deltacloud-devel October 2009

deltacloud-devel@lists.fedorahosted.org

12 participants
18 discussions

create_instance - are public addresses returned ?
by Michael Neale 30 Oct '09

30 Oct '09

I note that according to the spec when creating an instance an XML representation of that instance should be returned immeditately... however, on ec2, at least on its web console, it doesn't assign the public address until it is out of "pending" status ? So should we not expect public addresses to be set until the server is ready? -- Michael D Neale home: www.michaelneale.net blog: michaelneale.blogspot.com

4 6

dynamic DNS in deltacloud?
by Michael Neale 29 Oct '09

29 Oct '09

Hey All. One of the things which I would like to add in is the ability to pass ing forward DNS details and let deltacloud take care of setting it up against one of the public IPs when it knows it. I am not really sure if this is a deltacloud thing - unfortunately it looks like EC2 doesn't provide something like this for you (it has elastic IPs, but that is kind of different), but rackspace does. There are things like ez-ipupdate utilities that you can use to hook in to a wide variety of public dyn DNS things, and of course private servers. Is this something of interest or appropriate to deltacloud? it is certainly relevant to a lot of what some of us need to do, would be nice to have it abstracted into some part of the drivers. Unfortunately, not much we can do about reverse DNS as it is up to who owns the IPs, so with Amazon, I believe the term is "SOL", but at least with forward resolution, that is something (no good for the spammer though!). Thoughts? If people are interested, I might nock something up to see how it might work. -- Michael D Neale home: www.michaelneale.net blog: michaelneale.blogspot.com

5 8

Options for create instance
by Ivan Meredith 29 Oct '09

29 Oct '09

The REST API for creating instances is fairly minimal. It would be good if we could pass some custom options to it. These would be optional of course, and provider specific. We allow customers to clone another instance if they want to, or choose a billing method (some like to have multiple CC's or some servers on Wire Transfer etc). I propose something like, any options that don't match the 4 specified in the API, are bundled up into an opts hash, and given to the providers driver. Then they could use them at will. Possibly there might be a way for something like the portal to be able to specify some dynamic options by returning a list of options from the driver (or provider api). (Actaully I'm still trying to get the portal working with the mock driver, so I assume it can create instances.) Any commets/ideas? Regards, Ivan

5 7

deltacloud framework and credentials
by Michael Neale 28 Oct '09

28 Oct '09

Hey - Ivan pointed out to me that the Framework is storing the credentials - I can assume that this is in the session store for rails for it- I assume this isn't really the intent, and that in practice deltacloud should either only keep sessions in memory, or not at all, and just challenge each request? -- Michael D Neale home: www.michaelneale.net blog: michaelneale.blogspot.com

4 4

CPU in flavor?
by Michael Neale 25 Oct '09

25 Oct '09

-- Michael D Neale home: www.michaelneale.net blog: michaelneale.blogspot.com

2 3

RimuHosting DeltaCloud Driver
by Ivan Meredith 23 Oct '09

23 Oct '09

Hi all, I work at RimuHosting and am currently working on getting a deltacloud driver coded for our api. I'm pretty interested in this project so if I can find time I would like to contribute more than just our driver. I've done an inital commit that you can find at http://github.com/hadashi/deltacloud-driver-rimuhosting I've had the framework server up and running with what I've done. In the process of writing and testing the driver I noticed some weird things going on, like the framework interface showing the flavors correctly ( http://localhost:3000/api/flavors) but then only showing the same plan when going to different actually flavors such as http://localhost:3000/api/flavors/MIRO3B was actually showing the EU2 flavor. After looking at the base driver I saw why.. def flavor(credentials, opts) flavors = flavors(credentials, opts) return flavors.first unless flavors.empty? nil end That will always return the first flavor. I overrode it in my driver to look like def flavor(credentials, opts=nil) flav = flavors(credentials, opts) flav.each { |x| return x if x.id == opts[:id] } nil end and it worked properly. My question really is, Is the flavor method just not implemented fully yet, or am I missing something :). And if its not implemented yet, I guess you would take patches? (I'm not sure if what I did was OK, this is my first attempt at ruby.) Regards, Ivan Meredith RimuHosting

3 4

[PATCH portal] Add logging to make debugging easier.
by jason.guiditta 23 Oct '09

23 Oct '09

Signed-off-by: Jason Guiditta <jason.guiditta(a)gmail.com> --- src/app/models/cloud_account.rb | 3 ++- src/app/models/provider.rb | 3 ++- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/src/app/models/cloud_account.rb b/src/app/models/cloud_account.rb index 90d9b2b..d249ba2 100644 --- a/src/app/models/cloud_account.rb +++ b/src/app/models/cloud_account.rb @@ -18,7 +18,8 @@ class CloudAccount < ActiveRecord::Base begin return DeltaCloud.new(username, password, provider.url) rescue Exception => e - #TODO: log or return an exception + logger.error("Error connecting to framework: #{e.message}") + logger.error("Backtrace: #{e.backtrace.join("\n")}") return nil end end diff --git a/src/app/models/provider.rb b/src/app/models/provider.rb index 5b6fb2e..c181878 100644 --- a/src/app/models/provider.rb +++ b/src/app/models/provider.rb @@ -17,7 +17,8 @@ class Provider < ActiveRecord::Base begin return DeltaCloud.new(nil, nil, url) rescue Exception => e - #TODO: log or return an exception + logger.error("Error connecting to framework: #{e.message}") + logger.error("Backtrace: #{e.backtrace.join("\n")}") return nil end end -- 1.6.2.5

3 2

[PATCH] Gemspec cleanup.
by jason.guiditta 23 Oct '09

23 Oct '09

Thought it would be good to include a few things the old version didn't have, and reset version to match portal for now (don't think we should be @ 1.0.0 yet anyway). Signed-off-by: Jason Guiditta <jason.guiditta(a)gmail.com> --- deltacloud-client-ruby.gemspec | 10 ++++++---- 1 files changed, 6 insertions(+), 4 deletions(-) diff --git a/deltacloud-client-ruby.gemspec b/deltacloud-client-ruby.gemspec index de1d626..d7894ea 100644 --- a/deltacloud-client-ruby.gemspec +++ b/deltacloud-client-ruby.gemspec @@ -1,8 +1,10 @@ Gem::Specification.new do |s| s.author = 'Red Hat, Inc.' + s.homepage = "http://www.deltacloud.org" s.name = 'deltacloud-client-ruby' - s.description = 'DeltaCloud REST Client' - s.version = '1.0.0' - s.summary = 'DeltaCloud Client' - s.files = Dir['lib/**/*.rb'] + [ 'init.rb' ] + s.description = %q{Deltacloud REST Client} + s.version = '0.0.1' + s.summary = %q{Deltacloud Client} + s.files = Dir['Rakefile', 'credentials.yml', 'lib/**/*.rb', 'init.rb' ] + s.test_files= Dir.glob("specs/**/**") end -- 1.6.2.5

2 1

filter_on confusion, was: Re: RimuHosting DeltaCloud Driver
by Michael Neale 23 Oct '09

23 Oct '09

Hi All. Looking at the instances, flavors etc methods in the drivers - if we are required to filter them if an :id or :architecture key is in the opts hash - then why not do that in the framework itself anyway? Would be less confusion? (I am sure I am missing something though...). If makes sense, anyone object to adding it in? On Fri, Oct 23, 2009 at 2:34 PM, Ivan Meredith <ivan(a)ivan.net.nz> wrote: > Hi all, > I work at RimuHosting and am currently working on getting a deltacloud > driver coded for our api. I'm pretty interested in this project so if I can > find time I would like to contribute more than just our driver. > I've done an inital commit that you can find > at http://github.com/hadashi/deltacloud-driver-rimuhosting > I've had the framework server up and running with what I've done. > In the process of writing and testing the driver I noticed some weird things > going on, like the framework interface showing the flavors correctly > (http://localhost:3000/api/flavors) but then only showing the same plan when > going to different actually flavors such > as http://localhost:3000/api/flavors/MIRO3B was actually showing the EU2 > flavor. > After looking at the base driver I saw why.. > def flavor(credentials, opts) > flavors = flavors(credentials, opts) > return flavors.first unless flavors.empty? > nil > end > That will always return the first flavor. I overrode it in my driver to look > like > def flavor(credentials, opts=nil) > flav = flavors(credentials, opts) > flav.each { |x| return x if x.id == opts[:id] } > nil > end > and it worked properly. > My question really is, Is the flavor method just not implemented fully yet, > or am I missing something :). And if its not implemented yet, I guess you > would take patches? (I'm not sure if what I did was OK, this is my first > attempt at ruby.) > Regards, Ivan Meredith > RimuHosting > > _______________________________________________ > deltacloud-devel mailing list > deltacloud-devel(a)lists.fedorahosted.org > https://fedorahosted.org/mailman/listinfo/deltacloud-devel > -- Michael D Neale home: www.michaelneale.net blog: michaelneale.blogspot.com

1 0

[PATCH] initial permission/privilege model for the portal.
by Scott Seago 21 Oct '09

21 Oct '09

This is still preliminary, as there are a few things missing: 1) no support for using these permissions in the controllers 2) no UI to manipulate permission records 3) The roles would ideally be loaded via a yml file rather than in the migration, since they are theoretically dynamic values -- changes over time would be allowed without changes to the underlying code. 4) No fixtures/tests for any of this yet. I'll update this patch with fixtures, etc. before pushing, but I wanted to get this out there while the recent model decisions were still in my mind. Signed-off-by: Scott Seago <sseago(a)redhat.com> --- src/app/models/base_portal_object.rb | 33 ++++++ src/app/models/cloud_account.rb | 4 + src/app/models/permission.rb | 43 ++++++++ src/app/models/portal_pool.rb | 4 + src/app/models/privilege.rb | 76 +++++++++++++ src/app/models/provider.rb | 4 + src/app/models/role.rb | 34 ++++++ src/db/migrate/20091008153046_create_privileges.rb | 49 +++++++++ src/db/migrate/20091008153058_create_roles.rb | 112 ++++++++++++++++++++ .../migrate/20091008153106_create_permissions.rb | 37 +++++++ .../20091019215838_create_base_portal_objects.rb | 14 +++ src/test/fixtures/base_portal_objects.yml | 7 ++ src/test/fixtures/permissions.yml | 7 ++ src/test/fixtures/privileges.yml | 7 ++ src/test/fixtures/roles.yml | 7 ++ src/test/unit/base_portal_object_test.rb | 8 ++ src/test/unit/permission_test.rb | 8 ++ src/test/unit/privilege_test.rb | 8 ++ src/test/unit/role_test.rb | 8 ++ 19 files changed, 470 insertions(+), 0 deletions(-) create mode 100644 src/app/models/base_portal_object.rb create mode 100644 src/app/models/permission.rb create mode 100644 src/app/models/privilege.rb create mode 100644 src/app/models/role.rb create mode 100644 src/db/migrate/20091008153046_create_privileges.rb create mode 100644 src/db/migrate/20091008153058_create_roles.rb create mode 100644 src/db/migrate/20091008153106_create_permissions.rb create mode 100644 src/db/migrate/20091019215838_create_base_portal_objects.rb create mode 100644 src/test/fixtures/base_portal_objects.yml create mode 100644 src/test/fixtures/permissions.yml create mode 100644 src/test/fixtures/privileges.yml create mode 100644 src/test/fixtures/roles.yml create mode 100644 src/test/unit/base_portal_object_test.rb create mode 100644 src/test/unit/permission_test.rb create mode 100644 src/test/unit/privilege_test.rb create mode 100644 src/test/unit/role_test.rb diff --git a/src/app/models/base_portal_object.rb b/src/app/models/base_portal_object.rb new file mode 100644 index 0000000..e96dd44 --- /dev/null +++ b/src/app/models/base_portal_object.rb @@ -0,0 +1,33 @@ +# +# Copyright (C) 2009 Red Hat, Inc. +# Written by Scott Seago <sseago(a)redhat.com> +# +# This program is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation; version 2 of the License. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program; if not, write to the Free Software +# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, +# MA 02110-1301, USA. A copy of the GNU General Public License is +# also available at http://www.gnu.org/copyleft/gpl.html. + +class BasePortalObject < ActiveRecord::Base + has_many :permissions, :as => :permission_object, :dependent => :destroy, + :include => [:role], + :order => "permissions.id ASC" + + validates_presence_of :name + validates_uniqueness_of :name + + GENERAL_PERMISSION_SCOPE = "general_permission_scope" + + def self.general_permission_scope + self.find_by_name(GENERAL_PERMISSION_SCOPE) + end +end diff --git a/src/app/models/cloud_account.rb b/src/app/models/cloud_account.rb index 90d9b2b..c55e3e1 100644 --- a/src/app/models/cloud_account.rb +++ b/src/app/models/cloud_account.rb @@ -14,6 +14,10 @@ class CloudAccount < ActiveRecord::Base validates_uniqueness_of :username, :scope => :provider_id validates_presence_of :password + has_many :permissions, :as => :permission_object, :dependent => :destroy, + :include => [:role], + :order => "permissions.id ASC" + def connect begin return DeltaCloud.new(username, password, provider.url) diff --git a/src/app/models/permission.rb b/src/app/models/permission.rb new file mode 100644 index 0000000..7c2bd9c --- /dev/null +++ b/src/app/models/permission.rb @@ -0,0 +1,43 @@ +# +# Copyright (C) 2009 Red Hat, Inc. +# Written by Scott Seago <sseago(a)redhat.com> +# +# This program is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation; version 2 of the License. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program; if not, write to the Free Software +# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, +# MA 02110-1301, USA. A copy of the GNU General Public License is +# also available at http://www.gnu.org/copyleft/gpl.html. + +class Permission < ActiveRecord::Base + belongs_to :pool + + belongs_to :role + + validates_presence_of :pool_id + validates_presence_of :role_id + + validates_presence_of :user_id + validates_uniqueness_of :user_id, :scope => [:permission_object_id, + :permission_object_type] + + belongs_to :permission_object, :polymorphic => true + # type-specific associations + belongs_to :portal_pool, :class_name => "PortalPool", + :foreign_key => "permission_object_id" + belongs_to :provider, :class_name => "Provider", + :foreign_key => "permission_object_id" + belongs_to :cloud_account, :class_name => "CloudAccount", + :foreign_key => "permission_object_id" + belongs_to :base_portal_object, :class_name => "BasePortalObject", + :foreign_key => "permission_object_id" + +end diff --git a/src/app/models/portal_pool.rb b/src/app/models/portal_pool.rb index a8df0d5..0e2b036 100644 --- a/src/app/models/portal_pool.rb +++ b/src/app/models/portal_pool.rb @@ -9,6 +9,10 @@ class PortalPool < ActiveRecord::Base validates_presence_of :name validates_uniqueness_of :name, :scope => :cloud_account_id + has_many :permissions, :as => :permission_object, :dependent => :destroy, + :include => [:role], + :order => "permissions.id ASC" + def populate_realms_and_images client = cloud_account.connect realms = client.realms diff --git a/src/app/models/privilege.rb b/src/app/models/privilege.rb new file mode 100644 index 0000000..06dd18e --- /dev/null +++ b/src/app/models/privilege.rb @@ -0,0 +1,76 @@ +# +# Copyright (C) 2009 Red Hat, Inc. +# Written by Scott Seago <sseago(a)redhat.com> +# +# This program is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation; version 2 of the License. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program; if not, write to the Free Software +# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, +# MA 02110-1301, USA. A copy of the GNU General Public License is +# also available at http://www.gnu.org/copyleft/gpl.html. + +class Privilege < ActiveRecord::Base + has_and_belongs_to_many :roles + + validates_presence_of :name + validates_uniqueness_of :name + + #default privileges + PERM_SET = "set_perms" # can create/modify/delete permission + # records on this object + PERM_VIEW = "view_perms" # can view permission records on this + # object + + # instance privileges normally checked at the pool level, although + # instance-specific overrides could be a future enhancement. + INSTANCE_MODIFY = "instance_modify" # can create, modify, delete, or + # control (start, stop, etc) instances + INSTANCE_CONTROL = "instance_control" # can control (start, stop, etc) + # instances + INSTANCE_VIEW = "instance_view" # can view instance metadata + # do we need a separate "connect" privilege? + + # stats privileges normally checked at the pool level, although + # instance-specific overrides could be a future enhancement. + STATS_VIEW = "stats_view" # can view monitoring data for + # instances + + # account privileges normally checked at the provider level, although + # account-specific overrides could be a future enhancement. + ACCOUNT_MODIFY = "account_modify" # can create or modify cloud accounts + ACCOUNT_VIEW = "account_view" # can create or modify cloud accounts + + # pool privileges normally checked at the provider level + # (and at the account level for choosing which accounts are visible on the + # new pool form), although + # pool-specific overrides could be a future enhancement. + POOL_MODIFY = "pool_modify" # can create or modify a pool + POOL_VIEW = "pool_view" # can view a pool + + # quota privileges normally checked at the pool or account level, + # depending on which quota level we're dealing with + # (account level for cloud-imposed quota, pool level for portal quota) + QUOTA_MODIFY = "quota_modify" # can create or modify a quota + QUOTA_VIEW = "quota_view" # can view a quota + + # provider privileges normally checked at the provider level, although + # 'new provider' action requires this privilege at the SystemPermission level + PROVIDER_MODIFY = "provider_modify" # can create or modify a provider + PROVIDER_VIEW = "provider_view" # can view a provider + + # normally checked at the SystemPermission level + USER_MODIFY = "user_modify" # can create a new user (other than + # self-registration) or modify another + # user's metadata (for admin-level + # actions) + USER_VIEW = "user_view" # can view a user's profile data + +end diff --git a/src/app/models/provider.rb b/src/app/models/provider.rb index 5b6fb2e..f770d9f 100644 --- a/src/app/models/provider.rb +++ b/src/app/models/provider.rb @@ -13,6 +13,10 @@ class Provider < ActiveRecord::Base validates_presence_of :cloud_type validates_presence_of :url + has_many :permissions, :as => :permission_object, :dependent => :destroy, + :include => [:role], + :order => "permissions.id ASC" + def connect begin return DeltaCloud.new(nil, nil, url) diff --git a/src/app/models/role.rb b/src/app/models/role.rb new file mode 100644 index 0000000..ed7aaf4 --- /dev/null +++ b/src/app/models/role.rb @@ -0,0 +1,34 @@ +# +# Copyright (C) 2009 Red Hat, Inc. +# Written by Scott Seago <sseago(a)redhat.com> +# +# This program is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation; version 2 of the License. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program; if not, write to the Free Software +# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, +# MA 02110-1301, USA. A copy of the GNU General Public License is +# also available at http://www.gnu.org/copyleft/gpl.html. + +class Role < ActiveRecord::Base + has_many :permissions + has_and_belongs_to_many :privileges, :uniq => true + + validates_presence_of :name + validates_uniqueness_of :name + + + #default roles + SUPER_ADMIN = "Super Admin" + ADMIN = "Administrator" + USER = "User" + MONITOR = "Monitor" + CLOUD_USER = "Cloud User" +end diff --git a/src/db/migrate/20091008153046_create_privileges.rb b/src/db/migrate/20091008153046_create_privileges.rb new file mode 100644 index 0000000..53817f8 --- /dev/null +++ b/src/db/migrate/20091008153046_create_privileges.rb @@ -0,0 +1,49 @@ +# +# Copyright (C) 2009 Red Hat, Inc. +# Written by Scott Seago <sseago(a)redhat.com> +# +# This program is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation; version 2 of the License. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program; if not, write to the Free Software +# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, +# MA 02110-1301, USA. A copy of the GNU General Public License is +# also available at http://www.gnu.org/copyleft/gpl.html. + +class CreatePrivileges < ActiveRecord::Migration + def self.up + create_table :privileges do |t| + t.string :name, :null => false + t.integer :lock_version, :default => 0 + + t.timestamps + end + + #create default privileges + privileges = ["set_perms", "view_perms", + "instance_modify", "instance_control", "instance_view", + "instance_console", "stats_view", + "account_modify", "account_view", + "pool_modify", "pool_view", + "quota_modify", "quota_view", + "provider_modify", "provider_view", + "user_modify", "user_view"] + Privilege.transaction do + privileges.each do |priv_name| + privilege = Privilege.new({:name => priv_name}) + privilege.save! + end + end + end + + def self.down + drop_table :privileges + end +end diff --git a/src/db/migrate/20091008153058_create_roles.rb b/src/db/migrate/20091008153058_create_roles.rb new file mode 100644 index 0000000..15e91c5 --- /dev/null +++ b/src/db/migrate/20091008153058_create_roles.rb @@ -0,0 +1,112 @@ +# +# Copyright (C) 2009 Red Hat, Inc. +# Written by Scott Seago <sseago(a)redhat.com> +# +# This program is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation; version 2 of the License. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program; if not, write to the Free Software +# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, +# MA 02110-1301, USA. A copy of the GNU General Public License is +# also available at http://www.gnu.org/copyleft/gpl.html. + +class CreateRoles < ActiveRecord::Migration + def self.up + create_table :roles do |t| + t.string :name, :null => false + t.string :scope, :null => false + t.integer :lock_version, :default => 0 + + t.timestamps + end + create_table :privileges_roles, :id => false do |t| + t.integer :privilege_id, :null => false + t.integer :role_id, :null => false + end + + #create default roles + roles = {"Instance Controller" => + {:role_scope => "PortalPool", + :privileges => ["instance_console", + "instance_control", + "instance_view", + "pool_view"]}, + "Instance Controller With Monitoring" => + {:role_scope => "PortalPool", + :privileges => ["instance_console", + "instance_control", + "instance_view", + "pool_view", + "stats_view"]}, + "Instance Creator and User" => + {:role_scope => "PortalPool", + :privileges => ["instance_console", + "instance_control", + "instance_view", + "pool_view", + "stats_view", + "instance_modify", + "quota_view", + "set_perms", + "view_perms"]}, + "Pool Creator" => + {:role_scope => "Provider", + :privileges => ["provider_view", + "pool_modify", + "pool_view", + "quota_view"]}, + "Pool Administrator" => + {:role_scope => "Provider", + :privileges => ["provider_view", + "pool_modify", + "pool_view", + "quota_view", + "quota_modify", + "account_view", + "account_modify"]}, + "Account Administrator" => + {:role_scope => "CloudAccount", + :privileges => ["set_perms", + "view_perms", + "account_view", + "account_modify"]}, + "Account User" => + {:role_scope => "CloudAccount", + :privileges => ["account_view"]}, + "Provider Administrator" => + {:role_scope => "BasePortalObject", + :privileges => ["provider_modify", + "provider_view"]}, + "Administrator" => + {:role_scope => "BasePortalObject", + :privileges => ["provider_modify", + "provider_view", + "user_modify", + "user_view", + "view_perms", + "set_perms"]} + + } + Role.transaction do + roles.each do |role_name, role_hash| + role = Role.new({:name => role_name, :scope => role_hash[:role_scope]}) + role.save! + role.privileges = role_hash[:privileges].collect do |priv_name| + Privilege.find_by_name(priv_name) + end + role.save! + end + end + end + + def self.down + drop_table :roles + end +end diff --git a/src/db/migrate/20091008153106_create_permissions.rb b/src/db/migrate/20091008153106_create_permissions.rb new file mode 100644 index 0000000..6e5a7a5 --- /dev/null +++ b/src/db/migrate/20091008153106_create_permissions.rb @@ -0,0 +1,37 @@ +# +# Copyright (C) 2009 Red Hat, Inc. +# Written by Scott Seago <sseago(a)redhat.com> +# +# This program is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation; version 2 of the License. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program; if not, write to the Free Software +# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, +# MA 02110-1301, USA. A copy of the GNU General Public License is +# also available at http://www.gnu.org/copyleft/gpl.html. + +class CreatePermissions < ActiveRecord::Migration + def self.up + create_table :permissions do |t| + t.integer :role_id, :null => false + t.integer :user_id, :null => false + t.integer :permission_object_id + t.string :permission_object_type + t.integer :pool_id + t.integer :lock_version, :default => 0 + + t.timestamps + end + end + + def self.down + drop_table :permissions + end +end diff --git a/src/db/migrate/20091019215838_create_base_portal_objects.rb b/src/db/migrate/20091019215838_create_base_portal_objects.rb new file mode 100644 index 0000000..badea5d --- /dev/null +++ b/src/db/migrate/20091019215838_create_base_portal_objects.rb @@ -0,0 +1,14 @@ +class CreateBasePortalObjects < ActiveRecord::Migration + def self.up + create_table :base_portal_objects do |t| + t.string :name, :null => false + t.timestamps + end + + BasePortalObject.new({:name => "general_permission_scope"}).save! + end + + def self.down + drop_table :base_portal_objects + end +end diff --git a/src/test/fixtures/base_portal_objects.yml b/src/test/fixtures/base_portal_objects.yml new file mode 100644 index 0000000..5bf0293 --- /dev/null +++ b/src/test/fixtures/base_portal_objects.yml @@ -0,0 +1,7 @@ +# Read about fixtures at http://ar.rubyonrails.org/classes/Fixtures.html + +# one: +# column: value +# +# two: +# column: value diff --git a/src/test/fixtures/permissions.yml b/src/test/fixtures/permissions.yml new file mode 100644 index 0000000..5bf0293 --- /dev/null +++ b/src/test/fixtures/permissions.yml @@ -0,0 +1,7 @@ +# Read about fixtures at http://ar.rubyonrails.org/classes/Fixtures.html + +# one: +# column: value +# +# two: +# column: value diff --git a/src/test/fixtures/privileges.yml b/src/test/fixtures/privileges.yml new file mode 100644 index 0000000..5bf0293 --- /dev/null +++ b/src/test/fixtures/privileges.yml @@ -0,0 +1,7 @@ +# Read about fixtures at http://ar.rubyonrails.org/classes/Fixtures.html + +# one: +# column: value +# +# two: +# column: value diff --git a/src/test/fixtures/roles.yml b/src/test/fixtures/roles.yml new file mode 100644 index 0000000..5bf0293 --- /dev/null +++ b/src/test/fixtures/roles.yml @@ -0,0 +1,7 @@ +# Read about fixtures at http://ar.rubyonrails.org/classes/Fixtures.html + +# one: +# column: value +# +# two: +# column: value diff --git a/src/test/unit/base_portal_object_test.rb b/src/test/unit/base_portal_object_test.rb new file mode 100644 index 0000000..e6e4b9d --- /dev/null +++ b/src/test/unit/base_portal_object_test.rb @@ -0,0 +1,8 @@ +require 'test_helper' + +class BasePortalObjectTest < ActiveSupport::TestCase + # Replace this with your real tests. + test "the truth" do + assert true + end +end diff --git a/src/test/unit/permission_test.rb b/src/test/unit/permission_test.rb new file mode 100644 index 0000000..08fcc0b --- /dev/null +++ b/src/test/unit/permission_test.rb @@ -0,0 +1,8 @@ +require 'test_helper' + +class PermissionTest < ActiveSupport::TestCase + # Replace this with your real tests. + test "the truth" do + assert true + end +end diff --git a/src/test/unit/privilege_test.rb b/src/test/unit/privilege_test.rb new file mode 100644 index 0000000..459d805 --- /dev/null +++ b/src/test/unit/privilege_test.rb @@ -0,0 +1,8 @@ +require 'test_helper' + +class PrivilegeTest < ActiveSupport::TestCase + # Replace this with your real tests. + test "the truth" do + assert true + end +end diff --git a/src/test/unit/role_test.rb b/src/test/unit/role_test.rb new file mode 100644 index 0000000..b0374ce --- /dev/null +++ b/src/test/unit/role_test.rb @@ -0,0 +1,8 @@ +require 'test_helper' + +class RoleTest < ActiveSupport::TestCase + # Replace this with your real tests. + test "the truth" do + assert true + end +end -- 1.6.2.5

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

deltacloud-devel October 2009