[PATCH aeolus] Rename step deffinition instance.rb
by Martyn Taylor
From: Martyn Taylor <mtaylor(a)redhat.com>
---
src/features/step_definitions/instance.rb | 80 -----------------------
src/features/step_definitions/instance_steps.rb | 80 +++++++++++++++++++++++
2 files changed, 80 insertions(+), 80 deletions(-)
delete mode 100644 src/features/step_definitions/instance.rb
create mode 100644 src/features/step_definitions/instance_steps.rb
diff --git a/src/features/step_definitions/instance.rb b/src/features/step_definitions/instance.rb
deleted file mode 100644
index 4324891..0000000
--- a/src/features/step_definitions/instance.rb
+++ /dev/null
@@ -1,80 +0,0 @@
-def mock_instance
- @mock_instance ||= Factory :mock_running_instance
-end
-
-def pending_instance
- @pending_instance ||= Factory :mock_pending_instance
-end
-
-Given /^a mock running instance exists$/ do
- mock_instance.instance_key = Factory :mock_instance_key, :instance_key_owner => mock_instance
-end
-
-Given /^a mock pending instance exists$/ do
- pending_instance
-end
-
-Given /^I am viewing the mock instance detail$/ do
- visit resources_instance_url(mock_instance)
-end
-
-When /^I am viewing the pending instance detail$/ do
- visit resources_instance_url(pending_instance)
-end
-
-When /^I manually go to the key action for this instance$/ do
- visit key_resources_instance_url(pending_instance)
-end
-
-Given /^I see "([^"]*)"$/ do |text|
- response.should contain(text)
-end
-
-Then /^I should see the Save dialog for a (.+) file$/ do |filetype|
- response.headers["Content-Disposition"].should
- match(/^attachment;\sfilename=.*#{filetype}$/)
-end
-
-Given /^there is a "([^"]*)" instance$/ do |name|
- Factory :instance, :name => name
-end
-
-Given /^there is a "([^"]*)" failed instance$/ do |name|
- Factory :instance, :name => name, :state => Instance::STATE_ERROR
-end
-
-Given /^there is a "([^"]*)" running instance$/ do |name|
- Factory :instance, :name => name, :state => Instance::STATE_RUNNING
-end
-
-Given /^there is an uploaded image for a template$/ do
- Factory :replicated_image
-end
-
-Given /^there is "([^"]*)" aggregator hardware profile$/ do |name|
- Factory :mock_hwp2, :name => name
-end
-
-Given /^there is "([^"]*)" aggregator realm$/ do |name|
- Factory :frontend_realm, :provider_id => nil, :name => name
-end
-
-Given /^there is "([^"]*)" pool$/ do |arg1|
- Factory :pool, :name => arg1
-end
-
-
-When /^I check "([^"]*)" instance$/ do |name|
- inst = Instance.find_by_name(name)
- check("inst_ids_#{inst.id}")
-end
-
-Given /^there are the following instances:$/ do |table|
- table.hashes.each do |hash|
- Factory(:instance, :name => hash['name'],
- :external_key => hash['external_key'],
- :state => hash['state'],
- :public_addresses => hash['public_addresses'],
- :private_addresses => hash['private_addresses'])
- end
-end
diff --git a/src/features/step_definitions/instance_steps.rb b/src/features/step_definitions/instance_steps.rb
new file mode 100644
index 0000000..4324891
--- /dev/null
+++ b/src/features/step_definitions/instance_steps.rb
@@ -0,0 +1,80 @@
+def mock_instance
+ @mock_instance ||= Factory :mock_running_instance
+end
+
+def pending_instance
+ @pending_instance ||= Factory :mock_pending_instance
+end
+
+Given /^a mock running instance exists$/ do
+ mock_instance.instance_key = Factory :mock_instance_key, :instance_key_owner => mock_instance
+end
+
+Given /^a mock pending instance exists$/ do
+ pending_instance
+end
+
+Given /^I am viewing the mock instance detail$/ do
+ visit resources_instance_url(mock_instance)
+end
+
+When /^I am viewing the pending instance detail$/ do
+ visit resources_instance_url(pending_instance)
+end
+
+When /^I manually go to the key action for this instance$/ do
+ visit key_resources_instance_url(pending_instance)
+end
+
+Given /^I see "([^"]*)"$/ do |text|
+ response.should contain(text)
+end
+
+Then /^I should see the Save dialog for a (.+) file$/ do |filetype|
+ response.headers["Content-Disposition"].should
+ match(/^attachment;\sfilename=.*#{filetype}$/)
+end
+
+Given /^there is a "([^"]*)" instance$/ do |name|
+ Factory :instance, :name => name
+end
+
+Given /^there is a "([^"]*)" failed instance$/ do |name|
+ Factory :instance, :name => name, :state => Instance::STATE_ERROR
+end
+
+Given /^there is a "([^"]*)" running instance$/ do |name|
+ Factory :instance, :name => name, :state => Instance::STATE_RUNNING
+end
+
+Given /^there is an uploaded image for a template$/ do
+ Factory :replicated_image
+end
+
+Given /^there is "([^"]*)" aggregator hardware profile$/ do |name|
+ Factory :mock_hwp2, :name => name
+end
+
+Given /^there is "([^"]*)" aggregator realm$/ do |name|
+ Factory :frontend_realm, :provider_id => nil, :name => name
+end
+
+Given /^there is "([^"]*)" pool$/ do |arg1|
+ Factory :pool, :name => arg1
+end
+
+
+When /^I check "([^"]*)" instance$/ do |name|
+ inst = Instance.find_by_name(name)
+ check("inst_ids_#{inst.id}")
+end
+
+Given /^there are the following instances:$/ do |table|
+ table.hashes.each do |hash|
+ Factory(:instance, :name => hash['name'],
+ :external_key => hash['external_key'],
+ :state => hash['state'],
+ :public_addresses => hash['public_addresses'],
+ :private_addresses => hash['private_addresses'])
+ end
+end
--
1.7.2.3
12 years, 10 months
[PATCH] refactored role/privilege model
by Scott Seago
Privileges are now a combination of a base action and a target object type (i.e. "modify" on Pool instead of the flat string "pool_modify"). In addition, the modeling has changed -- instead of a privileges model that was only low-level privileges with an explicit mapping to roles, the privileges model now tracks the privileges assigned to each role, with no separate mapping table.
This will require a database reload as the seeds.rb required substantial changes in role/privilege loading
Signed-off-by: Scott Seago <sseago(a)redhat.com>
---
.../admin/provider_accounts_controller.rb | 11 +-
src/app/controllers/admin/providers_controller.rb | 15 +-
src/app/controllers/admin/settings_controller.rb | 15 +--
src/app/controllers/admin/users_controller.rb | 32 +---
src/app/controllers/application_controller.rb | 11 +-
src/app/controllers/builds_controller.rb | 10 +-
src/app/controllers/cloud_accounts_controller.rb | 20 ++--
src/app/controllers/dashboard_controller.rb | 10 --
.../controllers/hardware_profiles_controller.rb | 1 -
.../controllers/image_factory/builds_controller.rb | 8 +-
.../image_factory/templates_controller.rb | 66 ++++++---
src/app/controllers/instances_controller.rb | 12 +-
src/app/controllers/permissions_controller.rb | 14 +-
src/app/controllers/pools_controller.rb | 38 ++----
src/app/controllers/providers_controller.rb | 27 ++--
src/app/controllers/quotas_controller.rb | 8 +-
.../controllers/resources/instances_controller.rb | 10 +-
src/app/controllers/resources/pools_controller.rb | 15 +-
src/app/controllers/settings_controller.rb | 17 +--
src/app/controllers/templates_controller.rb | 50 ++++--
src/app/controllers/users_controller.rb | 79 ++++------
src/app/models/cloud_account.rb | 21 +++
src/app/models/instance.rb | 27 +++-
src/app/models/permission.rb | 6 +
src/app/models/permissioned_object.rb | 136 +++++++---------
src/app/models/privilege.rb | 168 +++++++++++++-------
src/app/models/role.rb | 7 +-
src/app/models/template.rb | 5 +
src/app/services/application_service.rb | 35 +++--
src/app/views/admin/users/_form.haml | 4 +-
src/app/views/admin/users/edit.haml | 2 +-
src/app/views/dashboard/summary.haml | 20 ++--
src/app/views/layouts/_main_nav.html.erb | 2 +-
src/app/views/permissions/list.haml | 6 +-
src/app/views/pools/show.haml | 2 +-
src/app/views/providers/accounts.haml | 4 +-
src/app/views/users/_form.haml | 4 +-
src/app/views/users/edit.haml | 2 +-
.../20110107000000_privilege_model_refactor.rb | 53 ++++++
src/db/seeds.rb | 163 ++++++++------------
src/features/support/custom.rb | 4 -
src/features/support/hooks.rb | 17 --
src/lib/tasks/cucumber.rake | 6 +-
src/spec/controllers/instance_controller_spec.rb | 12 +-
src/spec/controllers/users_controller_spec.rb | 7 -
src/spec/factories/base_permission_object.rb | 3 -
src/spec/factories/metadata_object.rb | 34 ----
src/spec/factories/permission.rb | 8 +-
src/spec/factories/pool.rb | 2 +-
src/spec/factories/pool_family.rb | 2 +-
src/spec/factories/user.rb | 5 +-
src/spec/fixtures/base_permission_objects.yml | 2 -
src/spec/fixtures/privileges.yml | 43 -----
src/spec/fixtures/roles.yml | 47 ------
src/spec/models/metadata_object_spec.rb | 2 +-
src/spec/models/permission_spec.rb | 58 +++++++
src/spec/models/pool_family_spec.rb | 4 +-
src/spec/services/registration_service_spec.rb | 14 +--
src/spec/spec_helper.rb | 2 +-
59 files changed, 705 insertions(+), 703 deletions(-)
create mode 100644 src/db/migrate/20110107000000_privilege_model_refactor.rb
delete mode 100644 src/spec/factories/base_permission_object.rb
delete mode 100644 src/spec/factories/metadata_object.rb
delete mode 100644 src/spec/fixtures/base_permission_objects.yml
delete mode 100644 src/spec/fixtures/privileges.yml
delete mode 100644 src/spec/fixtures/roles.yml
create mode 100644 src/spec/models/permission_spec.rb
diff --git a/src/app/controllers/admin/provider_accounts_controller.rb b/src/app/controllers/admin/provider_accounts_controller.rb
index 2c331f7..960f4f5 100644
--- a/src/app/controllers/admin/provider_accounts_controller.rb
+++ b/src/app/controllers/admin/provider_accounts_controller.rb
@@ -8,6 +8,7 @@ class Admin::ProviderAccountsController < ApplicationController
def show
@tab_captions = ['Properties', 'Credentials', 'History', 'Permissions']
@account = CloudAccount.find(params[:id])
+ require_privilege(Privilege::ACTION_VIEW, @account)
@details_tab = params[:details_tab].blank? ? 'properties' : params[:details_tab]
if params.delete :test_account
@@ -34,7 +35,7 @@ class Admin::ProviderAccountsController < ApplicationController
def create
@provider = Provider.find(params[:provider_id])
- require_privilege(Privilege::ACCOUNT_MODIFY, @provider)
+ require_privilege(Privilege::ACTION_CREATE, CloudAccount, @provider)
@providers = Provider.all
@cloud_account = CloudAccount.new(params[:cloud_account])
@@ -73,13 +74,13 @@ class Admin::ProviderAccountsController < ApplicationController
@cloud_account = CloudAccount.find(params[:id])
@quota = @cloud_account.quota
@provider = @cloud_account.provider
- require_privilege(Privilege::ACCOUNT_MODIFY,@provider)
+ require_privilege(Privilege::ACTION_MODIFY,@cloud_account)
end
def update
@cloud_account = CloudAccount.find(params[:id])
@provider = @cloud_account.provider
- require_privilege(Privilege::ACCOUNT_MODIFY, @provider)
+ require_privilege(Privilege::ACTION_MODIFY,@cloud_account)
@quota = @cloud_account.quota
if params.delete :test_account
@@ -101,7 +102,9 @@ class Admin::ProviderAccountsController < ApplicationController
if (not params[:accounts_selected]) or (params[:accounts_selected].length == 0)
flash[:notice] = "You must select some accounts first."
else
- CloudAccount.destroy(params[:accounts_selected])
+ CloudAccount.find(params[:accounts_selected]).each do |account|
+ account.destroy if check_privilege(Privilege::ACTION_MODIFY, account)
+ end
end
redirect_to admin_provider_accounts_url
end
diff --git a/src/app/controllers/admin/providers_controller.rb b/src/app/controllers/admin/providers_controller.rb
index aac2c1d..61a405b 100644
--- a/src/app/controllers/admin/providers_controller.rb
+++ b/src/app/controllers/admin/providers_controller.rb
@@ -6,19 +6,20 @@ class Admin::ProvidersController < ApplicationController
end
def new
- require_privilege(Privilege::PROVIDER_MODIFY)
+ require_privilege(Privilege::ACTION_CREATE, Provider)
@provider = Provider.new
kick_condor
end
def edit
@provider = Provider.find_by_id(params[:id])
- require_privilege(Privilege::PROVIDER_MODIFY, @provider)
+ require_privilege(Privilege::ACTION_MODIFY, @provider)
end
def show
@provider = Provider.find(params[:id])
@url_params = params.clone
+ require_privilege(Privilege::ACTION_VIEW, @provider)
@tab_captions = ['Properties', 'HW Profiles', 'Realms', 'Provider Accounts', 'Services','History','Permissions']
@details_tab = params[:details_tab].blank? ? 'properties' : params[:details_tab]
respond_to do |format|
@@ -33,7 +34,7 @@ class Admin::ProvidersController < ApplicationController
end
def create
- require_privilege(Privilege::PROVIDER_MODIFY)
+ require_privilege(Privilege::ACTION_CREATE, Provider)
@provider = Provider.new(params[:provider])
if params[:test_connection]
test_connection(@provider)
@@ -52,8 +53,8 @@ class Admin::ProvidersController < ApplicationController
end
def update
- require_privilege(Privilege::PROVIDER_MODIFY)
@provider = Provider.find_by_id(params[:id])
+ require_privilege(Privilege::ACTION_MODIFY, @provider)
previous_cloud_type = @provider.cloud_type
@provider.update_attributes(params[:provider])
if params[:test_connection]
@@ -77,7 +78,9 @@ class Admin::ProvidersController < ApplicationController
end
def multi_destroy
- Provider.destroy(params[:provider_selected])
+ Provider.find(params[:provider_selected]).each do |provider|
+ provider.destroy if check_privilege(Privilege::ACTION_MODIFY, provider)
+ end
redirect_to admin_providers_url
end
@@ -97,7 +100,7 @@ class Admin::ProvidersController < ApplicationController
@header = [{ :name => "Provider name", :sort_attr => :name },
{ :name => "Provider URL", :sort_attr => :name }
]
- @providers = Provider.list_for_user(@current_user, Privilege::PROVIDER_VIEW)
+ @providers = Provider.list_for_user(@current_user, Privilege::ACTION_VIEW)
@url_params = params.clone
end
end
diff --git a/src/app/controllers/admin/settings_controller.rb b/src/app/controllers/admin/settings_controller.rb
index accf398..2b816d4 100644
--- a/src/app/controllers/admin/settings_controller.rb
+++ b/src/app/controllers/admin/settings_controller.rb
@@ -6,18 +6,12 @@ class Admin::SettingsController < ApplicationController
KEYS = [SELF_SERVICE_DEFAULT_QUOTA]
def self_service
- if !is_admin?
- raise PermissionError.new('You have insufficient privileges to perform action.')
- return
- end
+ require_privilege(Privilege::ACTION_MODIFY)
@self_service_default_quota = MetadataObject.lookup(SELF_SERVICE_DEFAULT_QUOTA)
end
def general_settings
- if !is_admin?
- raise PermissionError.new('You have insufficient privileges to perform action.')
- return
- end
+ require_privilege(Privilege::ACTION_MODIFY)
end
def update
@@ -47,9 +41,4 @@ class Admin::SettingsController < ApplicationController
redirect_to :action => 'self_service'
end
- private
- def is_admin?
- is_admin = @current_user.permissions.collect { |p| p.role }.find { |r| r.name == "Administrator" }
- return is_admin == nil ? false : true
- end
end
diff --git a/src/app/controllers/admin/users_controller.rb b/src/app/controllers/admin/users_controller.rb
index 0e854a9..4648da9 100644
--- a/src/app/controllers/admin/users_controller.rb
+++ b/src/app/controllers/admin/users_controller.rb
@@ -1,9 +1,9 @@
class Admin::UsersController < ApplicationController
before_filter :require_user
- before_filter :only_admin, :only => [:index, :multi_destroy]
before_filter :load_users, :only => [:index, :show]
def new
+ require_privilege(Privilege::ACTION_CREATE, User) unless current_user.nil?
@user = User.new
@user.quota = Quota.new
end
@@ -13,8 +13,7 @@ class Admin::UsersController < ApplicationController
redirect_to :action => 'new' and return
end
- # TODO: Shouldn't it be if current_user.nil? instead?
- require_privilege(Privilege::USER_MODIFY) unless current_user.nil?
+ require_privilege(Privilege::ACTION_MODIFY, User) unless current_user.nil?
@user = User.new(params[:user])
@registration = RegistrationService.new(@user)
@@ -34,6 +33,7 @@ class Admin::UsersController < ApplicationController
def show
@user = User.find_by_id(params[:id]) || current_user
+ require_privilege(Privilege::ACTION_VIEW, User) unless current_user == @user
@quota_resources = @user.quota.quota_resources
@url_params = params.clone
@@ -52,15 +52,12 @@ class Admin::UsersController < ApplicationController
def edit
@user = User.find_by_id(params[:id]) || current_user
-
- if cannot_modify_different_user?(@user)
- flash[:notice] = "Invalid Permission to perform this operation"
- redirect_to dashboard_url and return
- end
+ require_privilege(Privilege::ACTION_MODIFY, User) unless @user == current_user
end
def update
@user = User.find_by_id(params[:id]) || current_user
+ require_privilege(Privilege::ACTION_MODIFY, User) unless @user == current_user
if params[:commit] == "Reset"
redirect_to edit_admin_user_url(@user) and return
@@ -68,20 +65,16 @@ class Admin::UsersController < ApplicationController
redirect_to dashboard_url and return unless @user
- if cannot_modify_different_user = cannot_modify_different_user?(@user)
- flash[:notice] = "Invalid Permission to perform this operation"
- redirect_to dashboard_url and return
- end
-
unless @user.update_attributes(params[:user])
render :action => 'edit' and return
else
flash[:notice] = "User updated!"
- redirect_to cannot_modify_different_user ? dashboard_url : admin_users_url
+ redirect_to (@user == current_user) ? dashboard_url : admin_users_url
end
end
def multi_destroy
+ require_privilege(Privilege::ACTION_MODIFY, User)
User.destroy(params[:user_selected])
redirect_to admin_users_url
end
@@ -101,15 +94,4 @@ class Admin::UsersController < ApplicationController
end
end
- def only_admin
- unless current_user.permissions.collect { |p| p.role }.find { |r| r.name == "Administrator" }
- flash[:notice] = "Invalid Permission to perform this operation"
- redirect_to dashboard_url
- end
- end
-
- def cannot_modify_different_user?(user)
- user && user != current_user && !BasePermissionObject.general_permission_scope.can_modify_users(current_user)
- end
-
end
diff --git a/src/app/controllers/application_controller.rb b/src/app/controllers/application_controller.rb
index b77fe9c..b0386e0 100644
--- a/src/app/controllers/application_controller.rb
+++ b/src/app/controllers/application_controller.rb
@@ -60,13 +60,6 @@ class ApplicationController < ActionController::Base
'generic'
end
- perm_helper_string = ""
- Privilege::FULL_PRIVILEGE_LIST.each do |privilege|
- perm_helper_string += "def has_#{privilege}?(obj=@perm_obj); " +
- "check_privilege(\"#{privilege}\", obj) end; "
- end
- master_helper_module.module_eval perm_helper_string
-
helper_method :check_privilege
protected
@@ -162,8 +155,8 @@ class ApplicationController < ActionController::Base
def get_nav_items
if current_user.present?
- @providers = Provider.list_for_user(@current_user, Privilege::PROVIDER_VIEW)
- @pools = Pool.list_for_user(@current_user, Privilege::POOL_VIEW)
+ @providers = Provider.list_for_user(@current_user, Privilege::ACTION_VIEW)
+ @pools = Pool.list_for_user(@current_user, Privilege::ACTION_VIEW)
end
end
diff --git a/src/app/controllers/builds_controller.rb b/src/app/controllers/builds_controller.rb
index 7cf0ad6..e205171 100644
--- a/src/app/controllers/builds_controller.rb
+++ b/src/app/controllers/builds_controller.rb
@@ -1,12 +1,12 @@
class BuildsController < ApplicationController
- before_filter [:require_user, :check_permission]
+ before_filter [:require_user]
def section_id
'build'
end
def index
- require_privilege(Privilege::IMAGE_VIEW)
+ require_privilege(Privilege::ACTION_VIEW, Template)
order = get_order('templates.name')
@running_images = Image.all(:include => :template, :conditions => ['status IN (?)', Image::ACTIVE_STATES], :order => order)
@completed_images = Image.all(:include => :template, :conditions => {:status => Image::STATE_COMPLETE}, :order => order)
@@ -16,6 +16,7 @@ class BuildsController < ApplicationController
def new
raise "select template to build" unless id = params[:template_id]
@tpl = Template.find(id)
+ check_permission
if @tpl.imported
flash[:warning] = "Build imported template is not supported"
redirect_to templates_path
@@ -30,6 +31,7 @@ class BuildsController < ApplicationController
end
@tpl = Template.find(params[:template_id])
+ check_permission
@all_targets = Image.available_targets
if params[:targets].blank?
@@ -60,9 +62,11 @@ class BuildsController < ApplicationController
end
def edit
+ # FIXME: is @tpl defined here? do we need check_permission here?
end
def update
+ # FIXME: is @tpl defined here? do we need check_permission here?
end
private
@@ -82,6 +86,6 @@ class BuildsController < ApplicationController
end
def check_permission
- require_privilege(Privilege::IMAGE_MODIFY)
+ require_privilege(Privilege::ACTION_MODIFY, @tpl)
end
end
diff --git a/src/app/controllers/cloud_accounts_controller.rb b/src/app/controllers/cloud_accounts_controller.rb
index 75a75d9..c2fe5e7 100644
--- a/src/app/controllers/cloud_accounts_controller.rb
+++ b/src/app/controllers/cloud_accounts_controller.rb
@@ -31,19 +31,19 @@ class CloudAccountsController < ApplicationController
def index
@provider = Provider.find(params[:provider_id])
- require_privilege(Privilege::ACCOUNT_VIEW, @provider)
+ require_privilege(Privilege::ACTION_VIEW, CloudAccount, @provider)
end
def new
@provider = Provider.find(params[:provider_id])
@cloud_account = CloudAccount.new
@quota = Quota.new
- require_privilege(Privilege::ACCOUNT_MODIFY, @provider)
+ require_privilege(Privilege::ACTION_CREATE, CloudAccount, @provider)
end
def create
@provider = Provider.find(params[:provider_id])
- require_privilege(Privilege::ACCOUNT_MODIFY,@provider)
+ require_privilege(Privilege::ACTION_CREATE, CloudAccount, @provider)
@cloud_account = CloudAccount.new(params[:cloud_account])
@cloud_account.provider = @provider
@cloud_account.quota = @quota = Quota.new
@@ -80,13 +80,13 @@ class CloudAccountsController < ApplicationController
@cloud_account = CloudAccount.find(params[:id])
@quota = @cloud_account.quota
@provider = @cloud_account.provider
- require_privilege(Privilege::ACCOUNT_MODIFY,@provider)
+ require_privilege(Privilege::ACTION_MODIFY, @cloud_account)
end
def update_accounts
@provider = Provider.find(params[:provider][:id])
- require_privilege(Privilege::ACCOUNT_MODIFY, @provider)
- @providers = Provider.list_for_user(@current_user, Privilege::PROVIDER_VIEW)
+ require_privilege(Privilege::ACTION_MODIFY, CloudAccount, @provider)
+ @providers = Provider.list_for_user(@current_user, Privilege::ACTION_VIEW)
success = true
@provider.cloud_accounts.each do |cloud_account|
@@ -130,7 +130,7 @@ class CloudAccountsController < ApplicationController
def update
@cloud_account = CloudAccount.find(params[:id])
@provider = @cloud_account.provider
- require_privilege(Privilege::ACCOUNT_MODIFY, @provider)
+ require_privilege(Privilege::ACTION_MODIFY, @cloud_account)
@quota = @cloud_account.quota
limit = params[:quota][:maximum_running_instances] if params[:quota]
@@ -145,7 +145,7 @@ class CloudAccountsController < ApplicationController
def key
@cloud_account = CloudAccount.find(params[:id])
- require_privilege(Privilege::ACCOUNT_MODIFY,@cloud_account.provider)
+ require_privilege(Privilege::ACTION_MODIFY,@cloud_account)
unless @cloud_account.instance_key.nil?
render :text => @cloud_account.instance_key.pem
end
@@ -154,7 +154,7 @@ class CloudAccountsController < ApplicationController
def destroy
account = CloudAccount.find(params[:id])
provider = account.provider
- require_privilege(Privilege::ACCOUNT_MODIFY, provider)
+ require_privilege(Privilege::ACTION_MODIFY, account)
if account.destroy
flash[:notice] = "Cloud Account destroyed"
else
@@ -176,6 +176,6 @@ class CloudAccountsController < ApplicationController
private
def load_providers
- @providers = Provider.list_for_user(@current_user, Privilege::PROVIDER_VIEW)
+ @providers = Provider.list_for_user(@current_user, Privilege::ACTION_VIEW)
end
end
diff --git a/src/app/controllers/dashboard_controller.rb b/src/app/controllers/dashboard_controller.rb
index 8d37a12..5254dd7 100644
--- a/src/app/controllers/dashboard_controller.rb
+++ b/src/app/controllers/dashboard_controller.rb
@@ -70,16 +70,6 @@ class DashboardController < ApplicationController
@cloud_accounts = CloudAccount.find(:all)
- # Now need to check any permissions are set since default permission and pool
- # may not be set for the admin user
- if @current_user.permissions
- # FIXME remove general role based permission check, replace w/
- # more granular / per-permission-object permission checks on the
- # dashboard in the future (here and in dashboard views)
- @is_admin = @current_user.permissions.collect { |p| p.role }.
- find { |r| r.name == "Administrator" }
- end
-
render :action => 'monitor'
end
diff --git a/src/app/controllers/hardware_profiles_controller.rb b/src/app/controllers/hardware_profiles_controller.rb
index c3afae2..d18110c 100644
--- a/src/app/controllers/hardware_profiles_controller.rb
+++ b/src/app/controllers/hardware_profiles_controller.rb
@@ -23,7 +23,6 @@ class HardwareProfilesController < ApplicationController
def index
@hardware_profiles = HardwareProfile.find(:all)
- #require_privilege(Privilege::PROVIDER_VIEW, @hardware_profile) ?
end
def new
diff --git a/src/app/controllers/image_factory/builds_controller.rb b/src/app/controllers/image_factory/builds_controller.rb
index 97bd32f..df9aba6 100644
--- a/src/app/controllers/image_factory/builds_controller.rb
+++ b/src/app/controllers/image_factory/builds_controller.rb
@@ -1,9 +1,10 @@
class ImageFactory::BuildsController < ApplicationController
- before_filter [:require_user, :check_permission]
+ before_filter [:require_user]
def new
raise "select template to build" unless id = params[:template_id]
@tpl = Template.find(id)
+ check_permission
if @tpl.imported
flash[:warning] = "Build imported template is not supported"
redirect_to templates_path
@@ -13,6 +14,7 @@ class ImageFactory::BuildsController < ApplicationController
def create
@tpl = Template.find(params[:template_id])
+ check_permission
@all_targets = Image.available_targets
if params[:targets].blank?
@@ -43,9 +45,11 @@ class ImageFactory::BuildsController < ApplicationController
end
def edit
+ # FIXME: is @tpl defined here? do we need check_permission here?
end
def update
+ # FIXME: is @tpl defined here? do we need check_permission here?
end
private
@@ -65,6 +69,6 @@ class ImageFactory::BuildsController < ApplicationController
end
def check_permission
- require_privilege(Privilege::IMAGE_MODIFY)
+ require_privilege(Privilege::ACTION_MODIFY, @tpl)
end
end
diff --git a/src/app/controllers/image_factory/templates_controller.rb b/src/app/controllers/image_factory/templates_controller.rb
index fbba625..a1b0fec 100644
--- a/src/app/controllers/image_factory/templates_controller.rb
+++ b/src/app/controllers/image_factory/templates_controller.rb
@@ -2,7 +2,6 @@ require 'util/repository_manager'
class ImageFactory::TemplatesController < ApplicationController
before_filter :require_user
- before_filter :check_permission, :except => [:index, :show]
before_filter :load_templates, :only => [:index, :show]
def index
@@ -10,6 +9,7 @@ class ImageFactory::TemplatesController < ApplicationController
def show
@tpl = Template.find(params[:id])
+ require_privilege(Privilege::ACTION_VIEW, @tpl)
@url_params = params.clone
@tab_captions = ['Properties', 'Images']
@details_tab = params[:details_tab].blank? ? 'properties' : params[:details_tab]
@@ -26,6 +26,7 @@ class ImageFactory::TemplatesController < ApplicationController
end
def new
+ check_create_permission
# can't use @template variable - is used by compass (or something other)
@tpl = Template.new(params[:tpl])
@repository_manager = RepositoryManager.new(:repositories => params[:repository] || @tpl.platform)
@@ -34,9 +35,11 @@ class ImageFactory::TemplatesController < ApplicationController
def add_selected
if params[:tpl] and not params[:tpl][:id].blank?
@tpl = Template.find(params[:tpl][:id])
+ check_edit_permission
@tpl.attributes = params[:tpl]
else
@tpl = Template.new(params[:tpl])
+ check_create_permission
end
@repository_manager = RepositoryManager.new(:repositories => params[:repository] || @tpl.platform)
@tpl.add_software(params[:packages].to_a + params[:selected_packages].to_a + params[:cached_packages].to_a,
@@ -46,11 +49,13 @@ class ImageFactory::TemplatesController < ApplicationController
def edit
@tpl = Template.find(params[:id])
+ check_edit_permission
@tpl.attributes = params[:tpl] unless params[:tpl].blank?
@repository_manager = RepositoryManager.new(:repositories => params[:repository] || @tpl.platform)
end
def create
+ check_create_permission
@tpl = Template.new(params[:tpl])
@tpl.packages = params[:packages]
if @tpl.save
@@ -65,6 +70,7 @@ class ImageFactory::TemplatesController < ApplicationController
def update
@tpl = Template.find(params[:id])
+ check_edit_permission
@tpl.packages = []
if @tpl.update_attributes(params[:tpl])
@@ -120,7 +126,13 @@ class ImageFactory::TemplatesController < ApplicationController
end
def managed_content
- @tpl = params[:template_id].blank? ? Template.new : Template.find(params[:template_id])
+ if params[:template_id].blank?
+ @tpl = Template.new
+ check_create_permission
+ else
+ @tpl = Template.find(params[:template_id])
+ check_edit_permission
+ end
@tpl.add_software(params[:packages].to_a + params[:selected_packages].to_a,
params[:groups].to_a + params[:selected_groups].to_a)
render :layout => false
@@ -133,9 +145,11 @@ class ImageFactory::TemplatesController < ApplicationController
else
errs = {}
Template.find(ids).each do |t|
- t.destroy
- unless t.destroyed?
- errs[t.name] = t.errors.full_messages.join(". ")
+ if check_permission(Privilege::ACTION_MODIFY, t)
+ t.destroy
+ errs[t.name] = t.errors.full_messages.join(". ") unless t.destroyed?
+ else
+ errs[t.name] = "You don't have permission to delete #{t.name}"
end
end
if errs.empty?
@@ -148,9 +162,11 @@ class ImageFactory::TemplatesController < ApplicationController
end
def assembly
+ # FIXME: do we need perm check here?
end
def deployment_definition
+ # FIXME: do we need perm check here?
@all_targets = Image.available_targets
end
@@ -158,9 +174,11 @@ class ImageFactory::TemplatesController < ApplicationController
params[:packages].delete(params[:name]) unless params[:name].blank?
if params[:tpl] and not params[:tpl][:id].blank?
@tpl = Template.find(params[:tpl][:id])
+ check_edit_permission
@tpl.attributes = params[:tpl]
else
@tpl = Template.new(params[:tpl])
+ check_create_permission
end
@tpl.add_software(params[:packages].to_a, params[:groups].to_a)
@repository_manager = RepositoryManager.new(:repositories => params[:repository] || @tpl.platform)
@@ -168,9 +186,13 @@ class ImageFactory::TemplatesController < ApplicationController
end
def multi_destroy
- # FIXME: set correct check permission when we will have it
- require_privilege(Privilege::IMAGE_MODIFY)
- Template.destroy(params[:selected])
+ @tpl = Template.find(params[:selected])
+ if check_edit_permission
+ @tpl.destroy
+ errs[(a)tpl.name] = @tpl.errors.full_messages.join(". ") unless @tpl.destroyed?
+ else
+ errs[(a)tpl.name] = "You don't have permission to delete #{(a)tpl.name}"
+ end
redirect_to image_factory_templates_url
end
@@ -184,7 +206,6 @@ class ImageFactory::TemplatesController < ApplicationController
{:name => 'ARCH', :sort_attr => 'templates.architecture'},
{:name => 'STATUS', :sort_attr => 'status'},
]
- require_privilege(Privilege::IMAGE_VIEW)
@images = tpl.images
end
@@ -197,18 +218,21 @@ class ImageFactory::TemplatesController < ApplicationController
{:name => 'ARCH', :sort_attr => 'architecture'},
]
- # TODO: add template permission check
- require_privilege(Privilege::IMAGE_VIEW)
- @templates = Template.find(
- :all,
- :include => :images,
- :order => get_order('name')
- )
+ @templates = Template.list_for_user(Privilege::ACTION_VIEW,
+ :include => :images,
+ :order => get_order('name')
+ )
@url_params = params.clone
end
def set_package_vars(set_all = false)
- @tpl = params[:id].blank? ? Template.new : Template.find(params[:id])
+ if params[:id].blank?
+ @tpl = Template.new
+ check_create_permission
+ else
+ @tpl = Template.find(params[:id])
+ check_edit_permission
+ end
@tpl.attributes = params[:tpl] unless params[:tpl].nil?
@repository_manager = RepositoryManager.new(:repositories => params[:repository] || @tpl.platform)
@groups = @repository_manager.groups
@@ -230,8 +254,12 @@ class ImageFactory::TemplatesController < ApplicationController
flash.now[:error][:failures].merge!(errs)
end
- def check_permission
- require_privilege(Privilege::IMAGE_MODIFY)
+ def check_create_permission
+ require_privilege(Privilege::ACTION_CREATE, Template)
+ end
+
+ def check_edit_permission
+ require_privilege(Privilege::ACTION_MODIFY, @tpl)
end
def get_selected_id
diff --git a/src/app/controllers/instances_controller.rb b/src/app/controllers/instances_controller.rb
index 5e68b8e..142a336 100644
--- a/src/app/controllers/instances_controller.rb
+++ b/src/app/controllers/instances_controller.rb
@@ -35,7 +35,7 @@ class InstancesController < ApplicationController
end
def index
- @pools = Pool.list_for_user(@current_user, Privilege::INSTANCE_MODIFY)
+ @pools = Pool.list_for_user(@current_user, Privilege::ACTION_MODIFY, :target_type => Instance)
@order_dir = params[:order_dir] == 'desc' ? 'desc' : 'asc'
@order_field = params[:order_field] || 'name'
@@ -69,7 +69,7 @@ class InstancesController < ApplicationController
def new
@instance = Instance.new(params[:instance])
- require_privilege(Privilege::INSTANCE_MODIFY, @instance.pool) if @instance.pool
+ require_privilege(Privilege::ACTION_CREATE, Instance, @instance.pool) if @instance.pool
# FIXME: we need to list only templates for particular user,
# => TODO: add TEMPLATE_* permissions
@templates = Template.paginate(
@@ -81,7 +81,7 @@ class InstancesController < ApplicationController
def configure
@instance = Instance.new(params[:instance])
- require_privilege(Privilege::INSTANCE_MODIFY, @instance.pool)
+ require_privilege(Privilege::ACTION_CREATE, Instance, @instance.pool)
@hardware_profiles = HardwareProfile.find(:all, :include => :architecture,
:conditions => {:provider_id => nil,
'hardware_profile_properties.value' => @instance.template.architecture})
@@ -97,7 +97,7 @@ class InstancesController < ApplicationController
@instance.state = Instance::STATE_NEW
@instance.owner = current_user
- require_privilege(Privilege::INSTANCE_MODIFY,
+ require_privilege(Privilege::ACTION_CREATE, Instance,
Pool.find((a)instance.pool_id))
#FIXME: This should probably be in a transaction
if @instance.save!
@@ -131,7 +131,7 @@ class InstancesController < ApplicationController
end
@instance = Instance.find((params[:id] || []).first)
- require_privilege(Privilege::INSTANCE_CONTROL,@instance.pool)
+ require_privilege(Privilege::ACTION_USE,@instance)
if params[:instance_details]
render :action => 'show'
@@ -190,7 +190,7 @@ class InstancesController < ApplicationController
def instance
@instance = Instance.find(params[:id])
- require_privilege(Privilege::INSTANCE_VIEW, @instance.pool)
+ require_privilege(Privilege::ACTION_VIEW, @instance)
end
end
diff --git a/src/app/controllers/permissions_controller.rb b/src/app/controllers/permissions_controller.rb
index c326e14..a2991d9 100644
--- a/src/app/controllers/permissions_controller.rb
+++ b/src/app/controllers/permissions_controller.rb
@@ -21,15 +21,15 @@ class PermissionsController < ApplicationController
def show
@permission = Permission.find(params[:id])
- require_privilege(Privilege::PERM_VIEW, @permission.permission_object)
+ require_privilege(Privilege::ACTION_PERM_VIEW, @permission.permission_object)
end
def list
- set_permission_object Privilege::PERM_VIEW
+ set_permission_object Privilege::ACTION_PERM_VIEW
end
def new
- set_permission_object Privilege::PERM_SET
+ set_permission_object Privilege::ACTION_PERM_SET
@permission = Permission.new(:permission_object_type => @permission_object.class,
:permission_object_id => @permission_object.id)
@users = User.all
@@ -38,7 +38,7 @@ class PermissionsController < ApplicationController
def create
@permission = Permission.new(params[:permission])
- require_privilege(Privilege::PERM_SET, @permission.permission_object)
+ require_privilege(Privilege::ACTION_PERM_SET, @permission.permission_object)
if request.post? && @permission.save
flash[:notice] = "Permission record added."
redirect_to :action => "list",
@@ -55,7 +55,7 @@ class PermissionsController < ApplicationController
def destroy
if request.post?
p =Permission.find(params[:permission][:id])
- require_privilege(Privilege::PERM_SET, p.permission_object)
+ require_privilege(Privilege::ACTION_PERM_SET, p.permission_object)
p.destroy
end
redirect_to :action => "list",
@@ -65,7 +65,7 @@ class PermissionsController < ApplicationController
private
- def set_permission_object(privilege)
+ def set_permission_object(action)
if !params[:permission_object_type].nil?
@permission_object =
params[:permission_object_type].constantize.find(params[:permission_object_id])
@@ -83,7 +83,7 @@ class PermissionsController < ApplicationController
raise ActiveRecord::RecordNotFound if @permission_object.nil?
- require_privilege(privilege, @permission_object)
+ require_privilege(action, @permission_object)
end
end
diff --git a/src/app/controllers/pools_controller.rb b/src/app/controllers/pools_controller.rb
index 47cdc77..fdc3650 100644
--- a/src/app/controllers/pools_controller.rb
+++ b/src/app/controllers/pools_controller.rb
@@ -44,16 +44,19 @@ class PoolsController < ApplicationController
def show
@pool = Pool.find(params[:id])
+ require_privilege(Privilege::ACTION_VIEW, @pool)
end
def edit
@pool = Pool.find(params[:id])
+ require_privilege(Privilege::ACTION_MODIFY, @pool)
end
def list
#FIXME: clean this up, many error cases here
@pool = Pool.find(params[:id])
- require_privilege(Privilege::INSTANCE_VIEW,@pool)
+ # FIXME: really we need perm-filtered list here
+ require_privilege(Privilege::ACTION_VIEW, Instance, @pool)
@pool.reload
@order_dir = params[:order_dir] == 'desc' ? 'desc' : 'asc'
@@ -74,23 +77,23 @@ class PoolsController < ApplicationController
def hardware_profiles
@pool = Pool.find(params[:id])
@hardware_profiles = @pool.hardware_profiles
- require_privilege(Privilege::POOL_VIEW, @pool)
+ require_privilege(Privilege::ACTION_VIEW, @pool)
end
def realms
@pool = Pool.find(params[:id])
@realm_names = @pool.realms
- require_privilege(Privilege::POOL_VIEW,@pool)
+ require_privilege(Privilege::ACTION_VIEW, @pool)
end
def new
- require_privilege(Privilege::POOL_MODIFY)
- @pools = Pool.list_for_user(@current_user, Privilege::POOL_MODIFY)
+ require_privilege(Privilege::ACTION_CREATE, Pool)
+ @pools = Pool.list_for_user(@current_user, Privilege::ACTION_MODIFY)
@pool = Pool.new
end
def create
- require_privilege(Privilege::POOL_MODIFY)
+ require_privilege(Privilege::ACTION_CREATE, Pool)
#FIXME: This should probably be in a transaction
@pool = Pool.new(params[:pool])
@@ -118,6 +121,7 @@ class PoolsController < ApplicationController
if type == "edit"
redirect_to :action => 'edit', :id => pool_id
elsif type == "delete"
+ require_privilege(Privilege::ACTION_MODIFY, Pool.find(pool_id))
params[:id] = pool_id
destroy
end
@@ -130,27 +134,5 @@ class PoolsController < ApplicationController
def delete
end
- def accounts_for_pool
- @pool = Pool.find(params[:pool_id])
- require_privilege(Privilege::ACCOUNT_VIEW,@pool)
- @cloud_accounts = []
- all_accounts = CloudAccount.list_for_user(@current_user, Privilege::ACCOUNT_ADD)
- all_accounts.each {|account|
- @cloud_accounts << account unless @pool.cloud_accounts.map{|x| x.id}.include?(account.id)
- }
- end
-
- def add_account
- @pool = Pool.find(params[:pool])
- @cloud_account = CloudAccount.find(params[:cloud_account])
- require_privilege(Privilege::ACCOUNT_ADD,@pool)
- require_privilege(Privilege::ACCOUNT_ADD,@cloud_account)
- Pool.transaction do
- @pool.cloud_accounts << @cloud_account unless @pool.cloud_accounts.map{|x| x.id}.include?((a)cloud_account.id)
- @pool.save!
- @pool.populate_realms([@cloud_account])
- end
- redirect_to :action => 'show', :id => @pool.id
- end
kick_condor
end
diff --git a/src/app/controllers/providers_controller.rb b/src/app/controllers/providers_controller.rb
index 0754d65..0104f95 100644
--- a/src/app/controllers/providers_controller.rb
+++ b/src/app/controllers/providers_controller.rb
@@ -32,25 +32,25 @@ class ProvidersController < ApplicationController
def show
@provider = Provider.find(:first, :conditions => {:id => params[:id]})
- require_privilege(Privilege::PROVIDER_VIEW, @provider)
+ require_privilege(Privilege::ACTION_VIEW, @provider)
end
def edit
- @providers = Provider.list_for_user(@current_user, Privilege::PROVIDER_MODIFY)
+ @providers = Provider.list_for_user(@current_user, Privilege::ACTION_VIEW)
@provider = Provider.find(:first, :conditions => {:id => params[:id]})
- require_privilege(Privilege::PROVIDER_MODIFY, @provider)
+ require_privilege(Privilege::ACTION_MODIFY, @provider)
end
def new
- require_privilege(Privilege::PROVIDER_MODIFY)
- @providers = Provider.list_for_user(@current_user, Privilege::PROVIDER_MODIFY)
+ require_privilege(Privilege::ACTION_CREATE, Provider)
+ @providers = Provider.list_for_user(@current_user, Privilege::ACTION_MODIFY)
@provider = Provider.new(params[:provider])
kick_condor
end
def create
- require_privilege(Privilege::PROVIDER_MODIFY)
- @providers = Provider.list_for_user(@current_user, Privilege::PROVIDER_MODIFY)
+ require_privilege(Privilege::ACTION_CREATE, Provider)
+ @providers = Provider.list_for_user(@current_user, Privilege::ACTION_MODIFY)
@provider = Provider.new(params[:provider])
if params[:test_connection]
@@ -70,9 +70,9 @@ class ProvidersController < ApplicationController
end
def update
- require_privilege(Privilege::PROVIDER_MODIFY)
- @providers = Provider.list_for_user(@current_user, Privilege::PROVIDER_MODIFY)
+ @providers = Provider.list_for_user(@current_user, Privilege::ACTION_MODIFY)
@provider = Provider.find(:first, :conditions => {:id => params[:id]})
+ require_privilege(Privilege::ACTION_MODIFY, @provider)
previous_cloud_type = @provider.cloud_type
@provider.update_attributes(params[:provider])
@@ -99,7 +99,7 @@ class ProvidersController < ApplicationController
def destroy
if request.post? || request.delete?
@provider = Provider.find(params[:id])
- require_privilege(Privilege::PROVIDER_MODIFY, @provider)
+ require_privilege(Privilege::ACTION_MODIFY, @provider)
if @provider.destroy and @provider.destroyed?
redirect_to :action => "index"
flash[:notice] = "Provider Deleted"
@@ -117,17 +117,18 @@ class ProvidersController < ApplicationController
def hardware_profiles
@provider = Provider.find(params[:id])
@hardware_profiles = @provider.hardware_profiles
- require_privilege(Privilege::PROVIDER_VIEW, @provider)
+ require_privilege(Privilege::ACTION_VIEW, @provider)
end
def realms
@provider = Provider.find(params[:id])
@realm_names = @provider.realms.collect { |r| r.name }
- require_privilege(Privilege::PROVIDER_VIEW, @provider)
+ require_privilege(Privilege::ACTION_VIEW, @provider)
end
def settings
@provider = Provider.find(params[:id])
+ require_privilege(Privilege::ACTION_VIEW, @provider)
end
def list
@@ -145,6 +146,6 @@ class ProvidersController < ApplicationController
protected
def load_providers
- @providers = Provider.list_for_user(@current_user, Privilege::PROVIDER_VIEW)
+ @providers = Provider.list_for_user(@current_user, Privilege::ACTION_VIEW)
end
end
diff --git a/src/app/controllers/quotas_controller.rb b/src/app/controllers/quotas_controller.rb
index e9937fb..df9bb41 100644
--- a/src/app/controllers/quotas_controller.rb
+++ b/src/app/controllers/quotas_controller.rb
@@ -28,7 +28,7 @@ class QuotasController < ApplicationController
@parent_type = params[:parent_type]
@quota = @parent.quota
- require_privilege(Privilege::QUOTA_VIEW, @parent)
+ require_privilege(Privilege::ACTION_VIEW, Quota, @parent)
end
def edit
@@ -38,13 +38,13 @@ class QuotasController < ApplicationController
@quota = @parent.quota
- require_privilege(Privilege::QUOTA_MODIFY, @parent)
+ require_privilege(Privilege::ACTION_MODIFY, Quota, @parent)
end
def update
@parent = @parent = get_parent_object(params)
@parent_type = params[:parent_type]
- require_privilege(Privilege::QUOTA_MODIFY, @parent)
+ require_privilege(Privilege::ACTION_MODIFY, Quota, @parent)
@quota = @parent.quota
@name = get_parent_name(@parent, @parent_type)
@@ -60,7 +60,7 @@ class QuotasController < ApplicationController
def reset
@parent = @parent = get_parent_object(params)
@parent_type = params[:parent_type]
- require_privilege(Privilege::QUOTA_MODIFY, @parent)
+ require_privilege(Privilege::ACTION_MODIFY, Quota, @parent)
@quota = @parent.quota
@quota.maximum_running_instances = Quota::NO_LIMIT
diff --git a/src/app/controllers/resources/instances_controller.rb b/src/app/controllers/resources/instances_controller.rb
index 3bd0c45..241dbba 100644
--- a/src/app/controllers/resources/instances_controller.rb
+++ b/src/app/controllers/resources/instances_controller.rb
@@ -5,7 +5,7 @@ class Resources::InstancesController < ApplicationController
def new
@instance = Instance.new(params[:instance])
- #require_privilege(Privilege::INSTANCE_MODIFY, @instance.pool) if @instance.pool
+ #require_privilege(Privilege::ACTION_CREATE, Instance, @instance.pool) if @instance.pool
unless @instance.template
redirect_to select_template_resources_instances_path
@@ -36,7 +36,7 @@ class Resources::InstancesController < ApplicationController
@instance.owner = current_user
begin
- require_privilege(Privilege::INSTANCE_MODIFY,
+ require_privilege(Privilege::ACTION_CREATE, Instance,
Pool.find((a)instance.pool_id))
free_quota = Quota.can_start_instance?(@instance, nil)
@instance.transaction do
@@ -120,11 +120,11 @@ class Resources::InstancesController < ApplicationController
def load_instance
@instance = Instance.find((params[:id] || []).first)
- require_privilege(Privilege::INSTANCE_CONTROL,@instance.pool)
+ require_privilege(Privilege::ACTION_USE,@instance)
end
def init_new_instance_attrs
- @pools = Pool.list_for_user(@current_user, Privilege::INSTANCE_MODIFY)
+ @pools = Pool.list_for_user(@current_user, Privilege::ACTION_MODIFY, :target_type => Instance)
@realms = Realm.find(:all, :conditions => { :provider_id => nil })
@hardware_profiles = HardwareProfile.all(
:include => :architecture,
@@ -145,7 +145,7 @@ class Resources::InstancesController < ApplicationController
{:name => 'CREATED BY', :sort_attr => 'users.last_name'},
]
- pools = Pool.list_for_user(@current_user, Privilege::INSTANCE_MODIFY)
+ pools = Pool.list_for_user(@current_user, Privilege::ACTION_MODIFY, :target_type => Instance)
@instances = Instance.all(
:include => [:template, :owner],
:conditions => {:pool_id => pools},
diff --git a/src/app/controllers/resources/pools_controller.rb b/src/app/controllers/resources/pools_controller.rb
index ffd1f55..3205da9 100644
--- a/src/app/controllers/resources/pools_controller.rb
+++ b/src/app/controllers/resources/pools_controller.rb
@@ -18,6 +18,7 @@ class Resources::PoolsController < ApplicationController
def show
@pool = Pool.find(params[:id])
+ require_privilege(Privilege::ACTION_VIEW, @pool)
@url_params = params.clone
@tab_captions = ['Properties', 'Deployments', 'Instances', 'History', 'Permissions']
@details_tab = params[:details_tab].blank? ? 'properties' : params[:details_tab]
@@ -33,12 +34,12 @@ class Resources::PoolsController < ApplicationController
end
def new
- require_privilege(Privilege::POOL_MODIFY)
+ require_privilege(Privilege::ACTION_CREATE, Pool)
@pool = Pool.new
end
def create
- require_privilege(Privilege::POOL_MODIFY)
+ require_privilege(Privilege::ACTION_CREATE, Pool)
@pool = Pool.new(params[:pool])
quota = Quota.new
@@ -55,15 +56,13 @@ class Resources::PoolsController < ApplicationController
end
def edit
- require_privilege(Privilege::POOL_MODIFY)
-
@pool = Pool.find(params[:id])
+ require_privilege(Privilege::ACTION_MODIFY, @pool)
end
def update
- require_privilege(Privilege::POOL_MODIFY)
-
@pool = Pool.find(params[:id])
+ require_privilege(Privilege::ACTION_MODIFY, @pool)
if @pool.update_attributes(params[:pool])
flash[:notice] = "Pool updated."
redirect_to :action => 'show', :id => @pool.id
@@ -73,7 +72,9 @@ class Resources::PoolsController < ApplicationController
end
def multi_destroy
- Pool.destroy(params[:pools_selected])
+ Pool.find(params[:pools_selected]).each do |pool|
+ pool.destroy if check_privilege(Privilege::ACTION_MODIFY, pool)
+ end
redirect_to resources_pools_url
end
diff --git a/src/app/controllers/settings_controller.rb b/src/app/controllers/settings_controller.rb
index ae20e12..0166e71 100644
--- a/src/app/controllers/settings_controller.rb
+++ b/src/app/controllers/settings_controller.rb
@@ -31,22 +31,16 @@ class SettingsController < ApplicationController
end
def index
- @providers = Provider.list_for_user(@current_user, Privilege::PROVIDER_VIEW)
+ @providers = Provider.list_for_user(@current_user, Privilege::ACTION_VIEW)
end
def self_service
- if !is_admin?
- raise PermissionError.new('You have insufficient privileges to perform action.')
- return
- end
+ require_privilege(Privilege::ACTION_MODIFY)
@self_service_default_quota = MetadataObject.lookup(SELF_SERVICE_DEFAULT_QUOTA)
end
def general_settings
- if !is_admin?
- raise PermissionError.new('You have insufficient privileges to perform action.')
- return
- end
+ require_privilege(Privilege::ACTION_MODIFY)
end
def update
@@ -76,9 +70,4 @@ class SettingsController < ApplicationController
redirect_to :action => 'self_service'
end
- private
- def is_admin?
- is_admin = @current_user.permissions.collect { |p| p.role }.find { |r| r.name == "Administrator" }
- return is_admin == nil ? false : true
- end
end
diff --git a/src/app/controllers/templates_controller.rb b/src/app/controllers/templates_controller.rb
index 403e6c3..e19c8e6 100644
--- a/src/app/controllers/templates_controller.rb
+++ b/src/app/controllers/templates_controller.rb
@@ -2,7 +2,6 @@ require 'util/repository_manager'
class TemplatesController < ApplicationController
before_filter :require_user
- before_filter :check_permission, :except => :index
layout :layout
def layout
@@ -14,13 +13,10 @@ class TemplatesController < ApplicationController
end
def index
- # TODO: add template permission check
- require_privilege(Privilege::IMAGE_VIEW)
- @templates = Template.find(
- :all,
- :include => :images,
- :order => get_order('name')
- )
+ @templates = Template.list_for_user(current_user,
+ Privilege::ACTION_VIEW,
+ :include => :images,
+ :order => get_order('name'))
end
def index_action
@@ -81,6 +77,7 @@ class TemplatesController < ApplicationController
end
def new
+ check_create_permission
# can't use @template variable - is used by compass (or something other)
@tpl = Template.new(params[:tpl])
@repository_manager = RepositoryManager.new(:repositories => params[:repository] || @tpl.platform)
@@ -91,12 +88,14 @@ class TemplatesController < ApplicationController
def edit
@tpl = Template.find(params[:id])
+ check_edit_permission
@tpl.attributes = params[:tpl] unless params[:tpl].blank?
@repository_manager = RepositoryManager.new(:repositories => params[:repository] || @tpl.platform)
render :action => :edit
end
def create
+ check_create_permission
@tpl = Template.new(params[:tpl])
@tpl.packages = params[:packages]
if @tpl.save
@@ -112,6 +111,7 @@ class TemplatesController < ApplicationController
def update
@tpl = Template.find(params[:id])
@tpl.packages = []
+ check_edit_permission
if @tpl.update_attributes(params[:tpl])
@tpl.set_complete
@@ -163,7 +163,13 @@ class TemplatesController < ApplicationController
end
def managed_content
- @tpl = params[:template_id].blank? ? Template.new : Template.find(params[:template_id])
+ if params[:template_id].blank?
+ @tpl = Template.new
+ check_create_permission
+ else
+ @tpl = Template.find(params[:template_id])
+ check_edit_permission
+ end
@tpl.add_software(params[:packages].to_a + params[:selected_packages].to_a,
params[:groups].to_a + params[:selected_groups].to_a)
render :layout => false
@@ -176,9 +182,11 @@ class TemplatesController < ApplicationController
else
errs = {}
Template.find(ids).each do |t|
- t.destroy
- unless t.destroyed?
- errs[t.name] = t.errors.full_messages.join(". ")
+ if check_permission(Privilege::ACTION_MODIFY, t)
+ t.destroy
+ errs[t.name] = t.errors.full_messages.join(". ") unless t.destroyed?
+ else
+ errs[t.name] = "You don't have permission to delete #{t.name}"
end
end
if errs.empty?
@@ -191,16 +199,24 @@ class TemplatesController < ApplicationController
end
def assembly
+ # FIXME: do we need perm check here?
end
def deployment_definition
+ # FIXME: do we need perm check here?
@all_targets = Image.available_targets
end
private
def set_package_vars(set_all = false)
- @tpl = params[:id].blank? ? Template.new : Template.find(params[:id])
+ if params[:id].blank?
+ @tpl = Template.new
+ check_create_permission
+ else
+ @tpl = Template.find(params[:id])
+ check_edit_permission
+ end
@tpl.attributes = params[:tpl] unless params[:tpl].nil?
@repository_manager = RepositoryManager.new(:repositories => params[:repository] || @tpl.platform)
@groups = @repository_manager.groups
@@ -222,8 +238,12 @@ class TemplatesController < ApplicationController
flash.now[:error][:failures].merge!(errs)
end
- def check_permission
- require_privilege(Privilege::IMAGE_MODIFY)
+ def check_create_permission
+ require_privilege(Privilege::ACTION_CREATE, Template)
+ end
+
+ def check_edit_permission
+ require_privilege(Privilege::ACTION_MODIFY, @tpl)
end
def get_selected_id
diff --git a/src/app/controllers/users_controller.rb b/src/app/controllers/users_controller.rb
index 0e3220f..b462893 100644
--- a/src/app/controllers/users_controller.rb
+++ b/src/app/controllers/users_controller.rb
@@ -24,12 +24,13 @@ class UsersController < ApplicationController
before_filter :current_user
def new
+ require_privilege(Privilege::ACTION_CREATE, User) unless current_user.nil?
@user = User.new
@user.quota = Quota.new
end
def create
- require_privilege(Privilege::USER_MODIFY) unless current_user.nil?
+ require_privilege(Privilege::ACTION_CREATE, User) unless current_user.nil?
@user = User.new(params[:user])
if params[:commit] == "Reset"
@@ -58,39 +59,26 @@ class UsersController < ApplicationController
else
@user = current_user
end
+ require_privilege(Privilege::ACTION_VIEW, User) unless current_user == @user
@quota_resources = @user.quota.quota_resources()
end
def edit
- @user = params[:id] ? User.find(params[:id]) : @current_user
-
- if @user
- if @user != @current_user
- if !BasePermissionObject.general_permission_scope.can_modify_users(@current_user)
- flash[:notice] = "Invalid Permission to perform this operation"
- redirect_to users_path
- end
- end
- end
+ @user = params[:id] ? User.find(params[:id]) : current_user
+ require_privilege(Privilege::ACTION_MODIFY, User) unless current_user == @user
end
def update
@user = params[:user][:id] ? User.find(params[:user][:id]) : @current_user
+ require_privilege(Privilege::ACTION_MODIFY, User) unless current_user == @user
if params[:commit] == "Save"
if @user
- has_users_modify = BasePermissionObject.general_permission_scope.can_modify_users(@current_user)
- if @user != @current_user
- if !has_users_modify
- flash[:notice] = "Invalid Permission to perform this operation"
- redirect_to :dashboard
- end
- end
if @user.update_attributes(params[:user])
flash[:notice] = "User updated!"
- if has_users_modify
- redirect_to users_path
- else
+ if @user == current_user
redirect_to :dashboard
+ else
+ redirect_to users_path
end
else
render :action => :edit
@@ -102,21 +90,17 @@ class UsersController < ApplicationController
end
def index
- if @current_user.permissions.collect { |p| p.role }.find { |r| r.name == "Administrator" }
+ require_privilege(Privilege::ACTION_VIEW, User)
+ @users = User.all
+ sort_order = params[:sort_by].nil? ? "login" : params[:sort_by]
+ if sort_order == "percentage_quota_used"
@users = User.all
- sort_order = params[:sort_by].nil? ? "login" : params[:sort_by]
- if sort_order == "percentage_quota_used"
- @users = User.all
- @users.sort! {|x,y| y.quota.percentage_used <=> x.quota.percentage_used }
- elsif sort_order == "quota"
- @users = User.all
- @users.sort! {|x,y| (x.quota.maximum_running_instances and y.quota.maximum_running_instances) ? x.quota.maximum_running_instances <=> y.quota.maximum_running_instances : (x ? 1 : -1) }
- else
- @users = User.find(:all, :order => sort_order)
- end
+ @users.sort! {|x,y| y.quota.percentage_used <=> x.quota.percentage_used }
+ elsif sort_order == "quota"
+ @users = User.all
+ @users.sort! {|x,y| (x.quota.maximum_running_instances and y.quota.maximum_running_instances) ? x.quota.maximum_running_instances <=> y.quota.maximum_running_instances : (x ? 1 : -1) }
else
- flash[:notice] = "Invalid Permission to perform this operation"
- redirect_to :dashboard
+ @users = User.find(:all, :order => sort_order)
end
end
@@ -138,22 +122,19 @@ class UsersController < ApplicationController
end
def destroy
- if @current_user.permissions.collect { |p| p.role }.find { |r| r.name == "Administrator" }
- if request.post? || request.delete?
- @user = User.find(params[:id])
- if @user == @current_user
- flash[:notice] = "Can not delete the currently logged in user!"
- elsif @user.destroy
- flash[:notice] = "User Deleted"
- else
- flash[:error] = {
- :summary => "Failed to delete User",
- :failures => @user.errors.full_messages,
- }
- end
+ require_privilege(Privilege::ACTION_MODIFY, User)
+ if request.post? || request.delete?
+ @user = User.find(params[:id])
+ if @user == @current_user
+ flash[:notice] = "Can not delete the currently logged in user!"
+ elsif @user.destroy
+ flash[:notice] = "User Deleted"
+ else
+ flash[:error] = {
+ :summary => "Failed to delete User",
+ :failures => @user.errors.full_messages,
+ }
end
- else
- flash[:notice] = "Invalid Permission to perform this operation"
end
redirect_to users_path
end
diff --git a/src/app/models/cloud_account.rb b/src/app/models/cloud_account.rb
index e4fe6c6..ee07b8d 100644
--- a/src/app/models/cloud_account.rb
+++ b/src/app/models/cloud_account.rb
@@ -66,6 +66,27 @@ class CloudAccount < ActiveRecord::Base
before_destroy :destroyable?
before_validation :read_x509_files
+ def object_list
+ super << provider
+ end
+ class << self
+ alias orig_list_for_user_include list_for_user_include
+ alias orig_list_for_user_conditions list_for_user_conditions
+ end
+
+ def self.list_for_user_include
+ includes = orig_list_for_user_include
+ includes << { :provider => {:permissions => {:role => :privileges}}}
+ includes
+ end
+
+ def self.list_for_user_conditions
+ "(#{orig_list_for_user_conditions}) or
+ (permissions_providers.user_id=:user and
+ privileges_roles.target_type=:target_type and
+ privileges_roles.action=:action)"
+ end
+
def destroyable?
instances.empty?
end
diff --git a/src/app/models/instance.rb b/src/app/models/instance.rb
index 8573c5a..5aa500d 100644
--- a/src/app/models/instance.rb
+++ b/src/app/models/instance.rb
@@ -36,6 +36,10 @@ class Instance < ActiveRecord::Base
belongs_to :instance_key
belongs_to :instance_hwp
+ has_many :permissions, :as => :permission_object, :dependent => :destroy,
+ :include => [:role],
+ :order => "permissions.id ASC"
+
validates_presence_of :pool_id
validates_presence_of :hardware_profile_id
validates_presence_of :template_id
@@ -66,6 +70,27 @@ class Instance < ActiveRecord::Base
validates_inclusion_of :state,
:in => STATES
+ def object_list
+ super << pool
+ end
+ class << self
+ alias orig_list_for_user_include list_for_user_include
+ alias orig_list_for_user_conditions list_for_user_conditions
+ end
+
+ def self.list_for_user_include
+ includes = orig_list_for_user_include
+ includes << { :pool => {:permissions => {:role => :privileges}}}
+ includes
+ end
+
+ def self.list_for_user_conditions
+ "(#{orig_list_for_user_conditions}) or
+ (permissions_pools.user_id=:user and
+ privileges_roles.target_type=:target_type and
+ privileges_roles.action=:action)"
+ end
+
def get_action_list(user=nil)
# return empty list rather than nil
# FIXME: not handling pending state now -- only current state
@@ -142,7 +167,7 @@ class Instance < ActiveRecord::Base
}
instances = []
- pools = Pool.list_for_user(user, Privilege::INSTANCE_VIEW)
+ pools = Pool.list_for_user(user, Privilege::ACTION_VIEW, Instance)
pools.each{|pool| pool.instances.each {|i| instances << i}}
instances.each do |i|
if i.state == Instance::STATE_RUNNING
diff --git a/src/app/models/permission.rb b/src/app/models/permission.rb
index 349b6a7..22b228a 100644
--- a/src/app/models/permission.rb
+++ b/src/app/models/permission.rb
@@ -29,12 +29,18 @@ class Permission < ActiveRecord::Base
belongs_to :permission_object, :polymorphic => true
# type-specific associations
+ belongs_to :pool_family, :class_name => "PoolFamily",
+ :foreign_key => "permission_object_id"
belongs_to :pool, :class_name => "Pool",
:foreign_key => "permission_object_id"
+ belongs_to :instance, :class_name => "Instance",
+ :foreign_key => "permission_object_id"
belongs_to :provider, :class_name => "Provider",
:foreign_key => "permission_object_id"
belongs_to :cloud_account, :class_name => "CloudAccount",
:foreign_key => "permission_object_id"
+ belongs_to :template, :class_name => "Template",
+ :foreign_key => "permission_object_id"
belongs_to :base_permission_object, :class_name => "BasePermissionObject",
:foreign_key => "permission_object_id"
diff --git a/src/app/models/permissioned_object.rb b/src/app/models/permissioned_object.rb
index 24aebe0..34efec8 100644
--- a/src/app/models/permissioned_object.rb
+++ b/src/app/models/permissioned_object.rb
@@ -17,91 +17,77 @@
# MA 02110-1301, USA. A copy of the GNU General Public License is
# also available at http://www.gnu.org/copyleft/gpl.html.
module PermissionedObject
- def can_view_perms(user)
- has_privilege(user, Privilege::PERM_VIEW)
- end
- def can_set_perms(user)
- has_privilege(user, Privilege::PERM_SET)
- end
-
- def can_view_instances(user)
- has_privilege(user, Privilege::INSTANCE_VIEW)
- end
- def can_modify_instances(user)
- has_privilege(user, Privilege::INSTANCE_MODIFY)
- end
- def can_control_instances(user)
- has_privilege(user, Privilege::INSTANCE_CONTROL)
- end
-
- def can_view_stats(user)
- has_privilege(user, Privilege::STATS_VIEW)
- end
-
- def can_view_accounts(user)
- has_privilege(user, Privilege::ACCOUNT_VIEW)
- end
- def can_modify_accounts(user)
- has_privilege(user, Privilege::ACCOUNT_MODIFY)
- end
-
- def can_view_pools(user)
- has_privilege(user, Privilege::POOL_VIEW)
- end
- def can_modify_pools(user)
- has_privilege(user, Privilege::POOL_MODIFY)
- end
- def can_view_quotas(user)
- has_privilege(user, Privilege::QUOTA_VIEW)
- end
- def can_modify_quotas(user)
- has_privilege(user, Privilege::QUOTA_MODIFY)
- end
-
- def can_view_providers(user)
- has_privilege(user, Privilege::PROVIDER_VIEW)
- end
- def can_modify_providers(user)
- has_privilege(user, Privilege::PROVIDER_MODIFY)
- end
-
- def can_view_users(user)
- has_privilege(user, Privilege::USER_VIEW)
- end
- def can_modify_users(user)
- has_privilege(user, Privilege::USER_MODIFY)
- end
-
- def can_view_images(user)
- has_privilege(user, Privilege::IMAGE_VIEW)
- end
- def can_modify_images(user)
- has_privilege(user, Privilege::IMAGE_MODIFY)
+ def has_privilege(user, action, target_type=nil)
+ return false if user.nil? or action.nil?
+ target_type = self.class.default_privilege_target_type if target_type.nil?
+ object_list.each do |obj|
+ return true if obj.permissions.find(:first,
+ :include => [:role => :privileges],
+ :conditions =>
+ ["permissions.user_id=:user and
+ privileges.target_type=:target_type and
+ privileges.action=:action",
+ { :user => user.id,
+ :target_type => target_type.name,
+ :action => action}])
+ end
+ return false
end
- def has_privilege(user, privilege)
- return false if user.nil?
- permissions.find(:first, :include => [:role => :privileges],
- :conditions => ["permissions.user_id=:user and
- privileges.name=:priv",
- { :user => user.id,
- :priv => privilege }])
+ # Returns the list of objects to check for permissions on -- by default
+ # this object plus the Base permission object
+ def object_list
+ [self, BasePermissionObject.general_permission_scope]
end
# Any methods here will be able to use the context of the
# ActiveRecord model the module is included in.
def self.included(base)
base.class_eval do
- def self.list_for_user(user, privilege)
- if BasePermissionObject.general_permission_scope.has_privilege(user, privilege)
- all
+ def self.default_privilege_target_type
+ self.name.constantize
+ end
+ def self.list_for_user_include
+ [{:permissions => {:role => :privileges}}]
+ end
+ def self.list_for_user_conditions
+ "permissions.user_id=:user and
+ privileges.target_type=:target_type and
+ privileges.action=:action"
+ end
+ # :conditions in hash must match form ["foo=:param and ...", {:param => value}]
+ def self.list_for_user(user, action, find_hash={})
+ target_type = find_hash.fetch(:target_type, self.default_privilege_target_type)
+ query_include = find_hash[:include]
+ query_order = find_hash[:order]
+ query_conditions = find_hash[:conditions]
+ return [] if user.nil? or action.nil? or target_type.nil?
+ if BasePermissionObject.general_permission_scope.has_privilege(user,
+ action,
+ target_type)
+ find(:all, :include => query_include,
+ :order => query_order,
+ :conditions => query_conditions)
else
- find(:all, :include => {:permissions => {:role => :privileges}},
- :conditions => ["permissions.user_id=:user and
- privileges.name=:priv",
- {:user => user.id,
- :priv => privilege }])
+ include_clause = self.list_for_user_include
+ if query_include.is_a?(Array)
+ include_clause += query_include
+ elsif !query_include.nil?
+ include_clause << query_include
+ end
+ conditions_hash = {:user => user.id,
+ :target_type => target_type.name,
+ :action => action}
+ if query_conditions.nil?
+ conditions_str = self.list_for_user_conditions
+ else
+ conditions_str = "(#{self.list_for_user_include}) and (#{query_conditions[0]})"
+ conditions_hash.merge!(query_conditions[1]) { |key, h1, h2| h1 }
+ end
+ find(:all, :include => include_clause,
+ :conditions => [conditions_str, conditions_hash],
+ :order => query_order)
end
end
end
diff --git a/src/app/models/privilege.rb b/src/app/models/privilege.rb
index 552beef..6456d66 100644
--- a/src/app/models/privilege.rb
+++ b/src/app/models/privilege.rb
@@ -18,66 +18,122 @@
# also available at http://www.gnu.org/copyleft/gpl.html.
class Privilege < ActiveRecord::Base
- has_and_belongs_to_many :roles
- validates_presence_of :name
- validates_uniqueness_of :name
+ ACTION_PERM_SET = "set_perms" # can create/modify/delete permission
+ # records on this object
+ ACTION_PERM_VIEW = "view_perms" # can view permission records on this
+ # object
+ ACTION_CREATE = "create" # can create objects of this type here
+ ACTION_MODIFY = "modify" # can modify objects of this type here
+ ACTION_VIEW = "view" # can view objects of this type here
+ ACTION_USE = "use" # can use objects of this type here
+ # the meaning of 'use' is type-specific:
+ # Template: add this template to an assembly
+ # Assembly: add this assembly to a deployable
+ # Deployable: choose this deployable to launch
+ # Instance: may perform actions on this instance
+ # Realm: may map this realm
+ # CloudAccount: May add this account to PoolFamily
- #default privileges
- PERM_SET = "set_perms" # can create/modify/delete permission
- # records on this object
- PERM_VIEW = "view_perms" # can view permission records on this
- # object
- # instance privileges normally checked at the pool level, although
- # instance-specific overrides could be a future enhancement.
- INSTANCE_MODIFY = "instance_modify" # can create, modify, delete, or
- # control (start, stop, etc) instances
- INSTANCE_CONTROL = "instance_control" # can control (start, stop, etc)
- # instances
- INSTANCE_VIEW = "instance_view" # can view instance metadata
- # do we need a separate "connect" privilege?
+ ACTIONS = [ ACTION_CREATE, ACTION_MODIFY, ACTION_USE, ACTION_VIEW,
+ ACTION_PERM_SET, ACTION_PERM_VIEW]
+ TYPES = { BasePermissionObject => [ACTION_MODIFY, ACTION_PERM_SET, ACTION_PERM_VIEW],
+ Template => ACTIONS,
+ Pool => ACTIONS - [ACTION_USE],
+ PoolFamily => ACTIONS - [ACTION_USE],
+ Instance => ACTIONS,
+ Quota => [ACTION_VIEW, ACTION_MODIFY],
+ HardwareProfile => ACTIONS - [ACTION_USE, ACTION_VIEW],
+ Realm => ACTIONS - [ACTION_VIEW],
+ Provider => ACTIONS - [ACTION_USE],
+ CloudAccount => ACTIONS,
+ User => [ ACTION_CREATE, ACTION_MODIFY, ACTION_VIEW] }
- # stats privileges normally checked at the pool level, although
- # instance-specific overrides could be a future enhancement.
- STATS_VIEW = "stats_view" # can view monitoring data for
- # instances
+ belongs_to :role
+ validates_presence_of :role_id
+ validates_presence_of :target_type
+ validates_presence_of :action
+ validates_uniqueness_of :action, :scope => [:target_type, :role_id]
- # to create(i.e. import) an account on a provider needs ACCOUNT_MODIFY on the
- # provider.
- ACCOUNT_MODIFY = "account_modify" # can create or modify cloud accounts
- ACCOUNT_VIEW = "account_view" # can view cloud accounts
+ # notes on available privilege action/type pairs. Format is:
+ # Type Scope
+ # Action Notes (action defined on scope above unless specified)
+ #
+ # BasePermissionObject the base perm object
+ # modify Can modify system settings, etc.
+ # view_perms Can view permissions
+ # set_perms Can set permissions
+ #
+ # Template This template/assembly/deployable or all T/A/D in this TADCollection
+ # view Can view
+ # use Can assign T/A/D to TAD collection;
+ # (if template) can add to assembly or can use to launch instance
+ # (if assembly) can add to deployable
+ # (if deployable) can use to launch deployment
+ # (if TAD Collection) not used
+ # modify Can modify
+ # create Can create (on BasePermissionObject)
+ # view_perms Can view permissions
+ # set_perms Can set permissions
+ #
+ # Pool This pool
+ # view Can view
+ # modify Can modify
+ # create Can create (on BasePermissionObject)
+ # view_perms Can view permissions
+ # set_perms Can set permissions
+ #
+ # PoolFamily This PoolFamily
+ # view Can view
+ # modify Can modify
+ # create Can create (on BasePermissionObject)
+ # view_perms Can view permissions
+ # set_perms Can set permissions
+ #
+ # Instance This Instance or instances within this Pool
+ # view Can view
+ # use Can perform lifecycle actions on and/or view console
+ # modify Can modify
+ # create Can create (within this Pool)
+ # view_perms Can view permissions
+ # set_perms Can set permissions (or can set instance permissions on this pool)
+ #
+ # Quota The Pool/CloudAccount/PoolFamily/User assigned the quota
+ # view Can view quota on this obj
+ # modify Can edit quota on this obj
+ #
+ # HardwareProfile This HardwareProfile
+ # modify (for Aeolus HWPs) Can modify
+ # create Can create (on BasePermissionObject)
+ # view_perms Can view permissions
+ # set_perms Can set permissions
+ #
+ # Realm This Realm (or realms within this provider)
+ # use (for provider Realm) can map realm or provider to aeolus realm
+ # modify (for Aeolus realms) Can modify
+ # create Can create (within this Pool)
+ # view_perms Can view permissions
+ # set_perms Can set permissions
+ #
+ # Provider This Provider
+ # view Can view
+ # modify Can modify
+ # create Can create (on BasePermissionObject)
+ # view_perms Can view permissions
+ # set_perms Can set permissions
+ #
+ # CloudAccount This CloudAccount
+ # view Can view
+ # use Can map to PoolFamily
+ # modify Can modify
+ # create Can create (within this Provider)
+ # view_perms Can view permissions
+ # set_perms Can set permissions
+ #
+ # User This User (set on BasePermissionObject)
+ # view Can view
+ # modify Can modify
+ # create Can create
- POOL_MODIFY = "pool_modify" # can create or modify a pool
- POOL_VIEW = "pool_view" # can view a pool
-
- # quota privileges normally checked at the pool or account level,
- # depending on which quota level we're dealing with
- QUOTA_MODIFY = "quota_modify" # can create or modify a quota
- QUOTA_VIEW = "quota_view" # can view a quota
-
- # provider privileges normally checked at the provider level, although
- # 'new provider' action requires this privilege at the SystemPermission level
- PROVIDER_MODIFY = "provider_modify" # can create or modify a provider
- PROVIDER_VIEW = "provider_view" # can view a provider
-
- # normally checked at the SystemPermission level
- USER_MODIFY = "user_modify" # can create a new user (other than
- # self-registration) or modify another
- # user's metadata (for admin-level
- # actions)
- USER_VIEW = "user_view" # can view a user's profile data
-
- IMAGE_VIEW = "image_view" # can view existing images (templates)
- IMAGE_MODIFY = "image_modify" # can create or modify images (templates)
-
- FULL_PRIVILEGE_LIST = [PERM_SET, PERM_VIEW,
- INSTANCE_MODIFY, INSTANCE_CONTROL, INSTANCE_VIEW,
- STATS_VIEW,
- ACCOUNT_MODIFY, ACCOUNT_VIEW,
- POOL_MODIFY, POOL_VIEW,
- QUOTA_MODIFY, QUOTA_VIEW,
- PROVIDER_MODIFY, PROVIDER_VIEW,
- USER_MODIFY, USER_VIEW,
- IMAGE_VIEW, IMAGE_MODIFY]
end
diff --git a/src/app/models/role.rb b/src/app/models/role.rb
index db4a9ac..300dad8 100644
--- a/src/app/models/role.rb
+++ b/src/app/models/role.rb
@@ -18,10 +18,13 @@
# also available at http://www.gnu.org/copyleft/gpl.html.
class Role < ActiveRecord::Base
- has_many :permissions
- has_and_belongs_to_many :privileges, :uniq => true
+ has_many :permissions, :dependent => :destroy
+ has_many :privileges, :dependent => :destroy
+ validates_presence_of :scope
validates_presence_of :name
validates_uniqueness_of :name
+ validates_associated :privileges
+
end
diff --git a/src/app/models/template.rb b/src/app/models/template.rb
index d545f9b..bff586d 100644
--- a/src/app/models/template.rb
+++ b/src/app/models/template.rb
@@ -2,12 +2,17 @@ require 'util/image_descriptor_xml'
require 'typhoeus'
class Template < ActiveRecord::Base
+ include PermissionedObject
has_many :images, :dependent => :destroy
has_many :instances
before_validation :generate_uuid
before_save :update_xml
before_destroy :no_instances?
+ has_many :permissions, :as => :permission_object, :dependent => :destroy,
+ :include => [:role],
+ :order => "permissions.id ASC"
+
WAREHOUSE_CONFIG = YAML.load_file("#{RAILS_ROOT}/config/image_warehouse.yml")
validates_presence_of :uuid
diff --git a/src/app/services/application_service.rb b/src/app/services/application_service.rb
index 8161718..079c200 100644
--- a/src/app/services/application_service.rb
+++ b/src/app/services/application_service.rb
@@ -40,19 +40,34 @@ module ApplicationService
# @current_user must be defined
- def check_privilege(privilege, perm_obj)
- ((perm_obj and perm_obj.has_privilege(current_user, privilege)) or
- BasePermissionObject.general_permission_scope.has_privilege(current_user,
- privilege))
+ def check_privilege(action, *type_and_perm_obj)
+ target_type = nil
+ perm_obj = nil
+ type_and_perm_obj.each do |obj|
+ target_type=obj if obj.class==Class
+ perm_obj=obj if obj.is_a?(ActiveRecord::Base)
+ end
+ perm_obj=@perm_obj if perm_obj.nil?
+ perm_obj=BasePermissionObject.general_permission_scope if perm_obj.nil?
+ perm_obj.has_privilege(current_user, action, target_type)
end
- def authorized?(privilege, perm_obj=nil)
+ # Require a given privilege level to view this page
+ # 1. action is always required -- what action is being done (from Privilege::ACTIONS)
+ # 2. perm_obj is optional -- This is the resource on which to look for permission
+ # records. If omitted, check for site-wide permissions on BasePermissionObject
+ # 3. type is also optional -- if omitted it's taken from perm_obj.
+ # For example, if action is 'view', perm_obj is a Pool and type is omitted,
+ # then check for current user's "view pool" permission on this pool.
+ # if action is 'view', perm_obj is a Pool and type is Quota,
+ # then check for current user's "view quota" permission on this pool.
+ def require_privilege(action, *type_and_perm_obj)
+ perm_obj = nil
+ type_and_perm_obj.each do |obj|
+ perm_obj=obj if obj.is_a?(ActiveRecord::Base)
+ end
@perm_obj = perm_obj
- check_privilege(privilege,@perm_obj)
- end
-
- def require_privilege(privilege, perm_obj=nil)
- unless authorized?(privilege, perm_obj)
+ unless check_privilege(action, *type_and_perm_obj)
raise PermissionError.new(
'You have insufficient privileges to perform action.')
end
diff --git a/src/app/views/admin/users/_form.haml b/src/app/views/admin/users/_form.haml
index 3fdf33f..2d0945e 100644
--- a/src/app/views/admin/users/_form.haml
+++ b/src/app/views/admin/users/_form.haml
@@ -8,7 +8,7 @@
%fieldset
= form.label :password_confirmation, t(:confirm_password), :class => "grid_3 alpha"
= form.password_field :password_confirmation, :class => "grid_5"
--if has_user_modify?
+-if check_privilege(Privilege::ACTION_MODIFY, User)
%fieldset.clear
= form.label :user_status, "User Status:", :class => "alpha grid_3"
.grid_5
@@ -25,7 +25,7 @@
%fieldset.clear
= form.label :email, t(:email), :class => "alpha grid_3"
= form.text_field :email, :class => "grid_5"
--if has_user_modify?
+-if check_privilege(Privilege::ACTION_MODIFY, User)
%h3.grid_16 User Treatment
%fieldset.clearfix
= label_tag 'apply_treatment', t(:apply_treatment), :class => "alpha grid_3"
diff --git a/src/app/views/admin/users/edit.haml b/src/app/views/admin/users/edit.haml
index a367fec..69319e9 100644
--- a/src/app/views/admin/users/edit.haml
+++ b/src/app/views/admin/users/edit.haml
@@ -1,4 +1,4 @@
-- if has_user_modify?
+- if check_privilege(Privilege::ACTION_MODIFY, User)
%h2 Editing User: #{(a)user.first_name} #{(a)user.last_name}
- else
%h2 Editing Account
diff --git a/src/app/views/dashboard/summary.haml b/src/app/views/dashboard/summary.haml
index e6ba2dd..2f8600e 100644
--- a/src/app/views/dashboard/summary.haml
+++ b/src/app/views/dashboard/summary.haml
@@ -30,24 +30,24 @@
#actions_dashboard_section
%h2
Actions
- - if @is_admin
+ - if check_privilege(Privilege::ACTION_CREATE, Provider)
%a{:href => url_for(:controller => "providers", :action => "new")}
Add a Provider
+ - if check_privilege(Privilege::ACTION_CREATE, User)
%a{:href => url_for(:controller => "users", :action => "new")}
Create a User
- %a{:href => url_for(:controller => "instances", :action => "index")}
- View Instances
- - else
- %a{:href => url_for(:controller => "", :action => "")}
- Launch Instances
- %a{:href => url_for(:controller => "", :action => "")}
- Enter a help ticket
- - if BasePermissionObject.general_permission_scope.can_modify_images(@current_user)
+ %a{:href => url_for(:controller => "instances", :action => "index")}
+ View Instances
+ %a{:href => url_for(:controller => "", :action => "")}
+ Launch Instances
+ %a{:href => url_for(:controller => "", :action => "")}
+ Enter a help ticket
+ - if check_privilege(Privilege::ACTION_CREATE, Template)
%a{:href => url_for(:controller => "templates", :action => "new")}
Create a Template
#service_quality_dashboard_section
- - if @is_admin
+ - if check_privilege(Privilege::ACTION_MODIFY)
%h2
Provider Service Quality
.dashboard_section_summary
diff --git a/src/app/views/layouts/_main_nav.html.erb b/src/app/views/layouts/_main_nav.html.erb
index e85249b..c577a3b 100644
--- a/src/app/views/layouts/_main_nav.html.erb
+++ b/src/app/views/layouts/_main_nav.html.erb
@@ -14,6 +14,6 @@
<% } %>
<% end %>
</ul>
-<% if BasePermissionObject.general_permission_scope.has_privilege(@current_user, Privilege::POOL_MODIFY) %>
+<% if check_privilege(Privilege::ACTION_CREATE, Pool, BasePermissionObject.general_permission_scope) %>
<%= link_to "Add a pool", {:controller => "pools", :action => "new"}, :class => "actionlink" %>
<% end %>
diff --git a/src/app/views/permissions/list.haml b/src/app/views/permissions/list.haml
index 27831d0..263bbb5 100644
--- a/src/app/views/permissions/list.haml
+++ b/src/app/views/permissions/list.haml
@@ -14,7 +14,7 @@
%td= permission.user.login
%td= permission.role.name
%td
- - if has_set_perms?
+ - if check_privilege(Privilege::ACTION_PERM_SET)
- form_tag :action => 'destroy' do
= hidden_field :permission, :id, :value => permission.id
= submit_tag "delete", :class => "submit_link", :id => "delete_#{permission.id}"
@@ -22,10 +22,10 @@
= link_to "Add a user", |
{:controller => "users", |
:action => "new"}, |
- :class=>"actionlink" if has_user_modify?(BasePermissionObject.general_permission_scope) |
+ :class=>"actionlink" if check_privilege(Privilege::ACTION_CREATE,User,BasePermissionObject.general_permission_scope) |
-#
= link_to "Add a new permission record", |
{:action => "new", |
:permission_object_type => @permission_object.class, |
:permission_object_id => @permission_object.id}, |
- :class=>"actionlink" if has_set_perms? |
+ :class=>"actionlink" if check_privilege(Privilege::ACTION_PERM_SET) |
diff --git a/src/app/views/pools/show.haml b/src/app/views/pools/show.haml
index 229f3e2..ed14f4d 100644
--- a/src/app/views/pools/show.haml
+++ b/src/app/views/pools/show.haml
@@ -5,7 +5,7 @@
#pool-tabs
%ul
%li= link_to "Instances", {:action => "list", :id => @pool.id, :ajax => true}
- - if has_view_perms?
+ - if check_privilege(Privilege::ACTION_PERM_VIEW)
%li= link_to "User access", {:controller => "permissions", :action => "list", :pool_id => @pool.id, :ajax => true}
%li= link_to "Hardware Profiles", {:action => "hardware_profiles", :id => @pool.id, :ajax => true}
%li= link_to "Realms", {:action => "realms", :id => @pool.id, :ajax => true}
diff --git a/src/app/views/providers/accounts.haml b/src/app/views/providers/accounts.haml
index b136012..c9cb87c 100644
--- a/src/app/views/providers/accounts.haml
+++ b/src/app/views/providers/accounts.haml
@@ -26,7 +26,7 @@
= t('.quota_instances')
%span.required *
%fieldset.nomargin.clearfix
- - disabled = 'disabled' unless has_account_modify?(@provider)
+ - disabled = 'disabled' unless check_privilege(Privilege::ACTION_MODIFY, Account, @provider)
- cloud_account_id = "cloud_accounts[#{acct.id}]"
= text_field cloud_account_id, :label, :title => t('.account_name'), :value => acct.label, :disabled => disabled, :class => "grid_4 alpha"
= text_field cloud_account_id, :username, :title => t('.user_name'), :value => acct.username, :disabled => disabled, :class => "grid_3"
@@ -56,7 +56,7 @@
= file_field cloud_account_id, :x509_cert_priv_file, :title => t('.account_private_cert'), :disabled => disabled
.grid_3
= file_field cloud_account_id, :x509_cert_pub_file, :title => t('.account_public_cert'), :disabled => disabled
- - remove_path = url_for :controller => 'cloud_accounts', :action => 'destroy', :id => acct.id if has_account_modify?(@provider) && acct.destroyable?
+ - remove_path = url_for :controller => 'cloud_accounts', :action => 'destroy', :id => acct.id if check_privilege(Privilege::ACTION_MODIFY, Account, @provider) && acct.destroyable?
.grid_3.omega
%a.button{ :href => remove_path, :name => "remove_acc_#{acct.id}", :class => "tiny #{'disabled' unless remove_path}" }
= t(:remove)
diff --git a/src/app/views/users/_form.haml b/src/app/views/users/_form.haml
index 8d87a2f..8a48cd8 100644
--- a/src/app/views/users/_form.haml
+++ b/src/app/views/users/_form.haml
@@ -11,7 +11,7 @@
%fieldset
= form.label :password_confirmation, t(:confirm_password), :class => "grid_3 alpha"
= form.password_field :password_confirmation, :class => "grid_5"
- -if has_user_modify?
+ -if check_privilege(Privilege::ACTION_MODIFY, User)
%fieldset.clear
= form.label :user_status, "User Status:", :class => "alpha grid_3"
.grid_5
@@ -28,7 +28,7 @@
%fieldset.clear
= form.label :email, t(:email), :class => "alpha grid_3"
= form.text_field :email, :class => "grid_5"
- -if has_user_modify?
+ -if check_privilege(Privilege::ACTION_MODIFY, User)
%h3.grid_16 User Treatment
%fieldset.clearfix
= label_tag 'apply_treatment', t(:apply_treatment), :class => "alpha grid_3"
diff --git a/src/app/views/users/edit.haml b/src/app/views/users/edit.haml
index 0551bee..83c4236 100644
--- a/src/app/views/users/edit.haml
+++ b/src/app/views/users/edit.haml
@@ -1,5 +1,5 @@
.formwindow
-- if has_user_modify?
+- if check_privilege(Privilege::ACTION_MODIFY, User)
%h2 Editing User: #{(a)user.first_name} #{(a)user.last_name}
- else
%h2 Editing Account
diff --git a/src/db/migrate/20110107000000_privilege_model_refactor.rb b/src/db/migrate/20110107000000_privilege_model_refactor.rb
new file mode 100644
index 0000000..78e0b99
--- /dev/null
+++ b/src/db/migrate/20110107000000_privilege_model_refactor.rb
@@ -0,0 +1,53 @@
+#
+# Copyright (C) 2011 Red Hat, Inc.
+# Written by Scott Seago <sseago(a)redhat.com>
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; version 2 of the License.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston,
+# MA 02110-1301, USA. A copy of the GNU General Public License is
+# also available at http://www.gnu.org/copyleft/gpl.html.
+
+class PrivilegeModelRefactor < ActiveRecord::Migration
+
+
+ def self.up
+ # remove old privileges and role mapping
+ drop_table :privileges_roles
+ drop_table :privileges
+
+ # new privilege model
+ create_table :privileges do |t|
+ t.integer :role_id, :null => false
+ t.string :target_type, :null => false
+ t.string :action, :null => false
+ t.integer :lock_version, :default => 0
+
+ t.timestamps
+ end
+
+ end
+
+ def self.down
+ drop_table :privileges
+ create_table :privileges do |t|
+ t.string :name, :null => false
+ t.integer :lock_version, :default => 0
+
+ t.timestamps
+ end
+ create_table :privileges_roles, :id => false do |t|
+ t.integer :privilege_id, :null => false
+ t.integer :role_id, :null => false
+ end
+ end
+end
diff --git a/src/db/seeds.rb b/src/db/seeds.rb
index 934d432..9a6065c 100644
--- a/src/db/seeds.rb
+++ b/src/db/seeds.rb
@@ -4,108 +4,75 @@ PoolFamily.create!(:name => "default", :description => "default pool family")
# Default Pool
Pool.create!(:name => "default_pool", :quota => Quota.create, :pool_family => PoolFamily.find_by_name('default'))
-# Create default privileges
-privileges = ["set_perms", "view_perms",
- "instance_modify", "instance_control", "instance_view",
- "stats_view",
- "account_modify", "account_view",
- "pool_modify", "pool_view",
- "quota_modify", "quota_view",
- "provider_modify", "provider_view",
- "user_modify", "user_view",
- "image_modify", "image_view"]
-Privilege.transaction do
- privileges.each do |priv_name|
- privilege = Privilege.create!(:name => priv_name)
- end
-end
# Create default roles
-roles = {"Instance Controller" =>
- {:role_scope => "Pool",
- :privileges => ["instance_control",
- "instance_view",
- "pool_view"]},
- "Instance Controller With Monitoring" =>
- {:role_scope => "Pool",
- :privileges => ["instance_control",
- "instance_view",
- "pool_view",
- "stats_view"]},
- "Instance Creator and User" =>
- {:role_scope => "Pool",
- :privileges => ["instance_control",
- "instance_view",
- "pool_view",
- "stats_view",
- "instance_modify",
- "quota_view",
- "set_perms",
- "view_perms"]},
- "Pool Creator" =>
- {:role_scope => "Provider",
- :privileges => ["provider_view",
- "pool_modify",
- "pool_view",
- "quota_view"]},
- "Pool Administrator" =>
- {:role_scope => "Provider",
- :privileges => ["provider_view",
- "pool_modify",
- "pool_view",
- "quota_view",
- "quota_modify",
- "set_perms",
- "view_perms"]},
- "Provider Administrator" =>
- {:role_scope => "Provider",
- :privileges => ["provider_modify",
- "provider_view",
- "account_modify",
- "account_view"]},
- "Account Administrator" =>
- {:role_scope => "CloudAccount",
- :privileges => ["set_perms",
- "view_perms",
- "stats_view",
- "account_view",
- "account_modify"]},
- "Account Viewer" =>
- {:role_scope => "CloudAccount",
- :privileges => ["account_view"]},
- "Provider Creator" =>
- {:role_scope => "BasePermissionObject",
- :privileges => ["provider_modify",
- "provider_view"]},
- "Administrator" =>
- {:role_scope => "BasePermissionObject",
- :privileges => ["provider_modify",
- "provider_view",
- "account_modify",
- "account_view",
- "user_modify",
- "user_view",
- "set_perms",
- "view_perms",
- "pool_modify",
- "pool_view",
- "quota_modify",
- "quota_view",
- "stats_view",
- "instance_modify",
- "instance_control",
- "instance_view",
- "image_modify",
- "image_view"]}
+VIEW = "view"
+USE = "use"
+MOD = "modify"
+CRE = "create"
+VPRM = "view_perms"
+GPRM = "set_perms"
-}
+roles =
+ {Instance =>
+ {"Instance Controller" => {Instance => [VIEW,USE]},
+ "Instance Owner" => {Instance => [VIEW,USE,MOD, VPRM,GPRM]}},
+ PoolFamily =>
+ {"Pool Family User" => {Pool => [VIEW]},
+ "Pool Family Owner" => {PoolFamily => [VIEW, MOD, VPRM,GPRM],
+ Pool => [VIEW, MOD,CRE,VPRM,GPRM]}},
+ Pool =>
+ {"Pool User" => {Pool => [VIEW],
+ Instance => [ CRE],
+ Quota => [VIEW]},
+ "Pool Owner" => {Pool => [VIEW, MOD, VPRM,GPRM],
+ Instance => [VIEW,USE,MOD,CRE],
+ Quota => [VIEW]}},
+ Provider =>
+ {"Provider Owner" => {Provider => [VIEW, MOD, VPRM,GPRM],
+ CloudAccount => [VIEW,USE,MOD,CRE,VPRM,GPRM]}},
+ CloudAccount =>
+ {"Provider Account User" => {CloudAccount => [VIEW,USE]},
+ "Provider Account Owner" => {CloudAccount => [VIEW,USE,MOD, VPRM,GPRM]}},
+ Template =>
+ {"Template User" => {Template => [VIEW,USE]},
+ "Template Owner" => {Template => [VIEW,USE,MOD, VPRM,GPRM]}},
+ BasePermissionObject =>
+ {"Provider Creator" => {Provider => [ CRE]},
+ "Provider Administrator" => {Provider => [VIEW, MOD,CRE,VPRM,GPRM],
+ CloudAccount => [VIEW,USE,MOD,CRE,VPRM,GPRM]},
+ "HWP Administrator" => {HardwareProfile => [ MOD,CRE,VPRM,GPRM]},
+ "Realm Administrator" => {Realm => [ USE,MOD,CRE,VPRM,GPRM]},
+ "Pool Creator" => {Pool => [ CRE]},
+ "Pool Administrator" => {Pool => [VIEW, MOD,CRE,VPRM,GPRM],
+ Instance => [VIEW,USE,MOD,CRE,VPRM,GPRM],
+ Quota => [VIEW, MOD],
+ PoolFamily => [VIEW, MOD,CRE,VPRM,GPRM]},
+ "Template Administrator" => {Template => [VIEW,USE,MOD,CRE,VPRM,GPRM]},
+ "Administrator" => {Provider => [VIEW, MOD,CRE,VPRM,GPRM],
+ CloudAccount => [VIEW,USE,MOD,CRE,VPRM,GPRM],
+ HardwareProfile => [ MOD,CRE,VPRM,GPRM],
+ Realm => [ USE,MOD,CRE,VPRM,GPRM],
+ User => [VIEW, MOD,CRE],
+ Pool => [VIEW, MOD,CRE,VPRM,GPRM],
+ Instance => [VIEW,USE,MOD,CRE,VPRM,GPRM],
+ Quota => [VIEW, MOD],
+ PoolFamily => [VIEW, MOD,CRE,VPRM,GPRM],
+ Template => [VIEW,USE,MOD,CRE,VPRM,GPRM],
+ BasePermissionObject => [ MOD, VPRM,GPRM]}}}
Role.transaction do
- roles.each do |role_name, role_hash|
- role = Role.create!(:name => role_name, :scope => role_hash[:role_scope])
- role.privileges = role_hash[:privileges].collect do |priv_name|
- Privilege.find_by_name(priv_name)
+ roles.each do |role_scope, scoped_hash|
+ scoped_hash.each do |role_name, role_privileges|
+ role_privileges.each do |priv_type, priv_actions|
+ role = Role.find_or_initialize_by_name(role_name)
+ role.update_attributes({:name => role_name, :scope => role_scope.name})
+ role.save!
+ priv_actions.each do |action|
+ Privilege.create!(:role => role, :target_type => priv_type.name,
+ :action => action)
+ end
+ end
end
- role.save!
end
end
@@ -118,7 +85,7 @@ MetadataObject.set("default_pool_family", PoolFamily.find_by_name('default'))
default_pool = Pool.find_by_name("default_pool")
default_quota = Quota.create
-default_role = Role.find_by_name("Instance Creator and User")
+default_role = Role.find_by_name("Pool User")
settings = {"allow_self_service_logins" => "true",
"self_service_default_quota" => default_quota,
"self_service_default_pool" => default_pool,
diff --git a/src/features/support/custom.rb b/src/features/support/custom.rb
index 6b0db10..ec9d052 100644
--- a/src/features/support/custom.rb
+++ b/src/features/support/custom.rb
@@ -1,8 +1,4 @@
#Seed the DB with fixture data
-Fixtures.reset_cache
-fixtures_folder = File.join(Rails.root, 'spec', 'fixtures')
-fixtures = Dir[File.join(fixtures_folder, '*.yml')].map {|f| File.basename(f, '.yml') }
-Fixtures.create_fixtures(fixtures_folder, fixtures)
# We can't stub out these methods properly in cucumber, and we don't want to
# couple these tests to require the core server be running (connections should be tested
diff --git a/src/features/support/hooks.rb b/src/features/support/hooks.rb
index c21d323..a00ac36 100644
--- a/src/features/support/hooks.rb
+++ b/src/features/support/hooks.rb
@@ -1,19 +1,2 @@
Before do
- @default_pool_family_metadata = Factory.create(:default_pool_family_metadata)
- @allow_self_service_logins = Factory(:metadata_object, :key => "allow_self_service_logins", :value => "true")
-
- @default_quota = Factory(:unlimited_quota)
- @self_service_default_quota = Factory(:metadata_object, :key => "self_service_default_quota",
- :value => @default_quota,
- :object_type => "Quota")
-
- @default_pool = Factory(:pool, :name => "default_pool", :quota => @default_quota)
- @self_service_default_pool = Factory(:metadata_object, :key => "self_service_default_pool",
- :value => @default_pool,
- :object_type => "Pool")
-
- @default_role = Role.find(:first, :conditions => ['name = ?', 'Instance Creator and User'])
- @self_service_default_pool = Factory(:metadata_object, :key => "self_service_default_role",
- :value => @default_role,
- :object_type => "Role")
end
diff --git a/src/lib/tasks/cucumber.rake b/src/lib/tasks/cucumber.rake
index 15034cd..453f43c 100644
--- a/src/lib/tasks/cucumber.rake
+++ b/src/lib/tasks/cucumber.rake
@@ -14,19 +14,19 @@ begin
require 'cucumber/rake/task'
namespace :cucumber do
- Cucumber::Rake::Task.new({:ok => 'db:test:prepare'}, 'Run features that should pass') do |t|
+ Cucumber::Rake::Task.new({:ok => ['db:test:prepare','db:seed']}, 'Run features that should pass') do |t|
t.binary = vendored_cucumber_bin # If nil, the gem's binary is used.
t.fork = true # You may get faster startup if you set this to false
t.profile = 'default'
end
- Cucumber::Rake::Task.new({:wip => 'db:test:prepare'}, 'Run features that are being worked on') do |t|
+ Cucumber::Rake::Task.new({:wip => ['db:test:prepare','db:seed']}, 'Run features that are being worked on') do |t|
t.binary = vendored_cucumber_bin
t.fork = true # You may get faster startup if you set this to false
t.profile = 'wip'
end
- Cucumber::Rake::Task.new({:rerun => 'db:test:prepare'}, 'Record failing features and run only them if any exist') do |t|
+ Cucumber::Rake::Task.new({:rerun => ['db:test:prepare','db:seed']}, 'Record failing features and run only them if any exist') do |t|
t.binary = vendored_cucumber_bin
t.fork = true # You may get faster startup if you set this to false
t.profile = 'rerun'
diff --git a/src/spec/controllers/instance_controller_spec.rb b/src/spec/controllers/instance_controller_spec.rb
index 241c05b..34a44c8 100644
--- a/src/spec/controllers/instance_controller_spec.rb
+++ b/src/spec/controllers/instance_controller_spec.rb
@@ -20,11 +20,11 @@ describe InstancesController do
response.should_not be_success
end
- it "should allow instance creator to launch instance" do
- @inst_user_permission = Factory :instance_creator_and_user_permission
- @inst_user = @inst_user_permission.user
- UserSession.create(@inst_user)
- pool = Permission.first(:conditions => {:permission_object_type => 'Pool', :user_id => @inst_user.id}).permission_object
+ it "should allow pool user to launch instance" do
+ @pool_user_permission = Factory :pool_user_permission
+ @pool_user = @pool_user_permission.user
+ UserSession.create(@pool_user)
+ pool = Permission.first(:conditions => {:permission_object_type => 'Pool', :user_id => @pool_user.id}).permission_object
template = Factory.build(:template)
template.save!
hwp = Factory.build(:mock_hwp1)
@@ -36,6 +36,6 @@ describe InstancesController do
:hardware_profile_id => hwp.id }
end.should change(Instance, :count).by(1)
inst = Instance.find(:first, :conditions => ['name = ?', 'mockinstance'])
- inst.owner_id.should == @inst_user.id
+ inst.owner_id.should == @pool_user.id
end
end
diff --git a/src/spec/controllers/users_controller_spec.rb b/src/spec/controllers/users_controller_spec.rb
index c1fad30..f9a3dde 100644
--- a/src/spec/controllers/users_controller_spec.rb
+++ b/src/spec/controllers/users_controller_spec.rb
@@ -3,16 +3,9 @@ require 'spec_helper'
describe UsersController do
before(:each) do
- unless BasePermissionObject.find_by_name(BasePermissionObject::GENERAL_PERMISSION_SCOPE)
- Factory(:base_permission_object)
- end
@tuser = Factory :tuser
@admin_permission = Factory :admin_permission
- @admin_permission.role.privileges << Privilege.find_by_name('user_modify')
@admin = @admin_permission.user
- Factory.create(:default_quota_metadata)
- Factory.create(:default_role_metadata)
- Factory.create(:default_pool_metadata)
activate_authlogic
end
diff --git a/src/spec/factories/base_permission_object.rb b/src/spec/factories/base_permission_object.rb
deleted file mode 100644
index ccc2bf1..0000000
--- a/src/spec/factories/base_permission_object.rb
+++ /dev/null
@@ -1,3 +0,0 @@
-Factory.define :base_permission_object do |o|
- o.name BasePermissionObject::GENERAL_PERMISSION_SCOPE
-end
diff --git a/src/spec/factories/metadata_object.rb b/src/spec/factories/metadata_object.rb
deleted file mode 100644
index fea2f88..0000000
--- a/src/spec/factories/metadata_object.rb
+++ /dev/null
@@ -1,34 +0,0 @@
-Factory.define :metadata_object do |o|
- o.key 'key'
- o.value 'value'
- o.object_type nil
-end
-
-Factory.define :default_logins_metadata, :parent => :metadata_object do |o|
- o.key 'allow_self_service_logins'
- o.value 'true'
-end
-
-Factory.define :default_pool_family_metadata, :parent => :metadata_object do |o|
- o.key 'default_pool_family'
- o.value {Factory.create(:pool_family).id}
- o.object_type 'PoolFamily'
-end
-
-Factory.define :default_quota_metadata, :parent => :metadata_object do |o|
- o.key 'self_service_default_quota'
- o.value {Factory.create(:quota).id}
- o.object_type 'Quota'
-end
-
-Factory.define :default_role_metadata, :parent => :metadata_object do |o|
- o.key 'self_service_default_role'
- o.value {Factory.create(:role).id}
- o.object_type 'Role'
-end
-
-Factory.define :default_pool_metadata, :parent => :metadata_object do |o|
- o.key 'self_service_default_pool'
- o.value {Factory.create(:pool).id}
- o.object_type 'Pool'
-end
diff --git a/src/spec/factories/permission.rb b/src/spec/factories/permission.rb
index 9ccd3e7..f260ad7 100644
--- a/src/spec/factories/permission.rb
+++ b/src/spec/factories/permission.rb
@@ -16,12 +16,12 @@ end
Factory.define :pool_creator_permission, :parent => :permission do |p|
p.role { |r| Role.first(:conditions => ['name = ?', 'Pool Creator']) || Factory(:role, :name => 'Pool Creator') }
- p.permission_object { |r| r.association(:mock_provider) }
- p.user { |u| u.association(:pool_creator) }
+ p.permission_object { |r| BasePermissionObject.general_permission_scope }
+ p.user { |u| u.association(:pool_creator_user) }
end
-Factory.define :instance_creator_and_user_permission, :parent => :permission do |p|
- p.role { |r| Role.first(:conditions => ['name = ?', 'Instance Creator and User']) || Factory(:role, :name => 'Instance Creator and User') }
+Factory.define :pool_user_permission, :parent => :permission do |p|
+ p.role { |r| Role.first(:conditions => ['name = ?', 'Pool User']) || Factory(:role, :name => 'Pool User') }
p.permission_object { |r| r.association(:pool) }
p.user { |u| u.association(:user) }
end
diff --git a/src/spec/factories/pool.rb b/src/spec/factories/pool.rb
index 32e8c99..3b20f96 100644
--- a/src/spec/factories/pool.rb
+++ b/src/spec/factories/pool.rb
@@ -1,6 +1,6 @@
Factory.define :pool do |p|
p.sequence(:name) { |n| "mypool#{n}" }
- p.association :pool_family, :factory => :pool_family
+ p.pool_family { |p| PoolFamily.find_by_name('default') }
p.association :quota
end
diff --git a/src/spec/factories/pool_family.rb b/src/spec/factories/pool_family.rb
index 4a890ce..d0ca8e7 100644
--- a/src/spec/factories/pool_family.rb
+++ b/src/spec/factories/pool_family.rb
@@ -1,4 +1,4 @@
Factory.define :pool_family do |z|
z.sequence(:name) { |n| "pool_family#{n}" }
- z.description 'default pool family'
+ z.description 'pool family'
end
diff --git a/src/spec/factories/user.rb b/src/spec/factories/user.rb
index e737a35..a9dd23e 100644
--- a/src/spec/factories/user.rb
+++ b/src/spec/factories/user.rb
@@ -14,10 +14,13 @@ end
Factory.define :admin_user, :parent => :user do |u|
end
+Factory.define :pool_creator_user, :parent => :user do |u|
+end
+
Factory.define :provider_admin_user, :parent => :user do |u|
end
Factory.define :pool_user, :parent => :user do |u|
u.sequence(:login) { |n| "pool_user#{n}" }
u.email { |e| "#{e.login}(a)example.com" }
-end
\ No newline at end of file
+end
diff --git a/src/spec/fixtures/base_permission_objects.yml b/src/spec/fixtures/base_permission_objects.yml
deleted file mode 100644
index a520969..0000000
--- a/src/spec/fixtures/base_permission_objects.yml
+++ /dev/null
@@ -1,2 +0,0 @@
-general_permission_scope:
- name: 'general_permission_scope'
diff --git a/src/spec/fixtures/privileges.yml b/src/spec/fixtures/privileges.yml
deleted file mode 100644
index 16723de..0000000
--- a/src/spec/fixtures/privileges.yml
+++ /dev/null
@@ -1,43 +0,0 @@
-# Read about fixtures at http://ar.rubyonrails.org/classes/Fixtures.html
-
-# one:
-# column: value
-#
-# two:
-# column: value
-set_perms:
- name: set_perms
-view_perms:
- name: view_perms
-instance_modify:
- name: instance_modify
-instance_control:
- name: instance_control
-instance_view:
- name: instance_view
-stats_view:
- name: stats_view
-account_modify:
- name: account_modify
-account_view:
- name: account_view
-pool_modify:
- name: pool_modify
-pool_view:
- name: pool_view
-quota_modify:
- name: quota_modify
-quota_view:
- name: quota_view
-provider_modify:
- name: provider_modify
-provider_view:
- name: provider_view
-user_modify:
- name: user_modify
-user_view:
- name: user_view
-image_modify:
- name: image_modify
-image_view:
- name: image_view
diff --git a/src/spec/fixtures/roles.yml b/src/spec/fixtures/roles.yml
deleted file mode 100644
index d3ed623..0000000
--- a/src/spec/fixtures/roles.yml
+++ /dev/null
@@ -1,47 +0,0 @@
-# Read about fixtures at http://ar.rubyonrails.org/classes/Fixtures.html
-
-# one:
-# column: value
-#
-# two:
-# column: value
-instance_controller:
- name: Instance Controller
- scope: Pool
- privileges: instance_control, instance_view, pool_view
-instance_controller_with_monitoring:
- name: Instance Controller With Monitoring
- scope: Pool
- privileges: instance_control, instance_view, pool_view, stats_view
-instance_creator_and_user:
- name: Instance Creator and User
- scope: Pool
- privileges: instance_control, instance_view, pool_view, stats_view, instance_modify, quota_view, set_perms, view_perms
-pool_creator:
- name: Pool Creator
- scope: Provider
- privileges: provider_view, pool_modify, pool_view, quota_view
-pool_administrator:
- name: Pool Administrator
- scope: Provider
- privileges: provider_view, pool_modify, pool_view, quota_modify, quota_view, stats_view, set_perms, view_perms
-provider_administrator:
- name: Provider Administrator
- scope: Provider
- privileges: provider_modify, provider_view, account_modify, account_view, stats_view
-account_administrator:
- name: Account Administrator
- scope: CloudAccount
- privileges: account_modify, account_view, stats_view, set_perms, view_perms
-account_viewer:
- name: Account Viewer
- scope: CloudAccount
- privileges: account_view
-provider_creator:
- name: Provider Creator
- scope: BasePermissionObject
- privileges: provider_modify, provider_view, stats_view
-administrator:
- name: Administrator
- scope: BasePermissionObject
- privileges: provider_modify, provider_view, account_modify, account_view, user_modify, user_view, set_perms, view_perms, pool_modify, pool_view, quota_modify, quota_view, stats_view, instance_modify, instance_control, instance_view, image_modify, image_view
diff --git a/src/spec/models/metadata_object_spec.rb b/src/spec/models/metadata_object_spec.rb
index e3a74f8..0290b57 100644
--- a/src/spec/models/metadata_object_spec.rb
+++ b/src/spec/models/metadata_object_spec.rb
@@ -3,7 +3,7 @@ require 'spec_helper'
describe MetadataObject do
before(:each) do
- @default_pool_family_metadata = Factory :default_pool_family_metadata
+ @default_pool_family_metadata = MetadataObject.find_by_key("default_pool_family")
end
it "lookup on nonexistent key should return nil" do
diff --git a/src/spec/models/permission_spec.rb b/src/spec/models/permission_spec.rb
new file mode 100644
index 0000000..4da3ddf
--- /dev/null
+++ b/src/spec/models/permission_spec.rb
@@ -0,0 +1,58 @@
+require 'spec_helper'
+
+describe Permission do
+
+ before(:each) do
+ @admin_permission = Factory :admin_permission
+ @provider_admin_permission = Factory :provider_admin_permission
+ @pool_creator_permission = Factory :pool_creator_permission
+ @pool_user_permission = Factory :pool_user_permission
+
+ @admin = @admin_permission.user
+ @provider_admin = @provider_admin_permission.user
+ @pool_creator = @pool_creator_permission.user
+ @pool_user = @pool_user_permission.user
+
+ @provider = @provider_admin_permission.provider
+ @pool = @pool_user_permission.pool
+ end
+
+ it "Admin should be able to create users" do
+ BasePermissionObject.general_permission_scope.has_privilege(@admin,
+ Privilege::ACTION_CREATE,
+ User).should be_true
+ end
+
+ it "Provider Admin should NOT be able to create users" do
+ BasePermissionObject.general_permission_scope.has_privilege(@provider_admin,
+ Privilege::ACTION_CREATE,
+ User).should be_false
+ end
+
+ it "Pool User should NOT be able to create users" do
+ BasePermissionObject.general_permission_scope.has_privilege(@pool_user,
+ Privilege::ACTION_CREATE,
+ User).should be_false
+ end
+
+ it "Provider Admin should be able to edit provider" do
+ @provider.has_privilege(@provider_admin, Privilege::ACTION_MODIFY).should be_true
+ end
+
+ it "Admin should be able to edit provider" do
+ @provider.has_privilege(@admin, Privilege::ACTION_MODIFY).should be_true
+ end
+
+ it "Pool User should NOT be able to edit provider" do
+ @provider.has_privilege(@pool_user, Privilege::ACTION_MODIFY).should be_false
+ end
+
+ it "Pool User should be able to create instances in @pool" do
+ @pool.has_privilege(@pool_user, Privilege::ACTION_CREATE, Instance).should be_true
+ end
+
+ it "Pool User should NOT be able to create instances in another pool" do
+ Factory(:tpool).has_privilege(@pool_user, Privilege::ACTION_CREATE, Instance).should be_false
+ end
+
+end
diff --git a/src/spec/models/pool_family_spec.rb b/src/spec/models/pool_family_spec.rb
index 1210b48..2b69eab 100644
--- a/src/spec/models/pool_family_spec.rb
+++ b/src/spec/models/pool_family_spec.rb
@@ -22,8 +22,8 @@ describe PoolFamily do
end
it "should have pool" do
- @pool_family.pools.size.should == 1
- @pool_family.pools[0].id.should == @pool.id
+ @pool_family.pools.size.should == 2 #default pool + pool created here
+ @pool.pool_family.id.should == @pool_family.id
end
it "should have account" do
diff --git a/src/spec/services/registration_service_spec.rb b/src/spec/services/registration_service_spec.rb
index 41f6764..bdb6d9f 100644
--- a/src/spec/services/registration_service_spec.rb
+++ b/src/spec/services/registration_service_spec.rb
@@ -3,9 +3,6 @@ require 'spec_helper'
describe RegistrationService do
before(:each) do
- Factory.create(:default_quota_metadata)
- Factory.create(:default_role_metadata)
- Factory.create(:default_pool_metadata)
end
describe "with validations" do
@@ -22,20 +19,15 @@ describe RegistrationService do
it "should register a user with default pool/quota/role when default settings set" do
@user = Factory :user
- @pool = Factory(:pool, :name => "default_pool")
- privilege = Privilege.find_by_name('instance_view')
- @role = Factory(:role, :privileges => [privilege])
+ @pool = MetadataObject.lookup("self_service_default_pool")
+ @role = MetadataObject.lookup("self_service_default_role")
@quota = Factory :quota
-
- MetadataObject.set("allow_self_service_logins", "true")
- MetadataObject.set("self_service_default_pool", @pool)
- MetadataObject.set("self_service_default_role", @role)
MetadataObject.set("self_service_default_quota", @quota)
@registration_service = RegistrationService.new(@user)
@registration_service.save
- @pools = Pool.list_for_user(@user, Privilege::INSTANCE_VIEW)
+ @pools = Pool.list_for_user(@user, Privilege::ACTION_CREATE, :target_type => Instance)
@pools.length.should == 1
@pools[0].name.should == "default_pool"
diff --git a/src/spec/spec_helper.rb b/src/spec/spec_helper.rb
index 90f0eaf..88413c0 100644
--- a/src/spec/spec_helper.rb
+++ b/src/spec/spec_helper.rb
@@ -56,7 +56,6 @@ Spec::Runner.configure do |config|
# For more information take a look at Spec::Runner::Configuration and Spec::Runner
config.before(:each, :type => :controller) do
#activate_authlogic
- @default_pool_family_metadata = Factory.create(:default_pool_family_metadata)
end
config.after(:each, :type => :controller) do
#current_user_session.destroy
@@ -66,6 +65,7 @@ Spec::Runner.configure do |config|
config.before(:suite) do
DatabaseCleaner.strategy = :truncation
DatabaseCleaner.clean_with(:truncation)
+ load "#{Rails.root}/db/seeds.rb"
end
config.before(:each) do
DatabaseCleaner.start
--
1.7.3.4
12 years, 10 months
[PATCH aeolus 1/2] Added Tests for Search on Instance model
by Martyn Taylor
From: Martyn Taylor <mtaylor(a)redhat.com>
---
src/features/instance.feature | 34 +++++++++++++++++++++++++++++
src/features/step_definitions/instance.rb | 11 +++++++++
2 files changed, 45 insertions(+), 0 deletions(-)
diff --git a/src/features/instance.feature b/src/features/instance.feature
index 22e38b3..ad22025 100644
--- a/src/features/instance.feature
+++ b/src/features/instance.feature
@@ -76,3 +76,37 @@ Feature: Mange Instances
And I press "Stop"
Then I should be on the instances page
And I should see "mock1: stop action was successfully queued"
+
+ @tag
+ Scenario: Search for instances
+ Given there are the following instances:
+ | name | external_key | state | public_addresses | private_addresses |
+ | mock | ext_mock | running | mock.public.address | mock.private.address |
+ | test | ext_test | pending | test.public.address | test.private.address |
+ | other | ext_other | stopped | other.public.address | other.private.address |
+ And I am on the the instances page
+ When I fill in "q" with "mock"
+ And I press "Search"
+ Then I should see "mock"
+ And I should not see "test"
+ And I should not see "other"
+ When I fill in "q" with "ext_other"
+ And I press "Search"
+ Then I should not see "mock"
+ And I should not see "test"
+ And I should see "other"
+ When I fill in "q" with "pending"
+ And I press "Search"
+ Then I should not see "mock"
+ And I should see "test"
+ And I should not see "other"
+ When I fill in "q" with "mock.public.address"
+ And I press "Search"
+ Then I should see "mock"
+ And I should not see "test"
+ And I should not see "other"
+ When I fill in "q" with "test.private.address"
+ And I press "Search"
+ Then I should not see "mock"
+ And I should see "test"
+ And I should not see "other"
\ No newline at end of file
diff --git a/src/features/step_definitions/instance.rb b/src/features/step_definitions/instance.rb
index 412cd57..4324891 100644
--- a/src/features/step_definitions/instance.rb
+++ b/src/features/step_definitions/instance.rb
@@ -63,7 +63,18 @@ Given /^there is "([^"]*)" pool$/ do |arg1|
Factory :pool, :name => arg1
end
+
When /^I check "([^"]*)" instance$/ do |name|
inst = Instance.find_by_name(name)
check("inst_ids_#{inst.id}")
end
+
+Given /^there are the following instances:$/ do |table|
+ table.hashes.each do |hash|
+ Factory(:instance, :name => hash['name'],
+ :external_key => hash['external_key'],
+ :state => hash['state'],
+ :public_addresses => hash['public_addresses'],
+ :private_addresses => hash['private_addresses'])
+ end
+end
--
1.7.2.3
12 years, 10 months
[PATCH conductor 1/2] Search Roles for models and controllers
by Tomas Sedovic
From: Tomas Sedovic <tsedovic(a)redhat.com>
---
src/app/controllers/admin/roles_controller.rb | 23 ++++++++++++++++++++---
src/app/models/role.rb | 4 ++++
2 files changed, 24 insertions(+), 3 deletions(-)
diff --git a/src/app/controllers/admin/roles_controller.rb b/src/app/controllers/admin/roles_controller.rb
index 70f0097..971c599 100644
--- a/src/app/controllers/admin/roles_controller.rb
+++ b/src/app/controllers/admin/roles_controller.rb
@@ -1,6 +1,20 @@
class Admin::RolesController < ApplicationController
before_filter :require_user
- before_filter :load_roles, :only => [:index, :show]
+ before_filter :load_roles, :only => [:show]
+ before_filter :load_params_and_headers, :only => [:index]
+
+ def index
+ @search_term = params[:q]
+ if @search_term.blank?
+ load_roles
+ return
+ end
+
+ search = Role.search() do
+ keywords(params[:q])
+ end
+ @roles = search.results
+ end
def create
@role = Role.new(params[:role])
@@ -59,15 +73,18 @@ class Admin::RolesController < ApplicationController
protected
- def load_roles
+ def load_params_and_headers
@header = [
{ :name => "Role name", :sort_attr => :name }
]
+ @url_params = params.clone
+ end
+
+ def load_roles
@roles = Role.paginate(:all,
:page => params[:page] || 1,
:order => (params[:order_field] || 'name') +' '+ (params[:order_dir] || 'asc')
)
- @url_params = params.clone
end
end
diff --git a/src/app/models/role.rb b/src/app/models/role.rb
index db4a9ac..b932544 100644
--- a/src/app/models/role.rb
+++ b/src/app/models/role.rb
@@ -17,7 +17,11 @@
# MA 02110-1301, USA. A copy of the GNU General Public License is
# also available at http://www.gnu.org/copyleft/gpl.html.
+require 'sunspot_rails'
class Role < ActiveRecord::Base
+ searchable do
+ text :name, :as => :code_substring
+ end
has_many :permissions
has_and_belongs_to_many :privileges, :uniq => true
--
1.7.3.4
12 years, 10 months
[PATCH aeolus 1/2] Added Search on CloudAccount Model
by steve linabery
From: Steve Linabery <slinabery(a)redhat.com>
Indexed attributes are 'name' and 'username'.
---
.../admin/provider_accounts_controller.rb | 19 ++++++++++++++++---
src/app/models/cloud_account.rb | 7 +++++++
2 files changed, 23 insertions(+), 3 deletions(-)
diff --git a/src/app/controllers/admin/provider_accounts_controller.rb b/src/app/controllers/admin/provider_accounts_controller.rb
index 2c331f7..7a63d38 100644
--- a/src/app/controllers/admin/provider_accounts_controller.rb
+++ b/src/app/controllers/admin/provider_accounts_controller.rb
@@ -1,8 +1,18 @@
class Admin::ProviderAccountsController < ApplicationController
before_filter :require_user
- before_filter :load_accounts, :only => [:index, :show]
+ before_filter :load_accounts, :only => :show
+ before_filter :set_view_vars, :only => [:index,:show]
def index
+ @search_term = params[:q]
+ if @search_term.blank?
+ load_accounts
+ else
+ search = CloudAccount.search do
+ keywords(params[:q])
+ end
+ @accounts = search.results
+ end
end
def show
@@ -118,15 +128,18 @@ class Admin::ProviderAccountsController < ApplicationController
flash.now[:error] = "Test Connection Failed: Could not connect to provider"
end
- def load_accounts
+ def set_view_vars
@header = [
{ :name => "Name", :sort_attr => :name },
{ :name => "Username", :sort_attr => :username},
]
+ @url_params = params
+ end
+
+ def load_accounts
@accounts = CloudAccount.paginate(:all,
:page => params[:page] || 1,
:order => (params[:order_field] || 'label') +' '+ (params[:order_dir] || 'asc')
)
- @url_params = params
end
end
diff --git a/src/app/models/cloud_account.rb b/src/app/models/cloud_account.rb
index 4371a1a..334b7cb 100644
--- a/src/app/models/cloud_account.rb
+++ b/src/app/models/cloud_account.rb
@@ -20,8 +20,15 @@
# Likewise, all the methods added will be available for all controllers.
require 'nokogiri'
+require 'sunspot_rails'
class CloudAccount < ActiveRecord::Base
+
+ searchable do
+ text :name, :as => :code_substring
+ text :username, :as => :code_substring
+ end
+
include PermissionedObject
# Relations
--
1.7.3.4
12 years, 10 months
[PATCH aeolus 1/2] Added Cucumber Tests for Provider Search
by Martyn Taylor
From: Martyn Taylor <mtaylor(a)redhat.com>
---
src/features/provider.feature | 22 ++++++++++++++++++++++
src/features/step_definitions/provider_steps.rb | 2 +-
2 files changed, 23 insertions(+), 1 deletions(-)
diff --git a/src/features/provider.feature b/src/features/provider.feature
index 9e6f398..08704dd 100644
--- a/src/features/provider.feature
+++ b/src/features/provider.feature
@@ -73,3 +73,25 @@ Feature: Manage Providers
And there should not be any hardware profiles
And there should not be a cloud account
And there should not be a realm
+
+ Scenario: Search for hardware profiles
+ Given there are these providers:
+ | name | url |
+ | Test | http://testprovider.com/api |
+ | Mock | http://mockprovider.com/api |
+ | Other | http://sometesturl.com/api |
+ And I am on the admin providers page
+ Then I should see the following:
+ | Test | http://testprovider.com/api |
+ | Mock | http://mockprovider.com/ap |
+ | Other | http://sometesturl.com/api |
+ When I fill in "q" with "test"
+ And I press "Search"
+ Then I should see "Test"
+ And I should see "Other"
+ And I should not see "Mock"
+ When I fill in "q" with "Mock"
+ And I press "Search"
+ Then I should see "Mock"
+ And I should not see "Test"
+ And I should not see "Other"
\ No newline at end of file
diff --git a/src/features/step_definitions/provider_steps.rb b/src/features/step_definitions/provider_steps.rb
index 2673ae8..bc56276 100644
--- a/src/features/step_definitions/provider_steps.rb
+++ b/src/features/step_definitions/provider_steps.rb
@@ -32,7 +32,7 @@ end
Given /^there are these providers:$/ do |table|
table.hashes.each do |hash|
- Factory(:mock_provider, :name => hash['name'])
+ hash['url'].nil? ? Factory(:mock_provider, :name => hash['name']) : Factory(:mock_provider, :name => hash['name'], :url => hash['url'])
end
end
--
1.7.2.3
12 years, 10 months
[PATCH aeolus] admin, Hardware Profiles UI for new HardwareProfile Model
by Martyn Taylor
From: Martyn Taylor <mtaylor(a)redhat.com>
---
.../admin/hardware_profiles_controller.rb | 140 +++++++++++++++++++-
src/app/models/hardware_profile.rb | 10 +-
src/app/models/hardware_profile_property.rb | 2 +-
src/app/models/property_enum_entry.rb | 3 +
src/app/stylesheets/newui.scss | 5 +
src/app/views/admin/hardware_profiles/_form.haml | 29 ++++
src/app/views/admin/hardware_profiles/_list.haml | 35 +++---
.../_matching_provider_hardware_profiles.haml | 8 +-
.../views/admin/hardware_profiles/_properties.haml | 1 +
src/app/views/admin/hardware_profiles/create.haml | 6 +
src/app/views/admin/hardware_profiles/edit.haml | 7 +
src/app/views/admin/hardware_profiles/new.haml | 7 +
src/app/views/admin/provider_accounts/new.haml | 2 +-
src/config/routes.rb | 3 +-
.../20090804135630_create_hardware_profiles.rb | 2 +-
src/features/hardware_profile.feature | 60 +++++++++
src/features/provider_account.feature | 16 +++
.../step_definitions/hardware_profile_steps.rb | 17 +++
.../step_definitions/provider_account_steps.rb | 6 +
src/features/support/paths.rb | 6 +
20 files changed, 336 insertions(+), 29 deletions(-)
create mode 100644 src/app/views/admin/hardware_profiles/_form.haml
create mode 100644 src/app/views/admin/hardware_profiles/create.haml
create mode 100644 src/app/views/admin/hardware_profiles/edit.haml
create mode 100644 src/app/views/admin/hardware_profiles/new.haml
diff --git a/src/app/controllers/admin/hardware_profiles_controller.rb b/src/app/controllers/admin/hardware_profiles_controller.rb
index 92edab0..69676c7 100644
--- a/src/app/controllers/admin/hardware_profiles_controller.rb
+++ b/src/app/controllers/admin/hardware_profiles_controller.rb
@@ -1,7 +1,10 @@
class Admin::HardwareProfilesController < ApplicationController
before_filter :require_user
before_filter :set_params_and_header, :only => [:index, :show]
- before_filter :load_hardware_profiles, :only => [:show]
+ before_filter :load_hardware_profiles, :only => [:index, :show]
+ before_filter :load_hardware_profile, :only => [:show]
+ before_filter :setup_new_hardware_profile, :only => [:new]
+ before_filter :setup_hardware_profile, :only => [:new, :create, :edit, :update]
def index
@params = params
@@ -39,7 +42,77 @@ class Admin::HardwareProfilesController < ApplicationController
end
end
+ def new
+ end
+
+ def create
+ build_hardware_profile(params[:hardware_profile])
+ if params[:commit] == 'Save'
+ if @hardware_profile.save!
+ redirect_to admin_hardware_profiles_path
+ else
+ params.delete :commit
+ render :action => 'create'
+ end
+ else
+ matching_provider_hardware_profiles
+ render :action => 'new'
+ end
+ end
+
+ def delete
+ end
+
+ def edit
+ unless @hardware_profile
+ @hardware_profile = HardwareProfile.find(params[:id])
+ end
+ matching_provider_hardware_profiles
+ end
+
+ def update
+ if params[:commit] == "Reset"
+ redirect_to edit_admin_hardware_profile_url(@hardware_profile) and return
+ end
+
+ if params[:id]
+ @hardware_profile = HardwareProfile.find(params[:id])
+ build_hardware_profile(params[:hardware_profile])
+ end
+
+ if params[:commit] == "Check Matches"
+ matching_provider_hardware_profiles
+ render :edit and return
+ end
+
+ unless @hardware_profile.save!
+ render :action => 'edit' and return
+ else
+ flash[:notice] = "Hardware Profile updated!"
+ redirect_to admin_hardware_profiles_path
+ end
+ end
+
+ def multi_destroy
+ HardwareProfile.destroy(params[:hardware_profile_selected])
+ redirect_to admin_hardware_profiles_path
+ end
+
private
+ def setup_new_hardware_profile
+ if params[:hardware_profile]
+ begin
+ @hardware_profile = HardwareProfile.new(remove_irrelevant_params(params[:hardware_profile]))
+ end
+ else
+ @hardware_profile = HardwareProfile.new(:memory => HardwareProfileProperty.new(:name => "memory", :unit => "MB"),
+ :cpu => HardwareProfileProperty.new(:name => "cpu", :unit => "count"),
+ :storage => HardwareProfileProperty.new(:name => "storage", :unit => "GB"),
+ :architecture => HardwareProfileProperty.new(:name => "architecture", :unit => "label"))
+ end
+ matching_provider_hardware_profiles
+ end
+
def properties
@properties_header = [
{ :name => "Name", :sort_attr => :name},
@@ -63,8 +136,26 @@ class Admin::HardwareProfilesController < ApplicationController
{ :name => "Storage", :sort_attr => :storage },
{ :name => "Virtual CPU", :sort_attr => :cpus}
]
- @matching_hwps = HardwareProfile.all(:include => "aggregator_hardware_profiles",
- :conditions => {:hardware_profile_map => { :aggregator_hardware_profile_id => params[:id] }})
+
+ begin
+ @matching_hwps = HardwareProfile.matching_hwps((a)hardware_profile).map { |hwp| hwp[:hardware_profile] }
+ rescue
+ @matching_hwps = []
+ end
+ end
+
+ def setup_hardware_profile
+ @tab_captions = ['Matched Provider Hardware Profiles']
+ @details_tab = 'matching_provider_hardware_profiles'
+ @url_params = params
+ @header = [
+ { :name => "Name", :sort_attr => :name},
+ { :name => "Unit", :sort_attr => :unit},
+ { :name => "Kind", :sort_attr => :kind },
+ { :name => "Value (Default)", :sort_attr => :value},
+ { :name => "Enum Entries", :sort_attr => :false },
+ { :name => "Range First", :sort_attr => :range_first},
+ { :name => "Range Last", :sort_attr => :range_last }]
end
def set_params_and_header
@@ -81,4 +172,47 @@ class Admin::HardwareProfilesController < ApplicationController
def load_hardware_profiles
@hardware_profiles = HardwareProfile.all(:conditions => 'provider_id IS NULL')
end
+
+ def load_hardware_profile
+ @hardware_profile = HardwareProfile.find(params[:id])
+ end
+
+ def build_hardware_profile(params)
+ hwpps = [:memory_attributes, :cpu_attributes, :storage_attributes, :architecture_attributes]
+ enum_values = {}
+ hwpps.each do |attr|
+ unless params[attr][:kind] == "range"
+ params[attr].delete(:range_first)
+ params[attr].delete(:range_last)
+ end
+
+ unless params[attr][:kind] == "enum"
+ params[attr].delete(:enum)
+ else
+ unless params[attr][:name] == "architecture"
+ enum_values[params[attr][:name]] = params[attr][:property_enum_entries].split(%r{,\s*})
+ end
+ end
+ params[attr].delete(:property_enum_entries)
+ end
+
+ @hardware_profile.nil? ? @hardware_profile = HardwareProfile.new(params) : @hardware_profile.update_attributes(params)
+ #TODO Maybe we can complete the build with out the save here
+ @hardware_profile.save!
+
+ # Set Property Enum Entries on enum types
+ begin
+ [@hardware_profile.memory, @hardware_profile.cpu, @hardware_profile.architecture, @hardware_profile.storage].each do |hwpp|
+ if hwpp.kind == "enum"
+ unless hwpp.name == "architecture"
+ hwpp.property_enum_entries = enum_values[hwpp.name].map { |value| PropertyEnumEntry.new(:value => value) }
+ end
+ end
+ end
+ @hardware_profile.save!
+ rescue => e
+ @hardware_profile.delete
+ raise e
+ end
+ end
end
diff --git a/src/app/models/hardware_profile.rb b/src/app/models/hardware_profile.rb
index 5e6e9e8..ba96d2a 100644
--- a/src/app/models/hardware_profile.rb
+++ b/src/app/models/hardware_profile.rb
@@ -41,13 +41,18 @@ class HardwareProfile < ActiveRecord::Base
belongs_to :memory, :class_name => "HardwareProfileProperty",
:dependent => :destroy
+
belongs_to :storage, :class_name => "HardwareProfileProperty",
:dependent => :destroy
+
belongs_to :cpu, :class_name => "HardwareProfileProperty",
:dependent => :destroy
+
belongs_to :architecture, :class_name => "HardwareProfileProperty",
:dependent => :destroy
+ accepts_nested_attributes_for :memory, :cpu, :storage, :architecture
+
has_and_belongs_to_many :aggregator_hardware_profiles,
:class_name => "HardwareProfile",
:join_table => "hardware_profile_map",
@@ -60,7 +65,6 @@ class HardwareProfile < ActiveRecord::Base
:foreign_key => "aggregator_hardware_profile_id",
:association_foreign_key => "provider_hardware_profile_id"
- validates_presence_of :external_key
validates_uniqueness_of :external_key, :scope => [:provider_id]
validates_presence_of :name
@@ -79,8 +83,8 @@ class HardwareProfile < ActiveRecord::Base
def validate
if provider.nil?
if !aggregator_hardware_profiles.empty?
- errors.add(:aggregator_hardware_profiles,
- "Aggregator profiles only allowed for provider profiles")
+ #errors.add(:aggregator_hardware_profiles,
+ #"Aggregator profiles only allowed for provider profiles")
end
else
if !provider_hardware_profiles.empty?
diff --git a/src/app/models/hardware_profile_property.rb b/src/app/models/hardware_profile_property.rb
index 46e4b8e..3f6bdfe 100644
--- a/src/app/models/hardware_profile_property.rb
+++ b/src/app/models/hardware_profile_property.rb
@@ -101,7 +101,7 @@ class HardwareProfileProperty < ActiveRecord::Base
def to_s
case kind
when FIXED
- value
+ value.to_s
when RANGE
range_first.to_s + " - " + range_last.to_s
when ENUM
diff --git a/src/app/models/property_enum_entry.rb b/src/app/models/property_enum_entry.rb
index ff497ef..81bb67e 100644
--- a/src/app/models/property_enum_entry.rb
+++ b/src/app/models/property_enum_entry.rb
@@ -32,4 +32,7 @@ class PropertyEnumEntry < ActiveRecord::Base
HardwareProfileProperty::STORAGE or
p.hardware_profile_property.name ==
HardwareProfileProperty::CPU }
+ def to_s
+ value.to_s + ", "
+ end
end
diff --git a/src/app/stylesheets/newui.scss b/src/app/stylesheets/newui.scss
index 513d510..d0fbcc9 100644
--- a/src/app/stylesheets/newui.scss
+++ b/src/app/stylesheets/newui.scss
@@ -1371,6 +1371,11 @@ $content-left: 180px;
float: left;
}
+#list {
+ float: left;
+ width: 100%;
+}
+
#details-view {
border: 1px solid;
position: absolute;
diff --git a/src/app/views/admin/hardware_profiles/_form.haml b/src/app/views/admin/hardware_profiles/_form.haml
new file mode 100644
index 0000000..21462ae
--- /dev/null
+++ b/src/app/views/admin/hardware_profiles/_form.haml
@@ -0,0 +1,29 @@
+=hwp_form.label :name
+=hwp_form.text_field :name
+%table
+ = sortable_table_header @header
+ - [:memory, :cpu, :storage, :architecture].each do |type|
+ - hwp_form.fields_for type do |hwpp_form|
+ %tr
+ %td
+ =hwpp_form.text_field(:name, :readonly => "readonly")
+ %td
+ =hwpp_form.text_field(:unit, :size => 5, :readonly => "readonly")
+ %td
+ -unless type == :architecture
+ =hwpp_form.select("kind", ["fixed", "range", "enum"], {})
+ -else
+ =hwpp_form.select("kind", ["fixed"], {})
+ %td
+ =hwpp_form.text_field(:value)
+ %td
+ -unless type == :architecture
+ =hwpp_form.text_field(:property_enum_entries)
+ %td
+ -unless type == :architecture
+ =hwpp_form.text_field(:range_first)
+ %td
+ -unless type == :architecture
+ =hwpp_form.text_field(:range_last)
+= hwp_form.submit 'Check Matches', :class => "submit formbutton"
+= hwp_form.submit 'Save', :class => 'submit formbutton'
\ No newline at end of file
diff --git a/src/app/views/admin/hardware_profiles/_list.haml b/src/app/views/admin/hardware_profiles/_list.haml
index 1001db3..e2f344e 100644
--- a/src/app/views/admin/hardware_profiles/_list.haml
+++ b/src/app/views/admin/hardware_profiles/_list.haml
@@ -1,5 +1,7 @@
- form_tag do
#object-actions
+ = link_to "New Hardware Profile", new_admin_hardware_profile_path, :class => 'button'
+ = restful_submit_tag "Delete", "destroy", multi_destroy_admin_hardware_profiles_path, "DELETE", :id => 'delete_button'
#selections
%p
@@ -8,19 +10,20 @@
%span> ,
= link_to "None", @url_params.merge(:select => 'none')
-%table
- = sortable_table_header @header
- - @hardware_profiles.each do |hwp|
- %tr
- %td
- - selected = @url_params[:select] == 'all'
- = check_box(:pool, "selected[#{hwp.id}]", :checked => selected)
- = link_to hwp.name, admin_hardware_profile_path(hwp)
- %td
- =hwp.architecture.to_s
- %td
- =hwp.memory.to_s
- %td
- =hwp.storage.to_s
- %td
- =hwp.cpu.to_s
+ #list
+ %table
+ = sortable_table_header @header
+ - @hardware_profiles.each do |hwp|
+ %tr
+ %td
+ - selected = @url_params[:select] == 'all'
+ %input{:name => "hardware_profile_selected[]", :type => "checkbox", :value => hwp.id, :id => "hardware_profile_checkbox_#{hwp.id}", :checked => selected }
+ = link_to hwp.name, admin_hardware_profile_path(hwp)
+ %td
+ =hwp.architecture.to_s
+ %td
+ =hwp.memory.to_s
+ %td
+ =hwp.storage.to_s
+ %td
+ =hwp.cpu.to_s
diff --git a/src/app/views/admin/hardware_profiles/_matching_provider_hardware_profiles.haml b/src/app/views/admin/hardware_profiles/_matching_provider_hardware_profiles.haml
index cfbb856..0f4ba7b 100644
--- a/src/app/views/admin/hardware_profiles/_matching_provider_hardware_profiles.haml
+++ b/src/app/views/admin/hardware_profiles/_matching_provider_hardware_profiles.haml
@@ -1,11 +1,13 @@
-%h3
- = @hardware_profile.name
+- if @hardware_profile
+ %h3
+ =(a)hardware_profile.name
%table
= sortable_table_header @provider_hwps_header
- @matching_hwps.each do |hwp|
%tr
%td
- = link_to hwp.provider.name, admin_provider_path(hwp.provider)
+ - if hwp.provider
+ = link_to hwp.provider.name, admin_provider_path(hwp.provider)
%td
= link_to hwp.name, admin_hardware_profile_path(hwp)
%td
diff --git a/src/app/views/admin/hardware_profiles/_properties.haml b/src/app/views/admin/hardware_profiles/_properties.haml
index 590edc5..bc91219 100644
--- a/src/app/views/admin/hardware_profiles/_properties.haml
+++ b/src/app/views/admin/hardware_profiles/_properties.haml
@@ -1,5 +1,6 @@
%h3
= @hardware_profile.name + "(" + (@hardware_profile.provider_id.nil? ? "Front End" : "Provider" ) + ")"
+= link_to 'Edit', edit_admin_hardware_profile_path(@hardware_profile), :class => 'button'
%table
= sortable_table_header @properties_header
- @hwp_properties.each do |hwpp|
diff --git a/src/app/views/admin/hardware_profiles/create.haml b/src/app/views/admin/hardware_profiles/create.haml
new file mode 100644
index 0000000..c26bbe9
--- /dev/null
+++ b/src/app/views/admin/hardware_profiles/create.haml
@@ -0,0 +1,6 @@
+%h3
+ Check Matching Hardware Profiles
+- content_for :list do
+ = render :partial => "form"
+- content_for :details do
+ = render :partial => 'layouts/details_pane'
\ No newline at end of file
diff --git a/src/app/views/admin/hardware_profiles/edit.haml b/src/app/views/admin/hardware_profiles/edit.haml
new file mode 100644
index 0000000..e32eebd
--- /dev/null
+++ b/src/app/views/admin/hardware_profiles/edit.haml
@@ -0,0 +1,7 @@
+- content_for :list do
+ %h3
+ Edit Hardware Profile
+ -form_for @hardware_profile, :url => admin_hardware_profile_path(@hardware_profile), :html => { :multipart => true } do |hwp_form|
+ = render :partial => "form", :locals => { :hwp_form => hwp_form }
+- content_for :details do
+ = render :partial => 'layouts/details_pane'
diff --git a/src/app/views/admin/hardware_profiles/new.haml b/src/app/views/admin/hardware_profiles/new.haml
new file mode 100644
index 0000000..3355c87
--- /dev/null
+++ b/src/app/views/admin/hardware_profiles/new.haml
@@ -0,0 +1,7 @@
+- content_for :list do
+ %h3
+ New Hardware Profile
+ -form_for @hardware_profile, :url => admin_hardware_profiles_path, :html => { :multipart => true } do |hwp_form|
+ = render :partial => "form", :locals => { :hwp_form => hwp_form }
+- content_for :details do
+ = render :partial => 'layouts/details_pane'
\ No newline at end of file
diff --git a/src/app/views/admin/provider_accounts/new.haml b/src/app/views/admin/provider_accounts/new.haml
index e567bce..55e469c 100644
--- a/src/app/views/admin/provider_accounts/new.haml
+++ b/src/app/views/admin/provider_accounts/new.haml
@@ -13,4 +13,4 @@
%p.requirement
%span.required *
\-
- = t('cloud_accounts.new.required_field')
+ = t('cloud_accounts.new.required_field')
\ No newline at end of file
diff --git a/src/config/routes.rb b/src/config/routes.rb
index ad9fb67..ef7008b 100644
--- a/src/config/routes.rb
+++ b/src/config/routes.rb
@@ -48,7 +48,8 @@ ActionController::Routing::Routes.draw do |map|
map.connect '/set_layout', :controller => 'application', :action => 'set_layout'
map.namespace 'admin' do |r|
- r.resources :hardware_profiles, :realms
+ r.resources :realms
+ r.resources :hardware_profiles, :collection => { :multi_destroy => :delete }
r.resources :providers, :collection => { :multi_destroy => :delete }
r.resources :users, :collection => { :multi_destroy => :delete }
r.resources :provider_accounts, :collection => { :multi_destroy => :delete }
diff --git a/src/db/migrate/20090804135630_create_hardware_profiles.rb b/src/db/migrate/20090804135630_create_hardware_profiles.rb
index 5ad0435..ec4a50f 100644
--- a/src/db/migrate/20090804135630_create_hardware_profiles.rb
+++ b/src/db/migrate/20090804135630_create_hardware_profiles.rb
@@ -40,7 +40,7 @@ class CreateHardwareProfiles < ActiveRecord::Migration
end
create_table :hardware_profiles do |t|
- t.string :external_key, :null => false
+ t.string :external_key
t.string :name, :null => false, :limit => 1024
t.integer :memory_id
t.integer :storage_id
diff --git a/src/features/hardware_profile.feature b/src/features/hardware_profile.feature
index 5f63c96..cfefa6e 100644
--- a/src/features/hardware_profile.feature
+++ b/src/features/hardware_profile.feature
@@ -77,3 +77,63 @@ Feature: Manage Pools
Then I should see "m1-small"
And I should not see "m1-large"
And I should not see "m1-xlarge"
+
+ Scenario: Create a new Hardware Profile
+ Given I am an authorised user
+ And I am on the hardware profiles page
+ When I follow "New Hardware Profile"
+ Then I should be on the new hardware profile page
+ When I fill in "name" with "Test Hardware Profile"
+ And I enter the following details for the Hardware Profile Properties
+ | name | kind | range_first | range_last | property_enum_entries | value | unit |
+ | memory | fixed | | | | 1740 | MB |
+ | cpu | range | 1 | 4 | | 2 | count |
+ | storage | range | 250 | 500 | | 300 | GB |
+ | architecture | fixed | | | | i386 | label |
+ And I press "Save"
+ Then I should be on the hardware profiles page
+ And I should see the following:
+ | Test Hardware Profile | 1740 | 1 - 4 | 250 - 500 | i386 |
+
+ Scenario: Check New Hardware Profile matching Provider Hardware Profiles
+ Given I am an authorised user
+ And there are the following provider hardware profiles:
+ | name | memory | cpu |storage | architecture |
+ | m1-small | 1740 | 1 | 250 | i386 |
+ | m1-medium | 1740 | 2 | 500 | i386 |
+ | m1-large | 2048 | 4 | 850 | x86_64 |
+ And I am on the new hardware profile page
+ When I fill in "name" with "Test Hardware Profile"
+ And I enter the following details for the Hardware Profile Properties
+ | name | kind | range_first | range_last | property_enum_entries | value | unit |
+ | memory | fixed | | | | 1740 | MB |
+ | cpu | range | 1 | 4 | | 2 | count |
+ | storage | range | 250 | 500 | | 300 | GB |
+ | architecture | fixed | | | | i386 | label |
+ And I press "Check Matches"
+ Then I should see the following:
+ | Name | Memory | CPU | Storage | Architecture |
+ | m1-small | 1740 | 1 | 250 | i386 |
+ | m1-medium | 1740 | 2 | 500 | i386 |
+
+ Scenario: Update a HardwareProfile
+ Given I am an authorised user
+ And there are the following aggregator hardware profiles:
+ | name | memory | cpu |storage | architecture |
+ | m1-small | 1740 | 2 | 160 | i386 |
+ And I am on the hardware profiles page
+ When I follow "m1-small"
+ Then I should see "Properties"
+ When I follow "edit"
+ Then I should be on the edit hardware profiles page
+ When I enter the following details for the Hardware Profile Properties
+ | name | kind | range_first | range_last | property_enum_entries | value |
+ | memory | fixed | | | | 1740 |
+ | cpu | range | 1 | 4 | | 1 |
+ | storage | range | 250 | 500 | | 300 |
+ | architecture | fixed | | | | i386 |
+ And I press "Save"
+ Then I should be on the hardware profiles page
+ Then I should see the following:
+ | Name | Memory | CPU | Storage | Architecture |
+ | m1-small | 1740 | 1 - 4 | 250 - 500 | i386 |
diff --git a/src/features/provider_account.feature b/src/features/provider_account.feature
index 9a73bb5..cb4c2ce 100644
--- a/src/features/provider_account.feature
+++ b/src/features/provider_account.feature
@@ -68,3 +68,19 @@ Feature: Manage Provider Accounts
And I press "Delete"
Then I should be on the admin provider accounts page
And there should be no provider accounts
+
+ Scenario: Search for Provider Accounts
+ Given there is a provider named "testprovider"
+ And there is a provider account named "testaccount"
+ And I am on the admin provider accounts page
+ When I fill in "q" with "test"
+ And I press "Search"
+ Then I should see the following:
+ | testaccount | mockuser |
+ When I fill in "q" with "mock"
+ And I press "Search"
+ Then I should see the following:
+ | testaccount | mockuser |
+ When I fill in "q" with "foo"
+ And I press "Search"
+ Then I should not see "testaccount"
diff --git a/src/features/step_definitions/hardware_profile_steps.rb b/src/features/step_definitions/hardware_profile_steps.rb
index d29d136..a7a17bf 100644
--- a/src/features/step_definitions/hardware_profile_steps.rb
+++ b/src/features/step_definitions/hardware_profile_steps.rb
@@ -19,4 +19,21 @@ def create_hwp(hash, provider=nil)
cpu = Factory(:mock_hwp1_cpu, :value => hash[:cpu])
arch = Factory(:mock_hwp1_arch, :value => hash[:architecture])
Factory(:mock_hwp1, :name => hash[:name], :memory => memory, :cpu => cpu, :storage => storage, :architecture => arch, :provider => provider)
+end
+
+When /^I enter the following details for the Hardware Profile Properties$/ do |table|
+ table.hashes.each do |hash|
+ hash.each_pair do |key, value|
+ unless (hash[:name] == "architecture" && (key == "range_first" || key == "range_last" || key == "property_enum_entries")) || key == "name"
+ When "I fill in \"#{"hardware_profile_" + hash[:name] + "_attributes_" + key}\" with \"#{value}\""
+ end
+ end
+ end
+end
+
+Given /^there are the following provider hardware profiles:$/ do |table|
+ provider = Factory :mock_provider
+ table.hashes.each do |hash|
+ create_hwp(hash, provider)
+ end
end
\ No newline at end of file
diff --git a/src/features/step_definitions/provider_account_steps.rb b/src/features/step_definitions/provider_account_steps.rb
index bf9991c..40d6d76 100644
--- a/src/features/step_definitions/provider_account_steps.rb
+++ b/src/features/step_definitions/provider_account_steps.rb
@@ -24,3 +24,9 @@ When /^I check the "([^"]*)" account$/ do |label|
account = CloudAccount.find_by_label(label)
check("account_checkbox_#{account.id}")
end
+
+Given /^that there are these provider accounts:$/ do |table|
+ table.hashes.each do |hash|
+ Factory.create(:cloud_account, :name => hash['name'], :username => hash['username'])
+ end
+end
diff --git a/src/features/support/paths.rb b/src/features/support/paths.rb
index c0c77dc..4bc7ba4 100644
--- a/src/features/support/paths.rb
+++ b/src/features/support/paths.rb
@@ -98,6 +98,12 @@ module NavigationHelpers
when /the hardware profiles page/
url_for admin_hardware_profiles_path
+ when /the new hardware profile page/
+ url_for new_admin_hardware_profile_path
+
+ when /the edit hardware profiles page/
+ url_for :action => 'edit', :controller => 'hardware_profiles', :only_path => true
+
when /^(.*)'s provider account page$/
admin_provider_account_path(CloudAccount.find_by_label($1))
--
1.7.2.3
12 years, 10 months
[PATCH aeolus] Fix Solr to support longer tokens
by Tomas Sedovic
From: Tomas Sedovic <tsedovic(a)redhat.com>
Previously, if we had a long token (say "this.public.address") in the data, a
substring query longer than 15 characters (like "this.public.addr") would not
match while shorter queries ("this.public.a") would match.
This updates the NGram length limit to 100 characters which should be enough.
---
src/solr/conf/schema.xml | 2 +-
1 files changed, 1 insertions(+), 1 deletions(-)
diff --git a/src/solr/conf/schema.xml b/src/solr/conf/schema.xml
index a36ea0f..db2f9d8 100644
--- a/src/solr/conf/schema.xml
+++ b/src/solr/conf/schema.xml
@@ -71,7 +71,7 @@
<analyzer type="index">
<tokenizer class="solr.WhitespaceTokenizerFactory"/>
<filter class="solr.LowerCaseFilterFactory"/>
- <filter class="solr.NGramFilterFactory" minGramSize="2" maxGramSize="15"/>
+ <filter class="solr.NGramFilterFactory" minGramSize="2" maxGramSize="100"/>
</analyzer>
<analyzer type="query">
<tokenizer class="solr.WhitespaceTokenizerFactory"/>
--
1.7.3.4
12 years, 10 months
[PATCH aeolus] Added Search on instance model
by Martyn Taylor
From: Martyn Taylor <mtaylor(a)redhat.com>
---
.../controllers/resources/instances_controller.rb | 34 ++++++++++++++------
src/app/models/instance.rb | 9 +++++
src/app/models/instance_hwp.rb | 2 +-
src/features/instance.feature | 34 ++++++++++++++++++++
src/features/step_definitions/instance.rb | 11 ++++++
src/test/fixtures/base_permission_objects.yml | 2 +-
6 files changed, 80 insertions(+), 12 deletions(-)
diff --git a/src/app/controllers/resources/instances_controller.rb b/src/app/controllers/resources/instances_controller.rb
index 3bd0c45..1bbe878 100644
--- a/src/app/controllers/resources/instances_controller.rb
+++ b/src/app/controllers/resources/instances_controller.rb
@@ -1,7 +1,21 @@
class Resources::InstancesController < ApplicationController
before_filter :require_user
before_filter :load_instance, :only => [:show, :remove_failed, :key, :stop]
- before_filter :load_instances, :only => [:show, :index]
+ before_filter :set_view_vars, :only => [:show, :index]
+
+ def index
+ @params = params
+ @search_term = params[:q]
+ if @search_term.blank?
+ load_instances
+ return
+ end
+
+ search = Instance.search do
+ keywords(params[:q])
+ end
+ @instances = search.results
+ end
def new
@instance = Instance.new(params[:instance])
@@ -64,6 +78,7 @@ class Resources::InstancesController < ApplicationController
end
def show
+ load_instances
@url_params = params.clone
@tab_captions = ['Properties', 'History', 'Permissions']
@details_tab = params[:details_tab].blank? ? 'properties' : params[:details_tab]
@@ -78,9 +93,6 @@ class Resources::InstancesController < ApplicationController
end
end
- def index
- end
-
def key
unless @instance.instance_key.nil?
send_data @instance.instance_key.pem,
@@ -135,7 +147,7 @@ class Resources::InstancesController < ApplicationController
)
end
- def load_instances
+ def set_view_vars
@header = [
{:name => 'VM NAME', :sort_attr => 'name'},
{:name => 'STATUS', :sortable => false},
@@ -145,11 +157,13 @@ class Resources::InstancesController < ApplicationController
{:name => 'CREATED BY', :sort_attr => 'users.last_name'},
]
- pools = Pool.list_for_user(@current_user, Privilege::INSTANCE_MODIFY)
- @instances = Instance.all(
- :include => [:template, :owner],
- :conditions => {:pool_id => pools},
- :order => (params[:order_field] || 'name') +' '+ (params[:order_dir] || 'asc')
+ @pools = Pool.list_for_user(@current_user, Privilege::INSTANCE_MODIFY)
+ end
+
+ def load_instances
+ @instances = Instance.all(:include => [:template, :owner],
+ :conditions => {:pool_id => @pools},
+ :order => (params[:order_field] || 'name') +' '+ (params[:order_dir] || 'asc')
)
end
end
diff --git a/src/app/models/instance.rb b/src/app/models/instance.rb
index e7757e3..8fa00d1 100644
--- a/src/app/models/instance.rb
+++ b/src/app/models/instance.rb
@@ -19,10 +19,19 @@
# Filters added to this controller apply to all controllers in the application.
# Likewise, all the methods added will be available for all controllers.
+require 'sunspot_rails'
class Instance < ActiveRecord::Base
include SearchFilter
include PermissionedObject
+ searchable do
+ text :name, :as => :code_substring
+ text :external_key, :as => :code_substring
+ text :public_addresses, :as => :code_substring
+ text :private_addresses, :as => :code_substring
+ text :state, :as => :code_substring
+ end
+
cattr_reader :per_page
@@per_page = 15
diff --git a/src/app/models/instance_hwp.rb b/src/app/models/instance_hwp.rb
index 8b52df9..5b751f4 100644
--- a/src/app/models/instance_hwp.rb
+++ b/src/app/models/instance_hwp.rb
@@ -23,4 +23,4 @@ class InstanceHwp < ActiveRecord::Base
has_one :instance
-end
\ No newline at end of file
+end
diff --git a/src/features/instance.feature b/src/features/instance.feature
index 22e38b3..ad22025 100644
--- a/src/features/instance.feature
+++ b/src/features/instance.feature
@@ -76,3 +76,37 @@ Feature: Mange Instances
And I press "Stop"
Then I should be on the instances page
And I should see "mock1: stop action was successfully queued"
+
+ @tag
+ Scenario: Search for instances
+ Given there are the following instances:
+ | name | external_key | state | public_addresses | private_addresses |
+ | mock | ext_mock | running | mock.public.address | mock.private.address |
+ | test | ext_test | pending | test.public.address | test.private.address |
+ | other | ext_other | stopped | other.public.address | other.private.address |
+ And I am on the the instances page
+ When I fill in "q" with "mock"
+ And I press "Search"
+ Then I should see "mock"
+ And I should not see "test"
+ And I should not see "other"
+ When I fill in "q" with "ext_other"
+ And I press "Search"
+ Then I should not see "mock"
+ And I should not see "test"
+ And I should see "other"
+ When I fill in "q" with "pending"
+ And I press "Search"
+ Then I should not see "mock"
+ And I should see "test"
+ And I should not see "other"
+ When I fill in "q" with "mock.public.address"
+ And I press "Search"
+ Then I should see "mock"
+ And I should not see "test"
+ And I should not see "other"
+ When I fill in "q" with "test.private.address"
+ And I press "Search"
+ Then I should not see "mock"
+ And I should see "test"
+ And I should not see "other"
\ No newline at end of file
diff --git a/src/features/step_definitions/instance.rb b/src/features/step_definitions/instance.rb
index 412cd57..4324891 100644
--- a/src/features/step_definitions/instance.rb
+++ b/src/features/step_definitions/instance.rb
@@ -63,7 +63,18 @@ Given /^there is "([^"]*)" pool$/ do |arg1|
Factory :pool, :name => arg1
end
+
When /^I check "([^"]*)" instance$/ do |name|
inst = Instance.find_by_name(name)
check("inst_ids_#{inst.id}")
end
+
+Given /^there are the following instances:$/ do |table|
+ table.hashes.each do |hash|
+ Factory(:instance, :name => hash['name'],
+ :external_key => hash['external_key'],
+ :state => hash['state'],
+ :public_addresses => hash['public_addresses'],
+ :private_addresses => hash['private_addresses'])
+ end
+end
diff --git a/src/test/fixtures/base_permission_objects.yml b/src/test/fixtures/base_permission_objects.yml
index 4cf58b8..10585b0 100644
--- a/src/test/fixtures/base_permission_objects.yml
+++ b/src/test/fixtures/base_permission_objects.yml
@@ -6,4 +6,4 @@
# two:
# column: value
base_permission_object:
- name: general_permission_scope
\ No newline at end of file
+ name: general_permission_scope
--
1.7.2.3
12 years, 10 months
rename deltacloud-configure to aeolus-configure
by Mo Morsi
Renamed deltacloud to aeolus in the recipe and docs.
Also update subcomponents which have been renamed
(aggregator to conductor, core to deltacloud)
Same patchset as before, resending to aeolus-devel
12 years, 10 months