From: Tomas Sedovic <tsedovic(a)redhat.com>
https://www.aeolusproject.org/redmine/issues/1844
https://bugzilla.redhat.com/show_bug.cgi?id=714790
---
src/app/controllers/deployments_controller.rb | 2 +-
.../20110623142949_pool_self_service_role.rb | 52 ++++++++++++++++++++
src/db/seeds.rb | 9 +++-
3 files changed, 61 insertions(+), 2 deletions(-)
create mode 100644 src/db/migrate/20110623142949_pool_self_service_role.rb
diff --git a/src/app/controllers/deployments_controller.rb
b/src/app/controllers/deployments_controller.rb
index 3c60506..8ad3d2c 100644
--- a/src/app/controllers/deployments_controller.rb
+++ b/src/app/controllers/deployments_controller.rb
@@ -21,7 +21,7 @@ class DeploymentsController < ApplicationController
# It is expected that params[:pool_id] will be set on requests into this method
def launch_new
@pool = Pool.find(params[:pool_id]) or raise "Invalid pool"
- require_privilege(Privilege::CREATE, Deployment)
+ require_privilege(Privilege::CREATE, Deployment, @pool)
@deployment = Deployment.new(:pool_id => @pool.id)
@suggested_deployables = SuggestedDeployable.list_for_user(current_user,
Privilege::USE)
init_new_deployment_attrs
diff --git a/src/db/migrate/20110623142949_pool_self_service_role.rb
b/src/db/migrate/20110623142949_pool_self_service_role.rb
new file mode 100644
index 0000000..e357812
--- /dev/null
+++ b/src/db/migrate/20110623142949_pool_self_service_role.rb
@@ -0,0 +1,52 @@
+class PoolSelfServiceRole < ActiveRecord::Migration
+ VIEW = "view"
+ CRE = "create"
+ ROLE_NAME = "Pool Global User"
+ ROLE_DEF = [false, {Pool => [VIEW],
+ Instance => [ CRE],
+ Deployment => [ CRE],
+ Quota => [VIEW]}]
+
+ def self.up
+ return if Role.all.empty?
+
+ Role.transaction do
+ role = Role.find_or_initialize_by_name(ROLE_NAME)
+ role.update_attributes({:name => ROLE_NAME, :scope =>
BasePermissionObject.name,
+ :assign_to_owner => ROLE_DEF[0]})
+ role.privileges = {}
+ role.save!
+ ROLE_DEF[1].each do |priv_type, priv_actions|
+ priv_actions.each do |action|
+ Privilege.create!(:role => role, :target_type => priv_type.name,
+ :action => action)
+ end
+ end
+
+ MetadataObject.transaction do
+ settings = {
+ "self_service_default_pool_global_user_obj" =>
BasePermissionObject.general_permission_scope,
+ "self_service_default_pool_global_user_role" =>
Role.find_by_name("Pool Global User"),
+ "self_service_perms_list" =>
"[self_service_default_pool,self_service_default_role],
[self_service_default_suggested_deployable_obj,self_service_default_suggested_deployable_role],
[self_service_default_pool_global_user_obj,self_service_default_pool_global_user_role]"
}
+ settings.each_pair { |key, value| MetadataObject.set(key, value) }
+ end
+
+ Permission.transaction do
+ User.all.each do |user|
+ default_obj =
MetadataObject.lookup("self_service_default_pool_global_user_obj")
+ default_role =
MetadataObject.lookup("self_service_default_pool_global_user_role")
+ unless Permission.first(:conditions => {:user_id => user.id,
+ :role_id => default_role.id,
+ :permission_object_id =>
default_obj.id})
+ Permission.create!(:user => user,
+ :role => default_role,
+ :permission_object => default_obj)
+ end
+ end
+ end
+ end
+ end
+
+ def self.down
+ end
+end
diff --git a/src/db/seeds.rb b/src/db/seeds.rb
index eee6904..67e566c 100644
--- a/src/db/seeds.rb
+++ b/src/db/seeds.rb
@@ -58,6 +58,10 @@ roles =
PoolFamily => [VIEW,
MOD,CRE,VPRM,GPRM]}],
"SuggestedDeployable Administrator" => [false, {SuggestedDeployable
=> [VIEW,USE,MOD,CRE,VPRM,GPRM]}],
"SuggestedDeployable Global User" => [false,
{SuggestedDeployable=> [VIEW,USE]}],
+ "Pool Global User" => [false, {Pool =>
[VIEW],
+ Instance => [
CRE],
+ Deployment => [
CRE],
+ Quota => [VIEW]}],
"Administrator" => [false, {Provider => [VIEW,
MOD,CRE,VPRM,GPRM],
ProviderAccount =>
[VIEW,USE,MOD,CRE,VPRM,GPRM],
HardwareProfile => [
MOD,CRE,VPRM,GPRM],
@@ -98,6 +102,7 @@ default_quota = Quota.create
default_pool = Pool.find_by_name("default_pool")
default_role = Role.find_by_name("Pool User")
default_suggested_deployable_role = Role.find_by_name("SuggestedDeployable Global
User")
+default_pool_global_user_role = Role.find_by_name("Pool Global User")
settings = {"allow_self_service_logins" => "true",
"self_service_default_quota" => default_quota,
@@ -105,9 +110,11 @@ settings = {"allow_self_service_logins" =>
"true",
"self_service_default_role" => default_role,
"self_service_default_suggested_deployable_obj" =>
BasePermissionObject.general_permission_scope,
"self_service_default_suggested_deployable_role" =>
default_suggested_deployable_role,
+ "self_service_default_pool_global_user_obj" =>
BasePermissionObject.general_permission_scope,
+ "self_service_default_pool_global_user_role" =>
default_pool_global_user_role,
# perm list in the format:
# "[resource1_key, resource1_role], [resource2_key, resource2_role], ..."
- "self_service_perms_list" =>
"[self_service_default_pool,self_service_default_role],
[self_service_default_suggested_deployable_obj,self_service_default_suggested_deployable_role]"}
+ "self_service_perms_list" =>
"[self_service_default_pool,self_service_default_role],
[self_service_default_suggested_deployable_obj,self_service_default_suggested_deployable_role],
[self_service_default_pool_global_user_obj,self_service_default_pool_global_user_role]"}
settings.each_pair do |key, value|
MetadataObject.set(key, value)
end
--
1.7.4.4