pool)
+ require_privilege(Privilege::VIEW, @pool)
end
def new
- require_privilege(Privilege::POOL_MODIFY)
- @pools = Pool.list_for_user(@current_user, Privilege::POOL_MODIFY)
+ require_privilege(Privilege::CREATE, Pool)
+ @pools = Pool.list_for_user(@current_user, Privilege::MODIFY)
@pool = Pool.new
end
def create
- require_privilege(Privilege::POOL_MODIFY)
+ require_privilege(Privilege::CREATE, Pool)
#FIXME: This should probably be in a transaction
@pool = Pool.new(params[:pool])
@@ -118,6 +121,7 @@ class PoolsController < ApplicationController
if type == "edit"
redirect_to :action => 'edit', :id => pool_id
elsif type == "delete"
+ require_privilege(Privilege::MODIFY, Pool.find(pool_id))
params[:id] = pool_id
destroy
end
@@ -130,27 +134,5 @@ class PoolsController < ApplicationController
def delete
end
- def accounts_for_pool
- @pool = Pool.find(params[:pool_id])
- require_privilege(Privilege::ACCOUNT_VIEW,@pool)
- @cloud_accounts = []
- all_accounts = CloudAccount.list_for_user(@current_user, Privilege::ACCOUNT_ADD)
- all_accounts.each {|account|
- @cloud_accounts << account unless @pool.cloud_accounts.map{|x| x.id}.include?(account.id)
- }
- end
-
- def add_account
- @pool = Pool.find(params[:pool])
- @cloud_account = CloudAccount.find(params[:cloud_account])
- require_privilege(Privilege::ACCOUNT_ADD,@pool)
- require_privilege(Privilege::ACCOUNT_ADD,@cloud_account)
- Pool.transaction do
- @pool.cloud_accounts << @cloud_account unless @pool.cloud_accounts.map{|x| x.id}.include?((a)cloud_account.id)
- @pool.save!
- @pool.populate_realms([@cloud_account])
- end
- redirect_to :action => 'show', :id => @pool.id
- end
kick_condor
end
diff --git a/src/app/controllers/providers_controller.rb b/src/app/controllers/providers_controller.rb
index 0754d65..57b4240 100644
--- a/src/app/controllers/providers_controller.rb
+++ b/src/app/controllers/providers_controller.rb
@@ -32,25 +32,25 @@ class ProvidersController < ApplicationController
def show
@provider = Provider.find(:first, :conditions => {:id => params[:id]})
- require_privilege(Privilege::PROVIDER_VIEW, @provider)
+ require_privilege(Privilege::VIEW, @provider)
end
def edit
- @providers = Provider.list_for_user(@current_user, Privilege::PROVIDER_MODIFY)
+ @providers = Provider.list_for_user(@current_user, Privilege::VIEW)
@provider = Provider.find(:first, :conditions => {:id => params[:id]})
- require_privilege(Privilege::PROVIDER_MODIFY, @provider)
+ require_privilege(Privilege::MODIFY, @provider)
end
def new
- require_privilege(Privilege::PROVIDER_MODIFY)
- @providers = Provider.list_for_user(@current_user, Privilege::PROVIDER_MODIFY)
+ require_privilege(Privilege::CREATE, Provider)
+ @providers = Provider.list_for_user(@current_user, Privilege::MODIFY)
@provider = Provider.new(params[:provider])
kick_condor
end
def create
- require_privilege(Privilege::PROVIDER_MODIFY)
- @providers = Provider.list_for_user(@current_user, Privilege::PROVIDER_MODIFY)
+ require_privilege(Privilege::CREATE, Provider)
+ @providers = Provider.list_for_user(@current_user, Privilege::MODIFY)
@provider = Provider.new(params[:provider])
if params[:test_connection]
@@ -70,9 +70,9 @@ class ProvidersController < ApplicationController
end
def update
- require_privilege(Privilege::PROVIDER_MODIFY)
- @providers = Provider.list_for_user(@current_user, Privilege::PROVIDER_MODIFY)
+ @providers = Provider.list_for_user(@current_user, Privilege::MODIFY)
@provider = Provider.find(:first, :conditions => {:id => params[:id]})
+ require_privilege(Privilege::MODIFY, @provider)
previous_cloud_type = @provider.cloud_type
@provider.update_attributes(params[:provider])
@@ -99,7 +99,7 @@ class ProvidersController < ApplicationController
def destroy
if request.post? || request.delete?
@provider = Provider.find(params[:id])
- require_privilege(Privilege::PROVIDER_MODIFY, @provider)
+ require_privilege(Privilege::MODIFY, @provider)
if @provider.destroy and @provider.destroyed?
redirect_to :action => "index"
flash[:notice] = "Provider Deleted"
@@ -117,17 +117,18 @@ class ProvidersController < ApplicationController
def hardware_profiles
@provider = Provider.find(params[:id])
@hardware_profiles = @provider.hardware_profiles
- require_privilege(Privilege::PROVIDER_VIEW, @provider)
+ require_privilege(Privilege::VIEW, @provider)
end
def realms
@provider = Provider.find(params[:id])
@realm_names = @provider.realms.collect { |r| r.name }
- require_privilege(Privilege::PROVIDER_VIEW, @provider)
+ require_privilege(Privilege::VIEW, @provider)
end
def settings
@provider = Provider.find(params[:id])
+ require_privilege(Privilege::VIEW, @provider)
end
def list
@@ -145,6 +146,6 @@ class ProvidersController < ApplicationController
protected
def load_providers
- @providers = Provider.list_for_user(@current_user, Privilege::PROVIDER_VIEW)
+ @providers = Provider.list_for_user(@current_user, Privilege::VIEW)
end
end
diff --git a/src/app/controllers/quotas_controller.rb b/src/app/controllers/quotas_controller.rb
index e9937fb..cfa85fb 100644
--- a/src/app/controllers/quotas_controller.rb
+++ b/src/app/controllers/quotas_controller.rb
@@ -28,7 +28,7 @@ class QuotasController < ApplicationController
@parent_type = params[:parent_type]
@quota = @parent.quota
- require_privilege(Privilege::QUOTA_VIEW, @parent)
+ require_privilege(Privilege::VIEW, Quota, @parent)
end
def edit
@@ -38,13 +38,13 @@ class QuotasController < ApplicationController
@quota = @parent.quota
- require_privilege(Privilege::QUOTA_MODIFY, @parent)
+ require_privilege(Privilege::MODIFY, Quota, @parent)
end
def update
@parent = @parent = get_parent_object(params)
@parent_type = params[:parent_type]
- require_privilege(Privilege::QUOTA_MODIFY, @parent)
+ require_privilege(Privilege::MODIFY, Quota, @parent)
@quota = @parent.quota
@name = get_parent_name(@parent, @parent_type)
@@ -60,7 +60,7 @@ class QuotasController < ApplicationController
def reset
@parent = @parent = get_parent_object(params)
@parent_type = params[:parent_type]
- require_privilege(Privilege::QUOTA_MODIFY, @parent)
+ require_privilege(Privilege::MODIFY, Quota, @parent)
@quota = @parent.quota
@quota.maximum_running_instances = Quota::NO_LIMIT
diff --git a/src/app/controllers/resources/instances_controller.rb b/src/app/controllers/resources/instances_controller.rb
index 1bbe878..9482a8d 100644
--- a/src/app/controllers/resources/instances_controller.rb
+++ b/src/app/controllers/resources/instances_controller.rb
@@ -19,7 +19,7 @@ class Resources::InstancesController < ApplicationController
def new
@instance = Instance.new(params[:instance])
- #require_privilege(Privilege::INSTANCE_MODIFY, @instance.pool) if @instance.pool
+ require_privilege(Privilege::CREATE, Instance, @instance.pool) if @instance.pool
unless @instance.template
redirect_to select_template_resources_instances_path
@@ -50,7 +50,7 @@ class Resources::InstancesController < ApplicationController
@instance.owner = current_user
begin
- require_privilege(Privilege::INSTANCE_MODIFY,
+ require_privilege(Privilege::CREATE, Instance,
Pool.find((a)instance.pool_id))
free_quota = Quota.can_start_instance?(@instance, nil)
@instance.transaction do
@@ -132,11 +132,11 @@ class Resources::InstancesController < ApplicationController
def load_instance
@instance = Instance.find((params[:id] || []).first)
- require_privilege(Privilege::INSTANCE_CONTROL,@instance.pool)
+ require_privilege(Privilege::USE,@instance)
end
def init_new_instance_attrs
- @pools = Pool.list_for_user(@current_user, Privilege::INSTANCE_MODIFY)
+ @pools = Pool.list_for_user(@current_user, Privilege::MODIFY, :target_type => Instance)
@realms = Realm.find(:all, :conditions => { :provider_id => nil })
@hardware_profiles = HardwareProfile.all(
:include => :architecture,
@@ -157,7 +157,7 @@ class Resources::InstancesController < ApplicationController
{:name => 'CREATED BY', :sort_attr => 'users.last_name'},
]
- @pools = Pool.list_for_user(@current_user, Privilege::INSTANCE_MODIFY)
+ @pools = Pool.list_for_user(@current_user, Privilege::MODIFY, :target_type => Instance)
end
def load_instances
diff --git a/src/app/controllers/resources/pools_controller.rb b/src/app/controllers/resources/pools_controller.rb
index ffd1f55..c5988ca 100644
--- a/src/app/controllers/resources/pools_controller.rb
+++ b/src/app/controllers/resources/pools_controller.rb
@@ -18,6 +18,7 @@ class Resources::PoolsController < ApplicationController
def show
@pool = Pool.find(params[:id])
+ require_privilege(Privilege::VIEW, @pool)
@url_params = params.clone
@tab_captions = ['Properties', 'Deployments', 'Instances', 'History', 'Permissions']
@details_tab = params[:details_tab].blank? ? 'properties' : params[:details_tab]
@@ -33,12 +34,12 @@ class Resources::PoolsController < ApplicationController
end
def new
- require_privilege(Privilege::POOL_MODIFY)
+ require_privilege(Privilege::CREATE, Pool)
@pool = Pool.new
end
def create
- require_privilege(Privilege::POOL_MODIFY)
+ require_privilege(Privilege::CREATE, Pool)
@pool = Pool.new(params[:pool])
quota = Quota.new
@@ -55,15 +56,13 @@ class Resources::PoolsController < ApplicationController
end
def edit
- require_privilege(Privilege::POOL_MODIFY)
-
@pool = Pool.find(params[:id])
+ require_privilege(Privilege::MODIFY, @pool)
end
def update
- require_privilege(Privilege::POOL_MODIFY)
-
@pool = Pool.find(params[:id])
+ require_privilege(Privilege::MODIFY, @pool)
if @pool.update_attributes(params[:pool])
flash[:notice] = "Pool updated."
redirect_to :action => 'show', :id => @pool.id
@@ -73,7 +72,9 @@ class Resources::PoolsController < ApplicationController
end
def multi_destroy
- Pool.destroy(params[:pools_selected])
+ Pool.find(params[:pools_selected]).each do |pool|
+ pool.destroy if check_privilege(Privilege::MODIFY, pool)
+ end
redirect_to resources_pools_url
end
diff --git a/src/app/controllers/settings_controller.rb b/src/app/controllers/settings_controller.rb
index ae20e12..0717fc0 100644
--- a/src/app/controllers/settings_controller.rb
+++ b/src/app/controllers/settings_controller.rb
@@ -31,22 +31,16 @@ class SettingsController < ApplicationController
end
def index
- @providers = Provider.list_for_user(@current_user, Privilege::PROVIDER_VIEW)
+ @providers = Provider.list_for_user(@current_user, Privilege::VIEW)
end
def self_service
- if !is_admin?
- raise PermissionError.new('You have insufficient privileges to perform action.')
- return
- end
+ require_privilege(Privilege::MODIFY)
@self_service_default_quota = MetadataObject.lookup(SELF_SERVICE_DEFAULT_QUOTA)
end
def general_settings
- if !is_admin?
- raise PermissionError.new('You have insufficient privileges to perform action.')
- return
- end
+ require_privilege(Privilege::MODIFY)
end
def update
@@ -76,9 +70,4 @@ class SettingsController < ApplicationController
redirect_to :action => 'self_service'
end
- private
- def is_admin?
- is_admin = @current_user.permissions.collect { |p| p.role }.find { |r| r.name == "Administrator" }
- return is_admin == nil ? false : true
- end
end
diff --git a/src/app/controllers/templates_controller.rb b/src/app/controllers/templates_controller.rb
index 403e6c3..51ed922 100644
--- a/src/app/controllers/templates_controller.rb
+++ b/src/app/controllers/templates_controller.rb
@@ -2,7 +2,6 @@ require 'util/repository_manager'
class TemplatesController < ApplicationController
before_filter :require_user
- before_filter :check_permission, :except => :index
layout :layout
def layout
@@ -14,13 +13,10 @@ class TemplatesController < ApplicationController
end
def index
- # TODO: add template permission check
- require_privilege(Privilege::IMAGE_VIEW)
- @templates = Template.find(
- :all,
- :include => :images,
- :order => get_order('name')
- )
+ @templates = Template.list_for_user(current_user,
+ Privilege::VIEW,
+ :include => :images,
+ :order => get_order('name'))
end
def index_action
@@ -81,6 +77,7 @@ class TemplatesController < ApplicationController
end
def new
+ check_create_permission
# can't use @template variable - is used by compass (or something other)
@tpl = Template.new(params[:tpl])
@repository_manager = RepositoryManager.new(:repositories => params[:repository] || @tpl.platform)
@@ -91,12 +88,14 @@ class TemplatesController < ApplicationController
def edit
@tpl = Template.find(params[:id])
+ check_edit_permission
@tpl.attributes = params[:tpl] unless params[:tpl].blank?
@repository_manager = RepositoryManager.new(:repositories => params[:repository] || @tpl.platform)
render :action => :edit
end
def create
+ check_create_permission
@tpl = Template.new(params[:tpl])
@tpl.packages = params[:packages]
if @tpl.save
@@ -112,6 +111,7 @@ class TemplatesController < ApplicationController
def update
@tpl = Template.find(params[:id])
@tpl.packages = []
+ check_edit_permission
if @tpl.update_attributes(params[:tpl])
@tpl.set_complete
@@ -163,7 +163,13 @@ class TemplatesController < ApplicationController
end
def managed_content
- @tpl = params[:template_id].blank? ? Template.new : Template.find(params[:template_id])
+ if params[:template_id].blank?
+ @tpl = Template.new
+ check_create_permission
+ else
+ @tpl = Template.find(params[:template_id])
+ check_edit_permission
+ end
@tpl.add_software(params[:packages].to_a + params[:selected_packages].to_a,
params[:groups].to_a + params[:selected_groups].to_a)
render :layout => false
@@ -176,9 +182,11 @@ class TemplatesController < ApplicationController
else
errs = {}
Template.find(ids).each do |t|
- t.destroy
- unless t.destroyed?
- errs[t.name] = t.errors.full_messages.join(". ")
+ if check_permission(Privilege::MODIFY, t)
+ t.destroy
+ errs[t.name] = t.errors.full_messages.join(". ") unless t.destroyed?
+ else
+ errs[t.name] = "You don't have permission to delete #{t.name}"
end
end
if errs.empty?
@@ -191,16 +199,24 @@ class TemplatesController < ApplicationController
end
def assembly
+ # FIXME: do we need perm check here?
end
def deployment_definition
+ # FIXME: do we need perm check here?
@all_targets = Image.available_targets
end
private
def set_package_vars(set_all = false)
- @tpl = params[:id].blank? ? Template.new : Template.find(params[:id])
+ if params[:id].blank?
+ @tpl = Template.new
+ check_create_permission
+ else
+ @tpl = Template.find(params[:id])
+ check_edit_permission
+ end
@tpl.attributes = params[:tpl] unless params[:tpl].nil?
@repository_manager = RepositoryManager.new(:repositories => params[:repository] || @tpl.platform)
@groups = @repository_manager.groups
@@ -222,8 +238,12 @@ class TemplatesController < ApplicationController
flash.now[:error][:failures].merge!(errs)
end
- def check_permission
- require_privilege(Privilege::IMAGE_MODIFY)
+ def check_create_permission
+ require_privilege(Privilege::CREATE, Template)
+ end
+
+ def check_edit_permission
+ require_privilege(Privilege::MODIFY, @tpl)
end
def get_selected_id
diff --git a/src/app/controllers/users_controller.rb b/src/app/controllers/users_controller.rb
index 0e3220f..04754a6 100644
--- a/src/app/controllers/users_controller.rb
+++ b/src/app/controllers/users_controller.rb
@@ -24,12 +24,13 @@ class UsersController < ApplicationController
before_filter :current_user
def new
+ require_privilege(Privilege::CREATE, User) unless current_user.nil?
@user = User.new
@user.quota = Quota.new
end
def create
- require_privilege(Privilege::USER_MODIFY) unless current_user.nil?
+ require_privilege(Privilege::CREATE, User) unless current_user.nil?
@user = User.new(params[:user])
if params[:commit] == "Reset"
@@ -58,39 +59,26 @@ class UsersController < ApplicationController
else
@user = current_user
end
+ require_privilege(Privilege::VIEW, User) unless current_user == @user
@quota_resources = @user.quota.quota_resources()
end
def edit
- @user = params[:id] ? User.find(params[:id]) : @current_user
-
- if @user
- if @user != @current_user
- if !BasePermissionObject.general_permission_scope.can_modify_users(@current_user)
- flash[:notice] = "Invalid Permission to perform this operation"
- redirect_to users_path
- end
- end
- end
+ @user = params[:id] ? User.find(params[:id]) : current_user
+ require_privilege(Privilege::MODIFY, User) unless current_user == @user
end
def update
@user = params[:user][:id] ? User.find(params[:user][:id]) : @current_user
+ require_privilege(Privilege::MODIFY, User) unless current_user == @user
if params[:commit] == "Save"
if @user
- has_users_modify = BasePermissionObject.general_permission_scope.can_modify_users(@current_user)
- if @user != @current_user
- if !has_users_modify
- flash[:notice] = "Invalid Permission to perform this operation"
- redirect_to :dashboard
- end
- end
if @user.update_attributes(params[:user])
flash[:notice] = "User updated!"
- if has_users_modify
- redirect_to users_path
- else
+ if @user == current_user
redirect_to :dashboard
+ else
+ redirect_to users_path
end
else
render :action => :edit
@@ -102,21 +90,17 @@ class UsersController < ApplicationController
end
def index
- if @current_user.permissions.collect { |p| p.role }.find { |r| r.name == "Administrator" }
+ require_privilege(Privilege::VIEW, User)
+ @users = User.all
+ sort_order = params[:sort_by].nil? ? "login" : params[:sort_by]
+ if sort_order == "percentage_quota_used"
@users = User.all
- sort_order = params[:sort_by].nil? ? "login" : params[:sort_by]
- if sort_order == "percentage_quota_used"
- @users = User.all
- @users.sort! {|x,y| y.quota.percentage_used <=> x.quota.percentage_used }
- elsif sort_order == "quota"
- @users = User.all
- @users.sort! {|x,y| (x.quota.maximum_running_instances and y.quota.maximum_running_instances) ? x.quota.maximum_running_instances <=> y.quota.maximum_running_instances : (x ? 1 : -1) }
- else
- @users = User.find(:all, :order => sort_order)
- end
+ @users.sort! {|x,y| y.quota.percentage_used <=> x.quota.percentage_used }
+ elsif sort_order == "quota"
+ @users = User.all
+ @users.sort! {|x,y| (x.quota.maximum_running_instances and y.quota.maximum_running_instances) ? x.quota.maximum_running_instances <=> y.quota.maximum_running_instances : (x ? 1 : -1) }
else
- flash[:notice] = "Invalid Permission to perform this operation"
- redirect_to :dashboard
+ @users = User.find(:all, :order => sort_order)
end
end
@@ -138,22 +122,19 @@ class UsersController < ApplicationController
end
def destroy
- if @current_user.permissions.collect { |p| p.role }.find { |r| r.name == "Administrator" }
- if request.post? || request.delete?
- @user = User.find(params[:id])
- if @user == @current_user
- flash[:notice] = "Can not delete the currently logged in user!"
- elsif @user.destroy
- flash[:notice] = "User Deleted"
- else
- flash[:error] = {
- :summary => "Failed to delete User",
- :failures => @user.errors.full_messages,
- }
- end
+ require_privilege(Privilege::MODIFY, User)
+ if request.post? || request.delete?
+ @user = User.find(params[:id])
+ if @user == @current_user
+ flash[:notice] = "Can not delete the currently logged in user!"
+ elsif @user.destroy
+ flash[:notice] = "User Deleted"
+ else
+ flash[:error] = {
+ :summary => "Failed to delete User",
+ :failures => @user.errors.full_messages,
+ }
end
- else
- flash[:notice] = "Invalid Permission to perform this operation"
end
redirect_to users_path
end
diff --git a/src/app/models/cloud_account.rb b/src/app/models/cloud_account.rb
index 334b7cb..4eba087 100644
--- a/src/app/models/cloud_account.rb
+++ b/src/app/models/cloud_account.rb
@@ -72,6 +72,27 @@ class CloudAccount < ActiveRecord::Base
before_destroy :destroyable?
before_validation :read_x509_files
+ def object_list
+ super << provider
+ end
+ class << self
+ alias orig_list_for_user_include list_for_user_include
+ alias orig_list_for_user_conditions list_for_user_conditions
+ end
+
+ def self.list_for_user_include
+ includes = orig_list_for_user_include
+ includes << { :provider => {:permissions => {:role => :privileges}}}
+ includes
+ end
+
+ def self.list_for_user_conditions
+ "(#{orig_list_for_user_conditions}) or
+ (permissions_providers.user_id=:user and
+ privileges_roles.target_type=:target_type and
+ privileges_roles.action=:action)"
+ end
+
def destroyable?
instances.empty?
end
diff --git a/src/app/models/instance.rb b/src/app/models/instance.rb
index 8fa00d1..b84a596 100644
--- a/src/app/models/instance.rb
+++ b/src/app/models/instance.rb
@@ -45,6 +45,9 @@ class Instance < ActiveRecord::Base
belongs_to :instance_hwp
has_one :instance_key, :as => :instance_key_owner, :dependent => :destroy
+ has_many :permissions, :as => :permission_object, :dependent => :destroy,
+ :include => [:role],
+ :order => "permissions.id ASC"
validates_presence_of :pool_id
validates_presence_of :hardware_profile_id
@@ -76,6 +79,27 @@ class Instance < ActiveRecord::Base
validates_inclusion_of :state,
:in => STATES
+ def object_list
+ super << pool
+ end
+ class << self
+ alias orig_list_for_user_include list_for_user_include
+ alias orig_list_for_user_conditions list_for_user_conditions
+ end
+
+ def self.list_for_user_include
+ includes = orig_list_for_user_include
+ includes << { :pool => {:permissions => {:role => :privileges}}}
+ includes
+ end
+
+ def self.list_for_user_conditions
+ "(#{orig_list_for_user_conditions}) or
+ (permissions_pools.user_id=:user and
+ privileges_roles.target_type=:target_type and
+ privileges_roles.action=:action)"
+ end
+
def get_action_list(user=nil)
# return empty list rather than nil
# FIXME: not handling pending state now -- only current state
@@ -152,7 +176,7 @@ class Instance < ActiveRecord::Base
}
instances = []
- pools = Pool.list_for_user(user, Privilege::INSTANCE_VIEW)
+ pools = Pool.list_for_user(user, Privilege::VIEW, Instance)
pools.each{|pool| pool.instances.each {|i| instances << i}}
instances.each do |i|
if i.state == Instance::STATE_RUNNING
diff --git a/src/app/models/permission.rb b/src/app/models/permission.rb
index 349b6a7..22b228a 100644
--- a/src/app/models/permission.rb
+++ b/src/app/models/permission.rb
@@ -29,12 +29,18 @@ class Permission < ActiveRecord::Base
belongs_to :permission_object, :polymorphic => true
# type-specific associations
+ belongs_to :pool_family, :class_name => "PoolFamily",
+ :foreign_key => "permission_object_id"
belongs_to :pool, :class_name => "Pool",
:foreign_key => "permission_object_id"
+ belongs_to :instance, :class_name => "Instance",
+ :foreign_key => "permission_object_id"
belongs_to :provider, :class_name => "Provider",
:foreign_key => "permission_object_id"
belongs_to :cloud_account, :class_name => "CloudAccount",
:foreign_key => "permission_object_id"
+ belongs_to :template, :class_name => "Template",
+ :foreign_key => "permission_object_id"
belongs_to :base_permission_object, :class_name => "BasePermissionObject",
:foreign_key => "permission_object_id"
diff --git a/src/app/models/permissioned_object.rb b/src/app/models/permissioned_object.rb
index 24aebe0..34efec8 100644
--- a/src/app/models/permissioned_object.rb
+++ b/src/app/models/permissioned_object.rb
@@ -17,91 +17,77 @@
# MA 02110-1301, USA. A copy of the GNU General Public License is
# also available at http://www.gnu.org/copyleft/gpl.html.
module PermissionedObject
- def can_view_perms(user)
- has_privilege(user, Privilege::PERM_VIEW)
- end
- def can_set_perms(user)
- has_privilege(user, Privilege::PERM_SET)
- end
-
- def can_view_instances(user)
- has_privilege(user, Privilege::INSTANCE_VIEW)
- end
- def can_modify_instances(user)
- has_privilege(user, Privilege::INSTANCE_MODIFY)
- end
- def can_control_instances(user)
- has_privilege(user, Privilege::INSTANCE_CONTROL)
- end
-
- def can_view_stats(user)
- has_privilege(user, Privilege::STATS_VIEW)
- end
-
- def can_view_accounts(user)
- has_privilege(user, Privilege::ACCOUNT_VIEW)
- end
- def can_modify_accounts(user)
- has_privilege(user, Privilege::ACCOUNT_MODIFY)
- end
-
- def can_view_pools(user)
- has_privilege(user, Privilege::POOL_VIEW)
- end
- def can_modify_pools(user)
- has_privilege(user, Privilege::POOL_MODIFY)
- end
- def can_view_quotas(user)
- has_privilege(user, Privilege::QUOTA_VIEW)
- end
- def can_modify_quotas(user)
- has_privilege(user, Privilege::QUOTA_MODIFY)
- end
-
- def can_view_providers(user)
- has_privilege(user, Privilege::PROVIDER_VIEW)
- end
- def can_modify_providers(user)
- has_privilege(user, Privilege::PROVIDER_MODIFY)
- end
-
- def can_view_users(user)
- has_privilege(user, Privilege::USER_VIEW)
- end
- def can_modify_users(user)
- has_privilege(user, Privilege::USER_MODIFY)
- end
-
- def can_view_images(user)
- has_privilege(user, Privilege::IMAGE_VIEW)
- end
- def can_modify_images(user)
- has_privilege(user, Privilege::IMAGE_MODIFY)
+ def has_privilege(user, action, target_type=nil)
+ return false if user.nil? or action.nil?
+ target_type = self.class.default_privilege_target_type if target_type.nil?
+ object_list.each do |obj|
+ return true if obj.permissions.find(:first,
+ :include => [:role => :privileges],
+ :conditions =>
+ ["permissions.user_id=:user and
+ privileges.target_type=:target_type and
+ privileges.action=:action",
+ { :user => user.id,
+ :target_type => target_type.name,
+ :action => action}])
+ end
+ return false
end
- def has_privilege(user, privilege)
- return false if user.nil?
- permissions.find(:first, :include => [:role => :privileges],
- :conditions => ["permissions.user_id=:user and
- privileges.name=:priv",
- { :user => user.id,
- :priv => privilege }])
+ # Returns the list of objects to check for permissions on -- by default
+ # this object plus the Base permission object
+ def object_list
+ [self, BasePermissionObject.general_permission_scope]
end
# Any methods here will be able to use the context of the
# ActiveRecord model the module is included in.
def self.included(base)
base.class_eval do
- def self.list_for_user(user, privilege)
- if BasePermissionObject.general_permission_scope.has_privilege(user, privilege)
- all
+ def self.default_privilege_target_type
+ self.name.constantize
+ end
+ def self.list_for_user_include
+ [{:permissions => {:role => :privileges}}]
+ end
+ def self.list_for_user_conditions
+ "permissions.user_id=:user and
+ privileges.target_type=:target_type and
+ privileges.action=:action"
+ end
+ # :conditions in hash must match form ["foo=:param and ...", {:param => value}]
+ def self.list_for_user(user, action, find_hash={})
+ target_type = find_hash.fetch(:target_type, self.default_privilege_target_type)
+ query_include = find_hash[:include]
+ query_order = find_hash[:order]
+ query_conditions = find_hash[:conditions]
+ return [] if user.nil? or action.nil? or target_type.nil?
+ if BasePermissionObject.general_permission_scope.has_privilege(user,
+ action,
+ target_type)
+ find(:all, :include => query_include,
+ :order => query_order,
+ :conditions => query_conditions)
else
- find(:all, :include => {:permissions => {:role => :privileges}},
- :conditions => ["permissions.user_id=:user and
- privileges.name=:priv",
- {:user => user.id,
- :priv => privilege }])
+ include_clause = self.list_for_user_include
+ if query_include.is_a?(Array)
+ include_clause += query_include
+ elsif !query_include.nil?
+ include_clause << query_include
+ end
+ conditions_hash = {:user => user.id,
+ :target_type => target_type.name,
+ :action => action}
+ if query_conditions.nil?
+ conditions_str = self.list_for_user_conditions
+ else
+ conditions_str = "(#{self.list_for_user_include}) and (#{query_conditions[0]})"
+ conditions_hash.merge!(query_conditions[1]) { |key, h1, h2| h1 }
+ end
+ find(:all, :include => include_clause,
+ :conditions => [conditions_str, conditions_hash],
+ :order => query_order)
end
end
end
diff --git a/src/app/models/privilege.rb b/src/app/models/privilege.rb
index 552beef..f7a61ef 100644
--- a/src/app/models/privilege.rb
+++ b/src/app/models/privilege.rb
@@ -18,66 +18,122 @@
# also available at http://www.gnu.org/copyleft/gpl.html.
class Privilege < ActiveRecord::Base
- has_and_belongs_to_many :roles
- validates_presence_of :name
- validates_uniqueness_of :name
+ PERM_SET = "set_perms" # can create/modify/delete permission
+ # records on this object
+ PERM_VIEW = "view_perms" # can view permission records on this
+ # object
+ CREATE = "create" # can create objects of this type here
+ MODIFY = "modify" # can modify objects of this type here
+ VIEW = "view" # can view objects of this type here
+ USE = "use" # can use objects of this type here
+ # the meaning of 'use' is type-specific:
+ # Template: add this template to an assembly
+ # Assembly: add this assembly to a deployable
+ # Deployable: choose this deployable to launch
+ # Instance: may perform actions on this instance
+ # Realm: may map this realm
+ # CloudAccount: May add this account to PoolFamily
- #default privileges
- PERM_SET = "set_perms" # can create/modify/delete permission
- # records on this object
- PERM_VIEW = "view_perms" # can view permission records on this
- # object
- # instance privileges normally checked at the pool level, although
- # instance-specific overrides could be a future enhancement.
- INSTANCE_MODIFY = "instance_modify" # can create, modify, delete, or
- # control (start, stop, etc) instances
- INSTANCE_CONTROL = "instance_control" # can control (start, stop, etc)
- # instances
- INSTANCE_VIEW = "instance_view" # can view instance metadata
- # do we need a separate "connect" privilege?
+ ACTIONS = [ CREATE, MODIFY, USE, VIEW,
+ PERM_SET, PERM_VIEW]
+ TYPES = { BasePermissionObject => [MODIFY, PERM_SET, PERM_VIEW],
+ Template => ACTIONS,
+ Pool => ACTIONS - [USE],
+ PoolFamily => ACTIONS - [USE],
+ Instance => ACTIONS,
+ Quota => [VIEW, MODIFY],
+ HardwareProfile => ACTIONS - [USE, VIEW],
+ Realm => ACTIONS - [VIEW],
+ Provider => ACTIONS - [USE],
+ CloudAccount => ACTIONS,
+ User => [ CREATE, MODIFY, VIEW] }
- # stats privileges normally checked at the pool level, although
- # instance-specific overrides could be a future enhancement.
- STATS_VIEW = "stats_view" # can view monitoring data for
- # instances
+ belongs_to :role
+ validates_presence_of :role_id
+ validates_presence_of :target_type
+ validates_presence_of :action
+ validates_uniqueness_of :action, :scope => [:target_type, :role_id]
- # to create(i.e. import) an account on a provider needs ACCOUNT_MODIFY on the
- # provider.
- ACCOUNT_MODIFY = "account_modify" # can create or modify cloud accounts
- ACCOUNT_VIEW = "account_view" # can view cloud accounts
+ # notes on available privilege action/type pairs. Format is:
+ # Type Scope
+ # Action Notes (action defined on scope above unless specified)
+ #
+ # BasePermissionObject the base perm object
+ # modify Can modify system settings, etc.
+ # view_perms Can view permissions
+ # set_perms Can set permissions
+ #
+ # Template This template/assembly/deployable or all T/A/D in this TADCollection
+ # view Can view
+ # use Can assign T/A/D to TAD collection;
+ # (if template) can add to assembly or can use to launch instance
+ # (if assembly) can add to deployable
+ # (if deployable) can use to launch deployment
+ # (if TAD Collection) not used
+ # modify Can modify
+ # create Can create (on BasePermissionObject)
+ # view_perms Can view permissions
+ # set_perms Can set permissions
+ #
+ # Pool This pool
+ # view Can view
+ # modify Can modify
+ # create Can create (on BasePermissionObject)
+ # view_perms Can view permissions
+ # set_perms Can set permissions
+ #
+ # PoolFamily This PoolFamily
+ # view Can view
+ # modify Can modify
+ # create Can create (on BasePermissionObject)
+ # view_perms Can view permissions
+ # set_perms Can set permissions
+ #
+ # Instance This Instance or instances within this Pool
+ # view Can view
+ # use Can perform lifecycle actions on and/or view console
+ # modify Can modify
+ # create Can create (within this Pool)
+ # view_perms Can view permissions
+ # set_perms Can set permissions (or can set instance permissions on this pool)
+ #
+ # Quota The Pool/CloudAccount/PoolFamily/User assigned the quota
+ # view Can view quota on this obj
+ # modify Can edit quota on this obj
+ #
+ # HardwareProfile This HardwareProfile
+ # modify (for Aeolus HWPs) Can modify
+ # create Can create (on BasePermissionObject)
+ # view_perms Can view permissions
+ # set_perms Can set permissions
+ #
+ # Realm This Realm (or realms within this provider)
+ # use (for provider Realm) can map realm or provider to aeolus realm
+ # modify (for Aeolus realms) Can modify
+ # create Can create (within this Pool)
+ # view_perms Can view permissions
+ # set_perms Can set permissions
+ #
+ # Provider This Provider
+ # view Can view
+ # modify Can modify
+ # create Can create (on BasePermissionObject)
+ # view_perms Can view permissions
+ # set_perms Can set permissions
+ #
+ # CloudAccount This CloudAccount
+ # view Can view
+ # use Can map to PoolFamily
+ # modify Can modify
+ # create Can create (within this Provider)
+ # view_perms Can view permissions
+ # set_perms Can set permissions
+ #
+ # User This User (set on BasePermissionObject)
+ # view Can view
+ # modify Can modify
+ # create Can create
- POOL_MODIFY = "pool_modify" # can create or modify a pool
- POOL_VIEW = "pool_view" # can view a pool
-
- # quota privileges normally checked at the pool or account level,
- # depending on which quota level we're dealing with
- QUOTA_MODIFY = "quota_modify" # can create or modify a quota
- QUOTA_VIEW = "quota_view" # can view a quota
-
- # provider privileges normally checked at the provider level, although
- # 'new provider' action requires this privilege at the SystemPermission level
- PROVIDER_MODIFY = "provider_modify" # can create or modify a provider
- PROVIDER_VIEW = "provider_view" # can view a provider
-
- # normally checked at the SystemPermission level
- USER_MODIFY = "user_modify" # can create a new user (other than
- # self-registration) or modify another
- # user's metadata (for admin-level
- # actions)
- USER_VIEW = "user_view" # can view a user's profile data
-
- IMAGE_VIEW = "image_view" # can view existing images (templates)
- IMAGE_MODIFY = "image_modify" # can create or modify images (templates)
-
- FULL_PRIVILEGE_LIST = [PERM_SET, PERM_VIEW,
- INSTANCE_MODIFY, INSTANCE_CONTROL, INSTANCE_VIEW,
- STATS_VIEW,
- ACCOUNT_MODIFY, ACCOUNT_VIEW,
- POOL_MODIFY, POOL_VIEW,
- QUOTA_MODIFY, QUOTA_VIEW,
- PROVIDER_MODIFY, PROVIDER_VIEW,
- USER_MODIFY, USER_VIEW,
- IMAGE_VIEW, IMAGE_MODIFY]
end
diff --git a/src/app/models/role.rb b/src/app/models/role.rb
index b932544..4e7118e 100644
--- a/src/app/models/role.rb
+++ b/src/app/models/role.rb
@@ -22,10 +22,13 @@ class Role < ActiveRecord::Base
searchable do
text :name, :as => :code_substring
end
- has_many :permissions
- has_and_belongs_to_many :privileges, :uniq => true
+ has_many :permissions, :dependent => :destroy
+ has_many :privileges, :dependent => :destroy
+ validates_presence_of :scope
validates_presence_of :name
validates_uniqueness_of :name
+ validates_associated :privileges
+
end
diff --git a/src/app/models/template.rb b/src/app/models/template.rb
index d545f9b..bff586d 100644
--- a/src/app/models/template.rb
+++ b/src/app/models/template.rb
@@ -2,12 +2,17 @@ require 'util/image_descriptor_xml'
require 'typhoeus'
class Template < ActiveRecord::Base
+ include PermissionedObject
has_many :images, :dependent => :destroy
has_many :instances
before_validation :generate_uuid
before_save :update_xml
before_destroy :no_instances?
+ has_many :permissions, :as => :permission_object, :dependent => :destroy,
+ :include => [:role],
+ :order => "permissions.id ASC"
+
WAREHOUSE_CONFIG = YAML.load_file("#{RAILS_ROOT}/config/image_warehouse.yml")
validates_presence_of :uuid
diff --git a/src/app/services/application_service.rb b/src/app/services/application_service.rb
index 8161718..079c200 100644
--- a/src/app/services/application_service.rb
+++ b/src/app/services/application_service.rb
@@ -40,19 +40,34 @@ module ApplicationService
# @current_user must be defined
- def check_privilege(privilege, perm_obj)
- ((perm_obj and perm_obj.has_privilege(current_user, privilege)) or
- BasePermissionObject.general_permission_scope.has_privilege(current_user,
- privilege))
+ def check_privilege(action, *type_and_perm_obj)
+ target_type = nil
+ perm_obj = nil
+ type_and_perm_obj.each do |obj|
+ target_type=obj if obj.class==Class
+ perm_obj=obj if obj.is_a?(ActiveRecord::Base)
+ end
+ perm_obj=@perm_obj if perm_obj.nil?
+ perm_obj=BasePermissionObject.general_permission_scope if perm_obj.nil?
+ perm_obj.has_privilege(current_user, action, target_type)
end
- def authorized?(privilege, perm_obj=nil)
+ # Require a given privilege level to view this page
+ # 1. action is always required -- what action is being done (from Privilege::ACTIONS)
+ # 2. perm_obj is optional -- This is the resource on which to look for permission
+ # records. If omitted, check for site-wide permissions on BasePermissionObject
+ # 3. type is also optional -- if omitted it's taken from perm_obj.
+ # For example, if action is 'view', perm_obj is a Pool and type is omitted,
+ # then check for current user's "view pool" permission on this pool.
+ # if action is 'view', perm_obj is a Pool and type is Quota,
+ # then check for current user's "view quota" permission on this pool.
+ def require_privilege(action, *type_and_perm_obj)
+ perm_obj = nil
+ type_and_perm_obj.each do |obj|
+ perm_obj=obj if obj.is_a?(ActiveRecord::Base)
+ end
@perm_obj = perm_obj
- check_privilege(privilege,@perm_obj)
- end
-
- def require_privilege(privilege, perm_obj=nil)
- unless authorized?(privilege, perm_obj)
+ unless check_privilege(action, *type_and_perm_obj)
raise PermissionError.new(
'You have insufficient privileges to perform action.')
end
diff --git a/src/app/views/admin/users/_form.haml b/src/app/views/admin/users/_form.haml
index 3fdf33f..f1b8aa3 100644
--- a/src/app/views/admin/users/_form.haml
+++ b/src/app/views/admin/users/_form.haml
@@ -8,7 +8,7 @@
%fieldset
= form.label :password_confirmation, t(:confirm_password), :class => "grid_3 alpha"
= form.password_field :password_confirmation, :class => "grid_5"
--if has_user_modify?
+-if check_privilege(Privilege::MODIFY, User)
%fieldset.clear
= form.label :user_status, "User Status:", :class => "alpha grid_3"
.grid_5
@@ -25,7 +25,7 @@
%fieldset.clear
= form.label :email, t(:email), :class => "alpha grid_3"
= form.text_field :email, :class => "grid_5"
--if has_user_modify?
+-if check_privilege(Privilege::MODIFY, User)
%h3.grid_16 User Treatment
%fieldset.clearfix
= label_tag 'apply_treatment', t(:apply_treatment), :class => "alpha grid_3"
diff --git a/src/app/views/admin/users/edit.haml b/src/app/views/admin/users/edit.haml
index a367fec..1290c4d 100644
--- a/src/app/views/admin/users/edit.haml
+++ b/src/app/views/admin/users/edit.haml
@@ -1,4 +1,4 @@
-- if has_user_modify?
+- if check_privilege(Privilege::MODIFY, User)
%h2 Editing User: #{(a)user.first_name} #{(a)user.last_name}
- else
%h2 Editing Account
diff --git a/src/app/views/dashboard/summary.haml b/src/app/views/dashboard/summary.haml
index e6ba2dd..cc8d8e9 100644
--- a/src/app/views/dashboard/summary.haml
+++ b/src/app/views/dashboard/summary.haml
@@ -30,24 +30,24 @@
#actions_dashboard_section
%h2
Actions
- - if @is_admin
+ - if check_privilege(Privilege::CREATE, Provider)
%a{:href => url_for(:controller => "providers", :action => "new")}
Add a Provider
+ - if check_privilege(Privilege::CREATE, User)
%a{:href => url_for(:controller => "users", :action => "new")}
Create a User
- %a{:href => url_for(:controller => "instances", :action => "index")}
- View Instances
- - else
- %a{:href => url_for(:controller => "", :action => "")}
- Launch Instances
- %a{:href => url_for(:controller => "", :action => "")}
- Enter a help ticket
- - if BasePermissionObject.general_permission_scope.can_modify_images(@current_user)
+ %a{:href => url_for(:controller => "instances", :action => "index")}
+ View Instances
+ %a{:href => url_for(:controller => "", :action => "")}
+ Launch Instances
+ %a{:href => url_for(:controller => "", :action => "")}
+ Enter a help ticket
+ - if check_privilege(Privilege::CREATE, Template)
%a{:href => url_for(:controller => "templates", :action => "new")}
Create a Template
#service_quality_dashboard_section
- - if @is_admin
+ - if check_privilege(Privilege::MODIFY)
%h2
Provider Service Quality
.dashboard_section_summary
diff --git a/src/app/views/layouts/_main_nav.html.erb b/src/app/views/layouts/_main_nav.html.erb
index e85249b..d877029 100644
--- a/src/app/views/layouts/_main_nav.html.erb
+++ b/src/app/views/layouts/_main_nav.html.erb
@@ -14,6 +14,6 @@
<% } %>
<% end %>
</ul>
-<% if BasePermissionObject.general_permission_scope.has_privilege(@current_user, Privilege::POOL_MODIFY) %>
+<% if check_privilege(Privilege::CREATE, Pool, BasePermissionObject.general_permission_scope) %>
<%= link_to "Add a pool", {:controller => "pools", :action => "new"}, :class => "actionlink" %>
<% end %>
diff --git a/src/app/views/permissions/list.haml b/src/app/views/permissions/list.haml
index 27831d0..5ab3a34 100644
--- a/src/app/views/permissions/list.haml
+++ b/src/app/views/permissions/list.haml
@@ -14,7 +14,7 @@
%td= permission.user.login
%td= permission.role.name
%td
- - if has_set_perms?
+ - if check_privilege(Privilege::PERM_SET)
- form_tag :action => 'destroy' do
= hidden_field :permission, :id, :value => permission.id
= submit_tag "delete", :class => "submit_link", :id => "delete_#{permission.id}"
@@ -22,10 +22,10 @@
= link_to "Add a user", |
{:controller => "users", |
:action => "new"}, |
- :class=>"actionlink" if has_user_modify?(BasePermissionObject.general_permission_scope) |
+ :class=>"actionlink" if check_privilege(Privilege::CREATE,User,BasePermissionObject.general_permission_scope) |
-#
= link_to "Add a new permission record", |
{:action => "new", |
:permission_object_type => @permission_object.class, |
:permission_object_id => @permission_object.id}, |
- :class=>"actionlink" if has_set_perms? |
+ :class=>"actionlink" if check_privilege(Privilege::PERM_SET) |
diff --git a/src/app/views/pools/show.haml b/src/app/views/pools/show.haml
index 229f3e2..ab914ad 100644
--- a/src/app/views/pools/show.haml
+++ b/src/app/views/pools/show.haml
@@ -5,7 +5,7 @@
#pool-tabs
%ul
%li= link_to "Instances", {:action => "list", :id => @pool.id, :ajax => true}
- - if has_view_perms?
+ - if check_privilege(Privilege::PERM_VIEW)
%li= link_to "User access", {:controller => "permissions", :action => "list", :pool_id => @pool.id, :ajax => true}
%li= link_to "Hardware Profiles", {:action => "hardware_profiles", :id => @pool.id, :ajax => true}
%li= link_to "Realms", {:action => "realms", :id => @pool.id, :ajax => true}
diff --git a/src/app/views/providers/accounts.haml b/src/app/views/providers/accounts.haml
index b136012..984f257 100644
--- a/src/app/views/providers/accounts.haml
+++ b/src/app/views/providers/accounts.haml
@@ -26,7 +26,7 @@
= t('.quota_instances')
%span.required *
%fieldset.nomargin.clearfix
- - disabled = 'disabled' unless has_account_modify?(@provider)
+ - disabled = 'disabled' unless check_privilege(Privilege::MODIFY, Account, @provider)
- cloud_account_id = "cloud_accounts[#{acct.id}]"
= text_field cloud_account_id, :label, :title => t('.account_name'), :value => acct.label, :disabled => disabled, :class => "grid_4 alpha"
= text_field cloud_account_id, :username, :title => t('.user_name'), :value => acct.username, :disabled => disabled, :class => "grid_3"
@@ -56,7 +56,7 @@
= file_field cloud_account_id, :x509_cert_priv_file, :title => t('.account_private_cert'), :disabled => disabled
.grid_3
= file_field cloud_account_id, :x509_cert_pub_file, :title => t('.account_public_cert'), :disabled => disabled
- - remove_path = url_for :controller => 'cloud_accounts', :action => 'destroy', :id => acct.id if has_account_modify?(@provider) && acct.destroyable?
+ - remove_path = url_for :controller => 'cloud_accounts', :action => 'destroy', :id => acct.id if check_privilege(Privilege::MODIFY, Account, @provider) && acct.destroyable?
.grid_3.omega
%a.button{ :href => remove_path, :name => "remove_acc_#{acct.id}", :class => "tiny #{'disabled' unless remove_path}" }
= t(:remove)
diff --git a/src/app/views/users/_form.haml b/src/app/views/users/_form.haml
index 8d87a2f..efe0c96 100644
--- a/src/app/views/users/_form.haml
+++ b/src/app/views/users/_form.haml
@@ -11,7 +11,7 @@
%fieldset
= form.label :password_confirmation, t(:confirm_password), :class => "grid_3 alpha"
= form.password_field :password_confirmation, :class => "grid_5"
- -if has_user_modify?
+ -if check_privilege(Privilege::MODIFY, User)
%fieldset.clear
= form.label :user_status, "User Status:", :class => "alpha grid_3"
.grid_5
@@ -28,7 +28,7 @@
%fieldset.clear
= form.label :email, t(:email), :class => "alpha grid_3"
= form.text_field :email, :class => "grid_5"
- -if has_user_modify?
+ -if check_privilege(Privilege::MODIFY, User)
%h3.grid_16 User Treatment
%fieldset.clearfix
= label_tag 'apply_treatment', t(:apply_treatment), :class => "alpha grid_3"
diff --git a/src/app/views/users/edit.haml b/src/app/views/users/edit.haml
index 0551bee..aa70a7c 100644
--- a/src/app/views/users/edit.haml
+++ b/src/app/views/users/edit.haml
@@ -1,5 +1,5 @@
.formwindow
-- if has_user_modify?
+- if check_privilege(Privilege::MODIFY, User)
%h2 Editing User: #{(a)user.first_name} #{(a)user.last_name}
- else
%h2 Editing Account
diff --git a/src/db/migrate/20110107000000_privilege_model_refactor.rb b/src/db/migrate/20110107000000_privilege_model_refactor.rb
new file mode 100644
index 0000000..78e0b99
--- /dev/null
+++ b/src/db/migrate/20110107000000_privilege_model_refactor.rb
@@ -0,0 +1,53 @@
+#
+# Copyright (C) 2011 Red Hat, Inc.
+# Written by Scott Seago <sseago(a)redhat.com>
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; version 2 of the License.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston,
+# MA 02110-1301, USA. A copy of the GNU General Public License is
+# also available at http://www.gnu.org/copyleft/gpl.html.
+
+class PrivilegeModelRefactor < ActiveRecord::Migration
+
+
+ def self.up
+ # remove old privileges and role mapping
+ drop_table :privileges_roles
+ drop_table :privileges
+
+ # new privilege model
+ create_table :privileges do |t|
+ t.integer :role_id, :null => false
+ t.string :target_type, :null => false
+ t.string :action, :null => false
+ t.integer :lock_version, :default => 0
+
+ t.timestamps
+ end
+
+ end
+
+ def self.down
+ drop_table :privileges
+ create_table :privileges do |t|
+ t.string :name, :null => false
+ t.integer :lock_version, :default => 0
+
+ t.timestamps
+ end
+ create_table :privileges_roles, :id => false do |t|
+ t.integer :privilege_id, :null => false
+ t.integer :role_id, :null => false
+ end
+ end
+end
diff --git a/src/db/seeds.rb b/src/db/seeds.rb
index 934d432..9a6065c 100644
--- a/src/db/seeds.rb
+++ b/src/db/seeds.rb
@@ -4,108 +4,75 @@ PoolFamily.create!(:name => "default", :description => "default pool family")
# Default Pool
Pool.create!(:name => "default_pool", :quota => Quota.create, :pool_family => PoolFamily.find_by_name('default'))
-# Create default privileges
-privileges = ["set_perms", "view_perms",
- "instance_modify", "instance_control", "instance_view",
- "stats_view",
- "account_modify", "account_view",
- "pool_modify", "pool_view",
- "quota_modify", "quota_view",
- "provider_modify", "provider_view",
- "user_modify", "user_view",
- "image_modify", "image_view"]
-Privilege.transaction do
- privileges.each do |priv_name|
- privilege = Privilege.create!(:name => priv_name)
- end
-end
# Create default roles
-roles = {"Instance Controller" =>
- {:role_scope => "Pool",
- :privileges => ["instance_control",
- "instance_view",
- "pool_view"]},
- "Instance Controller With Monitoring" =>
- {:role_scope => "Pool",
- :privileges => ["instance_control",
- "instance_view",
- "pool_view",
- "stats_view"]},
- "Instance Creator and User" =>
- {:role_scope => "Pool",
- :privileges => ["instance_control",
- "instance_view",
- "pool_view",
- "stats_view",
- "instance_modify",
- "quota_view",
- "set_perms",
- "view_perms"]},
- "Pool Creator" =>
- {:role_scope => "Provider",
- :privileges => ["provider_view",
- "pool_modify",
- "pool_view",
- "quota_view"]},
- "Pool Administrator" =>
- {:role_scope => "Provider",
- :privileges => ["provider_view",
- "pool_modify",
- "pool_view",
- "quota_view",
- "quota_modify",
- "set_perms",
- "view_perms"]},
- "Provider Administrator" =>
- {:role_scope => "Provider",
- :privileges => ["provider_modify",
- "provider_view",
- "account_modify",
- "account_view"]},
- "Account Administrator" =>
- {:role_scope => "CloudAccount",
- :privileges => ["set_perms",
- "view_perms",
- "stats_view",
- "account_view",
- "account_modify"]},
- "Account Viewer" =>
- {:role_scope => "CloudAccount",
- :privileges => ["account_view"]},
- "Provider Creator" =>
- {:role_scope => "BasePermissionObject",
- :privileges => ["provider_modify",
- "provider_view"]},
- "Administrator" =>
- {:role_scope => "BasePermissionObject",
- :privileges => ["provider_modify",
- "provider_view",
- "account_modify",
- "account_view",
- "user_modify",
- "user_view",
- "set_perms",
- "view_perms",
- "pool_modify",
- "pool_view",
- "quota_modify",
- "quota_view",
- "stats_view",
- "instance_modify",
- "instance_control",
- "instance_view",
- "image_modify",
- "image_view"]}
+VIEW = "view"
+USE = "use"
+MOD = "modify"
+CRE = "create"
+VPRM = "view_perms"
+GPRM = "set_perms"
-}
+roles =
+ {Instance =>
+ {"Instance Controller" => {Instance => [VIEW,USE]},
+ "Instance Owner" => {Instance => [VIEW,USE,MOD, VPRM,GPRM]}},
+ PoolFamily =>
+ {"Pool Family User" => {Pool => [VIEW]},
+ "Pool Family Owner" => {PoolFamily => [VIEW, MOD, VPRM,GPRM],
+ Pool => [VIEW, MOD,CRE,VPRM,GPRM]}},
+ Pool =>
+ {"Pool User" => {Pool => [VIEW],
+ Instance => [ CRE],
+ Quota => [VIEW]},
+ "Pool Owner" => {Pool => [VIEW, MOD, VPRM,GPRM],
+ Instance => [VIEW,USE,MOD,CRE],
+ Quota => [VIEW]}},
+ Provider =>
+ {"Provider Owner" => {Provider => [VIEW, MOD, VPRM,GPRM],
+ CloudAccount => [VIEW,USE,MOD,CRE,VPRM,GPRM]}},
+ CloudAccount =>
+ {"Provider Account User" => {CloudAccount => [VIEW,USE]},
+ "Provider Account Owner" => {CloudAccount => [VIEW,USE,MOD, VPRM,GPRM]}},
+ Template =>
+ {"Template User" => {Template => [VIEW,USE]},
+ "Template Owner" => {Template => [VIEW,USE,MOD, VPRM,GPRM]}},
+ BasePermissionObject =>
+ {"Provider Creator" => {Provider => [ CRE]},
+ "Provider Administrator" => {Provider => [VIEW, MOD,CRE,VPRM,GPRM],
+ CloudAccount => [VIEW,USE,MOD,CRE,VPRM,GPRM]},
+ "HWP Administrator" => {HardwareProfile => [ MOD,CRE,VPRM,GPRM]},
+ "Realm Administrator" => {Realm => [ USE,MOD,CRE,VPRM,GPRM]},
+ "Pool Creator" => {Pool => [ CRE]},
+ "Pool Administrator" => {Pool => [VIEW, MOD,CRE,VPRM,GPRM],
+ Instance => [VIEW,USE,MOD,CRE,VPRM,GPRM],
+ Quota => [VIEW, MOD],
+ PoolFamily => [VIEW, MOD,CRE,VPRM,GPRM]},
+ "Template Administrator" => {Template => [VIEW,USE,MOD,CRE,VPRM,GPRM]},
+ "Administrator" => {Provider => [VIEW, MOD,CRE,VPRM,GPRM],
+ CloudAccount => [VIEW,USE,MOD,CRE,VPRM,GPRM],
+ HardwareProfile => [ MOD,CRE,VPRM,GPRM],
+ Realm => [ USE,MOD,CRE,VPRM,GPRM],
+ User => [VIEW, MOD,CRE],
+ Pool => [VIEW, MOD,CRE,VPRM,GPRM],
+ Instance => [VIEW,USE,MOD,CRE,VPRM,GPRM],
+ Quota => [VIEW, MOD],
+ PoolFamily => [VIEW, MOD,CRE,VPRM,GPRM],
+ Template => [VIEW,USE,MOD,CRE,VPRM,GPRM],
+ BasePermissionObject => [ MOD, VPRM,GPRM]}}}
Role.transaction do
- roles.each do |role_name, role_hash|
- role = Role.create!(:name => role_name, :scope => role_hash[:role_scope])
- role.privileges = role_hash[:privileges].collect do |priv_name|
- Privilege.find_by_name(priv_name)
+ roles.each do |role_scope, scoped_hash|
+ scoped_hash.each do |role_name, role_privileges|
+ role_privileges.each do |priv_type, priv_actions|
+ role = Role.find_or_initialize_by_name(role_name)
+ role.update_attributes({:name => role_name, :scope => role_scope.name})
+ role.save!
+ priv_actions.each do |action|
+ Privilege.create!(:role => role, :target_type => priv_type.name,
+ :action => action)
+ end
+ end
end
- role.save!
end
end
@@ -118,7 +85,7 @@ MetadataObject.set("default_pool_family", PoolFamily.find_by_name('default'))
default_pool = Pool.find_by_name("default_pool")
default_quota = Quota.create
-default_role = Role.find_by_name("Instance Creator and User")
+default_role = Role.find_by_name("Pool User")
settings = {"allow_self_service_logins" => "true",
"self_service_default_quota" => default_quota,
"self_service_default_pool" => default_pool,
diff --git a/src/features/support/custom.rb b/src/features/support/custom.rb
index 12a3a45..c2c4987 100644
--- a/src/features/support/custom.rb
+++ b/src/features/support/custom.rb
@@ -1,8 +1,4 @@
#Seed the DB with fixture data
-Fixtures.reset_cache
-fixtures_folder = File.join(Rails.root, 'spec', 'fixtures')
-fixtures = Dir[File.join(fixtures_folder, '*.yml')].map {|f| File.basename(f, '.yml') }
-Fixtures.create_fixtures(fixtures_folder, fixtures)
# We can't stub out these methods properly in cucumber, and we don't want to
# couple these tests to require the core server be running (connections should be tested
diff --git a/src/features/support/hooks.rb b/src/features/support/hooks.rb
index c21d323..a00ac36 100644
--- a/src/features/support/hooks.rb
+++ b/src/features/support/hooks.rb
@@ -1,19 +1,2 @@
Before do
- @default_pool_family_metadata = Factory.create(:default_pool_family_metadata)
- @allow_self_service_logins = Factory(:metadata_object, :key => "allow_self_service_logins", :value => "true")
-
- @default_quota = Factory(:unlimited_quota)
- @self_service_default_quota = Factory(:metadata_object, :key => "self_service_default_quota",
- :value => @default_quota,
- :object_type => "Quota")
-
- @default_pool = Factory(:pool, :name => "default_pool", :quota => @default_quota)
- @self_service_default_pool = Factory(:metadata_object, :key => "self_service_default_pool",
- :value => @default_pool,
- :object_type => "Pool")
-
- @default_role = Role.find(:first, :conditions => ['name = ?', 'Instance Creator and User'])
- @self_service_default_pool = Factory(:metadata_object, :key => "self_service_default_role",
- :value => @default_role,
- :object_type => "Role")
end
diff --git a/src/lib/tasks/cucumber.rake b/src/lib/tasks/cucumber.rake
index 15034cd..453f43c 100644
--- a/src/lib/tasks/cucumber.rake
+++ b/src/lib/tasks/cucumber.rake
@@ -14,19 +14,19 @@ begin
require 'cucumber/rake/task'
namespace :cucumber do
- Cucumber::Rake::Task.new({:ok => 'db:test:prepare'}, 'Run features that should pass') do |t|
+ Cucumber::Rake::Task.new({:ok => ['db:test:prepare','db:seed']}, 'Run features that should pass') do |t|
t.binary = vendored_cucumber_bin # If nil, the gem's binary is used.
t.fork = true # You may get faster startup if you set this to false
t.profile = 'default'
end
- Cucumber::Rake::Task.new({:wip => 'db:test:prepare'}, 'Run features that are being worked on') do |t|
+ Cucumber::Rake::Task.new({:wip => ['db:test:prepare','db:seed']}, 'Run features that are being worked on') do |t|
t.binary = vendored_cucumber_bin
t.fork = true # You may get faster startup if you set this to false
t.profile = 'wip'
end
- Cucumber::Rake::Task.new({:rerun => 'db:test:prepare'}, 'Record failing features and run only them if any exist') do |t|
+ Cucumber::Rake::Task.new({:rerun => ['db:test:prepare','db:seed']}, 'Record failing features and run only them if any exist') do |t|
t.binary = vendored_cucumber_bin
t.fork = true # You may get faster startup if you set this to false
t.profile = 'rerun'
diff --git a/src/spec/controllers/instance_controller_spec.rb b/src/spec/controllers/instance_controller_spec.rb
index 241c05b..34a44c8 100644
--- a/src/spec/controllers/instance_controller_spec.rb
+++ b/src/spec/controllers/instance_controller_spec.rb
@@ -20,11 +20,11 @@ describe InstancesController do
response.should_not be_success
end
- it "should allow instance creator to launch instance" do
- @inst_user_permission = Factory :instance_creator_and_user_permission
- @inst_user = @inst_user_permission.user
- UserSession.create(@inst_user)
- pool = Permission.first(:conditions => {:permission_object_type => 'Pool', :user_id => @inst_user.id}).permission_object
+ it "should allow pool user to launch instance" do
+ @pool_user_permission = Factory :pool_user_permission
+ @pool_user = @pool_user_permission.user
+ UserSession.create(@pool_user)
+ pool = Permission.first(:conditions => {:permission_object_type => 'Pool', :user_id => @pool_user.id}).permission_object
template = Factory.build(:template)
template.save!
hwp = Factory.build(:mock_hwp1)
@@ -36,6 +36,6 @@ describe InstancesController do
:hardware_profile_id => hwp.id }
end.should change(Instance, :count).by(1)
inst = Instance.find(:first, :conditions => ['name = ?', 'mockinstance'])
- inst.owner_id.should == @inst_user.id
+ inst.owner_id.should == @pool_user.id
end
end
diff --git a/src/spec/controllers/users_controller_spec.rb b/src/spec/controllers/users_controller_spec.rb
index c1fad30..f9a3dde 100644
--- a/src/spec/controllers/users_controller_spec.rb
+++ b/src/spec/controllers/users_controller_spec.rb
@@ -3,16 +3,9 @@ require 'spec_helper'
describe UsersController do
before(:each) do
- unless BasePermissionObject.find_by_name(BasePermissionObject::GENERAL_PERMISSION_SCOPE)
- Factory(:base_permission_object)
- end
@tuser = Factory :tuser
@admin_permission = Factory :admin_permission
- @admin_permission.role.privileges << Privilege.find_by_name('user_modify')
@admin = @admin_permission.user
- Factory.create(:default_quota_metadata)
- Factory.create(:default_role_metadata)
- Factory.create(:default_pool_metadata)
activate_authlogic
end
diff --git a/src/spec/factories/base_permission_object.rb b/src/spec/factories/base_permission_object.rb
deleted file mode 100644
index ccc2bf1..0000000
--- a/src/spec/factories/base_permission_object.rb
+++ /dev/null
@@ -1,3 +0,0 @@
-Factory.define :base_permission_object do |o|
- o.name BasePermissionObject::GENERAL_PERMISSION_SCOPE
-end
diff --git a/src/spec/factories/metadata_object.rb b/src/spec/factories/metadata_object.rb
deleted file mode 100644
index fea2f88..0000000
--- a/src/spec/factories/metadata_object.rb
+++ /dev/null
@@ -1,34 +0,0 @@
-Factory.define :metadata_object do |o|
- o.key 'key'
- o.value 'value'
- o.object_type nil
-end
-
-Factory.define :default_logins_metadata, :parent => :metadata_object do |o|
- o.key 'allow_self_service_logins'
- o.value 'true'
-end
-
-Factory.define :default_pool_family_metadata, :parent => :metadata_object do |o|
- o.key 'default_pool_family'
- o.value {Factory.create(:pool_family).id}
- o.object_type 'PoolFamily'
-end
-
-Factory.define :default_quota_metadata, :parent => :metadata_object do |o|
- o.key 'self_service_default_quota'
- o.value {Factory.create(:quota).id}
- o.object_type 'Quota'
-end
-
-Factory.define :default_role_metadata, :parent => :metadata_object do |o|
- o.key 'self_service_default_role'
- o.value {Factory.create(:role).id}
- o.object_type 'Role'
-end
-
-Factory.define :default_pool_metadata, :parent => :metadata_object do |o|
- o.key 'self_service_default_pool'
- o.value {Factory.create(:pool).id}
- o.object_type 'Pool'
-end
diff --git a/src/spec/factories/permission.rb b/src/spec/factories/permission.rb
index 9ccd3e7..f260ad7 100644
--- a/src/spec/factories/permission.rb
+++ b/src/spec/factories/permission.rb
@@ -16,12 +16,12 @@ end
Factory.define :pool_creator_permission, :parent => :permission do |p|
p.role { |r| Role.first(:conditions => ['name = ?', 'Pool Creator']) || Factory(:role, :name => 'Pool Creator') }
- p.permission_object { |r| r.association(:mock_provider) }
- p.user { |u| u.association(:pool_creator) }
+ p.permission_object { |r| BasePermissionObject.general_permission_scope }
+ p.user { |u| u.association(:pool_creator_user) }
end
-Factory.define :instance_creator_and_user_permission, :parent => :permission do |p|
- p.role { |r| Role.first(:conditions => ['name = ?', 'Instance Creator and User']) || Factory(:role, :name => 'Instance Creator and User') }
+Factory.define :pool_user_permission, :parent => :permission do |p|
+ p.role { |r| Role.first(:conditions => ['name = ?', 'Pool User']) || Factory(:role, :name => 'Pool User') }
p.permission_object { |r| r.association(:pool) }
p.user { |u| u.association(:user) }
end
diff --git a/src/spec/factories/pool.rb b/src/spec/factories/pool.rb
index 32e8c99..3b20f96 100644
--- a/src/spec/factories/pool.rb
+++ b/src/spec/factories/pool.rb
@@ -1,6 +1,6 @@
Factory.define :pool do |p|
p.sequence(:name) { |n| "mypool#{n}" }
- p.association :pool_family, :factory => :pool_family
+ p.pool_family { |p| PoolFamily.find_by_name('default') }
p.association :quota
end
diff --git a/src/spec/factories/pool_family.rb b/src/spec/factories/pool_family.rb
index 4a890ce..d0ca8e7 100644
--- a/src/spec/factories/pool_family.rb
+++ b/src/spec/factories/pool_family.rb
@@ -1,4 +1,4 @@
Factory.define :pool_family do |z|
z.sequence(:name) { |n| "pool_family#{n}" }
- z.description 'default pool family'
+ z.description 'pool family'
end
diff --git a/src/spec/factories/user.rb b/src/spec/factories/user.rb
index e737a35..a9dd23e 100644
--- a/src/spec/factories/user.rb
+++ b/src/spec/factories/user.rb
@@ -14,10 +14,13 @@ end
Factory.define :admin_user, :parent => :user do |u|
end
+Factory.define :pool_creator_user, :parent => :user do |u|
+end
+
Factory.define :provider_admin_user, :parent => :user do |u|
end
Factory.define :pool_user, :parent => :user do |u|
u.sequence(:login) { |n| "pool_user#{n}" }
u.email { |e| "#{e.login}(a)example.com" }
-end
\ No newline at end of file
+end
diff --git a/src/spec/fixtures/base_permission_objects.yml b/src/spec/fixtures/base_permission_objects.yml
deleted file mode 100644
index a520969..0000000
--- a/src/spec/fixtures/base_permission_objects.yml
+++ /dev/null
@@ -1,2 +0,0 @@
-general_permission_scope:
- name: 'general_permission_scope'
diff --git a/src/spec/fixtures/privileges.yml b/src/spec/fixtures/privileges.yml
deleted file mode 100644
index 16723de..0000000
--- a/src/spec/fixtures/privileges.yml
+++ /dev/null
@@ -1,43 +0,0 @@
-# Read about fixtures at http://ar.rubyonrails.org/classes/Fixtures.html
-
-# one:
-# column: value
-#
-# two:
-# column: value
-set_perms:
- name: set_perms
-view_perms:
- name: view_perms
-instance_modify:
- name: instance_modify
-instance_control:
- name: instance_control
-instance_view:
- name: instance_view
-stats_view:
- name: stats_view
-account_modify:
- name: account_modify
-account_view:
- name: account_view
-pool_modify:
- name: pool_modify
-pool_view:
- name: pool_view
-quota_modify:
- name: quota_modify
-quota_view:
- name: quota_view
-provider_modify:
- name: provider_modify
-provider_view:
- name: provider_view
-user_modify:
- name: user_modify
-user_view:
- name: user_view
-image_modify:
- name: image_modify
-image_view:
- name: image_view
diff --git a/src/spec/fixtures/roles.yml b/src/spec/fixtures/roles.yml
deleted file mode 100644
index d3ed623..0000000
--- a/src/spec/fixtures/roles.yml
+++ /dev/null
@@ -1,47 +0,0 @@
-# Read about fixtures at http://ar.rubyonrails.org/classes/Fixtures.html
-
-# one:
-# column: value
-#
-# two:
-# column: value
-instance_controller:
- name: Instance Controller
- scope: Pool
- privileges: instance_control, instance_view, pool_view
-instance_controller_with_monitoring:
- name: Instance Controller With Monitoring
- scope: Pool
- privileges: instance_control, instance_view, pool_view, stats_view
-instance_creator_and_user:
- name: Instance Creator and User
- scope: Pool
- privileges: instance_control, instance_view, pool_view, stats_view, instance_modify, quota_view, set_perms, view_perms
-pool_creator:
- name: Pool Creator
- scope: Provider
- privileges: provider_view, pool_modify, pool_view, quota_view
-pool_administrator:
- name: Pool Administrator
- scope: Provider
- privileges: provider_view, pool_modify, pool_view, quota_modify, quota_view, stats_view, set_perms, view_perms
-provider_administrator:
- name: Provider Administrator
- scope: Provider
- privileges: provider_modify, provider_view, account_modify, account_view, stats_view
-account_administrator:
- name: Account Administrator
- scope: CloudAccount
- privileges: account_modify, account_view, stats_view, set_perms, view_perms
-account_viewer:
- name: Account Viewer
- scope: CloudAccount
- privileges: account_view
-provider_creator:
- name: Provider Creator
- scope: BasePermissionObject
- privileges: provider_modify, provider_view, stats_view
-administrator:
- name: Administrator
- scope: BasePermissionObject
- privileges: provider_modify, provider_view, account_modify, account_view, user_modify, user_view, set_perms, view_perms, pool_modify, pool_view, quota_modify, quota_view, stats_view, instance_modify, instance_control, instance_view, image_modify, image_view
diff --git a/src/spec/models/metadata_object_spec.rb b/src/spec/models/metadata_object_spec.rb
index e3a74f8..0290b57 100644
--- a/src/spec/models/metadata_object_spec.rb
+++ b/src/spec/models/metadata_object_spec.rb
@@ -3,7 +3,7 @@ require 'spec_helper'
describe MetadataObject do
before(:each) do
- @default_pool_family_metadata = Factory :default_pool_family_metadata
+ @default_pool_family_metadata = MetadataObject.find_by_key("default_pool_family")
end
it "lookup on nonexistent key should return nil" do
diff --git a/src/spec/models/permission_spec.rb b/src/spec/models/permission_spec.rb
new file mode 100644
index 0000000..4a56baf
--- /dev/null
+++ b/src/spec/models/permission_spec.rb
@@ -0,0 +1,58 @@
+require 'spec_helper'
+
+describe Permission do
+
+ before(:each) do
+ @admin_permission = Factory :admin_permission
+ @provider_admin_permission = Factory :provider_admin_permission
+ @pool_creator_permission = Factory :pool_creator_permission
+ @pool_user_permission = Factory :pool_user_permission
+
+ @admin = @admin_permission.user
+ @provider_admin = @provider_admin_permission.user
+ @pool_creator = @pool_creator_permission.user
+ @pool_user = @pool_user_permission.user
+
+ @provider = @provider_admin_permission.provider
+ @pool = @pool_user_permission.pool
+ end
+
+ it "Admin should be able to create users" do
+ BasePermissionObject.general_permission_scope.has_privilege(@admin,
+ Privilege::CREATE,
+ User).should be_true
+ end
+
+ it "Provider Admin should NOT be able to create users" do
+ BasePermissionObject.general_permission_scope.has_privilege(@provider_admin,
+ Privilege::CREATE,
+ User).should be_false
+ end
+
+ it "Pool User should NOT be able to create users" do
+ BasePermissionObject.general_permission_scope.has_privilege(@pool_user,
+ Privilege::CREATE,
+ User).should be_false
+ end
+
+ it "Provider Admin should be able to edit provider" do
+ @provider.has_privilege(@provider_admin, Privilege::MODIFY).should be_true
+ end
+
+ it "Admin should be able to edit provider" do
+ @provider.has_privilege(@admin, Privilege::MODIFY).should be_true
+ end
+
+ it "Pool User should NOT be able to edit provider" do
+ @provider.has_privilege(@pool_user, Privilege::MODIFY).should be_false
+ end
+
+ it "Pool User should be able to create instances in @pool" do
+ @pool.has_privilege(@pool_user, Privilege::CREATE, Instance).should be_true
+ end
+
+ it "Pool User should NOT be able to create instances in another pool" do
+ Factory(:tpool).has_privilege(@pool_user, Privilege::CREATE, Instance).should be_false
+ end
+
+end
diff --git a/src/spec/models/pool_family_spec.rb b/src/spec/models/pool_family_spec.rb
index 1210b48..2b69eab 100644
--- a/src/spec/models/pool_family_spec.rb
+++ b/src/spec/models/pool_family_spec.rb
@@ -22,8 +22,8 @@ describe PoolFamily do
end
it "should have pool" do
- @pool_family.pools.size.should == 1
- @pool_family.pools[0].id.should == @pool.id
+ @pool_family.pools.size.should == 2 #default pool + pool created here
+ @pool.pool_family.id.should == @pool_family.id
end
it "should have account" do
diff --git a/src/spec/services/registration_service_spec.rb b/src/spec/services/registration_service_spec.rb
index 41f6764..810fe6e 100644
--- a/src/spec/services/registration_service_spec.rb
+++ b/src/spec/services/registration_service_spec.rb
@@ -3,9 +3,6 @@ require 'spec_helper'
describe RegistrationService do
before(:each) do
- Factory.create(:default_quota_metadata)
- Factory.create(:default_role_metadata)
- Factory.create(:default_pool_metadata)
end
describe "with validations" do
@@ -22,20 +19,15 @@ describe RegistrationService do
it "should register a user with default pool/quota/role when default settings set" do
@user = Factory :user
- @pool = Factory(:pool, :name => "default_pool")
- privilege = Privilege.find_by_name('instance_view')
- @role = Factory(:role, :privileges => [privilege])
+ @pool = MetadataObject.lookup("self_service_default_pool")
+ @role = MetadataObject.lookup("self_service_default_role")
@quota = Factory :quota
-
- MetadataObject.set("allow_self_service_logins", "true")
- MetadataObject.set("self_service_default_pool", @pool)
- MetadataObject.set("self_service_default_role", @role)
MetadataObject.set("self_service_default_quota", @quota)
@registration_service = RegistrationService.new(@user)
@registration_service.save
- @pools = Pool.list_for_user(@user, Privilege::INSTANCE_VIEW)
+ @pools = Pool.list_for_user(@user, Privilege::CREATE, :target_type => Instance)
@pools.length.should == 1
@pools[0].name.should == "default_pool"
diff --git a/src/spec/spec_helper.rb b/src/spec/spec_helper.rb
index 90f0eaf..88413c0 100644
--- a/src/spec/spec_helper.rb
+++ b/src/spec/spec_helper.rb
@@ -56,7 +56,6 @@ Spec::Runner.configure do |config|
# For more information take a look at Spec::Runner::Configuration and Spec::Runner
config.before(:each, :type => :controller) do
#activate_authlogic
- @default_pool_family_metadata = Factory.create(:default_pool_family_metadata)
end
config.after(:each, :type => :controller) do
#current_user_session.destroy
@@ -66,6 +65,7 @@ Spec::Runner.configure do |config|
config.before(:suite) do
DatabaseCleaner.strategy = :truncation
DatabaseCleaner.clean_with(:truncation)
+ load "#{Rails.root}/db/seeds.rb"
end
config.before(:each) do
DatabaseCleaner.start
--
1.7.3.4
2
2
26 Jan '11
ACK to the series
On 01/26/2011 03:42 PM, mtaylor(a)redhat.com wrote:
> From: Martyn Taylor<mtaylor(a)redhat.com>
>
> ---
> src/features/step_definitions/template_steps.rb | 12 ++++++
> src/features/template.feature | 43 +++++++++++++++++++++++
> 2 files changed, 55 insertions(+), 0 deletions(-)
>
> diff --git a/src/features/step_definitions/template_steps.rb b/src/features/step_definitions/template_steps.rb
> index 24dea3b..79a6739 100644
> --- a/src/features/step_definitions/template_steps.rb
> +++ b/src/features/step_definitions/template_steps.rb
> @@ -42,6 +42,18 @@ Given /^I jump on the "([^"]*)" template software page$/ do |name|
> visit url_for(:action => 'software', :controller => 'templates', :id => @template)
> end
>
> +Given /^there are these templates:$/ do |table|
> + table.hashes.each do |hash|
> + @template = Factory.build (:template, :name => hash['name'],
> + :platform => hash['platform'])
> + @template.save!
> + @template.platform_version = hash['platform_version']
> + @template.architecture = hash['architecture']
> + @template.summary = hash['summary']
> + @template.save!
> + end
> +end
> +
> Then /^I should have a template named "([^"]*)"$/ do |name|
> Template.first(:order => 'created_at DESC').xml.name.should eql(name)
> end
> diff --git a/src/features/template.feature b/src/features/template.feature
> index 272573a..b7d75a8 100644
> --- a/src/features/template.feature
> +++ b/src/features/template.feature
> @@ -124,3 +124,46 @@ Feature: Manage Templates
> And I press "Build"
> Then I should be on the templates page
> And I should see "Build imported template is not supported"
> +
> + Scenario: Search for templates
> + Given there are these templates:
> + | name | platform | platform_version | architecture | summary |
> + | Test1 | fedora | 13 | x86_64 | Test Template Fedora 13 64 bit Description |
> + | Mock | fedora | 14 | i386 | Test Template Fedora 14 Description |
> + | Other | fedora | 10.04 | i386 | Test Template Ubuntu 10.04 32 bit Description |
> + And I am on the image factory templates page
> + Then I should see the following:
> + | NAME | OS | VERSION | ARCH |
> + | Test1 | fedora | 13 | x86_64 |
> + | Mock | fedora | 14 | i386 |
> + | Other | fedora | 10.04 | i386 |
> + When I fill in "q" with "test"
> + And I press "Search"
> + Then I should see "Test1"
> + And I should see "Mock"
> + And I should see "Other"
> + When I fill in "q" with "Mock"
> + And I press "Search"
> + Then I should see "Mock"
> + And I should not see "Test1"
> + And I should not see "Other"
> + When I fill in "q" with "13"
> + And I press "Search"
> + Then I should see "Test1"
> + And I should not see "Other"
> + And I should not see "Mock"
> + When I fill in "q" with "x86_64"
> + And I press "Search"
> + Then I should see "Test1"
> + And I should not see "Other"
> + And I should not see "Mock"
> + When I fill in "q" with "fedora"
> + And I press "Search"
> + Then I should see "Test1"
> + And I should see "Other"
> + And I should see "Mock"
> + When I fill in "q" with "32 bit Description"
> + And I press "Search"
> + Then I should not see "Test1"
> + And I should see "Other"
> + And I should not see "Mock"
> \ No newline at end of file
1
0
---
src/app/views/layouts/newui.haml | 2 --
1 files changed, 0 insertions(+), 2 deletions(-)
diff --git a/src/app/views/layouts/newui.haml b/src/app/views/layouts/newui.haml
index b5870a2..681f607 100644
--- a/src/app/views/layouts/newui.haml
+++ b/src/app/views/layouts/newui.haml
@@ -21,8 +21,6 @@
/= javascript_include_tag "jquery.html5form"
= yield :scripts
%body{:id => controller.section_id}
- %a{ :href => '', :onClick => "document.cookie = 'layout=aggregator'"}
- Switch to the old UI
%div#head
%header.container_16
= render :partial => '/layouts/header'
--
1.7.3.4
2
2
Privileges are now a combination of a base action and a target object type (i.e. "modify" on Pool instead of the flat string "pool_modify"). In addition, the modeling has changed -- instead of a privileges model that was only low-level privileges with an explicit mapping to roles, the privileges model now tracks the privileges assigned to each role, with no separate mapping table.
This will require a database reload as the seeds.rb required substantial changes in role/privilege loading
Signed-off-by: Scott Seago <sseago(a)redhat.com>
---
.../admin/provider_accounts_controller.rb | 11 +-
src/app/controllers/admin/providers_controller.rb | 23 ++-
src/app/controllers/admin/settings_controller.rb | 15 +--
src/app/controllers/admin/users_controller.rb | 33 +---
src/app/controllers/application_controller.rb | 11 +-
src/app/controllers/builds_controller.rb | 10 +-
src/app/controllers/cloud_accounts_controller.rb | 20 ++--
src/app/controllers/dashboard_controller.rb | 10 --
.../controllers/hardware_profiles_controller.rb | 1 -
.../controllers/image_factory/builds_controller.rb | 8 +-
.../image_factory/templates_controller.rb | 66 ++++++---
src/app/controllers/instances_controller.rb | 12 +-
src/app/controllers/permissions_controller.rb | 4 +-
src/app/controllers/pools_controller.rb | 38 ++----
src/app/controllers/providers_controller.rb | 27 ++--
src/app/controllers/quotas_controller.rb | 8 +-
.../controllers/resources/instances_controller.rb | 10 +-
src/app/controllers/resources/pools_controller.rb | 15 +-
src/app/controllers/settings_controller.rb | 17 +--
src/app/controllers/templates_controller.rb | 50 ++++--
src/app/controllers/users_controller.rb | 79 ++++------
src/app/models/cloud_account.rb | 21 +++
src/app/models/instance.rb | 26 +++-
src/app/models/permission.rb | 6 +
src/app/models/permissioned_object.rb | 136 +++++++---------
src/app/models/privilege.rb | 168 +++++++++++++-------
src/app/models/role.rb | 7 +-
src/app/models/template.rb | 5 +
src/app/services/application_service.rb | 35 +++--
src/app/views/admin/users/_form.haml | 4 +-
src/app/views/admin/users/edit.haml | 2 +-
src/app/views/dashboard/summary.haml | 20 ++--
src/app/views/layouts/_main_nav.html.erb | 2 +-
src/app/views/permissions/list.haml | 6 +-
src/app/views/pools/show.haml | 2 +-
src/app/views/providers/accounts.haml | 4 +-
src/app/views/users/_form.haml | 4 +-
src/app/views/users/edit.haml | 2 +-
.../20110107000000_privilege_model_refactor.rb | 53 ++++++
src/db/seeds.rb | 163 ++++++++------------
src/features/support/custom.rb | 4 -
src/features/support/hooks.rb | 17 --
src/lib/tasks/cucumber.rake | 6 +-
src/spec/controllers/instance_controller_spec.rb | 12 +-
src/spec/controllers/users_controller_spec.rb | 7 -
src/spec/factories/base_permission_object.rb | 3 -
src/spec/factories/metadata_object.rb | 34 ----
src/spec/factories/permission.rb | 8 +-
src/spec/factories/pool.rb | 2 +-
src/spec/factories/pool_family.rb | 2 +-
src/spec/factories/user.rb | 5 +-
src/spec/fixtures/base_permission_objects.yml | 2 -
src/spec/fixtures/privileges.yml | 43 -----
src/spec/fixtures/roles.yml | 47 ------
src/spec/models/metadata_object_spec.rb | 2 +-
src/spec/models/permission_spec.rb | 58 +++++++
src/spec/models/pool_family_spec.rb | 4 +-
src/spec/services/registration_service_spec.rb | 14 +--
src/spec/spec_helper.rb | 2 +-
59 files changed, 706 insertions(+), 700 deletions(-)
create mode 100644 src/db/migrate/20110107000000_privilege_model_refactor.rb
delete mode 100644 src/spec/factories/base_permission_object.rb
delete mode 100644 src/spec/factories/metadata_object.rb
delete mode 100644 src/spec/fixtures/base_permission_objects.yml
delete mode 100644 src/spec/fixtures/privileges.yml
delete mode 100644 src/spec/fixtures/roles.yml
create mode 100644 src/spec/models/permission_spec.rb
diff --git a/src/app/controllers/admin/provider_accounts_controller.rb b/src/app/controllers/admin/provider_accounts_controller.rb
index 7a63d38..d422a53 100644
--- a/src/app/controllers/admin/provider_accounts_controller.rb
+++ b/src/app/controllers/admin/provider_accounts_controller.rb
@@ -18,6 +18,7 @@ class Admin::ProviderAccountsController < ApplicationController
def show
@tab_captions = ['Properties', 'Credentials', 'History', 'Permissions']
@account = CloudAccount.find(params[:id])
+ require_privilege(Privilege::VIEW, @account)
@details_tab = params[:details_tab].blank? ? 'properties' : params[:details_tab]
if params.delete :test_account
@@ -44,7 +45,7 @@ class Admin::ProviderAccountsController < ApplicationController
def create
@provider = Provider.find(params[:provider_id])
- require_privilege(Privilege::ACCOUNT_MODIFY, @provider)
+ require_privilege(Privilege::CREATE, CloudAccount, @provider)
@providers = Provider.all
@cloud_account = CloudAccount.new(params[:cloud_account])
@@ -83,13 +84,13 @@ class Admin::ProviderAccountsController < ApplicationController
@cloud_account = CloudAccount.find(params[:id])
@quota = @cloud_account.quota
@provider = @cloud_account.provider
- require_privilege(Privilege::ACCOUNT_MODIFY,@provider)
+ require_privilege(Privilege::MODIFY,@cloud_account)
end
def update
@cloud_account = CloudAccount.find(params[:id])
@provider = @cloud_account.provider
- require_privilege(Privilege::ACCOUNT_MODIFY, @provider)
+ require_privilege(Privilege::MODIFY,@cloud_account)
@quota = @cloud_account.quota
if params.delete :test_account
@@ -111,7 +112,9 @@ class Admin::ProviderAccountsController < ApplicationController
if (not params[:accounts_selected]) or (params[:accounts_selected].length == 0)
flash[:notice] = "You must select some accounts first."
else
- CloudAccount.destroy(params[:accounts_selected])
+ CloudAccount.find(params[:accounts_selected]).each do |account|
+ account.destroy if check_privilege(Privilege::MODIFY, account)
+ end
end
redirect_to admin_provider_accounts_url
end
diff --git a/src/app/controllers/admin/providers_controller.rb b/src/app/controllers/admin/providers_controller.rb
index 98ebc77..a898d72 100644
--- a/src/app/controllers/admin/providers_controller.rb
+++ b/src/app/controllers/admin/providers_controller.rb
@@ -17,20 +17,21 @@ class Admin::ProvidersController < ApplicationController
end
def new
- require_privilege(Privilege::PROVIDER_MODIFY)
+ require_privilege(Privilege::CREATE, Provider)
@provider = Provider.new
kick_condor
end
def edit
@provider = Provider.find_by_id(params[:id])
- require_privilege(Privilege::PROVIDER_MODIFY, @provider)
+ require_privilege(Privilege::MODIFY, @provider)
end
def show
load_providers
@provider = Provider.find(params[:id])
@url_params = params.clone
+ require_privilege(Privilege::VIEW, @provider)
@tab_captions = ['Properties', 'HW Profiles', 'Realms', 'Provider Accounts', 'Services','History','Permissions']
@details_tab = params[:details_tab].blank? ? 'properties' : params[:details_tab]
respond_to do |format|
@@ -45,7 +46,7 @@ class Admin::ProvidersController < ApplicationController
end
def create
- require_privilege(Privilege::PROVIDER_MODIFY)
+ require_privilege(Privilege::CREATE, Provider)
@provider = Provider.new(params[:provider])
if params[:test_connection]
test_connection(@provider)
@@ -64,8 +65,8 @@ class Admin::ProvidersController < ApplicationController
end
def update
- require_privilege(Privilege::PROVIDER_MODIFY)
@provider = Provider.find_by_id(params[:id])
+ require_privilege(Privilege::MODIFY, @provider)
previous_cloud_type = @provider.cloud_type
@provider.update_attributes(params[:provider])
if params[:test_connection]
@@ -89,7 +90,9 @@ class Admin::ProvidersController < ApplicationController
end
def multi_destroy
- Provider.destroy(params[:provider_selected])
+ Provider.find(params[:provider_selected]).each do |provider|
+ provider.destroy if check_privilege(Privilege::MODIFY, provider)
+ end
redirect_to admin_providers_url
end
@@ -111,7 +114,11 @@ class Admin::ProvidersController < ApplicationController
@url_params = params.clone
end
- def load_providers
- @providers = Provider.list_for_user(@current_user, Privilege::PROVIDER_VIEW)
- end
+ def load_providers
+ @header = [{ :name => "Provider name", :sort_attr => :name },
+ { :name => "Provider URL", :sort_attr => :name }
+ ]
+ @providers = Provider.list_for_user(@current_user, Privilege::VIEW)
+ @url_params = params.clone
+ end
end
diff --git a/src/app/controllers/admin/settings_controller.rb b/src/app/controllers/admin/settings_controller.rb
index accf398..a6f5cec 100644
--- a/src/app/controllers/admin/settings_controller.rb
+++ b/src/app/controllers/admin/settings_controller.rb
@@ -6,18 +6,12 @@ class Admin::SettingsController < ApplicationController
KEYS = [SELF_SERVICE_DEFAULT_QUOTA]
def self_service
- if !is_admin?
- raise PermissionError.new('You have insufficient privileges to perform action.')
- return
- end
+ require_privilege(Privilege::MODIFY)
@self_service_default_quota = MetadataObject.lookup(SELF_SERVICE_DEFAULT_QUOTA)
end
def general_settings
- if !is_admin?
- raise PermissionError.new('You have insufficient privileges to perform action.')
- return
- end
+ require_privilege(Privilege::MODIFY)
end
def update
@@ -47,9 +41,4 @@ class Admin::SettingsController < ApplicationController
redirect_to :action => 'self_service'
end
- private
- def is_admin?
- is_admin = @current_user.permissions.collect { |p| p.role }.find { |r| r.name == "Administrator" }
- return is_admin == nil ? false : true
- end
end
diff --git a/src/app/controllers/admin/users_controller.rb b/src/app/controllers/admin/users_controller.rb
index 1c48dcb..58aabf8 100644
--- a/src/app/controllers/admin/users_controller.rb
+++ b/src/app/controllers/admin/users_controller.rb
@@ -1,9 +1,9 @@
class Admin::UsersController < ApplicationController
before_filter :require_user
- before_filter :only_admin, :only => [:index, :multi_destroy]
before_filter :load_users, :only => [:show]
def index
+ require_privilege(Privilege::VIEW, User)
@params = params
@search_term = params[:q]
if @search_term.blank?
@@ -18,6 +18,7 @@ class Admin::UsersController < ApplicationController
end
def new
+ require_privilege(Privilege::CREATE, User) unless current_user.nil?
@user = User.new
@user.quota = Quota.new
end
@@ -27,8 +28,7 @@ class Admin::UsersController < ApplicationController
redirect_to :action => 'new' and return
end
- # TODO: Shouldn't it be if current_user.nil? instead?
- require_privilege(Privilege::USER_MODIFY) unless current_user.nil?
+ require_privilege(Privilege::MODIFY, User) unless current_user.nil?
@user = User.new(params[:user])
@registration = RegistrationService.new(@user)
@@ -48,6 +48,7 @@ class Admin::UsersController < ApplicationController
def show
@user = User.find_by_id(params[:id]) || current_user
+ require_privilege(Privilege::VIEW, User) unless current_user == @user
@quota_resources = @user.quota.quota_resources
@url_params = params.clone
@@ -66,15 +67,12 @@ class Admin::UsersController < ApplicationController
def edit
@user = User.find_by_id(params[:id]) || current_user
-
- if cannot_modify_different_user?(@user)
- flash[:notice] = "Invalid Permission to perform this operation"
- redirect_to dashboard_url and return
- end
+ require_privilege(Privilege::MODIFY, User) unless @user == current_user
end
def update
@user = User.find_by_id(params[:id]) || current_user
+ require_privilege(Privilege::MODIFY, User) unless @user == current_user
if params[:commit] == "Reset"
redirect_to edit_admin_user_url(@user) and return
@@ -82,20 +80,16 @@ class Admin::UsersController < ApplicationController
redirect_to dashboard_url and return unless @user
- if cannot_modify_different_user = cannot_modify_different_user?(@user)
- flash[:notice] = "Invalid Permission to perform this operation"
- redirect_to dashboard_url and return
- end
-
unless @user.update_attributes(params[:user])
render :action => 'edit' and return
else
flash[:notice] = "User updated!"
- redirect_to cannot_modify_different_user ? dashboard_url : admin_users_url
+ redirect_to (@user == current_user) ? dashboard_url : admin_users_url
end
end
def multi_destroy
+ require_privilege(Privilege::MODIFY, User)
User.destroy(params[:user_selected])
redirect_to admin_users_url
end
@@ -115,15 +109,4 @@ class Admin::UsersController < ApplicationController
end
end
- def only_admin
- unless current_user.permissions.collect { |p| p.role }.find { |r| r.name == "Administrator" }
- flash[:notice] = "Invalid Permission to perform this operation"
- redirect_to dashboard_url
- end
- end
-
- def cannot_modify_different_user?(user)
- user && user != current_user && !BasePermissionObject.general_permission_scope.can_modify_users(current_user)
- end
-
end
diff --git a/src/app/controllers/application_controller.rb b/src/app/controllers/application_controller.rb
index b77fe9c..5b6c500 100644
--- a/src/app/controllers/application_controller.rb
+++ b/src/app/controllers/application_controller.rb
@@ -60,13 +60,6 @@ class ApplicationController < ActionController::Base
'generic'
end
- perm_helper_string = ""
- Privilege::FULL_PRIVILEGE_LIST.each do |privilege|
- perm_helper_string += "def has_#{privilege}?(obj=@perm_obj); " +
- "check_privilege(\"#{privilege}\", obj) end; "
- end
- master_helper_module.module_eval perm_helper_string
-
helper_method :check_privilege
protected
@@ -162,8 +155,8 @@ class ApplicationController < ActionController::Base
def get_nav_items
if current_user.present?
- @providers = Provider.list_for_user(@current_user, Privilege::PROVIDER_VIEW)
- @pools = Pool.list_for_user(@current_user, Privilege::POOL_VIEW)
+ @providers = Provider.list_for_user(@current_user, Privilege::VIEW)
+ @pools = Pool.list_for_user(@current_user, Privilege::VIEW)
end
end
diff --git a/src/app/controllers/builds_controller.rb b/src/app/controllers/builds_controller.rb
index 7cf0ad6..5f33ba3 100644
--- a/src/app/controllers/builds_controller.rb
+++ b/src/app/controllers/builds_controller.rb
@@ -1,12 +1,12 @@
class BuildsController < ApplicationController
- before_filter [:require_user, :check_permission]
+ before_filter [:require_user]
def section_id
'build'
end
def index
- require_privilege(Privilege::IMAGE_VIEW)
+ require_privilege(Privilege::VIEW, Template)
order = get_order('templates.name')
@running_images = Image.all(:include => :template, :conditions => ['status IN (?)', Image::ACTIVE_STATES], :order => order)
@completed_images = Image.all(:include => :template, :conditions => {:status => Image::STATE_COMPLETE}, :order => order)
@@ -16,6 +16,7 @@ class BuildsController < ApplicationController
def new
raise "select template to build" unless id = params[:template_id]
@tpl = Template.find(id)
+ check_permission
if @tpl.imported
flash[:warning] = "Build imported template is not supported"
redirect_to templates_path
@@ -30,6 +31,7 @@ class BuildsController < ApplicationController
end
@tpl = Template.find(params[:template_id])
+ check_permission
@all_targets = Image.available_targets
if params[:targets].blank?
@@ -60,9 +62,11 @@ class BuildsController < ApplicationController
end
def edit
+ # FIXME: is @tpl defined here? do we need check_permission here?
end
def update
+ # FIXME: is @tpl defined here? do we need check_permission here?
end
private
@@ -82,6 +86,6 @@ class BuildsController < ApplicationController
end
def check_permission
- require_privilege(Privilege::IMAGE_MODIFY)
+ require_privilege(Privilege::MODIFY, @tpl)
end
end
diff --git a/src/app/controllers/cloud_accounts_controller.rb b/src/app/controllers/cloud_accounts_controller.rb
index 75a75d9..d292f57 100644
--- a/src/app/controllers/cloud_accounts_controller.rb
+++ b/src/app/controllers/cloud_accounts_controller.rb
@@ -31,19 +31,19 @@ class CloudAccountsController < ApplicationController
def index
@provider = Provider.find(params[:provider_id])
- require_privilege(Privilege::ACCOUNT_VIEW, @provider)
+ require_privilege(Privilege::VIEW, CloudAccount, @provider)
end
def new
@provider = Provider.find(params[:provider_id])
@cloud_account = CloudAccount.new
@quota = Quota.new
- require_privilege(Privilege::ACCOUNT_MODIFY, @provider)
+ require_privilege(Privilege::CREATE, CloudAccount, @provider)
end
def create
@provider = Provider.find(params[:provider_id])
- require_privilege(Privilege::ACCOUNT_MODIFY,@provider)
+ require_privilege(Privilege::CREATE, CloudAccount, @provider)
@cloud_account = CloudAccount.new(params[:cloud_account])
@cloud_account.provider = @provider
@cloud_account.quota = @quota = Quota.new
@@ -80,13 +80,13 @@ class CloudAccountsController < ApplicationController
@cloud_account = CloudAccount.find(params[:id])
@quota = @cloud_account.quota
@provider = @cloud_account.provider
- require_privilege(Privilege::ACCOUNT_MODIFY,@provider)
+ require_privilege(Privilege::MODIFY, @cloud_account)
end
def update_accounts
@provider = Provider.find(params[:provider][:id])
- require_privilege(Privilege::ACCOUNT_MODIFY, @provider)
- @providers = Provider.list_for_user(@current_user, Privilege::PROVIDER_VIEW)
+ require_privilege(Privilege::MODIFY, CloudAccount, @provider)
+ @providers = Provider.list_for_user(@current_user, Privilege::VIEW)
success = true
@provider.cloud_accounts.each do |cloud_account|
@@ -130,7 +130,7 @@ class CloudAccountsController < ApplicationController
def update
@cloud_account = CloudAccount.find(params[:id])
@provider = @cloud_account.provider
- require_privilege(Privilege::ACCOUNT_MODIFY, @provider)
+ require_privilege(Privilege::MODIFY, @cloud_account)
@quota = @cloud_account.quota
limit = params[:quota][:maximum_running_instances] if params[:quota]
@@ -145,7 +145,7 @@ class CloudAccountsController < ApplicationController
def key
@cloud_account = CloudAccount.find(params[:id])
- require_privilege(Privilege::ACCOUNT_MODIFY,@cloud_account.provider)
+ require_privilege(Privilege::MODIFY,@cloud_account)
unless @cloud_account.instance_key.nil?
render :text => @cloud_account.instance_key.pem
end
@@ -154,7 +154,7 @@ class CloudAccountsController < ApplicationController
def destroy
account = CloudAccount.find(params[:id])
provider = account.provider
- require_privilege(Privilege::ACCOUNT_MODIFY, provider)
+ require_privilege(Privilege::MODIFY, account)
if account.destroy
flash[:notice] = "Cloud Account destroyed"
else
@@ -176,6 +176,6 @@ class CloudAccountsController < ApplicationController
private
def load_providers
- @providers = Provider.list_for_user(@current_user, Privilege::PROVIDER_VIEW)
+ @providers = Provider.list_for_user(@current_user, Privilege::VIEW)
end
end
diff --git a/src/app/controllers/dashboard_controller.rb b/src/app/controllers/dashboard_controller.rb
index 8d37a12..5254dd7 100644
--- a/src/app/controllers/dashboard_controller.rb
+++ b/src/app/controllers/dashboard_controller.rb
@@ -70,16 +70,6 @@ class DashboardController < ApplicationController
@cloud_accounts = CloudAccount.find(:all)
- # Now need to check any permissions are set since default permission and pool
- # may not be set for the admin user
- if @current_user.permissions
- # FIXME remove general role based permission check, replace w/
- # more granular / per-permission-object permission checks on the
- # dashboard in the future (here and in dashboard views)
- @is_admin = @current_user.permissions.collect { |p| p.role }.
- find { |r| r.name == "Administrator" }
- end
-
render :action => 'monitor'
end
diff --git a/src/app/controllers/hardware_profiles_controller.rb b/src/app/controllers/hardware_profiles_controller.rb
index c3afae2..d18110c 100644
--- a/src/app/controllers/hardware_profiles_controller.rb
+++ b/src/app/controllers/hardware_profiles_controller.rb
@@ -23,7 +23,6 @@ class HardwareProfilesController < ApplicationController
def index
@hardware_profiles = HardwareProfile.find(:all)
- #require_privilege(Privilege::PROVIDER_VIEW, @hardware_profile) ?
end
def new
diff --git a/src/app/controllers/image_factory/builds_controller.rb b/src/app/controllers/image_factory/builds_controller.rb
index 97bd32f..a2018bc 100644
--- a/src/app/controllers/image_factory/builds_controller.rb
+++ b/src/app/controllers/image_factory/builds_controller.rb
@@ -1,9 +1,10 @@
class ImageFactory::BuildsController < ApplicationController
- before_filter [:require_user, :check_permission]
+ before_filter [:require_user]
def new
raise "select template to build" unless id = params[:template_id]
@tpl = Template.find(id)
+ check_permission
if @tpl.imported
flash[:warning] = "Build imported template is not supported"
redirect_to templates_path
@@ -13,6 +14,7 @@ class ImageFactory::BuildsController < ApplicationController
def create
@tpl = Template.find(params[:template_id])
+ check_permission
@all_targets = Image.available_targets
if params[:targets].blank?
@@ -43,9 +45,11 @@ class ImageFactory::BuildsController < ApplicationController
end
def edit
+ # FIXME: is @tpl defined here? do we need check_permission here?
end
def update
+ # FIXME: is @tpl defined here? do we need check_permission here?
end
private
@@ -65,6 +69,6 @@ class ImageFactory::BuildsController < ApplicationController
end
def check_permission
- require_privilege(Privilege::IMAGE_MODIFY)
+ require_privilege(Privilege::MODIFY, @tpl)
end
end
diff --git a/src/app/controllers/image_factory/templates_controller.rb b/src/app/controllers/image_factory/templates_controller.rb
index fbba625..453f49e 100644
--- a/src/app/controllers/image_factory/templates_controller.rb
+++ b/src/app/controllers/image_factory/templates_controller.rb
@@ -2,7 +2,6 @@ require 'util/repository_manager'
class ImageFactory::TemplatesController < ApplicationController
before_filter :require_user
- before_filter :check_permission, :except => [:index, :show]
before_filter :load_templates, :only => [:index, :show]
def index
@@ -10,6 +9,7 @@ class ImageFactory::TemplatesController < ApplicationController
def show
@tpl = Template.find(params[:id])
+ require_privilege(Privilege::VIEW, @tpl)
@url_params = params.clone
@tab_captions = ['Properties', 'Images']
@details_tab = params[:details_tab].blank? ? 'properties' : params[:details_tab]
@@ -26,6 +26,7 @@ class ImageFactory::TemplatesController < ApplicationController
end
def new
+ check_create_permission
# can't use @template variable - is used by compass (or something other)
@tpl = Template.new(params[:tpl])
@repository_manager = RepositoryManager.new(:repositories => params[:repository] || @tpl.platform)
@@ -34,9 +35,11 @@ class ImageFactory::TemplatesController < ApplicationController
def add_selected
if params[:tpl] and not params[:tpl][:id].blank?
@tpl = Template.find(params[:tpl][:id])
+ check_edit_permission
@tpl.attributes = params[:tpl]
else
@tpl = Template.new(params[:tpl])
+ check_create_permission
end
@repository_manager = RepositoryManager.new(:repositories => params[:repository] || @tpl.platform)
@tpl.add_software(params[:packages].to_a + params[:selected_packages].to_a + params[:cached_packages].to_a,
@@ -46,11 +49,13 @@ class ImageFactory::TemplatesController < ApplicationController
def edit
@tpl = Template.find(params[:id])
+ check_edit_permission
@tpl.attributes = params[:tpl] unless params[:tpl].blank?
@repository_manager = RepositoryManager.new(:repositories => params[:repository] || @tpl.platform)
end
def create
+ check_create_permission
@tpl = Template.new(params[:tpl])
@tpl.packages = params[:packages]
if @tpl.save
@@ -65,6 +70,7 @@ class ImageFactory::TemplatesController < ApplicationController
def update
@tpl = Template.find(params[:id])
+ check_edit_permission
@tpl.packages = []
if @tpl.update_attributes(params[:tpl])
@@ -120,7 +126,13 @@ class ImageFactory::TemplatesController < ApplicationController
end
def managed_content
- @tpl = params[:template_id].blank? ? Template.new : Template.find(params[:template_id])
+ if params[:template_id].blank?
+ @tpl = Template.new
+ check_create_permission
+ else
+ @tpl = Template.find(params[:template_id])
+ check_edit_permission
+ end
@tpl.add_software(params[:packages].to_a + params[:selected_packages].to_a,
params[:groups].to_a + params[:selected_groups].to_a)
render :layout => false
@@ -133,9 +145,11 @@ class ImageFactory::TemplatesController < ApplicationController
else
errs = {}
Template.find(ids).each do |t|
- t.destroy
- unless t.destroyed?
- errs[t.name] = t.errors.full_messages.join(". ")
+ if check_permission(Privilege::MODIFY, t)
+ t.destroy
+ errs[t.name] = t.errors.full_messages.join(". ") unless t.destroyed?
+ else
+ errs[t.name] = "You don't have permission to delete #{t.name}"
end
end
if errs.empty?
@@ -148,9 +162,11 @@ class ImageFactory::TemplatesController < ApplicationController
end
def assembly
+ # FIXME: do we need perm check here?
end
def deployment_definition
+ # FIXME: do we need perm check here?
@all_targets = Image.available_targets
end
@@ -158,9 +174,11 @@ class ImageFactory::TemplatesController < ApplicationController
params[:packages].delete(params[:name]) unless params[:name].blank?
if params[:tpl] and not params[:tpl][:id].blank?
@tpl = Template.find(params[:tpl][:id])
+ check_edit_permission
@tpl.attributes = params[:tpl]
else
@tpl = Template.new(params[:tpl])
+ check_create_permission
end
@tpl.add_software(params[:packages].to_a, params[:groups].to_a)
@repository_manager = RepositoryManager.new(:repositories => params[:repository] || @tpl.platform)
@@ -168,9 +186,13 @@ class ImageFactory::TemplatesController < ApplicationController
end
def multi_destroy
- # FIXME: set correct check permission when we will have it
- require_privilege(Privilege::IMAGE_MODIFY)
- Template.destroy(params[:selected])
+ @tpl = Template.find(params[:selected])
+ if check_edit_permission
+ @tpl.destroy
+ errs[(a)tpl.name] = @tpl.errors.full_messages.join(". ") unless @tpl.destroyed?
+ else
+ errs[(a)tpl.name] = "You don't have permission to delete #{(a)tpl.name}"
+ end
redirect_to image_factory_templates_url
end
@@ -184,7 +206,6 @@ class ImageFactory::TemplatesController < ApplicationController
{:name => 'ARCH', :sort_attr => 'templates.architecture'},
{:name => 'STATUS', :sort_attr => 'status'},
]
- require_privilege(Privilege::IMAGE_VIEW)
@images = tpl.images
end
@@ -197,18 +218,21 @@ class ImageFactory::TemplatesController < ApplicationController
{:name => 'ARCH', :sort_attr => 'architecture'},
]
- # TODO: add template permission check
- require_privilege(Privilege::IMAGE_VIEW)
- @templates = Template.find(
- :all,
- :include => :images,
- :order => get_order('name')
- )
+ @templates = Template.list_for_user(Privilege::VIEW,
+ :include => :images,
+ :order => get_order('name')
+ )
@url_params = params.clone
end
def set_package_vars(set_all = false)
- @tpl = params[:id].blank? ? Template.new : Template.find(params[:id])
+ if params[:id].blank?
+ @tpl = Template.new
+ check_create_permission
+ else
+ @tpl = Template.find(params[:id])
+ check_edit_permission
+ end
@tpl.attributes = params[:tpl] unless params[:tpl].nil?
@repository_manager = RepositoryManager.new(:repositories => params[:repository] || @tpl.platform)
@groups = @repository_manager.groups
@@ -230,8 +254,12 @@ class ImageFactory::TemplatesController < ApplicationController
flash.now[:error][:failures].merge!(errs)
end
- def check_permission
- require_privilege(Privilege::IMAGE_MODIFY)
+ def check_create_permission
+ require_privilege(Privilege::CREATE, Template)
+ end
+
+ def check_edit_permission
+ require_privilege(Privilege::MODIFY, @tpl)
end
def get_selected_id
diff --git a/src/app/controllers/instances_controller.rb b/src/app/controllers/instances_controller.rb
index 5e68b8e..e22aea4 100644
--- a/src/app/controllers/instances_controller.rb
+++ b/src/app/controllers/instances_controller.rb
@@ -35,7 +35,7 @@ class InstancesController < ApplicationController
end
def index
- @pools = Pool.list_for_user(@current_user, Privilege::INSTANCE_MODIFY)
+ @pools = Pool.list_for_user(@current_user, Privilege::MODIFY, :target_type => Instance)
@order_dir = params[:order_dir] == 'desc' ? 'desc' : 'asc'
@order_field = params[:order_field] || 'name'
@@ -69,7 +69,7 @@ class InstancesController < ApplicationController
def new
@instance = Instance.new(params[:instance])
- require_privilege(Privilege::INSTANCE_MODIFY, @instance.pool) if @instance.pool
+ require_privilege(Privilege::CREATE, Instance, @instance.pool) if @instance.pool
# FIXME: we need to list only templates for particular user,
# => TODO: add TEMPLATE_* permissions
@templates = Template.paginate(
@@ -81,7 +81,7 @@ class InstancesController < ApplicationController
def configure
@instance = Instance.new(params[:instance])
- require_privilege(Privilege::INSTANCE_MODIFY, @instance.pool)
+ require_privilege(Privilege::CREATE, Instance, @instance.pool)
@hardware_profiles = HardwareProfile.find(:all, :include => :architecture,
:conditions => {:provider_id => nil,
'hardware_profile_properties.value' => @instance.template.architecture})
@@ -97,7 +97,7 @@ class InstancesController < ApplicationController
@instance.state = Instance::STATE_NEW
@instance.owner = current_user
- require_privilege(Privilege::INSTANCE_MODIFY,
+ require_privilege(Privilege::CREATE, Instance,
Pool.find((a)instance.pool_id))
#FIXME: This should probably be in a transaction
if @instance.save!
@@ -131,7 +131,7 @@ class InstancesController < ApplicationController
end
@instance = Instance.find((params[:id] || []).first)
- require_privilege(Privilege::INSTANCE_CONTROL,@instance.pool)
+ require_privilege(Privilege::USE,@instance)
if params[:instance_details]
render :action => 'show'
@@ -190,7 +190,7 @@ class InstancesController < ApplicationController
def instance
@instance = Instance.find(params[:id])
- require_privilege(Privilege::INSTANCE_VIEW, @instance.pool)
+ require_privilege(Privilege::VIEW, @instance)
end
end
diff --git a/src/app/controllers/permissions_controller.rb b/src/app/controllers/permissions_controller.rb
index c326e14..622f776 100644
--- a/src/app/controllers/permissions_controller.rb
+++ b/src/app/controllers/permissions_controller.rb
@@ -65,7 +65,7 @@ class PermissionsController < ApplicationController
private
- def set_permission_object(privilege)
+ def set_permission_object(action)
if !params[:permission_object_type].nil?
@permission_object =
params[:permission_object_type].constantize.find(params[:permission_object_id])
@@ -83,7 +83,7 @@ class PermissionsController < ApplicationController
raise ActiveRecord::RecordNotFound if @permission_object.nil?
- require_privilege(privilege, @permission_object)
+ require_privilege(action, @permission_object)
end
end
diff --git a/src/app/controllers/pools_controller.rb b/src/app/controllers/pools_controller.rb
index 47cdc77..c553318 100644
--- a/src/app/controllers/pools_controller.rb
+++ b/src/app/controllers/pools_controller.rb
@@ -44,16 +44,19 @@ class PoolsController < ApplicationController
def show
@pool = Pool.find(params[:id])
+ require_privilege(Privilege::VIEW, @pool)
end
def edit
@pool = Pool.find(params[:id])
+ require_privilege(Privilege::MODIFY, @pool)
end
def list
#FIXME: clean this up, many error cases here
@pool = Pool.find(params[:id])
- require_privilege(Privilege::INSTANCE_VIEW,@pool)
+ # FIXME: really we need perm-filtered list here
+ require_privilege(Privilege::VIEW, @pool)
@pool.reload
@order_dir = params[:order_dir] == 'desc' ? 'desc' : 'asc'
@@ -74,23 +77,23 @@ class PoolsController < ApplicationController
def hardware_profiles
@pool = Pool.find(params[:id])
@hardware_profiles = @pool.hardware_profiles
- require_privilege(Privilege::POOL_VIEW, @pool)
+ require_privilege(Privilege::VIEW, @pool)
end
def realms
@pool = Pool.find(params[:id])
@realm_names = @pool.realms
- require_privilege(Privilege::POOL_VIEW,@pool)
+ require_privilege(Privilege::VIEW, @pool)
end
def new
- require_privilege(Privilege::POOL_MODIFY)
- @pools = Pool.list_for_user(@current_user, Privilege::POOL_MODIFY)
+ require_privilege(Privilege::CREATE, Pool)
+ @pools = Pool.list_for_user(@current_user, Privilege::MODIFY)
@pool = Pool.new
end
def create
- require_privilege(Privilege::POOL_MODIFY)
+ require_privilege(Privilege::CREATE, Pool)
#FIXME: This should probably be in a transaction
@pool = Pool.new(params[:pool])
@@ -118,6 +121,7 @@ class PoolsController < ApplicationController
if type == "edit"
redirect_to :action => 'edit', :id => pool_id
elsif type == "delete"
+ require_privilege(Privilege::MODIFY, Pool.find(pool_id))
params[:id] = pool_id
destroy
end
@@ -130,27 +134,5 @@ class PoolsController < ApplicationController
def delete
end
- def accounts_for_pool
- @pool = Pool.find(params[:pool_id])
- require_privilege(Privilege::ACCOUNT_VIEW,@pool)
- @cloud_accounts = []
- all_accounts = CloudAccount.list_for_user(@current_user, Privilege::ACCOUNT_ADD)
- all_accounts.each {|account|
- @cloud_accounts << account unless @pool.cloud_accounts.map{|x| x.id}.include?(account.id)
- }
- end
-
- def add_account
- @pool = Pool.find(params[:pool])
- @cloud_account = CloudAccount.find(params[:cloud_account])
- require_privilege(Privilege::ACCOUNT_ADD,@pool)
- require_privilege(Privilege::ACCOUNT_ADD,@cloud_account)
- Pool.transaction do
- @pool.cloud_accounts << @cloud_account unless @pool.cloud_accounts.map{|x| x.id}.include?((a)cloud_account.id)
- @pool.save!
- @pool.populate_realms([@cloud_account])
- end
- redirect_to :action => 'show', :id => @pool.id
- end
kick_condor
end
diff --git a/src/app/controllers/providers_controller.rb b/src/app/controllers/providers_controller.rb
index 0754d65..57b4240 100644
--- a/src/app/controllers/providers_controller.rb
+++ b/src/app/controllers/providers_controller.rb
@@ -32,25 +32,25 @@ class ProvidersController < ApplicationController
def show
@provider = Provider.find(:first, :conditions => {:id => params[:id]})
- require_privilege(Privilege::PROVIDER_VIEW, @provider)
+ require_privilege(Privilege::VIEW, @provider)
end
def edit
- @providers = Provider.list_for_user(@current_user, Privilege::PROVIDER_MODIFY)
+ @providers = Provider.list_for_user(@current_user, Privilege::VIEW)
@provider = Provider.find(:first, :conditions => {:id => params[:id]})
- require_privilege(Privilege::PROVIDER_MODIFY, @provider)
+ require_privilege(Privilege::MODIFY, @provider)
end
def new
- require_privilege(Privilege::PROVIDER_MODIFY)
- @providers = Provider.list_for_user(@current_user, Privilege::PROVIDER_MODIFY)
+ require_privilege(Privilege::CREATE, Provider)
+ @providers = Provider.list_for_user(@current_user, Privilege::MODIFY)
@provider = Provider.new(params[:provider])
kick_condor
end
def create
- require_privilege(Privilege::PROVIDER_MODIFY)
- @providers = Provider.list_for_user(@current_user, Privilege::PROVIDER_MODIFY)
+ require_privilege(Privilege::CREATE, Provider)
+ @providers = Provider.list_for_user(@current_user, Privilege::MODIFY)
@provider = Provider.new(params[:provider])
if params[:test_connection]
@@ -70,9 +70,9 @@ class ProvidersController < ApplicationController
end
def update
- require_privilege(Privilege::PROVIDER_MODIFY)
- @providers = Provider.list_for_user(@current_user, Privilege::PROVIDER_MODIFY)
+ @providers = Provider.list_for_user(@current_user, Privilege::MODIFY)
@provider = Provider.find(:first, :conditions => {:id => params[:id]})
+ require_privilege(Privilege::MODIFY, @provider)
previous_cloud_type = @provider.cloud_type
@provider.update_attributes(params[:provider])
@@ -99,7 +99,7 @@ class ProvidersController < ApplicationController
def destroy
if request.post? || request.delete?
@provider = Provider.find(params[:id])
- require_privilege(Privilege::PROVIDER_MODIFY, @provider)
+ require_privilege(Privilege::MODIFY, @provider)
if @provider.destroy and @provider.destroyed?
redirect_to :action => "index"
flash[:notice] = "Provider Deleted"
@@ -117,17 +117,18 @@ class ProvidersController < ApplicationController
def hardware_profiles
@provider = Provider.find(params[:id])
@hardware_profiles = @provider.hardware_profiles
- require_privilege(Privilege::PROVIDER_VIEW, @provider)
+ require_privilege(Privilege::VIEW, @provider)
end
def realms
@provider = Provider.find(params[:id])
@realm_names = @provider.realms.collect { |r| r.name }
- require_privilege(Privilege::PROVIDER_VIEW, @provider)
+ require_privilege(Privilege::VIEW, @provider)
end
def settings
@provider = Provider.find(params[:id])
+ require_privilege(Privilege::VIEW, @provider)
end
def list
@@ -145,6 +146,6 @@ class ProvidersController < ApplicationController
protected
def load_providers
- @providers = Provider.list_for_user(@current_user, Privilege::PROVIDER_VIEW)
+ @providers = Provider.list_for_user(@current_user, Privilege::VIEW)
end
end
diff --git a/src/app/controllers/quotas_controller.rb b/src/app/controllers/quotas_controller.rb
index e9937fb..cfa85fb 100644
--- a/src/app/controllers/quotas_controller.rb
+++ b/src/app/controllers/quotas_controller.rb
@@ -28,7 +28,7 @@ class QuotasController < ApplicationController
@parent_type = params[:parent_type]
@quota = @parent.quota
- require_privilege(Privilege::QUOTA_VIEW, @parent)
+ require_privilege(Privilege::VIEW, Quota, @parent)
end
def edit
@@ -38,13 +38,13 @@ class QuotasController < ApplicationController
@quota = @parent.quota
- require_privilege(Privilege::QUOTA_MODIFY, @parent)
+ require_privilege(Privilege::MODIFY, Quota, @parent)
end
def update
@parent = @parent = get_parent_object(params)
@parent_type = params[:parent_type]
- require_privilege(Privilege::QUOTA_MODIFY, @parent)
+ require_privilege(Privilege::MODIFY, Quota, @parent)
@quota = @parent.quota
@name = get_parent_name(@parent, @parent_type)
@@ -60,7 +60,7 @@ class QuotasController < ApplicationController
def reset
@parent = @parent = get_parent_object(params)
@parent_type = params[:parent_type]
- require_privilege(Privilege::QUOTA_MODIFY, @parent)
+ require_privilege(Privilege::MODIFY, Quota, @parent)
@quota = @parent.quota
@quota.maximum_running_instances = Quota::NO_LIMIT
diff --git a/src/app/controllers/resources/instances_controller.rb b/src/app/controllers/resources/instances_controller.rb
index 3bd0c45..ba5f80e 100644
--- a/src/app/controllers/resources/instances_controller.rb
+++ b/src/app/controllers/resources/instances_controller.rb
@@ -5,7 +5,7 @@ class Resources::InstancesController < ApplicationController
def new
@instance = Instance.new(params[:instance])
- #require_privilege(Privilege::INSTANCE_MODIFY, @instance.pool) if @instance.pool
+ require_privilege(Privilege::CREATE, Instance, @instance.pool) if @instance.pool
unless @instance.template
redirect_to select_template_resources_instances_path
@@ -36,7 +36,7 @@ class Resources::InstancesController < ApplicationController
@instance.owner = current_user
begin
- require_privilege(Privilege::INSTANCE_MODIFY,
+ require_privilege(Privilege::CREATE, Instance,
Pool.find((a)instance.pool_id))
free_quota = Quota.can_start_instance?(@instance, nil)
@instance.transaction do
@@ -120,11 +120,11 @@ class Resources::InstancesController < ApplicationController
def load_instance
@instance = Instance.find((params[:id] || []).first)
- require_privilege(Privilege::INSTANCE_CONTROL,@instance.pool)
+ require_privilege(Privilege::USE,@instance)
end
def init_new_instance_attrs
- @pools = Pool.list_for_user(@current_user, Privilege::INSTANCE_MODIFY)
+ @pools = Pool.list_for_user(@current_user, Privilege::MODIFY, :target_type => Instance)
@realms = Realm.find(:all, :conditions => { :provider_id => nil })
@hardware_profiles = HardwareProfile.all(
:include => :architecture,
@@ -145,7 +145,7 @@ class Resources::InstancesController < ApplicationController
{:name => 'CREATED BY', :sort_attr => 'users.last_name'},
]
- pools = Pool.list_for_user(@current_user, Privilege::INSTANCE_MODIFY)
+ pools = Pool.list_for_user(@current_user, Privilege::MODIFY, :target_type => Instance)
@instances = Instance.all(
:include => [:template, :owner],
:conditions => {:pool_id => pools},
diff --git a/src/app/controllers/resources/pools_controller.rb b/src/app/controllers/resources/pools_controller.rb
index ffd1f55..c5988ca 100644
--- a/src/app/controllers/resources/pools_controller.rb
+++ b/src/app/controllers/resources/pools_controller.rb
@@ -18,6 +18,7 @@ class Resources::PoolsController < ApplicationController
def show
@pool = Pool.find(params[:id])
+ require_privilege(Privilege::VIEW, @pool)
@url_params = params.clone
@tab_captions = ['Properties', 'Deployments', 'Instances', 'History', 'Permissions']
@details_tab = params[:details_tab].blank? ? 'properties' : params[:details_tab]
@@ -33,12 +34,12 @@ class Resources::PoolsController < ApplicationController
end
def new
- require_privilege(Privilege::POOL_MODIFY)
+ require_privilege(Privilege::CREATE, Pool)
@pool = Pool.new
end
def create
- require_privilege(Privilege::POOL_MODIFY)
+ require_privilege(Privilege::CREATE, Pool)
@pool = Pool.new(params[:pool])
quota = Quota.new
@@ -55,15 +56,13 @@ class Resources::PoolsController < ApplicationController
end
def edit
- require_privilege(Privilege::POOL_MODIFY)
-
@pool = Pool.find(params[:id])
+ require_privilege(Privilege::MODIFY, @pool)
end
def update
- require_privilege(Privilege::POOL_MODIFY)
-
@pool = Pool.find(params[:id])
+ require_privilege(Privilege::MODIFY, @pool)
if @pool.update_attributes(params[:pool])
flash[:notice] = "Pool updated."
redirect_to :action => 'show', :id => @pool.id
@@ -73,7 +72,9 @@ class Resources::PoolsController < ApplicationController
end
def multi_destroy
- Pool.destroy(params[:pools_selected])
+ Pool.find(params[:pools_selected]).each do |pool|
+ pool.destroy if check_privilege(Privilege::MODIFY, pool)
+ end
redirect_to resources_pools_url
end
diff --git a/src/app/controllers/settings_controller.rb b/src/app/controllers/settings_controller.rb
index ae20e12..0717fc0 100644
--- a/src/app/controllers/settings_controller.rb
+++ b/src/app/controllers/settings_controller.rb
@@ -31,22 +31,16 @@ class SettingsController < ApplicationController
end
def index
- @providers = Provider.list_for_user(@current_user, Privilege::PROVIDER_VIEW)
+ @providers = Provider.list_for_user(@current_user, Privilege::VIEW)
end
def self_service
- if !is_admin?
- raise PermissionError.new('You have insufficient privileges to perform action.')
- return
- end
+ require_privilege(Privilege::MODIFY)
@self_service_default_quota = MetadataObject.lookup(SELF_SERVICE_DEFAULT_QUOTA)
end
def general_settings
- if !is_admin?
- raise PermissionError.new('You have insufficient privileges to perform action.')
- return
- end
+ require_privilege(Privilege::MODIFY)
end
def update
@@ -76,9 +70,4 @@ class SettingsController < ApplicationController
redirect_to :action => 'self_service'
end
- private
- def is_admin?
- is_admin = @current_user.permissions.collect { |p| p.role }.find { |r| r.name == "Administrator" }
- return is_admin == nil ? false : true
- end
end
diff --git a/src/app/controllers/templates_controller.rb b/src/app/controllers/templates_controller.rb
index 403e6c3..51ed922 100644
--- a/src/app/controllers/templates_controller.rb
+++ b/src/app/controllers/templates_controller.rb
@@ -2,7 +2,6 @@ require 'util/repository_manager'
class TemplatesController < ApplicationController
before_filter :require_user
- before_filter :check_permission, :except => :index
layout :layout
def layout
@@ -14,13 +13,10 @@ class TemplatesController < ApplicationController
end
def index
- # TODO: add template permission check
- require_privilege(Privilege::IMAGE_VIEW)
- @templates = Template.find(
- :all,
- :include => :images,
- :order => get_order('name')
- )
+ @templates = Template.list_for_user(current_user,
+ Privilege::VIEW,
+ :include => :images,
+ :order => get_order('name'))
end
def index_action
@@ -81,6 +77,7 @@ class TemplatesController < ApplicationController
end
def new
+ check_create_permission
# can't use @template variable - is used by compass (or something other)
@tpl = Template.new(params[:tpl])
@repository_manager = RepositoryManager.new(:repositories => params[:repository] || @tpl.platform)
@@ -91,12 +88,14 @@ class TemplatesController < ApplicationController
def edit
@tpl = Template.find(params[:id])
+ check_edit_permission
@tpl.attributes = params[:tpl] unless params[:tpl].blank?
@repository_manager = RepositoryManager.new(:repositories => params[:repository] || @tpl.platform)
render :action => :edit
end
def create
+ check_create_permission
@tpl = Template.new(params[:tpl])
@tpl.packages = params[:packages]
if @tpl.save
@@ -112,6 +111,7 @@ class TemplatesController < ApplicationController
def update
@tpl = Template.find(params[:id])
@tpl.packages = []
+ check_edit_permission
if @tpl.update_attributes(params[:tpl])
@tpl.set_complete
@@ -163,7 +163,13 @@ class TemplatesController < ApplicationController
end
def managed_content
- @tpl = params[:template_id].blank? ? Template.new : Template.find(params[:template_id])
+ if params[:template_id].blank?
+ @tpl = Template.new
+ check_create_permission
+ else
+ @tpl = Template.find(params[:template_id])
+ check_edit_permission
+ end
@tpl.add_software(params[:packages].to_a + params[:selected_packages].to_a,
params[:groups].to_a + params[:selected_groups].to_a)
render :layout => false
@@ -176,9 +182,11 @@ class TemplatesController < ApplicationController
else
errs = {}
Template.find(ids).each do |t|
- t.destroy
- unless t.destroyed?
- errs[t.name] = t.errors.full_messages.join(". ")
+ if check_permission(Privilege::MODIFY, t)
+ t.destroy
+ errs[t.name] = t.errors.full_messages.join(". ") unless t.destroyed?
+ else
+ errs[t.name] = "You don't have permission to delete #{t.name}"
end
end
if errs.empty?
@@ -191,16 +199,24 @@ class TemplatesController < ApplicationController
end
def assembly
+ # FIXME: do we need perm check here?
end
def deployment_definition
+ # FIXME: do we need perm check here?
@all_targets = Image.available_targets
end
private
def set_package_vars(set_all = false)
- @tpl = params[:id].blank? ? Template.new : Template.find(params[:id])
+ if params[:id].blank?
+ @tpl = Template.new
+ check_create_permission
+ else
+ @tpl = Template.find(params[:id])
+ check_edit_permission
+ end
@tpl.attributes = params[:tpl] unless params[:tpl].nil?
@repository_manager = RepositoryManager.new(:repositories => params[:repository] || @tpl.platform)
@groups = @repository_manager.groups
@@ -222,8 +238,12 @@ class TemplatesController < ApplicationController
flash.now[:error][:failures].merge!(errs)
end
- def check_permission
- require_privilege(Privilege::IMAGE_MODIFY)
+ def check_create_permission
+ require_privilege(Privilege::CREATE, Template)
+ end
+
+ def check_edit_permission
+ require_privilege(Privilege::MODIFY, @tpl)
end
def get_selected_id
diff --git a/src/app/controllers/users_controller.rb b/src/app/controllers/users_controller.rb
index 0e3220f..04754a6 100644
--- a/src/app/controllers/users_controller.rb
+++ b/src/app/controllers/users_controller.rb
@@ -24,12 +24,13 @@ class UsersController < ApplicationController
before_filter :current_user
def new
+ require_privilege(Privilege::CREATE, User) unless current_user.nil?
@user = User.new
@user.quota = Quota.new
end
def create
- require_privilege(Privilege::USER_MODIFY) unless current_user.nil?
+ require_privilege(Privilege::CREATE, User) unless current_user.nil?
@user = User.new(params[:user])
if params[:commit] == "Reset"
@@ -58,39 +59,26 @@ class UsersController < ApplicationController
else
@user = current_user
end
+ require_privilege(Privilege::VIEW, User) unless current_user == @user
@quota_resources = @user.quota.quota_resources()
end
def edit
- @user = params[:id] ? User.find(params[:id]) : @current_user
-
- if @user
- if @user != @current_user
- if !BasePermissionObject.general_permission_scope.can_modify_users(@current_user)
- flash[:notice] = "Invalid Permission to perform this operation"
- redirect_to users_path
- end
- end
- end
+ @user = params[:id] ? User.find(params[:id]) : current_user
+ require_privilege(Privilege::MODIFY, User) unless current_user == @user
end
def update
@user = params[:user][:id] ? User.find(params[:user][:id]) : @current_user
+ require_privilege(Privilege::MODIFY, User) unless current_user == @user
if params[:commit] == "Save"
if @user
- has_users_modify = BasePermissionObject.general_permission_scope.can_modify_users(@current_user)
- if @user != @current_user
- if !has_users_modify
- flash[:notice] = "Invalid Permission to perform this operation"
- redirect_to :dashboard
- end
- end
if @user.update_attributes(params[:user])
flash[:notice] = "User updated!"
- if has_users_modify
- redirect_to users_path
- else
+ if @user == current_user
redirect_to :dashboard
+ else
+ redirect_to users_path
end
else
render :action => :edit
@@ -102,21 +90,17 @@ class UsersController < ApplicationController
end
def index
- if @current_user.permissions.collect { |p| p.role }.find { |r| r.name == "Administrator" }
+ require_privilege(Privilege::VIEW, User)
+ @users = User.all
+ sort_order = params[:sort_by].nil? ? "login" : params[:sort_by]
+ if sort_order == "percentage_quota_used"
@users = User.all
- sort_order = params[:sort_by].nil? ? "login" : params[:sort_by]
- if sort_order == "percentage_quota_used"
- @users = User.all
- @users.sort! {|x,y| y.quota.percentage_used <=> x.quota.percentage_used }
- elsif sort_order == "quota"
- @users = User.all
- @users.sort! {|x,y| (x.quota.maximum_running_instances and y.quota.maximum_running_instances) ? x.quota.maximum_running_instances <=> y.quota.maximum_running_instances : (x ? 1 : -1) }
- else
- @users = User.find(:all, :order => sort_order)
- end
+ @users.sort! {|x,y| y.quota.percentage_used <=> x.quota.percentage_used }
+ elsif sort_order == "quota"
+ @users = User.all
+ @users.sort! {|x,y| (x.quota.maximum_running_instances and y.quota.maximum_running_instances) ? x.quota.maximum_running_instances <=> y.quota.maximum_running_instances : (x ? 1 : -1) }
else
- flash[:notice] = "Invalid Permission to perform this operation"
- redirect_to :dashboard
+ @users = User.find(:all, :order => sort_order)
end
end
@@ -138,22 +122,19 @@ class UsersController < ApplicationController
end
def destroy
- if @current_user.permissions.collect { |p| p.role }.find { |r| r.name == "Administrator" }
- if request.post? || request.delete?
- @user = User.find(params[:id])
- if @user == @current_user
- flash[:notice] = "Can not delete the currently logged in user!"
- elsif @user.destroy
- flash[:notice] = "User Deleted"
- else
- flash[:error] = {
- :summary => "Failed to delete User",
- :failures => @user.errors.full_messages,
- }
- end
+ require_privilege(Privilege::MODIFY, User)
+ if request.post? || request.delete?
+ @user = User.find(params[:id])
+ if @user == @current_user
+ flash[:notice] = "Can not delete the currently logged in user!"
+ elsif @user.destroy
+ flash[:notice] = "User Deleted"
+ else
+ flash[:error] = {
+ :summary => "Failed to delete User",
+ :failures => @user.errors.full_messages,
+ }
end
- else
- flash[:notice] = "Invalid Permission to perform this operation"
end
redirect_to users_path
end
diff --git a/src/app/models/cloud_account.rb b/src/app/models/cloud_account.rb
index 334b7cb..4eba087 100644
--- a/src/app/models/cloud_account.rb
+++ b/src/app/models/cloud_account.rb
@@ -72,6 +72,27 @@ class CloudAccount < ActiveRecord::Base
before_destroy :destroyable?
before_validation :read_x509_files
+ def object_list
+ super << provider
+ end
+ class << self
+ alias orig_list_for_user_include list_for_user_include
+ alias orig_list_for_user_conditions list_for_user_conditions
+ end
+
+ def self.list_for_user_include
+ includes = orig_list_for_user_include
+ includes << { :provider => {:permissions => {:role => :privileges}}}
+ includes
+ end
+
+ def self.list_for_user_conditions
+ "(#{orig_list_for_user_conditions}) or
+ (permissions_providers.user_id=:user and
+ privileges_roles.target_type=:target_type and
+ privileges_roles.action=:action)"
+ end
+
def destroyable?
instances.empty?
end
diff --git a/src/app/models/instance.rb b/src/app/models/instance.rb
index e7757e3..954e2eb 100644
--- a/src/app/models/instance.rb
+++ b/src/app/models/instance.rb
@@ -36,6 +36,9 @@ class Instance < ActiveRecord::Base
belongs_to :instance_hwp
has_one :instance_key, :as => :instance_key_owner, :dependent => :destroy
+ has_many :permissions, :as => :permission_object, :dependent => :destroy,
+ :include => [:role],
+ :order => "permissions.id ASC"
validates_presence_of :pool_id
validates_presence_of :hardware_profile_id
@@ -67,6 +70,27 @@ class Instance < ActiveRecord::Base
validates_inclusion_of :state,
:in => STATES
+ def object_list
+ super << pool
+ end
+ class << self
+ alias orig_list_for_user_include list_for_user_include
+ alias orig_list_for_user_conditions list_for_user_conditions
+ end
+
+ def self.list_for_user_include
+ includes = orig_list_for_user_include
+ includes << { :pool => {:permissions => {:role => :privileges}}}
+ includes
+ end
+
+ def self.list_for_user_conditions
+ "(#{orig_list_for_user_conditions}) or
+ (permissions_pools.user_id=:user and
+ privileges_roles.target_type=:target_type and
+ privileges_roles.action=:action)"
+ end
+
def get_action_list(user=nil)
# return empty list rather than nil
# FIXME: not handling pending state now -- only current state
@@ -143,7 +167,7 @@ class Instance < ActiveRecord::Base
}
instances = []
- pools = Pool.list_for_user(user, Privilege::INSTANCE_VIEW)
+ pools = Pool.list_for_user(user, Privilege::VIEW, Instance)
pools.each{|pool| pool.instances.each {|i| instances << i}}
instances.each do |i|
if i.state == Instance::STATE_RUNNING
diff --git a/src/app/models/permission.rb b/src/app/models/permission.rb
index 349b6a7..22b228a 100644
--- a/src/app/models/permission.rb
+++ b/src/app/models/permission.rb
@@ -29,12 +29,18 @@ class Permission < ActiveRecord::Base
belongs_to :permission_object, :polymorphic => true
# type-specific associations
+ belongs_to :pool_family, :class_name => "PoolFamily",
+ :foreign_key => "permission_object_id"
belongs_to :pool, :class_name => "Pool",
:foreign_key => "permission_object_id"
+ belongs_to :instance, :class_name => "Instance",
+ :foreign_key => "permission_object_id"
belongs_to :provider, :class_name => "Provider",
:foreign_key => "permission_object_id"
belongs_to :cloud_account, :class_name => "CloudAccount",
:foreign_key => "permission_object_id"
+ belongs_to :template, :class_name => "Template",
+ :foreign_key => "permission_object_id"
belongs_to :base_permission_object, :class_name => "BasePermissionObject",
:foreign_key => "permission_object_id"
diff --git a/src/app/models/permissioned_object.rb b/src/app/models/permissioned_object.rb
index 24aebe0..34efec8 100644
--- a/src/app/models/permissioned_object.rb
+++ b/src/app/models/permissioned_object.rb
@@ -17,91 +17,77 @@
# MA 02110-1301, USA. A copy of the GNU General Public License is
# also available at http://www.gnu.org/copyleft/gpl.html.
module PermissionedObject
- def can_view_perms(user)
- has_privilege(user, Privilege::PERM_VIEW)
- end
- def can_set_perms(user)
- has_privilege(user, Privilege::PERM_SET)
- end
-
- def can_view_instances(user)
- has_privilege(user, Privilege::INSTANCE_VIEW)
- end
- def can_modify_instances(user)
- has_privilege(user, Privilege::INSTANCE_MODIFY)
- end
- def can_control_instances(user)
- has_privilege(user, Privilege::INSTANCE_CONTROL)
- end
-
- def can_view_stats(user)
- has_privilege(user, Privilege::STATS_VIEW)
- end
-
- def can_view_accounts(user)
- has_privilege(user, Privilege::ACCOUNT_VIEW)
- end
- def can_modify_accounts(user)
- has_privilege(user, Privilege::ACCOUNT_MODIFY)
- end
-
- def can_view_pools(user)
- has_privilege(user, Privilege::POOL_VIEW)
- end
- def can_modify_pools(user)
- has_privilege(user, Privilege::POOL_MODIFY)
- end
- def can_view_quotas(user)
- has_privilege(user, Privilege::QUOTA_VIEW)
- end
- def can_modify_quotas(user)
- has_privilege(user, Privilege::QUOTA_MODIFY)
- end
-
- def can_view_providers(user)
- has_privilege(user, Privilege::PROVIDER_VIEW)
- end
- def can_modify_providers(user)
- has_privilege(user, Privilege::PROVIDER_MODIFY)
- end
-
- def can_view_users(user)
- has_privilege(user, Privilege::USER_VIEW)
- end
- def can_modify_users(user)
- has_privilege(user, Privilege::USER_MODIFY)
- end
-
- def can_view_images(user)
- has_privilege(user, Privilege::IMAGE_VIEW)
- end
- def can_modify_images(user)
- has_privilege(user, Privilege::IMAGE_MODIFY)
+ def has_privilege(user, action, target_type=nil)
+ return false if user.nil? or action.nil?
+ target_type = self.class.default_privilege_target_type if target_type.nil?
+ object_list.each do |obj|
+ return true if obj.permissions.find(:first,
+ :include => [:role => :privileges],
+ :conditions =>
+ ["permissions.user_id=:user and
+ privileges.target_type=:target_type and
+ privileges.action=:action",
+ { :user => user.id,
+ :target_type => target_type.name,
+ :action => action}])
+ end
+ return false
end
- def has_privilege(user, privilege)
- return false if user.nil?
- permissions.find(:first, :include => [:role => :privileges],
- :conditions => ["permissions.user_id=:user and
- privileges.name=:priv",
- { :user => user.id,
- :priv => privilege }])
+ # Returns the list of objects to check for permissions on -- by default
+ # this object plus the Base permission object
+ def object_list
+ [self, BasePermissionObject.general_permission_scope]
end
# Any methods here will be able to use the context of the
# ActiveRecord model the module is included in.
def self.included(base)
base.class_eval do
- def self.list_for_user(user, privilege)
- if BasePermissionObject.general_permission_scope.has_privilege(user, privilege)
- all
+ def self.default_privilege_target_type
+ self.name.constantize
+ end
+ def self.list_for_user_include
+ [{:permissions => {:role => :privileges}}]
+ end
+ def self.list_for_user_conditions
+ "permissions.user_id=:user and
+ privileges.target_type=:target_type and
+ privileges.action=:action"
+ end
+ # :conditions in hash must match form ["foo=:param and ...", {:param => value}]
+ def self.list_for_user(user, action, find_hash={})
+ target_type = find_hash.fetch(:target_type, self.default_privilege_target_type)
+ query_include = find_hash[:include]
+ query_order = find_hash[:order]
+ query_conditions = find_hash[:conditions]
+ return [] if user.nil? or action.nil? or target_type.nil?
+ if BasePermissionObject.general_permission_scope.has_privilege(user,
+ action,
+ target_type)
+ find(:all, :include => query_include,
+ :order => query_order,
+ :conditions => query_conditions)
else
- find(:all, :include => {:permissions => {:role => :privileges}},
- :conditions => ["permissions.user_id=:user and
- privileges.name=:priv",
- {:user => user.id,
- :priv => privilege }])
+ include_clause = self.list_for_user_include
+ if query_include.is_a?(Array)
+ include_clause += query_include
+ elsif !query_include.nil?
+ include_clause << query_include
+ end
+ conditions_hash = {:user => user.id,
+ :target_type => target_type.name,
+ :action => action}
+ if query_conditions.nil?
+ conditions_str = self.list_for_user_conditions
+ else
+ conditions_str = "(#{self.list_for_user_include}) and (#{query_conditions[0]})"
+ conditions_hash.merge!(query_conditions[1]) { |key, h1, h2| h1 }
+ end
+ find(:all, :include => include_clause,
+ :conditions => [conditions_str, conditions_hash],
+ :order => query_order)
end
end
end
diff --git a/src/app/models/privilege.rb b/src/app/models/privilege.rb
index 552beef..f7a61ef 100644
--- a/src/app/models/privilege.rb
+++ b/src/app/models/privilege.rb
@@ -18,66 +18,122 @@
# also available at http://www.gnu.org/copyleft/gpl.html.
class Privilege < ActiveRecord::Base
- has_and_belongs_to_many :roles
- validates_presence_of :name
- validates_uniqueness_of :name
+ PERM_SET = "set_perms" # can create/modify/delete permission
+ # records on this object
+ PERM_VIEW = "view_perms" # can view permission records on this
+ # object
+ CREATE = "create" # can create objects of this type here
+ MODIFY = "modify" # can modify objects of this type here
+ VIEW = "view" # can view objects of this type here
+ USE = "use" # can use objects of this type here
+ # the meaning of 'use' is type-specific:
+ # Template: add this template to an assembly
+ # Assembly: add this assembly to a deployable
+ # Deployable: choose this deployable to launch
+ # Instance: may perform actions on this instance
+ # Realm: may map this realm
+ # CloudAccount: May add this account to PoolFamily
- #default privileges
- PERM_SET = "set_perms" # can create/modify/delete permission
- # records on this object
- PERM_VIEW = "view_perms" # can view permission records on this
- # object
- # instance privileges normally checked at the pool level, although
- # instance-specific overrides could be a future enhancement.
- INSTANCE_MODIFY = "instance_modify" # can create, modify, delete, or
- # control (start, stop, etc) instances
- INSTANCE_CONTROL = "instance_control" # can control (start, stop, etc)
- # instances
- INSTANCE_VIEW = "instance_view" # can view instance metadata
- # do we need a separate "connect" privilege?
+ ACTIONS = [ CREATE, MODIFY, USE, VIEW,
+ PERM_SET, PERM_VIEW]
+ TYPES = { BasePermissionObject => [MODIFY, PERM_SET, PERM_VIEW],
+ Template => ACTIONS,
+ Pool => ACTIONS - [USE],
+ PoolFamily => ACTIONS - [USE],
+ Instance => ACTIONS,
+ Quota => [VIEW, MODIFY],
+ HardwareProfile => ACTIONS - [USE, VIEW],
+ Realm => ACTIONS - [VIEW],
+ Provider => ACTIONS - [USE],
+ CloudAccount => ACTIONS,
+ User => [ CREATE, MODIFY, VIEW] }
- # stats privileges normally checked at the pool level, although
- # instance-specific overrides could be a future enhancement.
- STATS_VIEW = "stats_view" # can view monitoring data for
- # instances
+ belongs_to :role
+ validates_presence_of :role_id
+ validates_presence_of :target_type
+ validates_presence_of :action
+ validates_uniqueness_of :action, :scope => [:target_type, :role_id]
- # to create(i.e. import) an account on a provider needs ACCOUNT_MODIFY on the
- # provider.
- ACCOUNT_MODIFY = "account_modify" # can create or modify cloud accounts
- ACCOUNT_VIEW = "account_view" # can view cloud accounts
+ # notes on available privilege action/type pairs. Format is:
+ # Type Scope
+ # Action Notes (action defined on scope above unless specified)
+ #
+ # BasePermissionObject the base perm object
+ # modify Can modify system settings, etc.
+ # view_perms Can view permissions
+ # set_perms Can set permissions
+ #
+ # Template This template/assembly/deployable or all T/A/D in this TADCollection
+ # view Can view
+ # use Can assign T/A/D to TAD collection;
+ # (if template) can add to assembly or can use to launch instance
+ # (if assembly) can add to deployable
+ # (if deployable) can use to launch deployment
+ # (if TAD Collection) not used
+ # modify Can modify
+ # create Can create (on BasePermissionObject)
+ # view_perms Can view permissions
+ # set_perms Can set permissions
+ #
+ # Pool This pool
+ # view Can view
+ # modify Can modify
+ # create Can create (on BasePermissionObject)
+ # view_perms Can view permissions
+ # set_perms Can set permissions
+ #
+ # PoolFamily This PoolFamily
+ # view Can view
+ # modify Can modify
+ # create Can create (on BasePermissionObject)
+ # view_perms Can view permissions
+ # set_perms Can set permissions
+ #
+ # Instance This Instance or instances within this Pool
+ # view Can view
+ # use Can perform lifecycle actions on and/or view console
+ # modify Can modify
+ # create Can create (within this Pool)
+ # view_perms Can view permissions
+ # set_perms Can set permissions (or can set instance permissions on this pool)
+ #
+ # Quota The Pool/CloudAccount/PoolFamily/User assigned the quota
+ # view Can view quota on this obj
+ # modify Can edit quota on this obj
+ #
+ # HardwareProfile This HardwareProfile
+ # modify (for Aeolus HWPs) Can modify
+ # create Can create (on BasePermissionObject)
+ # view_perms Can view permissions
+ # set_perms Can set permissions
+ #
+ # Realm This Realm (or realms within this provider)
+ # use (for provider Realm) can map realm or provider to aeolus realm
+ # modify (for Aeolus realms) Can modify
+ # create Can create (within this Pool)
+ # view_perms Can view permissions
+ # set_perms Can set permissions
+ #
+ # Provider This Provider
+ # view Can view
+ # modify Can modify
+ # create Can create (on BasePermissionObject)
+ # view_perms Can view permissions
+ # set_perms Can set permissions
+ #
+ # CloudAccount This CloudAccount
+ # view Can view
+ # use Can map to PoolFamily
+ # modify Can modify
+ # create Can create (within this Provider)
+ # view_perms Can view permissions
+ # set_perms Can set permissions
+ #
+ # User This User (set on BasePermissionObject)
+ # view Can view
+ # modify Can modify
+ # create Can create
- POOL_MODIFY = "pool_modify" # can create or modify a pool
- POOL_VIEW = "pool_view" # can view a pool
-
- # quota privileges normally checked at the pool or account level,
- # depending on which quota level we're dealing with
- QUOTA_MODIFY = "quota_modify" # can create or modify a quota
- QUOTA_VIEW = "quota_view" # can view a quota
-
- # provider privileges normally checked at the provider level, although
- # 'new provider' action requires this privilege at the SystemPermission level
- PROVIDER_MODIFY = "provider_modify" # can create or modify a provider
- PROVIDER_VIEW = "provider_view" # can view a provider
-
- # normally checked at the SystemPermission level
- USER_MODIFY = "user_modify" # can create a new user (other than
- # self-registration) or modify another
- # user's metadata (for admin-level
- # actions)
- USER_VIEW = "user_view" # can view a user's profile data
-
- IMAGE_VIEW = "image_view" # can view existing images (templates)
- IMAGE_MODIFY = "image_modify" # can create or modify images (templates)
-
- FULL_PRIVILEGE_LIST = [PERM_SET, PERM_VIEW,
- INSTANCE_MODIFY, INSTANCE_CONTROL, INSTANCE_VIEW,
- STATS_VIEW,
- ACCOUNT_MODIFY, ACCOUNT_VIEW,
- POOL_MODIFY, POOL_VIEW,
- QUOTA_MODIFY, QUOTA_VIEW,
- PROVIDER_MODIFY, PROVIDER_VIEW,
- USER_MODIFY, USER_VIEW,
- IMAGE_VIEW, IMAGE_MODIFY]
end
diff --git a/src/app/models/role.rb b/src/app/models/role.rb
index b932544..4e7118e 100644
--- a/src/app/models/role.rb
+++ b/src/app/models/role.rb
@@ -22,10 +22,13 @@ class Role < ActiveRecord::Base
searchable do
text :name, :as => :code_substring
end
- has_many :permissions
- has_and_belongs_to_many :privileges, :uniq => true
+ has_many :permissions, :dependent => :destroy
+ has_many :privileges, :dependent => :destroy
+ validates_presence_of :scope
validates_presence_of :name
validates_uniqueness_of :name
+ validates_associated :privileges
+
end
diff --git a/src/app/models/template.rb b/src/app/models/template.rb
index d545f9b..bff586d 100644
--- a/src/app/models/template.rb
+++ b/src/app/models/template.rb
@@ -2,12 +2,17 @@ require 'util/image_descriptor_xml'
require 'typhoeus'
class Template < ActiveRecord::Base
+ include PermissionedObject
has_many :images, :dependent => :destroy
has_many :instances
before_validation :generate_uuid
before_save :update_xml
before_destroy :no_instances?
+ has_many :permissions, :as => :permission_object, :dependent => :destroy,
+ :include => [:role],
+ :order => "permissions.id ASC"
+
WAREHOUSE_CONFIG = YAML.load_file("#{RAILS_ROOT}/config/image_warehouse.yml")
validates_presence_of :uuid
diff --git a/src/app/services/application_service.rb b/src/app/services/application_service.rb
index 8161718..079c200 100644
--- a/src/app/services/application_service.rb
+++ b/src/app/services/application_service.rb
@@ -40,19 +40,34 @@ module ApplicationService
# @current_user must be defined
- def check_privilege(privilege, perm_obj)
- ((perm_obj and perm_obj.has_privilege(current_user, privilege)) or
- BasePermissionObject.general_permission_scope.has_privilege(current_user,
- privilege))
+ def check_privilege(action, *type_and_perm_obj)
+ target_type = nil
+ perm_obj = nil
+ type_and_perm_obj.each do |obj|
+ target_type=obj if obj.class==Class
+ perm_obj=obj if obj.is_a?(ActiveRecord::Base)
+ end
+ perm_obj=@perm_obj if perm_obj.nil?
+ perm_obj=BasePermissionObject.general_permission_scope if perm_obj.nil?
+ perm_obj.has_privilege(current_user, action, target_type)
end
- def authorized?(privilege, perm_obj=nil)
+ # Require a given privilege level to view this page
+ # 1. action is always required -- what action is being done (from Privilege::ACTIONS)
+ # 2. perm_obj is optional -- This is the resource on which to look for permission
+ # records. If omitted, check for site-wide permissions on BasePermissionObject
+ # 3. type is also optional -- if omitted it's taken from perm_obj.
+ # For example, if action is 'view', perm_obj is a Pool and type is omitted,
+ # then check for current user's "view pool" permission on this pool.
+ # if action is 'view', perm_obj is a Pool and type is Quota,
+ # then check for current user's "view quota" permission on this pool.
+ def require_privilege(action, *type_and_perm_obj)
+ perm_obj = nil
+ type_and_perm_obj.each do |obj|
+ perm_obj=obj if obj.is_a?(ActiveRecord::Base)
+ end
@perm_obj = perm_obj
- check_privilege(privilege,@perm_obj)
- end
-
- def require_privilege(privilege, perm_obj=nil)
- unless authorized?(privilege, perm_obj)
+ unless check_privilege(action, *type_and_perm_obj)
raise PermissionError.new(
'You have insufficient privileges to perform action.')
end
diff --git a/src/app/views/admin/users/_form.haml b/src/app/views/admin/users/_form.haml
index 3fdf33f..f1b8aa3 100644
--- a/src/app/views/admin/users/_form.haml
+++ b/src/app/views/admin/users/_form.haml
@@ -8,7 +8,7 @@
%fieldset
= form.label :password_confirmation, t(:confirm_password), :class => "grid_3 alpha"
= form.password_field :password_confirmation, :class => "grid_5"
--if has_user_modify?
+-if check_privilege(Privilege::MODIFY, User)
%fieldset.clear
= form.label :user_status, "User Status:", :class => "alpha grid_3"
.grid_5
@@ -25,7 +25,7 @@
%fieldset.clear
= form.label :email, t(:email), :class => "alpha grid_3"
= form.text_field :email, :class => "grid_5"
--if has_user_modify?
+-if check_privilege(Privilege::MODIFY, User)
%h3.grid_16 User Treatment
%fieldset.clearfix
= label_tag 'apply_treatment', t(:apply_treatment), :class => "alpha grid_3"
diff --git a/src/app/views/admin/users/edit.haml b/src/app/views/admin/users/edit.haml
index a367fec..1290c4d 100644
--- a/src/app/views/admin/users/edit.haml
+++ b/src/app/views/admin/users/edit.haml
@@ -1,4 +1,4 @@
-- if has_user_modify?
+- if check_privilege(Privilege::MODIFY, User)
%h2 Editing User: #{(a)user.first_name} #{(a)user.last_name}
- else
%h2 Editing Account
diff --git a/src/app/views/dashboard/summary.haml b/src/app/views/dashboard/summary.haml
index e6ba2dd..cc8d8e9 100644
--- a/src/app/views/dashboard/summary.haml
+++ b/src/app/views/dashboard/summary.haml
@@ -30,24 +30,24 @@
#actions_dashboard_section
%h2
Actions
- - if @is_admin
+ - if check_privilege(Privilege::CREATE, Provider)
%a{:href => url_for(:controller => "providers", :action => "new")}
Add a Provider
+ - if check_privilege(Privilege::CREATE, User)
%a{:href => url_for(:controller => "users", :action => "new")}
Create a User
- %a{:href => url_for(:controller => "instances", :action => "index")}
- View Instances
- - else
- %a{:href => url_for(:controller => "", :action => "")}
- Launch Instances
- %a{:href => url_for(:controller => "", :action => "")}
- Enter a help ticket
- - if BasePermissionObject.general_permission_scope.can_modify_images(@current_user)
+ %a{:href => url_for(:controller => "instances", :action => "index")}
+ View Instances
+ %a{:href => url_for(:controller => "", :action => "")}
+ Launch Instances
+ %a{:href => url_for(:controller => "", :action => "")}
+ Enter a help ticket
+ - if check_privilege(Privilege::CREATE, Template)
%a{:href => url_for(:controller => "templates", :action => "new")}
Create a Template
#service_quality_dashboard_section
- - if @is_admin
+ - if check_privilege(Privilege::MODIFY)
%h2
Provider Service Quality
.dashboard_section_summary
diff --git a/src/app/views/layouts/_main_nav.html.erb b/src/app/views/layouts/_main_nav.html.erb
index e85249b..d877029 100644
--- a/src/app/views/layouts/_main_nav.html.erb
+++ b/src/app/views/layouts/_main_nav.html.erb
@@ -14,6 +14,6 @@
<% } %>
<% end %>
</ul>
-<% if BasePermissionObject.general_permission_scope.has_privilege(@current_user, Privilege::POOL_MODIFY) %>
+<% if check_privilege(Privilege::CREATE, Pool, BasePermissionObject.general_permission_scope) %>
<%= link_to "Add a pool", {:controller => "pools", :action => "new"}, :class => "actionlink" %>
<% end %>
diff --git a/src/app/views/permissions/list.haml b/src/app/views/permissions/list.haml
index 27831d0..5ab3a34 100644
--- a/src/app/views/permissions/list.haml
+++ b/src/app/views/permissions/list.haml
@@ -14,7 +14,7 @@
%td= permission.user.login
%td= permission.role.name
%td
- - if has_set_perms?
+ - if check_privilege(Privilege::PERM_SET)
- form_tag :action => 'destroy' do
= hidden_field :permission, :id, :value => permission.id
= submit_tag "delete", :class => "submit_link", :id => "delete_#{permission.id}"
@@ -22,10 +22,10 @@
= link_to "Add a user", |
{:controller => "users", |
:action => "new"}, |
- :class=>"actionlink" if has_user_modify?(BasePermissionObject.general_permission_scope) |
+ :class=>"actionlink" if check_privilege(Privilege::CREATE,User,BasePermissionObject.general_permission_scope) |
-#
= link_to "Add a new permission record", |
{:action => "new", |
:permission_object_type => @permission_object.class, |
:permission_object_id => @permission_object.id}, |
- :class=>"actionlink" if has_set_perms? |
+ :class=>"actionlink" if check_privilege(Privilege::PERM_SET) |
diff --git a/src/app/views/pools/show.haml b/src/app/views/pools/show.haml
index 229f3e2..ab914ad 100644
--- a/src/app/views/pools/show.haml
+++ b/src/app/views/pools/show.haml
@@ -5,7 +5,7 @@
#pool-tabs
%ul
%li= link_to "Instances", {:action => "list", :id => @pool.id, :ajax => true}
- - if has_view_perms?
+ - if check_privilege(Privilege::PERM_VIEW)
%li= link_to "User access", {:controller => "permissions", :action => "list", :pool_id => @pool.id, :ajax => true}
%li= link_to "Hardware Profiles", {:action => "hardware_profiles", :id => @pool.id, :ajax => true}
%li= link_to "Realms", {:action => "realms", :id => @pool.id, :ajax => true}
diff --git a/src/app/views/providers/accounts.haml b/src/app/views/providers/accounts.haml
index b136012..984f257 100644
--- a/src/app/views/providers/accounts.haml
+++ b/src/app/views/providers/accounts.haml
@@ -26,7 +26,7 @@
= t('.quota_instances')
%span.required *
%fieldset.nomargin.clearfix
- - disabled = 'disabled' unless has_account_modify?(@provider)
+ - disabled = 'disabled' unless check_privilege(Privilege::MODIFY, Account, @provider)
- cloud_account_id = "cloud_accounts[#{acct.id}]"
= text_field cloud_account_id, :label, :title => t('.account_name'), :value => acct.label, :disabled => disabled, :class => "grid_4 alpha"
= text_field cloud_account_id, :username, :title => t('.user_name'), :value => acct.username, :disabled => disabled, :class => "grid_3"
@@ -56,7 +56,7 @@
= file_field cloud_account_id, :x509_cert_priv_file, :title => t('.account_private_cert'), :disabled => disabled
.grid_3
= file_field cloud_account_id, :x509_cert_pub_file, :title => t('.account_public_cert'), :disabled => disabled
- - remove_path = url_for :controller => 'cloud_accounts', :action => 'destroy', :id => acct.id if has_account_modify?(@provider) && acct.destroyable?
+ - remove_path = url_for :controller => 'cloud_accounts', :action => 'destroy', :id => acct.id if check_privilege(Privilege::MODIFY, Account, @provider) && acct.destroyable?
.grid_3.omega
%a.button{ :href => remove_path, :name => "remove_acc_#{acct.id}", :class => "tiny #{'disabled' unless remove_path}" }
= t(:remove)
diff --git a/src/app/views/users/_form.haml b/src/app/views/users/_form.haml
index 8d87a2f..efe0c96 100644
--- a/src/app/views/users/_form.haml
+++ b/src/app/views/users/_form.haml
@@ -11,7 +11,7 @@
%fieldset
= form.label :password_confirmation, t(:confirm_password), :class => "grid_3 alpha"
= form.password_field :password_confirmation, :class => "grid_5"
- -if has_user_modify?
+ -if check_privilege(Privilege::MODIFY, User)
%fieldset.clear
= form.label :user_status, "User Status:", :class => "alpha grid_3"
.grid_5
@@ -28,7 +28,7 @@
%fieldset.clear
= form.label :email, t(:email), :class => "alpha grid_3"
= form.text_field :email, :class => "grid_5"
- -if has_user_modify?
+ -if check_privilege(Privilege::MODIFY, User)
%h3.grid_16 User Treatment
%fieldset.clearfix
= label_tag 'apply_treatment', t(:apply_treatment), :class => "alpha grid_3"
diff --git a/src/app/views/users/edit.haml b/src/app/views/users/edit.haml
index 0551bee..aa70a7c 100644
--- a/src/app/views/users/edit.haml
+++ b/src/app/views/users/edit.haml
@@ -1,5 +1,5 @@
.formwindow
-- if has_user_modify?
+- if check_privilege(Privilege::MODIFY, User)
%h2 Editing User: #{(a)user.first_name} #{(a)user.last_name}
- else
%h2 Editing Account
diff --git a/src/db/migrate/20110107000000_privilege_model_refactor.rb b/src/db/migrate/20110107000000_privilege_model_refactor.rb
new file mode 100644
index 0000000..78e0b99
--- /dev/null
+++ b/src/db/migrate/20110107000000_privilege_model_refactor.rb
@@ -0,0 +1,53 @@
+#
+# Copyright (C) 2011 Red Hat, Inc.
+# Written by Scott Seago <sseago(a)redhat.com>
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; version 2 of the License.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston,
+# MA 02110-1301, USA. A copy of the GNU General Public License is
+# also available at http://www.gnu.org/copyleft/gpl.html.
+
+class PrivilegeModelRefactor < ActiveRecord::Migration
+
+
+ def self.up
+ # remove old privileges and role mapping
+ drop_table :privileges_roles
+ drop_table :privileges
+
+ # new privilege model
+ create_table :privileges do |t|
+ t.integer :role_id, :null => false
+ t.string :target_type, :null => false
+ t.string :action, :null => false
+ t.integer :lock_version, :default => 0
+
+ t.timestamps
+ end
+
+ end
+
+ def self.down
+ drop_table :privileges
+ create_table :privileges do |t|
+ t.string :name, :null => false
+ t.integer :lock_version, :default => 0
+
+ t.timestamps
+ end
+ create_table :privileges_roles, :id => false do |t|
+ t.integer :privilege_id, :null => false
+ t.integer :role_id, :null => false
+ end
+ end
+end
diff --git a/src/db/seeds.rb b/src/db/seeds.rb
index 934d432..9a6065c 100644
--- a/src/db/seeds.rb
+++ b/src/db/seeds.rb
@@ -4,108 +4,75 @@ PoolFamily.create!(:name => "default", :description => "default pool family")
# Default Pool
Pool.create!(:name => "default_pool", :quota => Quota.create, :pool_family => PoolFamily.find_by_name('default'))
-# Create default privileges
-privileges = ["set_perms", "view_perms",
- "instance_modify", "instance_control", "instance_view",
- "stats_view",
- "account_modify", "account_view",
- "pool_modify", "pool_view",
- "quota_modify", "quota_view",
- "provider_modify", "provider_view",
- "user_modify", "user_view",
- "image_modify", "image_view"]
-Privilege.transaction do
- privileges.each do |priv_name|
- privilege = Privilege.create!(:name => priv_name)
- end
-end
# Create default roles
-roles = {"Instance Controller" =>
- {:role_scope => "Pool",
- :privileges => ["instance_control",
- "instance_view",
- "pool_view"]},
- "Instance Controller With Monitoring" =>
- {:role_scope => "Pool",
- :privileges => ["instance_control",
- "instance_view",
- "pool_view",
- "stats_view"]},
- "Instance Creator and User" =>
- {:role_scope => "Pool",
- :privileges => ["instance_control",
- "instance_view",
- "pool_view",
- "stats_view",
- "instance_modify",
- "quota_view",
- "set_perms",
- "view_perms"]},
- "Pool Creator" =>
- {:role_scope => "Provider",
- :privileges => ["provider_view",
- "pool_modify",
- "pool_view",
- "quota_view"]},
- "Pool Administrator" =>
- {:role_scope => "Provider",
- :privileges => ["provider_view",
- "pool_modify",
- "pool_view",
- "quota_view",
- "quota_modify",
- "set_perms",
- "view_perms"]},
- "Provider Administrator" =>
- {:role_scope => "Provider",
- :privileges => ["provider_modify",
- "provider_view",
- "account_modify",
- "account_view"]},
- "Account Administrator" =>
- {:role_scope => "CloudAccount",
- :privileges => ["set_perms",
- "view_perms",
- "stats_view",
- "account_view",
- "account_modify"]},
- "Account Viewer" =>
- {:role_scope => "CloudAccount",
- :privileges => ["account_view"]},
- "Provider Creator" =>
- {:role_scope => "BasePermissionObject",
- :privileges => ["provider_modify",
- "provider_view"]},
- "Administrator" =>
- {:role_scope => "BasePermissionObject",
- :privileges => ["provider_modify",
- "provider_view",
- "account_modify",
- "account_view",
- "user_modify",
- "user_view",
- "set_perms",
- "view_perms",
- "pool_modify",
- "pool_view",
- "quota_modify",
- "quota_view",
- "stats_view",
- "instance_modify",
- "instance_control",
- "instance_view",
- "image_modify",
- "image_view"]}
+VIEW = "view"
+USE = "use"
+MOD = "modify"
+CRE = "create"
+VPRM = "view_perms"
+GPRM = "set_perms"
-}
+roles =
+ {Instance =>
+ {"Instance Controller" => {Instance => [VIEW,USE]},
+ "Instance Owner" => {Instance => [VIEW,USE,MOD, VPRM,GPRM]}},
+ PoolFamily =>
+ {"Pool Family User" => {Pool => [VIEW]},
+ "Pool Family Owner" => {PoolFamily => [VIEW, MOD, VPRM,GPRM],
+ Pool => [VIEW, MOD,CRE,VPRM,GPRM]}},
+ Pool =>
+ {"Pool User" => {Pool => [VIEW],
+ Instance => [ CRE],
+ Quota => [VIEW]},
+ "Pool Owner" => {Pool => [VIEW, MOD, VPRM,GPRM],
+ Instance => [VIEW,USE,MOD,CRE],
+ Quota => [VIEW]}},
+ Provider =>
+ {"Provider Owner" => {Provider => [VIEW, MOD, VPRM,GPRM],
+ CloudAccount => [VIEW,USE,MOD,CRE,VPRM,GPRM]}},
+ CloudAccount =>
+ {"Provider Account User" => {CloudAccount => [VIEW,USE]},
+ "Provider Account Owner" => {CloudAccount => [VIEW,USE,MOD, VPRM,GPRM]}},
+ Template =>
+ {"Template User" => {Template => [VIEW,USE]},
+ "Template Owner" => {Template => [VIEW,USE,MOD, VPRM,GPRM]}},
+ BasePermissionObject =>
+ {"Provider Creator" => {Provider => [ CRE]},
+ "Provider Administrator" => {Provider => [VIEW, MOD,CRE,VPRM,GPRM],
+ CloudAccount => [VIEW,USE,MOD,CRE,VPRM,GPRM]},
+ "HWP Administrator" => {HardwareProfile => [ MOD,CRE,VPRM,GPRM]},
+ "Realm Administrator" => {Realm => [ USE,MOD,CRE,VPRM,GPRM]},
+ "Pool Creator" => {Pool => [ CRE]},
+ "Pool Administrator" => {Pool => [VIEW, MOD,CRE,VPRM,GPRM],
+ Instance => [VIEW,USE,MOD,CRE,VPRM,GPRM],
+ Quota => [VIEW, MOD],
+ PoolFamily => [VIEW, MOD,CRE,VPRM,GPRM]},
+ "Template Administrator" => {Template => [VIEW,USE,MOD,CRE,VPRM,GPRM]},
+ "Administrator" => {Provider => [VIEW, MOD,CRE,VPRM,GPRM],
+ CloudAccount => [VIEW,USE,MOD,CRE,VPRM,GPRM],
+ HardwareProfile => [ MOD,CRE,VPRM,GPRM],
+ Realm => [ USE,MOD,CRE,VPRM,GPRM],
+ User => [VIEW, MOD,CRE],
+ Pool => [VIEW, MOD,CRE,VPRM,GPRM],
+ Instance => [VIEW,USE,MOD,CRE,VPRM,GPRM],
+ Quota => [VIEW, MOD],
+ PoolFamily => [VIEW, MOD,CRE,VPRM,GPRM],
+ Template => [VIEW,USE,MOD,CRE,VPRM,GPRM],
+ BasePermissionObject => [ MOD, VPRM,GPRM]}}}
Role.transaction do
- roles.each do |role_name, role_hash|
- role = Role.create!(:name => role_name, :scope => role_hash[:role_scope])
- role.privileges = role_hash[:privileges].collect do |priv_name|
- Privilege.find_by_name(priv_name)
+ roles.each do |role_scope, scoped_hash|
+ scoped_hash.each do |role_name, role_privileges|
+ role_privileges.each do |priv_type, priv_actions|
+ role = Role.find_or_initialize_by_name(role_name)
+ role.update_attributes({:name => role_name, :scope => role_scope.name})
+ role.save!
+ priv_actions.each do |action|
+ Privilege.create!(:role => role, :target_type => priv_type.name,
+ :action => action)
+ end
+ end
end
- role.save!
end
end
@@ -118,7 +85,7 @@ MetadataObject.set("default_pool_family", PoolFamily.find_by_name('default'))
default_pool = Pool.find_by_name("default_pool")
default_quota = Quota.create
-default_role = Role.find_by_name("Instance Creator and User")
+default_role = Role.find_by_name("Pool User")
settings = {"allow_self_service_logins" => "true",
"self_service_default_quota" => default_quota,
"self_service_default_pool" => default_pool,
diff --git a/src/features/support/custom.rb b/src/features/support/custom.rb
index 12a3a45..c2c4987 100644
--- a/src/features/support/custom.rb
+++ b/src/features/support/custom.rb
@@ -1,8 +1,4 @@
#Seed the DB with fixture data
-Fixtures.reset_cache
-fixtures_folder = File.join(Rails.root, 'spec', 'fixtures')
-fixtures = Dir[File.join(fixtures_folder, '*.yml')].map {|f| File.basename(f, '.yml') }
-Fixtures.create_fixtures(fixtures_folder, fixtures)
# We can't stub out these methods properly in cucumber, and we don't want to
# couple these tests to require the core server be running (connections should be tested
diff --git a/src/features/support/hooks.rb b/src/features/support/hooks.rb
index c21d323..a00ac36 100644
--- a/src/features/support/hooks.rb
+++ b/src/features/support/hooks.rb
@@ -1,19 +1,2 @@
Before do
- @default_pool_family_metadata = Factory.create(:default_pool_family_metadata)
- @allow_self_service_logins = Factory(:metadata_object, :key => "allow_self_service_logins", :value => "true")
-
- @default_quota = Factory(:unlimited_quota)
- @self_service_default_quota = Factory(:metadata_object, :key => "self_service_default_quota",
- :value => @default_quota,
- :object_type => "Quota")
-
- @default_pool = Factory(:pool, :name => "default_pool", :quota => @default_quota)
- @self_service_default_pool = Factory(:metadata_object, :key => "self_service_default_pool",
- :value => @default_pool,
- :object_type => "Pool")
-
- @default_role = Role.find(:first, :conditions => ['name = ?', 'Instance Creator and User'])
- @self_service_default_pool = Factory(:metadata_object, :key => "self_service_default_role",
- :value => @default_role,
- :object_type => "Role")
end
diff --git a/src/lib/tasks/cucumber.rake b/src/lib/tasks/cucumber.rake
index 15034cd..453f43c 100644
--- a/src/lib/tasks/cucumber.rake
+++ b/src/lib/tasks/cucumber.rake
@@ -14,19 +14,19 @@ begin
require 'cucumber/rake/task'
namespace :cucumber do
- Cucumber::Rake::Task.new({:ok => 'db:test:prepare'}, 'Run features that should pass') do |t|
+ Cucumber::Rake::Task.new({:ok => ['db:test:prepare','db:seed']}, 'Run features that should pass') do |t|
t.binary = vendored_cucumber_bin # If nil, the gem's binary is used.
t.fork = true # You may get faster startup if you set this to false
t.profile = 'default'
end
- Cucumber::Rake::Task.new({:wip => 'db:test:prepare'}, 'Run features that are being worked on') do |t|
+ Cucumber::Rake::Task.new({:wip => ['db:test:prepare','db:seed']}, 'Run features that are being worked on') do |t|
t.binary = vendored_cucumber_bin
t.fork = true # You may get faster startup if you set this to false
t.profile = 'wip'
end
- Cucumber::Rake::Task.new({:rerun => 'db:test:prepare'}, 'Record failing features and run only them if any exist') do |t|
+ Cucumber::Rake::Task.new({:rerun => ['db:test:prepare','db:seed']}, 'Record failing features and run only them if any exist') do |t|
t.binary = vendored_cucumber_bin
t.fork = true # You may get faster startup if you set this to false
t.profile = 'rerun'
diff --git a/src/spec/controllers/instance_controller_spec.rb b/src/spec/controllers/instance_controller_spec.rb
index 241c05b..34a44c8 100644
--- a/src/spec/controllers/instance_controller_spec.rb
+++ b/src/spec/controllers/instance_controller_spec.rb
@@ -20,11 +20,11 @@ describe InstancesController do
response.should_not be_success
end
- it "should allow instance creator to launch instance" do
- @inst_user_permission = Factory :instance_creator_and_user_permission
- @inst_user = @inst_user_permission.user
- UserSession.create(@inst_user)
- pool = Permission.first(:conditions => {:permission_object_type => 'Pool', :user_id => @inst_user.id}).permission_object
+ it "should allow pool user to launch instance" do
+ @pool_user_permission = Factory :pool_user_permission
+ @pool_user = @pool_user_permission.user
+ UserSession.create(@pool_user)
+ pool = Permission.first(:conditions => {:permission_object_type => 'Pool', :user_id => @pool_user.id}).permission_object
template = Factory.build(:template)
template.save!
hwp = Factory.build(:mock_hwp1)
@@ -36,6 +36,6 @@ describe InstancesController do
:hardware_profile_id => hwp.id }
end.should change(Instance, :count).by(1)
inst = Instance.find(:first, :conditions => ['name = ?', 'mockinstance'])
- inst.owner_id.should == @inst_user.id
+ inst.owner_id.should == @pool_user.id
end
end
diff --git a/src/spec/controllers/users_controller_spec.rb b/src/spec/controllers/users_controller_spec.rb
index c1fad30..f9a3dde 100644
--- a/src/spec/controllers/users_controller_spec.rb
+++ b/src/spec/controllers/users_controller_spec.rb
@@ -3,16 +3,9 @@ require 'spec_helper'
describe UsersController do
before(:each) do
- unless BasePermissionObject.find_by_name(BasePermissionObject::GENERAL_PERMISSION_SCOPE)
- Factory(:base_permission_object)
- end
@tuser = Factory :tuser
@admin_permission = Factory :admin_permission
- @admin_permission.role.privileges << Privilege.find_by_name('user_modify')
@admin = @admin_permission.user
- Factory.create(:default_quota_metadata)
- Factory.create(:default_role_metadata)
- Factory.create(:default_pool_metadata)
activate_authlogic
end
diff --git a/src/spec/factories/base_permission_object.rb b/src/spec/factories/base_permission_object.rb
deleted file mode 100644
index ccc2bf1..0000000
--- a/src/spec/factories/base_permission_object.rb
+++ /dev/null
@@ -1,3 +0,0 @@
-Factory.define :base_permission_object do |o|
- o.name BasePermissionObject::GENERAL_PERMISSION_SCOPE
-end
diff --git a/src/spec/factories/metadata_object.rb b/src/spec/factories/metadata_object.rb
deleted file mode 100644
index fea2f88..0000000
--- a/src/spec/factories/metadata_object.rb
+++ /dev/null
@@ -1,34 +0,0 @@
-Factory.define :metadata_object do |o|
- o.key 'key'
- o.value 'value'
- o.object_type nil
-end
-
-Factory.define :default_logins_metadata, :parent => :metadata_object do |o|
- o.key 'allow_self_service_logins'
- o.value 'true'
-end
-
-Factory.define :default_pool_family_metadata, :parent => :metadata_object do |o|
- o.key 'default_pool_family'
- o.value {Factory.create(:pool_family).id}
- o.object_type 'PoolFamily'
-end
-
-Factory.define :default_quota_metadata, :parent => :metadata_object do |o|
- o.key 'self_service_default_quota'
- o.value {Factory.create(:quota).id}
- o.object_type 'Quota'
-end
-
-Factory.define :default_role_metadata, :parent => :metadata_object do |o|
- o.key 'self_service_default_role'
- o.value {Factory.create(:role).id}
- o.object_type 'Role'
-end
-
-Factory.define :default_pool_metadata, :parent => :metadata_object do |o|
- o.key 'self_service_default_pool'
- o.value {Factory.create(:pool).id}
- o.object_type 'Pool'
-end
diff --git a/src/spec/factories/permission.rb b/src/spec/factories/permission.rb
index 9ccd3e7..f260ad7 100644
--- a/src/spec/factories/permission.rb
+++ b/src/spec/factories/permission.rb
@@ -16,12 +16,12 @@ end
Factory.define :pool_creator_permission, :parent => :permission do |p|
p.role { |r| Role.first(:conditions => ['name = ?', 'Pool Creator']) || Factory(:role, :name => 'Pool Creator') }
- p.permission_object { |r| r.association(:mock_provider) }
- p.user { |u| u.association(:pool_creator) }
+ p.permission_object { |r| BasePermissionObject.general_permission_scope }
+ p.user { |u| u.association(:pool_creator_user) }
end
-Factory.define :instance_creator_and_user_permission, :parent => :permission do |p|
- p.role { |r| Role.first(:conditions => ['name = ?', 'Instance Creator and User']) || Factory(:role, :name => 'Instance Creator and User') }
+Factory.define :pool_user_permission, :parent => :permission do |p|
+ p.role { |r| Role.first(:conditions => ['name = ?', 'Pool User']) || Factory(:role, :name => 'Pool User') }
p.permission_object { |r| r.association(:pool) }
p.user { |u| u.association(:user) }
end
diff --git a/src/spec/factories/pool.rb b/src/spec/factories/pool.rb
index 32e8c99..3b20f96 100644
--- a/src/spec/factories/pool.rb
+++ b/src/spec/factories/pool.rb
@@ -1,6 +1,6 @@
Factory.define :pool do |p|
p.sequence(:name) { |n| "mypool#{n}" }
- p.association :pool_family, :factory => :pool_family
+ p.pool_family { |p| PoolFamily.find_by_name('default') }
p.association :quota
end
diff --git a/src/spec/factories/pool_family.rb b/src/spec/factories/pool_family.rb
index 4a890ce..d0ca8e7 100644
--- a/src/spec/factories/pool_family.rb
+++ b/src/spec/factories/pool_family.rb
@@ -1,4 +1,4 @@
Factory.define :pool_family do |z|
z.sequence(:name) { |n| "pool_family#{n}" }
- z.description 'default pool family'
+ z.description 'pool family'
end
diff --git a/src/spec/factories/user.rb b/src/spec/factories/user.rb
index e737a35..a9dd23e 100644
--- a/src/spec/factories/user.rb
+++ b/src/spec/factories/user.rb
@@ -14,10 +14,13 @@ end
Factory.define :admin_user, :parent => :user do |u|
end
+Factory.define :pool_creator_user, :parent => :user do |u|
+end
+
Factory.define :provider_admin_user, :parent => :user do |u|
end
Factory.define :pool_user, :parent => :user do |u|
u.sequence(:login) { |n| "pool_user#{n}" }
u.email { |e| "#{e.login}(a)example.com" }
-end
\ No newline at end of file
+end
diff --git a/src/spec/fixtures/base_permission_objects.yml b/src/spec/fixtures/base_permission_objects.yml
deleted file mode 100644
index a520969..0000000
--- a/src/spec/fixtures/base_permission_objects.yml
+++ /dev/null
@@ -1,2 +0,0 @@
-general_permission_scope:
- name: 'general_permission_scope'
diff --git a/src/spec/fixtures/privileges.yml b/src/spec/fixtures/privileges.yml
deleted file mode 100644
index 16723de..0000000
--- a/src/spec/fixtures/privileges.yml
+++ /dev/null
@@ -1,43 +0,0 @@
-# Read about fixtures at http://ar.rubyonrails.org/classes/Fixtures.html
-
-# one:
-# column: value
-#
-# two:
-# column: value
-set_perms:
- name: set_perms
-view_perms:
- name: view_perms
-instance_modify:
- name: instance_modify
-instance_control:
- name: instance_control
-instance_view:
- name: instance_view
-stats_view:
- name: stats_view
-account_modify:
- name: account_modify
-account_view:
- name: account_view
-pool_modify:
- name: pool_modify
-pool_view:
- name: pool_view
-quota_modify:
- name: quota_modify
-quota_view:
- name: quota_view
-provider_modify:
- name: provider_modify
-provider_view:
- name: provider_view
-user_modify:
- name: user_modify
-user_view:
- name: user_view
-image_modify:
- name: image_modify
-image_view:
- name: image_view
diff --git a/src/spec/fixtures/roles.yml b/src/spec/fixtures/roles.yml
deleted file mode 100644
index d3ed623..0000000
--- a/src/spec/fixtures/roles.yml
+++ /dev/null
@@ -1,47 +0,0 @@
-# Read about fixtures at http://ar.rubyonrails.org/classes/Fixtures.html
-
-# one:
-# column: value
-#
-# two:
-# column: value
-instance_controller:
- name: Instance Controller
- scope: Pool
- privileges: instance_control, instance_view, pool_view
-instance_controller_with_monitoring:
- name: Instance Controller With Monitoring
- scope: Pool
- privileges: instance_control, instance_view, pool_view, stats_view
-instance_creator_and_user:
- name: Instance Creator and User
- scope: Pool
- privileges: instance_control, instance_view, pool_view, stats_view, instance_modify, quota_view, set_perms, view_perms
-pool_creator:
- name: Pool Creator
- scope: Provider
- privileges: provider_view, pool_modify, pool_view, quota_view
-pool_administrator:
- name: Pool Administrator
- scope: Provider
- privileges: provider_view, pool_modify, pool_view, quota_modify, quota_view, stats_view, set_perms, view_perms
-provider_administrator:
- name: Provider Administrator
- scope: Provider
- privileges: provider_modify, provider_view, account_modify, account_view, stats_view
-account_administrator:
- name: Account Administrator
- scope: CloudAccount
- privileges: account_modify, account_view, stats_view, set_perms, view_perms
-account_viewer:
- name: Account Viewer
- scope: CloudAccount
- privileges: account_view
-provider_creator:
- name: Provider Creator
- scope: BasePermissionObject
- privileges: provider_modify, provider_view, stats_view
-administrator:
- name: Administrator
- scope: BasePermissionObject
- privileges: provider_modify, provider_view, account_modify, account_view, user_modify, user_view, set_perms, view_perms, pool_modify, pool_view, quota_modify, quota_view, stats_view, instance_modify, instance_control, instance_view, image_modify, image_view
diff --git a/src/spec/models/metadata_object_spec.rb b/src/spec/models/metadata_object_spec.rb
index e3a74f8..0290b57 100644
--- a/src/spec/models/metadata_object_spec.rb
+++ b/src/spec/models/metadata_object_spec.rb
@@ -3,7 +3,7 @@ require 'spec_helper'
describe MetadataObject do
before(:each) do
- @default_pool_family_metadata = Factory :default_pool_family_metadata
+ @default_pool_family_metadata = MetadataObject.find_by_key("default_pool_family")
end
it "lookup on nonexistent key should return nil" do
diff --git a/src/spec/models/permission_spec.rb b/src/spec/models/permission_spec.rb
new file mode 100644
index 0000000..4a56baf
--- /dev/null
+++ b/src/spec/models/permission_spec.rb
@@ -0,0 +1,58 @@
+require 'spec_helper'
+
+describe Permission do
+
+ before(:each) do
+ @admin_permission = Factory :admin_permission
+ @provider_admin_permission = Factory :provider_admin_permission
+ @pool_creator_permission = Factory :pool_creator_permission
+ @pool_user_permission = Factory :pool_user_permission
+
+ @admin = @admin_permission.user
+ @provider_admin = @provider_admin_permission.user
+ @pool_creator = @pool_creator_permission.user
+ @pool_user = @pool_user_permission.user
+
+ @provider = @provider_admin_permission.provider
+ @pool = @pool_user_permission.pool
+ end
+
+ it "Admin should be able to create users" do
+ BasePermissionObject.general_permission_scope.has_privilege(@admin,
+ Privilege::CREATE,
+ User).should be_true
+ end
+
+ it "Provider Admin should NOT be able to create users" do
+ BasePermissionObject.general_permission_scope.has_privilege(@provider_admin,
+ Privilege::CREATE,
+ User).should be_false
+ end
+
+ it "Pool User should NOT be able to create users" do
+ BasePermissionObject.general_permission_scope.has_privilege(@pool_user,
+ Privilege::CREATE,
+ User).should be_false
+ end
+
+ it "Provider Admin should be able to edit provider" do
+ @provider.has_privilege(@provider_admin, Privilege::MODIFY).should be_true
+ end
+
+ it "Admin should be able to edit provider" do
+ @provider.has_privilege(@admin, Privilege::MODIFY).should be_true
+ end
+
+ it "Pool User should NOT be able to edit provider" do
+ @provider.has_privilege(@pool_user, Privilege::MODIFY).should be_false
+ end
+
+ it "Pool User should be able to create instances in @pool" do
+ @pool.has_privilege(@pool_user, Privilege::CREATE, Instance).should be_true
+ end
+
+ it "Pool User should NOT be able to create instances in another pool" do
+ Factory(:tpool).has_privilege(@pool_user, Privilege::CREATE, Instance).should be_false
+ end
+
+end
diff --git a/src/spec/models/pool_family_spec.rb b/src/spec/models/pool_family_spec.rb
index 1210b48..2b69eab 100644
--- a/src/spec/models/pool_family_spec.rb
+++ b/src/spec/models/pool_family_spec.rb
@@ -22,8 +22,8 @@ describe PoolFamily do
end
it "should have pool" do
- @pool_family.pools.size.should == 1
- @pool_family.pools[0].id.should == @pool.id
+ @pool_family.pools.size.should == 2 #default pool + pool created here
+ @pool.pool_family.id.should == @pool_family.id
end
it "should have account" do
diff --git a/src/spec/services/registration_service_spec.rb b/src/spec/services/registration_service_spec.rb
index 41f6764..810fe6e 100644
--- a/src/spec/services/registration_service_spec.rb
+++ b/src/spec/services/registration_service_spec.rb
@@ -3,9 +3,6 @@ require 'spec_helper'
describe RegistrationService do
before(:each) do
- Factory.create(:default_quota_metadata)
- Factory.create(:default_role_metadata)
- Factory.create(:default_pool_metadata)
end
describe "with validations" do
@@ -22,20 +19,15 @@ describe RegistrationService do
it "should register a user with default pool/quota/role when default settings set" do
@user = Factory :user
- @pool = Factory(:pool, :name => "default_pool")
- privilege = Privilege.find_by_name('instance_view')
- @role = Factory(:role, :privileges => [privilege])
+ @pool = MetadataObject.lookup("self_service_default_pool")
+ @role = MetadataObject.lookup("self_service_default_role")
@quota = Factory :quota
-
- MetadataObject.set("allow_self_service_logins", "true")
- MetadataObject.set("self_service_default_pool", @pool)
- MetadataObject.set("self_service_default_role", @role)
MetadataObject.set("self_service_default_quota", @quota)
@registration_service = RegistrationService.new(@user)
@registration_service.save
- @pools = Pool.list_for_user(@user, Privilege::INSTANCE_VIEW)
+ @pools = Pool.list_for_user(@user, Privilege::CREATE, :target_type => Instance)
@pools.length.should == 1
@pools[0].name.should == "default_pool"
diff --git a/src/spec/spec_helper.rb b/src/spec/spec_helper.rb
index 90f0eaf..88413c0 100644
--- a/src/spec/spec_helper.rb
+++ b/src/spec/spec_helper.rb
@@ -56,7 +56,6 @@ Spec::Runner.configure do |config|
# For more information take a look at Spec::Runner::Configuration and Spec::Runner
config.before(:each, :type => :controller) do
#activate_authlogic
- @default_pool_family_metadata = Factory.create(:default_pool_family_metadata)
end
config.after(:each, :type => :controller) do
#current_user_session.destroy
@@ -66,6 +65,7 @@ Spec::Runner.configure do |config|
config.before(:suite) do
DatabaseCleaner.strategy = :truncation
DatabaseCleaner.clean_with(:truncation)
+ load "#{Rails.root}/db/seeds.rb"
end
config.before(:each) do
DatabaseCleaner.start
--
1.7.3.4
2
2