January 2011 - deltacloud-devel - Fedora Mailing-Lists

request for enhancement - injection of files on instance creation

by Michael Neale

Hi All. Would people consider an addition to the instance creation part of deltacloud API to allow the injection of files/content to specified paths? (an extra optional field(s) on the POST)? (this is the sort of thing that we need to have in some kind of semi-formal RFC wiki setup for people to point at and shout). -- Michael D Neale home: www.michaelneale.net blog: michaelneale.blogspot.com

13 years, 2 months

12
33
0 / 0

Task #197 - Remove any logic forcing one provider only

by jzigmund＠redhat.com

This patchset contains not only code for task #197, but also it contains renaming model of CloudAccount to ProviderAccount, and all fixings, that they were needed for green tests and changes in next branch, while this patchset was written. You need to apply all patches to work it well, when you will make a review.

13 years, 3 months

2
7
0 / 0

rename deltacloud-configure to aeolus-configure

by Mo Morsi

Renamed deltacloud to aeolus in the recipe and docs. Also update subcomponents which have been renamed (aggregator to conductor, core to deltacloud)

13 years, 3 months

2
6
0 / 0

initial aeolus-configure ssl integration

by Mo Morsi

This patchset integrates ssl support for https and postgres into the aeolus puppet recipe and configuration scripts

13 years, 3 months

3
7
0 / 0

[PATCH aeolus 1/2] Added Cucumber Tests for Provider Search

by Martyn Taylor

From: Martyn Taylor <mtaylor(a)redhat.com> --- src/features/provider.feature | 22 ++++++++++++++++++++++ src/features/step_definitions/provider_steps.rb | 2 +- 2 files changed, 23 insertions(+), 1 deletions(-) diff --git a/src/features/provider.feature b/src/features/provider.feature index 9e6f398..08704dd 100644 --- a/src/features/provider.feature +++ b/src/features/provider.feature @@ -73,3 +73,25 @@ Feature: Manage Providers And there should not be any hardware profiles And there should not be a cloud account And there should not be a realm + + Scenario: Search for hardware profiles + Given there are these providers: + | name | url | + | Test | http://testprovider.com/api | + | Mock | http://mockprovider.com/api | + | Other | http://sometesturl.com/api | + And I am on the admin providers page + Then I should see the following: + | Test | http://testprovider.com/api | + | Mock | http://mockprovider.com/ap | + | Other | http://sometesturl.com/api | + When I fill in "q" with "test" + And I press "Search" + Then I should see "Test" + And I should see "Other" + And I should not see "Mock" + When I fill in "q" with "Mock" + And I press "Search" + Then I should see "Mock" + And I should not see "Test" + And I should not see "Other" \ No newline at end of file diff --git a/src/features/step_definitions/provider_steps.rb b/src/features/step_definitions/provider_steps.rb index 2673ae8..bc56276 100644 --- a/src/features/step_definitions/provider_steps.rb +++ b/src/features/step_definitions/provider_steps.rb @@ -32,7 +32,7 @@ end Given /^there are these providers:$/ do |table| table.hashes.each do |hash| - Factory(:mock_provider, :name => hash['name']) + hash['url'].nil? ? Factory(:mock_provider, :name => hash['name']) : Factory(:mock_provider, :name => hash['name'], :url => hash['url']) end end -- 1.7.2.3

13 years, 3 months

2
2
0 / 0

[PATCH] refactored role/privilege model

by Scott Seago

Privileges are now a combination of a base action and a target object type (i.e. "modify" on Pool instead of the flat string "pool_modify"). In addition, the modeling has changed -- instead of a privileges model that was only low-level privileges with an explicit mapping to roles, the privileges model now tracks the privileges assigned to each role, with no separate mapping table. This will require a database reload as the seeds.rb required substantial changes in role/privilege loading Signed-off-by: Scott Seago <sseago(a)redhat.com> --- .../admin/provider_accounts_controller.rb | 11 +- src/app/controllers/admin/providers_controller.rb | 15 +- src/app/controllers/admin/settings_controller.rb | 15 +-- src/app/controllers/admin/users_controller.rb | 32 +--- src/app/controllers/application_controller.rb | 11 +- src/app/controllers/builds_controller.rb | 10 +- src/app/controllers/cloud_accounts_controller.rb | 20 ++-- src/app/controllers/dashboard_controller.rb | 10 -- .../controllers/hardware_profiles_controller.rb | 1 - .../controllers/image_factory/builds_controller.rb | 8 +- .../image_factory/templates_controller.rb | 66 ++++++--- src/app/controllers/instances_controller.rb | 12 +- src/app/controllers/permissions_controller.rb | 14 +- src/app/controllers/pools_controller.rb | 38 ++---- src/app/controllers/providers_controller.rb | 27 ++-- src/app/controllers/quotas_controller.rb | 8 +- .../controllers/resources/instances_controller.rb | 10 +- src/app/controllers/resources/pools_controller.rb | 15 +- src/app/controllers/settings_controller.rb | 17 +-- src/app/controllers/templates_controller.rb | 50 ++++-- src/app/controllers/users_controller.rb | 79 ++++------ src/app/models/cloud_account.rb | 21 +++ src/app/models/instance.rb | 27 +++- src/app/models/permission.rb | 6 + src/app/models/permissioned_object.rb | 136 +++++++--------- src/app/models/privilege.rb | 168 +++++++++++++------- src/app/models/role.rb | 7 +- src/app/models/template.rb | 5 + src/app/services/application_service.rb | 35 +++-- src/app/views/admin/users/_form.haml | 4 +- src/app/views/admin/users/edit.haml | 2 +- src/app/views/dashboard/summary.haml | 20 ++-- src/app/views/layouts/_main_nav.html.erb | 2 +- src/app/views/permissions/list.haml | 6 +- src/app/views/pools/show.haml | 2 +- src/app/views/providers/accounts.haml | 4 +- src/app/views/users/_form.haml | 4 +- src/app/views/users/edit.haml | 2 +- .../20110107000000_privilege_model_refactor.rb | 53 ++++++ src/db/seeds.rb | 163 ++++++++------------ src/features/support/custom.rb | 4 - src/features/support/hooks.rb | 17 -- src/lib/tasks/cucumber.rake | 6 +- src/spec/controllers/instance_controller_spec.rb | 12 +- src/spec/controllers/users_controller_spec.rb | 7 - src/spec/factories/base_permission_object.rb | 3 - src/spec/factories/metadata_object.rb | 34 ---- src/spec/factories/permission.rb | 8 +- src/spec/factories/pool.rb | 2 +- src/spec/factories/pool_family.rb | 2 +- src/spec/factories/user.rb | 5 +- src/spec/fixtures/base_permission_objects.yml | 2 - src/spec/fixtures/privileges.yml | 43 ----- src/spec/fixtures/roles.yml | 47 ------ src/spec/models/metadata_object_spec.rb | 2 +- src/spec/models/permission_spec.rb | 58 +++++++ src/spec/models/pool_family_spec.rb | 4 +- src/spec/services/registration_service_spec.rb | 14 +-- src/spec/spec_helper.rb | 2 +- 59 files changed, 705 insertions(+), 703 deletions(-) create mode 100644 src/db/migrate/20110107000000_privilege_model_refactor.rb delete mode 100644 src/spec/factories/base_permission_object.rb delete mode 100644 src/spec/factories/metadata_object.rb delete mode 100644 src/spec/fixtures/base_permission_objects.yml delete mode 100644 src/spec/fixtures/privileges.yml delete mode 100644 src/spec/fixtures/roles.yml create mode 100644 src/spec/models/permission_spec.rb diff --git a/src/app/controllers/admin/provider_accounts_controller.rb b/src/app/controllers/admin/provider_accounts_controller.rb index 2c331f7..960f4f5 100644 --- a/src/app/controllers/admin/provider_accounts_controller.rb +++ b/src/app/controllers/admin/provider_accounts_controller.rb @@ -8,6 +8,7 @@ class Admin::ProviderAccountsController < ApplicationController def show @tab_captions = ['Properties', 'Credentials', 'History', 'Permissions'] @account = CloudAccount.find(params[:id]) + require_privilege(Privilege::ACTION_VIEW, @account) @details_tab = params[:details_tab].blank? ? 'properties' : params[:details_tab] if params.delete :test_account @@ -34,7 +35,7 @@ class Admin::ProviderAccountsController < ApplicationController def create @provider = Provider.find(params[:provider_id]) - require_privilege(Privilege::ACCOUNT_MODIFY, @provider) + require_privilege(Privilege::ACTION_CREATE, CloudAccount, @provider) @providers = Provider.all @cloud_account = CloudAccount.new(params[:cloud_account]) @@ -73,13 +74,13 @@ class Admin::ProviderAccountsController < ApplicationController @cloud_account = CloudAccount.find(params[:id]) @quota = @cloud_account.quota @provider = @cloud_account.provider - require_privilege(Privilege::ACCOUNT_MODIFY,@provider) + require_privilege(Privilege::ACTION_MODIFY,@cloud_account) end def update @cloud_account = CloudAccount.find(params[:id]) @provider = @cloud_account.provider - require_privilege(Privilege::ACCOUNT_MODIFY, @provider) + require_privilege(Privilege::ACTION_MODIFY,@cloud_account) @quota = @cloud_account.quota if params.delete :test_account @@ -101,7 +102,9 @@ class Admin::ProviderAccountsController < ApplicationController if (not params[:accounts_selected]) or (params[:accounts_selected].length == 0) flash[:notice] = "You must select some accounts first." else - CloudAccount.destroy(params[:accounts_selected]) + CloudAccount.find(params[:accounts_selected]).each do |account| + account.destroy if check_privilege(Privilege::ACTION_MODIFY, account) + end end redirect_to admin_provider_accounts_url end diff --git a/src/app/controllers/admin/providers_controller.rb b/src/app/controllers/admin/providers_controller.rb index aac2c1d..61a405b 100644 --- a/src/app/controllers/admin/providers_controller.rb +++ b/src/app/controllers/admin/providers_controller.rb @@ -6,19 +6,20 @@ class Admin::ProvidersController < ApplicationController end def new - require_privilege(Privilege::PROVIDER_MODIFY) + require_privilege(Privilege::ACTION_CREATE, Provider) @provider = Provider.new kick_condor end def edit @provider = Provider.find_by_id(params[:id]) - require_privilege(Privilege::PROVIDER_MODIFY, @provider) + require_privilege(Privilege::ACTION_MODIFY, @provider) end def show @provider = Provider.find(params[:id]) @url_params = params.clone + require_privilege(Privilege::ACTION_VIEW, @provider) @tab_captions = ['Properties', 'HW Profiles', 'Realms', 'Provider Accounts', 'Services','History','Permissions'] @details_tab = params[:details_tab].blank? ? 'properties' : params[:details_tab] respond_to do |format| @@ -33,7 +34,7 @@ class Admin::ProvidersController < ApplicationController end def create - require_privilege(Privilege::PROVIDER_MODIFY) + require_privilege(Privilege::ACTION_CREATE, Provider) @provider = Provider.new(params[:provider]) if params[:test_connection] test_connection(@provider) @@ -52,8 +53,8 @@ class Admin::ProvidersController < ApplicationController end def update - require_privilege(Privilege::PROVIDER_MODIFY) @provider = Provider.find_by_id(params[:id]) + require_privilege(Privilege::ACTION_MODIFY, @provider) previous_cloud_type = @provider.cloud_type @provider.update_attributes(params[:provider]) if params[:test_connection] @@ -77,7 +78,9 @@ class Admin::ProvidersController < ApplicationController end def multi_destroy - Provider.destroy(params[:provider_selected]) + Provider.find(params[:provider_selected]).each do |provider| + provider.destroy if check_privilege(Privilege::ACTION_MODIFY, provider) + end redirect_to admin_providers_url end @@ -97,7 +100,7 @@ class Admin::ProvidersController < ApplicationController @header = [{ :name => "Provider name", :sort_attr => :name }, { :name => "Provider URL", :sort_attr => :name } ] - @providers = Provider.list_for_user(@current_user, Privilege::PROVIDER_VIEW) + @providers = Provider.list_for_user(@current_user, Privilege::ACTION_VIEW) @url_params = params.clone end end diff --git a/src/app/controllers/admin/settings_controller.rb b/src/app/controllers/admin/settings_controller.rb index accf398..2b816d4 100644 --- a/src/app/controllers/admin/settings_controller.rb +++ b/src/app/controllers/admin/settings_controller.rb @@ -6,18 +6,12 @@ class Admin::SettingsController < ApplicationController KEYS = [SELF_SERVICE_DEFAULT_QUOTA] def self_service - if !is_admin? - raise PermissionError.new('You have insufficient privileges to perform action.') - return - end + require_privilege(Privilege::ACTION_MODIFY) @self_service_default_quota = MetadataObject.lookup(SELF_SERVICE_DEFAULT_QUOTA) end def general_settings - if !is_admin? - raise PermissionError.new('You have insufficient privileges to perform action.') - return - end + require_privilege(Privilege::ACTION_MODIFY) end def update @@ -47,9 +41,4 @@ class Admin::SettingsController < ApplicationController redirect_to :action => 'self_service' end - private - def is_admin? - is_admin = @current_user.permissions.collect { |p| p.role }.find { |r| r.name == "Administrator" } - return is_admin == nil ? false : true - end end diff --git a/src/app/controllers/admin/users_controller.rb b/src/app/controllers/admin/users_controller.rb index 0e854a9..4648da9 100644 --- a/src/app/controllers/admin/users_controller.rb +++ b/src/app/controllers/admin/users_controller.rb @@ -1,9 +1,9 @@ class Admin::UsersController < ApplicationController before_filter :require_user - before_filter :only_admin, :only => [:index, :multi_destroy] before_filter :load_users, :only => [:index, :show] def new + require_privilege(Privilege::ACTION_CREATE, User) unless current_user.nil? @user = User.new @user.quota = Quota.new end @@ -13,8 +13,7 @@ class Admin::UsersController < ApplicationController redirect_to :action => 'new' and return end - # TODO: Shouldn't it be if current_user.nil? instead? - require_privilege(Privilege::USER_MODIFY) unless current_user.nil? + require_privilege(Privilege::ACTION_MODIFY, User) unless current_user.nil? @user = User.new(params[:user]) @registration = RegistrationService.new(@user) @@ -34,6 +33,7 @@ class Admin::UsersController < ApplicationController def show @user = User.find_by_id(params[:id]) || current_user + require_privilege(Privilege::ACTION_VIEW, User) unless current_user == @user @quota_resources = @user.quota.quota_resources @url_params = params.clone @@ -52,15 +52,12 @@ class Admin::UsersController < ApplicationController def edit @user = User.find_by_id(params[:id]) || current_user - - if cannot_modify_different_user?(@user) - flash[:notice] = "Invalid Permission to perform this operation" - redirect_to dashboard_url and return - end + require_privilege(Privilege::ACTION_MODIFY, User) unless @user == current_user end def update @user = User.find_by_id(params[:id]) || current_user + require_privilege(Privilege::ACTION_MODIFY, User) unless @user == current_user if params[:commit] == "Reset" redirect_to edit_admin_user_url(@user) and return @@ -68,20 +65,16 @@ class Admin::UsersController < ApplicationController redirect_to dashboard_url and return unless @user - if cannot_modify_different_user = cannot_modify_different_user?(@user) - flash[:notice] = "Invalid Permission to perform this operation" - redirect_to dashboard_url and return - end - unless @user.update_attributes(params[:user]) render :action => 'edit' and return else flash[:notice] = "User updated!" - redirect_to cannot_modify_different_user ? dashboard_url : admin_users_url + redirect_to (@user == current_user) ? dashboard_url : admin_users_url end end def multi_destroy + require_privilege(Privilege::ACTION_MODIFY, User) User.destroy(params[:user_selected]) redirect_to admin_users_url end @@ -101,15 +94,4 @@ class Admin::UsersController < ApplicationController end end - def only_admin - unless current_user.permissions.collect { |p| p.role }.find { |r| r.name == "Administrator" } - flash[:notice] = "Invalid Permission to perform this operation" - redirect_to dashboard_url - end - end - - def cannot_modify_different_user?(user) - user && user != current_user && !BasePermissionObject.general_permission_scope.can_modify_users(current_user) - end - end diff --git a/src/app/controllers/application_controller.rb b/src/app/controllers/application_controller.rb index b77fe9c..b0386e0 100644 --- a/src/app/controllers/application_controller.rb +++ b/src/app/controllers/application_controller.rb @@ -60,13 +60,6 @@ class ApplicationController < ActionController::Base 'generic' end - perm_helper_string = "" - Privilege::FULL_PRIVILEGE_LIST.each do |privilege| - perm_helper_string += "def has_#{privilege}?(obj=@perm_obj); " + - "check_privilege(\"#{privilege}\", obj) end; " - end - master_helper_module.module_eval perm_helper_string - helper_method :check_privilege protected @@ -162,8 +155,8 @@ class ApplicationController < ActionController::Base def get_nav_items if current_user.present? - @providers = Provider.list_for_user(@current_user, Privilege::PROVIDER_VIEW) - @pools = Pool.list_for_user(@current_user, Privilege::POOL_VIEW) + @providers = Provider.list_for_user(@current_user, Privilege::ACTION_VIEW) + @pools = Pool.list_for_user(@current_user, Privilege::ACTION_VIEW) end end diff --git a/src/app/controllers/builds_controller.rb b/src/app/controllers/builds_controller.rb index 7cf0ad6..e205171 100644 --- a/src/app/controllers/builds_controller.rb +++ b/src/app/controllers/builds_controller.rb @@ -1,12 +1,12 @@ class BuildsController < ApplicationController - before_filter [:require_user, :check_permission] + before_filter [:require_user] def section_id 'build' end def index - require_privilege(Privilege::IMAGE_VIEW) + require_privilege(Privilege::ACTION_VIEW, Template) order = get_order('templates.name') @running_images = Image.all(:include => :template, :conditions => ['status IN (?)', Image::ACTIVE_STATES], :order => order) @completed_images = Image.all(:include => :template, :conditions => {:status => Image::STATE_COMPLETE}, :order => order) @@ -16,6 +16,7 @@ class BuildsController < ApplicationController def new raise "select template to build" unless id = params[:template_id] @tpl = Template.find(id) + check_permission if @tpl.imported flash[:warning] = "Build imported template is not supported" redirect_to templates_path @@ -30,6 +31,7 @@ class BuildsController < ApplicationController end @tpl = Template.find(params[:template_id]) + check_permission @all_targets = Image.available_targets if params[:targets].blank? @@ -60,9 +62,11 @@ class BuildsController < ApplicationController end def edit + # FIXME: is @tpl defined here? do we need check_permission here? end def update + # FIXME: is @tpl defined here? do we need check_permission here? end private @@ -82,6 +86,6 @@ class BuildsController < ApplicationController end def check_permission - require_privilege(Privilege::IMAGE_MODIFY) + require_privilege(Privilege::ACTION_MODIFY, @tpl) end end diff --git a/src/app/controllers/cloud_accounts_controller.rb b/src/app/controllers/cloud_accounts_controller.rb index 75a75d9..c2fe5e7 100644 --- a/src/app/controllers/cloud_accounts_controller.rb +++ b/src/app/controllers/cloud_accounts_controller.rb @@ -31,19 +31,19 @@ class CloudAccountsController < ApplicationController def index @provider = Provider.find(params[:provider_id]) - require_privilege(Privilege::ACCOUNT_VIEW, @provider) + require_privilege(Privilege::ACTION_VIEW, CloudAccount, @provider) end def new @provider = Provider.find(params[:provider_id]) @cloud_account = CloudAccount.new @quota = Quota.new - require_privilege(Privilege::ACCOUNT_MODIFY, @provider) + require_privilege(Privilege::ACTION_CREATE, CloudAccount, @provider) end def create @provider = Provider.find(params[:provider_id]) - require_privilege(Privilege::ACCOUNT_MODIFY,@provider) + require_privilege(Privilege::ACTION_CREATE, CloudAccount, @provider) @cloud_account = CloudAccount.new(params[:cloud_account]) @cloud_account.provider = @provider @cloud_account.quota = @quota = Quota.new @@ -80,13 +80,13 @@ class CloudAccountsController < ApplicationController @cloud_account = CloudAccount.find(params[:id]) @quota = @cloud_account.quota @provider = @cloud_account.provider - require_privilege(Privilege::ACCOUNT_MODIFY,@provider) + require_privilege(Privilege::ACTION_MODIFY, @cloud_account) end def update_accounts @provider = Provider.find(params[:provider][:id]) - require_privilege(Privilege::ACCOUNT_MODIFY, @provider) - @providers = Provider.list_for_user(@current_user, Privilege::PROVIDER_VIEW) + require_privilege(Privilege::ACTION_MODIFY, CloudAccount, @provider) + @providers = Provider.list_for_user(@current_user, Privilege::ACTION_VIEW) success = true @provider.cloud_accounts.each do |cloud_account| @@ -130,7 +130,7 @@ class CloudAccountsController < ApplicationController def update @cloud_account = CloudAccount.find(params[:id]) @provider = @cloud_account.provider - require_privilege(Privilege::ACCOUNT_MODIFY, @provider) + require_privilege(Privilege::ACTION_MODIFY, @cloud_account) @quota = @cloud_account.quota limit = params[:quota][:maximum_running_instances] if params[:quota] @@ -145,7 +145,7 @@ class CloudAccountsController < ApplicationController def key @cloud_account = CloudAccount.find(params[:id]) - require_privilege(Privilege::ACCOUNT_MODIFY,@cloud_account.provider) + require_privilege(Privilege::ACTION_MODIFY,@cloud_account) unless @cloud_account.instance_key.nil? render :text => @cloud_account.instance_key.pem end @@ -154,7 +154,7 @@ class CloudAccountsController < ApplicationController def destroy account = CloudAccount.find(params[:id]) provider = account.provider - require_privilege(Privilege::ACCOUNT_MODIFY, provider) + require_privilege(Privilege::ACTION_MODIFY, account) if account.destroy flash[:notice] = "Cloud Account destroyed" else @@ -176,6 +176,6 @@ class CloudAccountsController < ApplicationController private def load_providers - @providers = Provider.list_for_user(@current_user, Privilege::PROVIDER_VIEW) + @providers = Provider.list_for_user(@current_user, Privilege::ACTION_VIEW) end end diff --git a/src/app/controllers/dashboard_controller.rb b/src/app/controllers/dashboard_controller.rb index 8d37a12..5254dd7 100644 --- a/src/app/controllers/dashboard_controller.rb +++ b/src/app/controllers/dashboard_controller.rb @@ -70,16 +70,6 @@ class DashboardController < ApplicationController @cloud_accounts = CloudAccount.find(:all) - # Now need to check any permissions are set since default permission and pool - # may not be set for the admin user - if @current_user.permissions - # FIXME remove general role based permission check, replace w/ - # more granular / per-permission-object permission checks on the - # dashboard in the future (here and in dashboard views) - @is_admin = @current_user.permissions.collect { |p| p.role }. - find { |r| r.name == "Administrator" } - end - render :action => 'monitor' end diff --git a/src/app/controllers/hardware_profiles_controller.rb b/src/app/controllers/hardware_profiles_controller.rb index c3afae2..d18110c 100644 --- a/src/app/controllers/hardware_profiles_controller.rb +++ b/src/app/controllers/hardware_profiles_controller.rb @@ -23,7 +23,6 @@ class HardwareProfilesController < ApplicationController def index @hardware_profiles = HardwareProfile.find(:all) - #require_privilege(Privilege::PROVIDER_VIEW, @hardware_profile) ? end def new diff --git a/src/app/controllers/image_factory/builds_controller.rb b/src/app/controllers/image_factory/builds_controller.rb index 97bd32f..df9aba6 100644 --- a/src/app/controllers/image_factory/builds_controller.rb +++ b/src/app/controllers/image_factory/builds_controller.rb @@ -1,9 +1,10 @@ class ImageFactory::BuildsController < ApplicationController - before_filter [:require_user, :check_permission] + before_filter [:require_user] def new raise "select template to build" unless id = params[:template_id] @tpl = Template.find(id) + check_permission if @tpl.imported flash[:warning] = "Build imported template is not supported" redirect_to templates_path @@ -13,6 +14,7 @@ class ImageFactory::BuildsController < ApplicationController def create @tpl = Template.find(params[:template_id]) + check_permission @all_targets = Image.available_targets if params[:targets].blank? @@ -43,9 +45,11 @@ class ImageFactory::BuildsController < ApplicationController end def edit + # FIXME: is @tpl defined here? do we need check_permission here? end def update + # FIXME: is @tpl defined here? do we need check_permission here? end private @@ -65,6 +69,6 @@ class ImageFactory::BuildsController < ApplicationController end def check_permission - require_privilege(Privilege::IMAGE_MODIFY) + require_privilege(Privilege::ACTION_MODIFY, @tpl) end end diff --git a/src/app/controllers/image_factory/templates_controller.rb b/src/app/controllers/image_factory/templates_controller.rb index fbba625..a1b0fec 100644 --- a/src/app/controllers/image_factory/templates_controller.rb +++ b/src/app/controllers/image_factory/templates_controller.rb @@ -2,7 +2,6 @@ require 'util/repository_manager' class ImageFactory::TemplatesController < ApplicationController before_filter :require_user - before_filter :check_permission, :except => [:index, :show] before_filter :load_templates, :only => [:index, :show] def index @@ -10,6 +9,7 @@ class ImageFactory::TemplatesController < ApplicationController def show @tpl = Template.find(params[:id]) + require_privilege(Privilege::ACTION_VIEW, @tpl) @url_params = params.clone @tab_captions = ['Properties', 'Images'] @details_tab = params[:details_tab].blank? ? 'properties' : params[:details_tab] @@ -26,6 +26,7 @@ class ImageFactory::TemplatesController < ApplicationController end def new + check_create_permission # can't use @template variable - is used by compass (or something other) @tpl = Template.new(params[:tpl]) @repository_manager = RepositoryManager.new(:repositories => params[:repository] || @tpl.platform) @@ -34,9 +35,11 @@ class ImageFactory::TemplatesController < ApplicationController def add_selected if params[:tpl] and not params[:tpl][:id].blank? @tpl = Template.find(params[:tpl][:id]) + check_edit_permission @tpl.attributes = params[:tpl] else @tpl = Template.new(params[:tpl]) + check_create_permission end @repository_manager = RepositoryManager.new(:repositories => params[:repository] || @tpl.platform) @tpl.add_software(params[:packages].to_a + params[:selected_packages].to_a + params[:cached_packages].to_a, @@ -46,11 +49,13 @@ class ImageFactory::TemplatesController < ApplicationController def edit @tpl = Template.find(params[:id]) + check_edit_permission @tpl.attributes = params[:tpl] unless params[:tpl].blank? @repository_manager = RepositoryManager.new(:repositories => params[:repository] || @tpl.platform) end def create + check_create_permission @tpl = Template.new(params[:tpl]) @tpl.packages = params[:packages] if @tpl.save @@ -65,6 +70,7 @@ class ImageFactory::TemplatesController < ApplicationController def update @tpl = Template.find(params[:id]) + check_edit_permission @tpl.packages = [] if @tpl.update_attributes(params[:tpl]) @@ -120,7 +126,13 @@ class ImageFactory::TemplatesController < ApplicationController end def managed_content - @tpl = params[:template_id].blank? ? Template.new : Template.find(params[:template_id]) + if params[:template_id].blank? + @tpl = Template.new + check_create_permission + else + @tpl = Template.find(params[:template_id]) + check_edit_permission + end @tpl.add_software(params[:packages].to_a + params[:selected_packages].to_a, params[:groups].to_a + params[:selected_groups].to_a) render :layout => false @@ -133,9 +145,11 @@ class ImageFactory::TemplatesController < ApplicationController else errs = {} Template.find(ids).each do |t| - t.destroy - unless t.destroyed? - errs[t.name] = t.errors.full_messages.join(". ") + if check_permission(Privilege::ACTION_MODIFY, t) + t.destroy + errs[t.name] = t.errors.full_messages.join(". ") unless t.destroyed? + else + errs[t.name] = "You don't have permission to delete #{t.name}" end end if errs.empty? @@ -148,9 +162,11 @@ class ImageFactory::TemplatesController < ApplicationController end def assembly + # FIXME: do we need perm check here? end def deployment_definition + # FIXME: do we need perm check here? @all_targets = Image.available_targets end @@ -158,9 +174,11 @@ class ImageFactory::TemplatesController < ApplicationController params[:packages].delete(params[:name]) unless params[:name].blank? if params[:tpl] and not params[:tpl][:id].blank? @tpl = Template.find(params[:tpl][:id]) + check_edit_permission @tpl.attributes = params[:tpl] else @tpl = Template.new(params[:tpl]) + check_create_permission end @tpl.add_software(params[:packages].to_a, params[:groups].to_a) @repository_manager = RepositoryManager.new(:repositories => params[:repository] || @tpl.platform) @@ -168,9 +186,13 @@ class ImageFactory::TemplatesController < ApplicationController end def multi_destroy - # FIXME: set correct check permission when we will have it - require_privilege(Privilege::IMAGE_MODIFY) - Template.destroy(params[:selected]) + @tpl = Template.find(params[:selected]) + if check_edit_permission + @tpl.destroy + errs[(a)tpl.name] = @tpl.errors.full_messages.join(". ") unless @tpl.destroyed? + else + errs[(a)tpl.name] = "You don't have permission to delete #{(a)tpl.name}" + end redirect_to image_factory_templates_url end @@ -184,7 +206,6 @@ class ImageFactory::TemplatesController < ApplicationController {:name => 'ARCH', :sort_attr => 'templates.architecture'}, {:name => 'STATUS', :sort_attr => 'status'}, ] - require_privilege(Privilege::IMAGE_VIEW) @images = tpl.images end @@ -197,18 +218,21 @@ class ImageFactory::TemplatesController < ApplicationController {:name => 'ARCH', :sort_attr => 'architecture'}, ] - # TODO: add template permission check - require_privilege(Privilege::IMAGE_VIEW) - @templates = Template.find( - :all, - :include => :images, - :order => get_order('name') - ) + @templates = Template.list_for_user(Privilege::ACTION_VIEW, + :include => :images, + :order => get_order('name') + ) @url_params = params.clone end def set_package_vars(set_all = false) - @tpl = params[:id].blank? ? Template.new : Template.find(params[:id]) + if params[:id].blank? + @tpl = Template.new + check_create_permission + else + @tpl = Template.find(params[:id]) + check_edit_permission + end @tpl.attributes = params[:tpl] unless params[:tpl].nil? @repository_manager = RepositoryManager.new(:repositories => params[:repository] || @tpl.platform) @groups = @repository_manager.groups @@ -230,8 +254,12 @@ class ImageFactory::TemplatesController < ApplicationController flash.now[:error][:failures].merge!(errs) end - def check_permission - require_privilege(Privilege::IMAGE_MODIFY) + def check_create_permission + require_privilege(Privilege::ACTION_CREATE, Template) + end + + def check_edit_permission + require_privilege(Privilege::ACTION_MODIFY, @tpl) end def get_selected_id diff --git a/src/app/controllers/instances_controller.rb b/src/app/controllers/instances_controller.rb index 5e68b8e..142a336 100644 --- a/src/app/controllers/instances_controller.rb +++ b/src/app/controllers/instances_controller.rb @@ -35,7 +35,7 @@ class InstancesController < ApplicationController end def index - @pools = Pool.list_for_user(@current_user, Privilege::INSTANCE_MODIFY) + @pools = Pool.list_for_user(@current_user, Privilege::ACTION_MODIFY, :target_type => Instance) @order_dir = params[:order_dir] == 'desc' ? 'desc' : 'asc' @order_field = params[:order_field] || 'name' @@ -69,7 +69,7 @@ class InstancesController < ApplicationController def new @instance = Instance.new(params[:instance]) - require_privilege(Privilege::INSTANCE_MODIFY, @instance.pool) if @instance.pool + require_privilege(Privilege::ACTION_CREATE, Instance, @instance.pool) if @instance.pool # FIXME: we need to list only templates for particular user, # => TODO: add TEMPLATE_* permissions @templates = Template.paginate( @@ -81,7 +81,7 @@ class InstancesController < ApplicationController def configure @instance = Instance.new(params[:instance]) - require_privilege(Privilege::INSTANCE_MODIFY, @instance.pool) + require_privilege(Privilege::ACTION_CREATE, Instance, @instance.pool) @hardware_profiles = HardwareProfile.find(:all, :include => :architecture, :conditions => {:provider_id => nil, 'hardware_profile_properties.value' => @instance.template.architecture}) @@ -97,7 +97,7 @@ class InstancesController < ApplicationController @instance.state = Instance::STATE_NEW @instance.owner = current_user - require_privilege(Privilege::INSTANCE_MODIFY, + require_privilege(Privilege::ACTION_CREATE, Instance, Pool.find((a)instance.pool_id)) #FIXME: This should probably be in a transaction if @instance.save! @@ -131,7 +131,7 @@ class InstancesController < ApplicationController end @instance = Instance.find((params[:id] || []).first) - require_privilege(Privilege::INSTANCE_CONTROL,@instance.pool) + require_privilege(Privilege::ACTION_USE,@instance) if params[:instance_details] render :action => 'show' @@ -190,7 +190,7 @@ class InstancesController < ApplicationController def instance @instance = Instance.find(params[:id]) - require_privilege(Privilege::INSTANCE_VIEW, @instance.pool) + require_privilege(Privilege::ACTION_VIEW, @instance) end end diff --git a/src/app/controllers/permissions_controller.rb b/src/app/controllers/permissions_controller.rb index c326e14..a2991d9 100644 --- a/src/app/controllers/permissions_controller.rb +++ b/src/app/controllers/permissions_controller.rb @@ -21,15 +21,15 @@ class PermissionsController < ApplicationController def show @permission = Permission.find(params[:id]) - require_privilege(Privilege::PERM_VIEW, @permission.permission_object) + require_privilege(Privilege::ACTION_PERM_VIEW, @permission.permission_object) end def list - set_permission_object Privilege::PERM_VIEW + set_permission_object Privilege::ACTION_PERM_VIEW end def new - set_permission_object Privilege::PERM_SET + set_permission_object Privilege::ACTION_PERM_SET @permission = Permission.new(:permission_object_type => @permission_object.class, :permission_object_id => @permission_object.id) @users = User.all @@ -38,7 +38,7 @@ class PermissionsController < ApplicationController def create @permission = Permission.new(params[:permission]) - require_privilege(Privilege::PERM_SET, @permission.permission_object) + require_privilege(Privilege::ACTION_PERM_SET, @permission.permission_object) if request.post? && @permission.save flash[:notice] = "Permission record added." redirect_to :action => "list", @@ -55,7 +55,7 @@ class PermissionsController < ApplicationController def destroy if request.post? p =Permission.find(params[:permission][:id]) - require_privilege(Privilege::PERM_SET, p.permission_object) + require_privilege(Privilege::ACTION_PERM_SET, p.permission_object) p.destroy end redirect_to :action => "list", @@ -65,7 +65,7 @@ class PermissionsController < ApplicationController private - def set_permission_object(privilege) + def set_permission_object(action) if !params[:permission_object_type].nil? @permission_object = params[:permission_object_type].constantize.find(params[:permission_object_id]) @@ -83,7 +83,7 @@ class PermissionsController < ApplicationController raise ActiveRecord::RecordNotFound if @permission_object.nil? - require_privilege(privilege, @permission_object) + require_privilege(action, @permission_object) end end diff --git a/src/app/controllers/pools_controller.rb b/src/app/controllers/pools_controller.rb index 47cdc77..fdc3650 100644 --- a/src/app/controllers/pools_controller.rb +++ b/src/app/controllers/pools_controller.rb @@ -44,16 +44,19 @@ class PoolsController < ApplicationController def show @pool = Pool.find(params[:id]) + require_privilege(Privilege::ACTION_VIEW, @pool) end def edit @pool = Pool.find(params[:id]) + require_privilege(Privilege::ACTION_MODIFY, @pool) end def list #FIXME: clean this up, many error cases here @pool = Pool.find(params[:id]) - require_privilege(Privilege::INSTANCE_VIEW,@pool) + # FIXME: really we need perm-filtered list here + require_privilege(Privilege::ACTION_VIEW, Instance, @pool) @pool.reload @order_dir = params[:order_dir] == 'desc' ? 'desc' : 'asc' @@ -74,23 +77,23 @@ class PoolsController < ApplicationController def hardware_profiles @pool = Pool.find(params[:id]) @hardware_profiles = @pool.hardware_profiles - require_privilege(Privilege::POOL_VIEW, @pool) + require_privilege(Privilege::ACTION_VIEW, @pool) end def realms @pool = Pool.find(params[:id]) @realm_names = @pool.realms - require_privilege(Privilege::POOL_VIEW,@pool) + require_privilege(Privilege::ACTION_VIEW, @pool) end def new - require_privilege(Privilege::POOL_MODIFY) - @pools = Pool.list_for_user(@current_user, Privilege::POOL_MODIFY) + require_privilege(Privilege::ACTION_CREATE, Pool) + @pools = Pool.list_for_user(@current_user, Privilege::ACTION_MODIFY) @pool = Pool.new end def create - require_privilege(Privilege::POOL_MODIFY) + require_privilege(Privilege::ACTION_CREATE, Pool) #FIXME: This should probably be in a transaction @pool = Pool.new(params[:pool]) @@ -118,6 +121,7 @@ class PoolsController < ApplicationController if type == "edit" redirect_to :action => 'edit', :id => pool_id elsif type == "delete" + require_privilege(Privilege::ACTION_MODIFY, Pool.find(pool_id)) params[:id] = pool_id destroy end @@ -130,27 +134,5 @@ class PoolsController < ApplicationController def delete end - def accounts_for_pool - @pool = Pool.find(params[:pool_id]) - require_privilege(Privilege::ACCOUNT_VIEW,@pool) - @cloud_accounts = [] - all_accounts = CloudAccount.list_for_user(@current_user, Privilege::ACCOUNT_ADD) - all_accounts.each {|account| - @cloud_accounts << account unless @pool.cloud_accounts.map{|x| x.id}.include?(account.id) - } - end - - def add_account - @pool = Pool.find(params[:pool]) - @cloud_account = CloudAccount.find(params[:cloud_account]) - require_privilege(Privilege::ACCOUNT_ADD,@pool) - require_privilege(Privilege::ACCOUNT_ADD,@cloud_account) - Pool.transaction do - @pool.cloud_accounts << @cloud_account unless @pool.cloud_accounts.map{|x| x.id}.include?((a)cloud_account.id) - @pool.save! - @pool.populate_realms([@cloud_account]) - end - redirect_to :action => 'show', :id => @pool.id - end kick_condor end diff --git a/src/app/controllers/providers_controller.rb b/src/app/controllers/providers_controller.rb index 0754d65..0104f95 100644 --- a/src/app/controllers/providers_controller.rb +++ b/src/app/controllers/providers_controller.rb @@ -32,25 +32,25 @@ class ProvidersController < ApplicationController def show @provider = Provider.find(:first, :conditions => {:id => params[:id]}) - require_privilege(Privilege::PROVIDER_VIEW, @provider) + require_privilege(Privilege::ACTION_VIEW, @provider) end def edit - @providers = Provider.list_for_user(@current_user, Privilege::PROVIDER_MODIFY) + @providers = Provider.list_for_user(@current_user, Privilege::ACTION_VIEW) @provider = Provider.find(:first, :conditions => {:id => params[:id]}) - require_privilege(Privilege::PROVIDER_MODIFY, @provider) + require_privilege(Privilege::ACTION_MODIFY, @provider) end def new - require_privilege(Privilege::PROVIDER_MODIFY) - @providers = Provider.list_for_user(@current_user, Privilege::PROVIDER_MODIFY) + require_privilege(Privilege::ACTION_CREATE, Provider) + @providers = Provider.list_for_user(@current_user, Privilege::ACTION_MODIFY) @provider = Provider.new(params[:provider]) kick_condor end def create - require_privilege(Privilege::PROVIDER_MODIFY) - @providers = Provider.list_for_user(@current_user, Privilege::PROVIDER_MODIFY) + require_privilege(Privilege::ACTION_CREATE, Provider) + @providers = Provider.list_for_user(@current_user, Privilege::ACTION_MODIFY) @provider = Provider.new(params[:provider]) if params[:test_connection] @@ -70,9 +70,9 @@ class ProvidersController < ApplicationController end def update - require_privilege(Privilege::PROVIDER_MODIFY) - @providers = Provider.list_for_user(@current_user, Privilege::PROVIDER_MODIFY) + @providers = Provider.list_for_user(@current_user, Privilege::ACTION_MODIFY) @provider = Provider.find(:first, :conditions => {:id => params[:id]}) + require_privilege(Privilege::ACTION_MODIFY, @provider) previous_cloud_type = @provider.cloud_type @provider.update_attributes(params[:provider]) @@ -99,7 +99,7 @@ class ProvidersController < ApplicationController def destroy if request.post? || request.delete? @provider = Provider.find(params[:id]) - require_privilege(Privilege::PROVIDER_MODIFY, @provider) + require_privilege(Privilege::ACTION_MODIFY, @provider) if @provider.destroy and @provider.destroyed? redirect_to :action => "index" flash[:notice] = "Provider Deleted" @@ -117,17 +117,18 @@ class ProvidersController < ApplicationController def hardware_profiles @provider = Provider.find(params[:id]) @hardware_profiles = @provider.hardware_profiles - require_privilege(Privilege::PROVIDER_VIEW, @provider) + require_privilege(Privilege::ACTION_VIEW, @provider) end def realms @provider = Provider.find(params[:id]) @realm_names = @provider.realms.collect { |r| r.name } - require_privilege(Privilege::PROVIDER_VIEW, @provider) + require_privilege(Privilege::ACTION_VIEW, @provider) end def settings @provider = Provider.find(params[:id]) + require_privilege(Privilege::ACTION_VIEW, @provider) end def list @@ -145,6 +146,6 @@ class ProvidersController < ApplicationController protected def load_providers - @providers = Provider.list_for_user(@current_user, Privilege::PROVIDER_VIEW) + @providers = Provider.list_for_user(@current_user, Privilege::ACTION_VIEW) end end diff --git a/src/app/controllers/quotas_controller.rb b/src/app/controllers/quotas_controller.rb index e9937fb..df9bb41 100644 --- a/src/app/controllers/quotas_controller.rb +++ b/src/app/controllers/quotas_controller.rb @@ -28,7 +28,7 @@ class QuotasController < ApplicationController @parent_type = params[:parent_type] @quota = @parent.quota - require_privilege(Privilege::QUOTA_VIEW, @parent) + require_privilege(Privilege::ACTION_VIEW, Quota, @parent) end def edit @@ -38,13 +38,13 @@ class QuotasController < ApplicationController @quota = @parent.quota - require_privilege(Privilege::QUOTA_MODIFY, @parent) + require_privilege(Privilege::ACTION_MODIFY, Quota, @parent) end def update @parent = @parent = get_parent_object(params) @parent_type = params[:parent_type] - require_privilege(Privilege::QUOTA_MODIFY, @parent) + require_privilege(Privilege::ACTION_MODIFY, Quota, @parent) @quota = @parent.quota @name = get_parent_name(@parent, @parent_type) @@ -60,7 +60,7 @@ class QuotasController < ApplicationController def reset @parent = @parent = get_parent_object(params) @parent_type = params[:parent_type] - require_privilege(Privilege::QUOTA_MODIFY, @parent) + require_privilege(Privilege::ACTION_MODIFY, Quota, @parent) @quota = @parent.quota @quota.maximum_running_instances = Quota::NO_LIMIT diff --git a/src/app/controllers/resources/instances_controller.rb b/src/app/controllers/resources/instances_controller.rb index 3bd0c45..241dbba 100644 --- a/src/app/controllers/resources/instances_controller.rb +++ b/src/app/controllers/resources/instances_controller.rb @@ -5,7 +5,7 @@ class Resources::InstancesController < ApplicationController def new @instance = Instance.new(params[:instance]) - #require_privilege(Privilege::INSTANCE_MODIFY, @instance.pool) if @instance.pool + #require_privilege(Privilege::ACTION_CREATE, Instance, @instance.pool) if @instance.pool unless @instance.template redirect_to select_template_resources_instances_path @@ -36,7 +36,7 @@ class Resources::InstancesController < ApplicationController @instance.owner = current_user begin - require_privilege(Privilege::INSTANCE_MODIFY, + require_privilege(Privilege::ACTION_CREATE, Instance, Pool.find((a)instance.pool_id)) free_quota = Quota.can_start_instance?(@instance, nil) @instance.transaction do @@ -120,11 +120,11 @@ class Resources::InstancesController < ApplicationController def load_instance @instance = Instance.find((params[:id] || []).first) - require_privilege(Privilege::INSTANCE_CONTROL,@instance.pool) + require_privilege(Privilege::ACTION_USE,@instance) end def init_new_instance_attrs - @pools = Pool.list_for_user(@current_user, Privilege::INSTANCE_MODIFY) + @pools = Pool.list_for_user(@current_user, Privilege::ACTION_MODIFY, :target_type => Instance) @realms = Realm.find(:all, :conditions => { :provider_id => nil }) @hardware_profiles = HardwareProfile.all( :include => :architecture, @@ -145,7 +145,7 @@ class Resources::InstancesController < ApplicationController {:name => 'CREATED BY', :sort_attr => 'users.last_name'}, ] - pools = Pool.list_for_user(@current_user, Privilege::INSTANCE_MODIFY) + pools = Pool.list_for_user(@current_user, Privilege::ACTION_MODIFY, :target_type => Instance) @instances = Instance.all( :include => [:template, :owner], :conditions => {:pool_id => pools}, diff --git a/src/app/controllers/resources/pools_controller.rb b/src/app/controllers/resources/pools_controller.rb index ffd1f55..3205da9 100644 --- a/src/app/controllers/resources/pools_controller.rb +++ b/src/app/controllers/resources/pools_controller.rb @@ -18,6 +18,7 @@ class Resources::PoolsController < ApplicationController def show @pool = Pool.find(params[:id]) + require_privilege(Privilege::ACTION_VIEW, @pool) @url_params = params.clone @tab_captions = ['Properties', 'Deployments', 'Instances', 'History', 'Permissions'] @details_tab = params[:details_tab].blank? ? 'properties' : params[:details_tab] @@ -33,12 +34,12 @@ class Resources::PoolsController < ApplicationController end def new - require_privilege(Privilege::POOL_MODIFY) + require_privilege(Privilege::ACTION_CREATE, Pool) @pool = Pool.new end def create - require_privilege(Privilege::POOL_MODIFY) + require_privilege(Privilege::ACTION_CREATE, Pool) @pool = Pool.new(params[:pool]) quota = Quota.new @@ -55,15 +56,13 @@ class Resources::PoolsController < ApplicationController end def edit - require_privilege(Privilege::POOL_MODIFY) - @pool = Pool.find(params[:id]) + require_privilege(Privilege::ACTION_MODIFY, @pool) end def update - require_privilege(Privilege::POOL_MODIFY) - @pool = Pool.find(params[:id]) + require_privilege(Privilege::ACTION_MODIFY, @pool) if @pool.update_attributes(params[:pool]) flash[:notice] = "Pool updated." redirect_to :action => 'show', :id => @pool.id @@ -73,7 +72,9 @@ class Resources::PoolsController < ApplicationController end def multi_destroy - Pool.destroy(params[:pools_selected]) + Pool.find(params[:pools_selected]).each do |pool| + pool.destroy if check_privilege(Privilege::ACTION_MODIFY, pool) + end redirect_to resources_pools_url end diff --git a/src/app/controllers/settings_controller.rb b/src/app/controllers/settings_controller.rb index ae20e12..0166e71 100644 --- a/src/app/controllers/settings_controller.rb +++ b/src/app/controllers/settings_controller.rb @@ -31,22 +31,16 @@ class SettingsController < ApplicationController end def index - @providers = Provider.list_for_user(@current_user, Privilege::PROVIDER_VIEW) + @providers = Provider.list_for_user(@current_user, Privilege::ACTION_VIEW) end def self_service - if !is_admin? - raise PermissionError.new('You have insufficient privileges to perform action.') - return - end + require_privilege(Privilege::ACTION_MODIFY) @self_service_default_quota = MetadataObject.lookup(SELF_SERVICE_DEFAULT_QUOTA) end def general_settings - if !is_admin? - raise PermissionError.new('You have insufficient privileges to perform action.') - return - end + require_privilege(Privilege::ACTION_MODIFY) end def update @@ -76,9 +70,4 @@ class SettingsController < ApplicationController redirect_to :action => 'self_service' end - private - def is_admin? - is_admin = @current_user.permissions.collect { |p| p.role }.find { |r| r.name == "Administrator" } - return is_admin == nil ? false : true - end end diff --git a/src/app/controllers/templates_controller.rb b/src/app/controllers/templates_controller.rb index 403e6c3..e19c8e6 100644 --- a/src/app/controllers/templates_controller.rb +++ b/src/app/controllers/templates_controller.rb @@ -2,7 +2,6 @@ require 'util/repository_manager' class TemplatesController < ApplicationController before_filter :require_user - before_filter :check_permission, :except => :index layout :layout def layout @@ -14,13 +13,10 @@ class TemplatesController < ApplicationController end def index - # TODO: add template permission check - require_privilege(Privilege::IMAGE_VIEW) - @templates = Template.find( - :all, - :include => :images, - :order => get_order('name') - ) + @templates = Template.list_for_user(current_user, + Privilege::ACTION_VIEW, + :include => :images, + :order => get_order('name')) end def index_action @@ -81,6 +77,7 @@ class TemplatesController < ApplicationController end def new + check_create_permission # can't use @template variable - is used by compass (or something other) @tpl = Template.new(params[:tpl]) @repository_manager = RepositoryManager.new(:repositories => params[:repository] || @tpl.platform) @@ -91,12 +88,14 @@ class TemplatesController < ApplicationController def edit @tpl = Template.find(params[:id]) + check_edit_permission @tpl.attributes = params[:tpl] unless params[:tpl].blank? @repository_manager = RepositoryManager.new(:repositories => params[:repository] || @tpl.platform) render :action => :edit end def create + check_create_permission @tpl = Template.new(params[:tpl]) @tpl.packages = params[:packages] if @tpl.save @@ -112,6 +111,7 @@ class TemplatesController < ApplicationController def update @tpl = Template.find(params[:id]) @tpl.packages = [] + check_edit_permission if @tpl.update_attributes(params[:tpl]) @tpl.set_complete @@ -163,7 +163,13 @@ class TemplatesController < ApplicationController end def managed_content - @tpl = params[:template_id].blank? ? Template.new : Template.find(params[:template_id]) + if params[:template_id].blank? + @tpl = Template.new + check_create_permission + else + @tpl = Template.find(params[:template_id]) + check_edit_permission + end @tpl.add_software(params[:packages].to_a + params[:selected_packages].to_a, params[:groups].to_a + params[:selected_groups].to_a) render :layout => false @@ -176,9 +182,11 @@ class TemplatesController < ApplicationController else errs = {} Template.find(ids).each do |t| - t.destroy - unless t.destroyed? - errs[t.name] = t.errors.full_messages.join(". ") + if check_permission(Privilege::ACTION_MODIFY, t) + t.destroy + errs[t.name] = t.errors.full_messages.join(". ") unless t.destroyed? + else + errs[t.name] = "You don't have permission to delete #{t.name}" end end if errs.empty? @@ -191,16 +199,24 @@ class TemplatesController < ApplicationController end def assembly + # FIXME: do we need perm check here? end def deployment_definition + # FIXME: do we need perm check here? @all_targets = Image.available_targets end private def set_package_vars(set_all = false) - @tpl = params[:id].blank? ? Template.new : Template.find(params[:id]) + if params[:id].blank? + @tpl = Template.new + check_create_permission + else + @tpl = Template.find(params[:id]) + check_edit_permission + end @tpl.attributes = params[:tpl] unless params[:tpl].nil? @repository_manager = RepositoryManager.new(:repositories => params[:repository] || @tpl.platform) @groups = @repository_manager.groups @@ -222,8 +238,12 @@ class TemplatesController < ApplicationController flash.now[:error][:failures].merge!(errs) end - def check_permission - require_privilege(Privilege::IMAGE_MODIFY) + def check_create_permission + require_privilege(Privilege::ACTION_CREATE, Template) + end + + def check_edit_permission + require_privilege(Privilege::ACTION_MODIFY, @tpl) end def get_selected_id diff --git a/src/app/controllers/users_controller.rb b/src/app/controllers/users_controller.rb index 0e3220f..b462893 100644 --- a/src/app/controllers/users_controller.rb +++ b/src/app/controllers/users_controller.rb @@ -24,12 +24,13 @@ class UsersController < ApplicationController before_filter :current_user def new + require_privilege(Privilege::ACTION_CREATE, User) unless current_user.nil? @user = User.new @user.quota = Quota.new end def create - require_privilege(Privilege::USER_MODIFY) unless current_user.nil? + require_privilege(Privilege::ACTION_CREATE, User) unless current_user.nil? @user = User.new(params[:user]) if params[:commit] == "Reset" @@ -58,39 +59,26 @@ class UsersController < ApplicationController else @user = current_user end + require_privilege(Privilege::ACTION_VIEW, User) unless current_user == @user @quota_resources = @user.quota.quota_resources() end def edit - @user = params[:id] ? User.find(params[:id]) : @current_user - - if @user - if @user != @current_user - if !BasePermissionObject.general_permission_scope.can_modify_users(@current_user) - flash[:notice] = "Invalid Permission to perform this operation" - redirect_to users_path - end - end - end + @user = params[:id] ? User.find(params[:id]) : current_user + require_privilege(Privilege::ACTION_MODIFY, User) unless current_user == @user end def update @user = params[:user][:id] ? User.find(params[:user][:id]) : @current_user + require_privilege(Privilege::ACTION_MODIFY, User) unless current_user == @user if params[:commit] == "Save" if @user - has_users_modify = BasePermissionObject.general_permission_scope.can_modify_users(@current_user) - if @user != @current_user - if !has_users_modify - flash[:notice] = "Invalid Permission to perform this operation" - redirect_to :dashboard - end - end if @user.update_attributes(params[:user]) flash[:notice] = "User updated!" - if has_users_modify - redirect_to users_path - else + if @user == current_user redirect_to :dashboard + else + redirect_to users_path end else render :action => :edit @@ -102,21 +90,17 @@ class UsersController < ApplicationController end def index - if @current_user.permissions.collect { |p| p.role }.find { |r| r.name == "Administrator" } + require_privilege(Privilege::ACTION_VIEW, User) + @users = User.all + sort_order = params[:sort_by].nil? ? "login" : params[:sort_by] + if sort_order == "percentage_quota_used" @users = User.all - sort_order = params[:sort_by].nil? ? "login" : params[:sort_by] - if sort_order == "percentage_quota_used" - @users = User.all - @users.sort! {|x,y| y.quota.percentage_used <=> x.quota.percentage_used } - elsif sort_order == "quota" - @users = User.all - @users.sort! {|x,y| (x.quota.maximum_running_instances and y.quota.maximum_running_instances) ? x.quota.maximum_running_instances <=> y.quota.maximum_running_instances : (x ? 1 : -1) } - else - @users = User.find(:all, :order => sort_order) - end + @users.sort! {|x,y| y.quota.percentage_used <=> x.quota.percentage_used } + elsif sort_order == "quota" + @users = User.all + @users.sort! {|x,y| (x.quota.maximum_running_instances and y.quota.maximum_running_instances) ? x.quota.maximum_running_instances <=> y.quota.maximum_running_instances : (x ? 1 : -1) } else - flash[:notice] = "Invalid Permission to perform this operation" - redirect_to :dashboard + @users = User.find(:all, :order => sort_order) end end @@ -138,22 +122,19 @@ class UsersController < ApplicationController end def destroy - if @current_user.permissions.collect { |p| p.role }.find { |r| r.name == "Administrator" } - if request.post? || request.delete? - @user = User.find(params[:id]) - if @user == @current_user - flash[:notice] = "Can not delete the currently logged in user!" - elsif @user.destroy - flash[:notice] = "User Deleted" - else - flash[:error] = { - :summary => "Failed to delete User", - :failures => @user.errors.full_messages, - } - end + require_privilege(Privilege::ACTION_MODIFY, User) + if request.post? || request.delete? + @user = User.find(params[:id]) + if @user == @current_user + flash[:notice] = "Can not delete the currently logged in user!" + elsif @user.destroy + flash[:notice] = "User Deleted" + else + flash[:error] = { + :summary => "Failed to delete User", + :failures => @user.errors.full_messages, + } end - else - flash[:notice] = "Invalid Permission to perform this operation" end redirect_to users_path end diff --git a/src/app/models/cloud_account.rb b/src/app/models/cloud_account.rb index e4fe6c6..ee07b8d 100644 --- a/src/app/models/cloud_account.rb +++ b/src/app/models/cloud_account.rb @@ -66,6 +66,27 @@ class CloudAccount < ActiveRecord::Base before_destroy :destroyable? before_validation :read_x509_files + def object_list + super << provider + end + class << self + alias orig_list_for_user_include list_for_user_include + alias orig_list_for_user_conditions list_for_user_conditions + end + + def self.list_for_user_include + includes = orig_list_for_user_include + includes << { :provider => {:permissions => {:role => :privileges}}} + includes + end + + def self.list_for_user_conditions + "(#{orig_list_for_user_conditions}) or + (permissions_providers.user_id=:user and + privileges_roles.target_type=:target_type and + privileges_roles.action=:action)" + end + def destroyable? instances.empty? end diff --git a/src/app/models/instance.rb b/src/app/models/instance.rb index 8573c5a..5aa500d 100644 --- a/src/app/models/instance.rb +++ b/src/app/models/instance.rb @@ -36,6 +36,10 @@ class Instance < ActiveRecord::Base belongs_to :instance_key belongs_to :instance_hwp + has_many :permissions, :as => :permission_object, :dependent => :destroy, + :include => [:role], + :order => "permissions.id ASC" + validates_presence_of :pool_id validates_presence_of :hardware_profile_id validates_presence_of :template_id @@ -66,6 +70,27 @@ class Instance < ActiveRecord::Base validates_inclusion_of :state, :in => STATES + def object_list + super << pool + end + class << self + alias orig_list_for_user_include list_for_user_include + alias orig_list_for_user_conditions list_for_user_conditions + end + + def self.list_for_user_include + includes = orig_list_for_user_include + includes << { :pool => {:permissions => {:role => :privileges}}} + includes + end + + def self.list_for_user_conditions + "(#{orig_list_for_user_conditions}) or + (permissions_pools.user_id=:user and + privileges_roles.target_type=:target_type and + privileges_roles.action=:action)" + end + def get_action_list(user=nil) # return empty list rather than nil # FIXME: not handling pending state now -- only current state @@ -142,7 +167,7 @@ class Instance < ActiveRecord::Base } instances = [] - pools = Pool.list_for_user(user, Privilege::INSTANCE_VIEW) + pools = Pool.list_for_user(user, Privilege::ACTION_VIEW, Instance) pools.each{|pool| pool.instances.each {|i| instances << i}} instances.each do |i| if i.state == Instance::STATE_RUNNING diff --git a/src/app/models/permission.rb b/src/app/models/permission.rb index 349b6a7..22b228a 100644 --- a/src/app/models/permission.rb +++ b/src/app/models/permission.rb @@ -29,12 +29,18 @@ class Permission < ActiveRecord::Base belongs_to :permission_object, :polymorphic => true # type-specific associations + belongs_to :pool_family, :class_name => "PoolFamily", + :foreign_key => "permission_object_id" belongs_to :pool, :class_name => "Pool", :foreign_key => "permission_object_id" + belongs_to :instance, :class_name => "Instance", + :foreign_key => "permission_object_id" belongs_to :provider, :class_name => "Provider", :foreign_key => "permission_object_id" belongs_to :cloud_account, :class_name => "CloudAccount", :foreign_key => "permission_object_id" + belongs_to :template, :class_name => "Template", + :foreign_key => "permission_object_id" belongs_to :base_permission_object, :class_name => "BasePermissionObject", :foreign_key => "permission_object_id" diff --git a/src/app/models/permissioned_object.rb b/src/app/models/permissioned_object.rb index 24aebe0..34efec8 100644 --- a/src/app/models/permissioned_object.rb +++ b/src/app/models/permissioned_object.rb @@ -17,91 +17,77 @@ # MA 02110-1301, USA. A copy of the GNU General Public License is # also available at http://www.gnu.org/copyleft/gpl.html. module PermissionedObject - def can_view_perms(user) - has_privilege(user, Privilege::PERM_VIEW) - end - def can_set_perms(user) - has_privilege(user, Privilege::PERM_SET) - end - - def can_view_instances(user) - has_privilege(user, Privilege::INSTANCE_VIEW) - end - def can_modify_instances(user) - has_privilege(user, Privilege::INSTANCE_MODIFY) - end - def can_control_instances(user) - has_privilege(user, Privilege::INSTANCE_CONTROL) - end - - def can_view_stats(user) - has_privilege(user, Privilege::STATS_VIEW) - end - - def can_view_accounts(user) - has_privilege(user, Privilege::ACCOUNT_VIEW) - end - def can_modify_accounts(user) - has_privilege(user, Privilege::ACCOUNT_MODIFY) - end - - def can_view_pools(user) - has_privilege(user, Privilege::POOL_VIEW) - end - def can_modify_pools(user) - has_privilege(user, Privilege::POOL_MODIFY) - end - def can_view_quotas(user) - has_privilege(user, Privilege::QUOTA_VIEW) - end - def can_modify_quotas(user) - has_privilege(user, Privilege::QUOTA_MODIFY) - end - - def can_view_providers(user) - has_privilege(user, Privilege::PROVIDER_VIEW) - end - def can_modify_providers(user) - has_privilege(user, Privilege::PROVIDER_MODIFY) - end - - def can_view_users(user) - has_privilege(user, Privilege::USER_VIEW) - end - def can_modify_users(user) - has_privilege(user, Privilege::USER_MODIFY) - end - - def can_view_images(user) - has_privilege(user, Privilege::IMAGE_VIEW) - end - def can_modify_images(user) - has_privilege(user, Privilege::IMAGE_MODIFY) + def has_privilege(user, action, target_type=nil) + return false if user.nil? or action.nil? + target_type = self.class.default_privilege_target_type if target_type.nil? + object_list.each do |obj| + return true if obj.permissions.find(:first, + :include => [:role => :privileges], + :conditions => + ["permissions.user_id=:user and + privileges.target_type=:target_type and + privileges.action=:action", + { :user => user.id, + :target_type => target_type.name, + :action => action}]) + end + return false end - def has_privilege(user, privilege) - return false if user.nil? - permissions.find(:first, :include => [:role => :privileges], - :conditions => ["permissions.user_id=:user and - privileges.name=:priv", - { :user => user.id, - :priv => privilege }]) + # Returns the list of objects to check for permissions on -- by default + # this object plus the Base permission object + def object_list + [self, BasePermissionObject.general_permission_scope] end # Any methods here will be able to use the context of the # ActiveRecord model the module is included in. def self.included(base) base.class_eval do - def self.list_for_user(user, privilege) - if BasePermissionObject.general_permission_scope.has_privilege(user, privilege) - all + def self.default_privilege_target_type + self.name.constantize + end + def self.list_for_user_include + [{:permissions => {:role => :privileges}}] + end + def self.list_for_user_conditions + "permissions.user_id=:user and + privileges.target_type=:target_type and + privileges.action=:action" + end + # :conditions in hash must match form ["foo=:param and ...", {:param => value}] + def self.list_for_user(user, action, find_hash={}) + target_type = find_hash.fetch(:target_type, self.default_privilege_target_type) + query_include = find_hash[:include] + query_order = find_hash[:order] + query_conditions = find_hash[:conditions] + return [] if user.nil? or action.nil? or target_type.nil? + if BasePermissionObject.general_permission_scope.has_privilege(user, + action, + target_type) + find(:all, :include => query_include, + :order => query_order, + :conditions => query_conditions) else - find(:all, :include => {:permissions => {:role => :privileges}}, - :conditions => ["permissions.user_id=:user and - privileges.name=:priv", - {:user => user.id, - :priv => privilege }]) + include_clause = self.list_for_user_include + if query_include.is_a?(Array) + include_clause += query_include + elsif !query_include.nil? + include_clause << query_include + end + conditions_hash = {:user => user.id, + :target_type => target_type.name, + :action => action} + if query_conditions.nil? + conditions_str = self.list_for_user_conditions + else + conditions_str = "(#{self.list_for_user_include}) and (#{query_conditions[0]})" + conditions_hash.merge!(query_conditions[1]) { |key, h1, h2| h1 } + end + find(:all, :include => include_clause, + :conditions => [conditions_str, conditions_hash], + :order => query_order) end end end diff --git a/src/app/models/privilege.rb b/src/app/models/privilege.rb index 552beef..6456d66 100644 --- a/src/app/models/privilege.rb +++ b/src/app/models/privilege.rb @@ -18,66 +18,122 @@ # also available at http://www.gnu.org/copyleft/gpl.html. class Privilege < ActiveRecord::Base - has_and_belongs_to_many :roles - validates_presence_of :name - validates_uniqueness_of :name + ACTION_PERM_SET = "set_perms" # can create/modify/delete permission + # records on this object + ACTION_PERM_VIEW = "view_perms" # can view permission records on this + # object + ACTION_CREATE = "create" # can create objects of this type here + ACTION_MODIFY = "modify" # can modify objects of this type here + ACTION_VIEW = "view" # can view objects of this type here + ACTION_USE = "use" # can use objects of this type here + # the meaning of 'use' is type-specific: + # Template: add this template to an assembly + # Assembly: add this assembly to a deployable + # Deployable: choose this deployable to launch + # Instance: may perform actions on this instance + # Realm: may map this realm + # CloudAccount: May add this account to PoolFamily - #default privileges - PERM_SET = "set_perms" # can create/modify/delete permission - # records on this object - PERM_VIEW = "view_perms" # can view permission records on this - # object - # instance privileges normally checked at the pool level, although - # instance-specific overrides could be a future enhancement. - INSTANCE_MODIFY = "instance_modify" # can create, modify, delete, or - # control (start, stop, etc) instances - INSTANCE_CONTROL = "instance_control" # can control (start, stop, etc) - # instances - INSTANCE_VIEW = "instance_view" # can view instance metadata - # do we need a separate "connect" privilege? + ACTIONS = [ ACTION_CREATE, ACTION_MODIFY, ACTION_USE, ACTION_VIEW, + ACTION_PERM_SET, ACTION_PERM_VIEW] + TYPES = { BasePermissionObject => [ACTION_MODIFY, ACTION_PERM_SET, ACTION_PERM_VIEW], + Template => ACTIONS, + Pool => ACTIONS - [ACTION_USE], + PoolFamily => ACTIONS - [ACTION_USE], + Instance => ACTIONS, + Quota => [ACTION_VIEW, ACTION_MODIFY], + HardwareProfile => ACTIONS - [ACTION_USE, ACTION_VIEW], + Realm => ACTIONS - [ACTION_VIEW], + Provider => ACTIONS - [ACTION_USE], + CloudAccount => ACTIONS, + User => [ ACTION_CREATE, ACTION_MODIFY, ACTION_VIEW] } - # stats privileges normally checked at the pool level, although - # instance-specific overrides could be a future enhancement. - STATS_VIEW = "stats_view" # can view monitoring data for - # instances + belongs_to :role + validates_presence_of :role_id + validates_presence_of :target_type + validates_presence_of :action + validates_uniqueness_of :action, :scope => [:target_type, :role_id] - # to create(i.e. import) an account on a provider needs ACCOUNT_MODIFY on the - # provider. - ACCOUNT_MODIFY = "account_modify" # can create or modify cloud accounts - ACCOUNT_VIEW = "account_view" # can view cloud accounts + # notes on available privilege action/type pairs. Format is: + # Type Scope + # Action Notes (action defined on scope above unless specified) + # + # BasePermissionObject the base perm object + # modify Can modify system settings, etc. + # view_perms Can view permissions + # set_perms Can set permissions + # + # Template This template/assembly/deployable or all T/A/D in this TADCollection + # view Can view + # use Can assign T/A/D to TAD collection; + # (if template) can add to assembly or can use to launch instance + # (if assembly) can add to deployable + # (if deployable) can use to launch deployment + # (if TAD Collection) not used + # modify Can modify + # create Can create (on BasePermissionObject) + # view_perms Can view permissions + # set_perms Can set permissions + # + # Pool This pool + # view Can view + # modify Can modify + # create Can create (on BasePermissionObject) + # view_perms Can view permissions + # set_perms Can set permissions + # + # PoolFamily This PoolFamily + # view Can view + # modify Can modify + # create Can create (on BasePermissionObject) + # view_perms Can view permissions + # set_perms Can set permissions + # + # Instance This Instance or instances within this Pool + # view Can view + # use Can perform lifecycle actions on and/or view console + # modify Can modify + # create Can create (within this Pool) + # view_perms Can view permissions + # set_perms Can set permissions (or can set instance permissions on this pool) + # + # Quota The Pool/CloudAccount/PoolFamily/User assigned the quota + # view Can view quota on this obj + # modify Can edit quota on this obj + # + # HardwareProfile This HardwareProfile + # modify (for Aeolus HWPs) Can modify + # create Can create (on BasePermissionObject) + # view_perms Can view permissions + # set_perms Can set permissions + # + # Realm This Realm (or realms within this provider) + # use (for provider Realm) can map realm or provider to aeolus realm + # modify (for Aeolus realms) Can modify + # create Can create (within this Pool) + # view_perms Can view permissions + # set_perms Can set permissions + # + # Provider This Provider + # view Can view + # modify Can modify + # create Can create (on BasePermissionObject) + # view_perms Can view permissions + # set_perms Can set permissions + # + # CloudAccount This CloudAccount + # view Can view + # use Can map to PoolFamily + # modify Can modify + # create Can create (within this Provider) + # view_perms Can view permissions + # set_perms Can set permissions + # + # User This User (set on BasePermissionObject) + # view Can view + # modify Can modify + # create Can create - POOL_MODIFY = "pool_modify" # can create or modify a pool - POOL_VIEW = "pool_view" # can view a pool - - # quota privileges normally checked at the pool or account level, - # depending on which quota level we're dealing with - QUOTA_MODIFY = "quota_modify" # can create or modify a quota - QUOTA_VIEW = "quota_view" # can view a quota - - # provider privileges normally checked at the provider level, although - # 'new provider' action requires this privilege at the SystemPermission level - PROVIDER_MODIFY = "provider_modify" # can create or modify a provider - PROVIDER_VIEW = "provider_view" # can view a provider - - # normally checked at the SystemPermission level - USER_MODIFY = "user_modify" # can create a new user (other than - # self-registration) or modify another - # user's metadata (for admin-level - # actions) - USER_VIEW = "user_view" # can view a user's profile data - - IMAGE_VIEW = "image_view" # can view existing images (templates) - IMAGE_MODIFY = "image_modify" # can create or modify images (templates) - - FULL_PRIVILEGE_LIST = [PERM_SET, PERM_VIEW, - INSTANCE_MODIFY, INSTANCE_CONTROL, INSTANCE_VIEW, - STATS_VIEW, - ACCOUNT_MODIFY, ACCOUNT_VIEW, - POOL_MODIFY, POOL_VIEW, - QUOTA_MODIFY, QUOTA_VIEW, - PROVIDER_MODIFY, PROVIDER_VIEW, - USER_MODIFY, USER_VIEW, - IMAGE_VIEW, IMAGE_MODIFY] end diff --git a/src/app/models/role.rb b/src/app/models/role.rb index db4a9ac..300dad8 100644 --- a/src/app/models/role.rb +++ b/src/app/models/role.rb @@ -18,10 +18,13 @@ # also available at http://www.gnu.org/copyleft/gpl.html. class Role < ActiveRecord::Base - has_many :permissions - has_and_belongs_to_many :privileges, :uniq => true + has_many :permissions, :dependent => :destroy + has_many :privileges, :dependent => :destroy + validates_presence_of :scope validates_presence_of :name validates_uniqueness_of :name + validates_associated :privileges + end diff --git a/src/app/models/template.rb b/src/app/models/template.rb index d545f9b..bff586d 100644 --- a/src/app/models/template.rb +++ b/src/app/models/template.rb @@ -2,12 +2,17 @@ require 'util/image_descriptor_xml' require 'typhoeus' class Template < ActiveRecord::Base + include PermissionedObject has_many :images, :dependent => :destroy has_many :instances before_validation :generate_uuid before_save :update_xml before_destroy :no_instances? + has_many :permissions, :as => :permission_object, :dependent => :destroy, + :include => [:role], + :order => "permissions.id ASC" + WAREHOUSE_CONFIG = YAML.load_file("#{RAILS_ROOT}/config/image_warehouse.yml") validates_presence_of :uuid diff --git a/src/app/services/application_service.rb b/src/app/services/application_service.rb index 8161718..079c200 100644 --- a/src/app/services/application_service.rb +++ b/src/app/services/application_service.rb @@ -40,19 +40,34 @@ module ApplicationService # @current_user must be defined - def check_privilege(privilege, perm_obj) - ((perm_obj and perm_obj.has_privilege(current_user, privilege)) or - BasePermissionObject.general_permission_scope.has_privilege(current_user, - privilege)) + def check_privilege(action, *type_and_perm_obj) + target_type = nil + perm_obj = nil + type_and_perm_obj.each do |obj| + target_type=obj if obj.class==Class + perm_obj=obj if obj.is_a?(ActiveRecord::Base) + end + perm_obj=@perm_obj if perm_obj.nil? + perm_obj=BasePermissionObject.general_permission_scope if perm_obj.nil? + perm_obj.has_privilege(current_user, action, target_type) end - def authorized?(privilege, perm_obj=nil) + # Require a given privilege level to view this page + # 1. action is always required -- what action is being done (from Privilege::ACTIONS) + # 2. perm_obj is optional -- This is the resource on which to look for permission + # records. If omitted, check for site-wide permissions on BasePermissionObject + # 3. type is also optional -- if omitted it's taken from perm_obj. + # For example, if action is 'view', perm_obj is a Pool and type is omitted, + # then check for current user's "view pool" permission on this pool. + # if action is 'view', perm_obj is a Pool and type is Quota, + # then check for current user's "view quota" permission on this pool. + def require_privilege(action, *type_and_perm_obj) + perm_obj = nil + type_and_perm_obj.each do |obj| + perm_obj=obj if obj.is_a?(ActiveRecord::Base) + end @perm_obj = perm_obj - check_privilege(privilege,@perm_obj) - end - - def require_privilege(privilege, perm_obj=nil) - unless authorized?(privilege, perm_obj) + unless check_privilege(action, *type_and_perm_obj) raise PermissionError.new( 'You have insufficient privileges to perform action.') end diff --git a/src/app/views/admin/users/_form.haml b/src/app/views/admin/users/_form.haml index 3fdf33f..2d0945e 100644 --- a/src/app/views/admin/users/_form.haml +++ b/src/app/views/admin/users/_form.haml @@ -8,7 +8,7 @@ %fieldset = form.label :password_confirmation, t(:confirm_password), :class => "grid_3 alpha" = form.password_field :password_confirmation, :class => "grid_5" --if has_user_modify? +-if check_privilege(Privilege::ACTION_MODIFY, User) %fieldset.clear = form.label :user_status, "User Status:", :class => "alpha grid_3" .grid_5 @@ -25,7 +25,7 @@ %fieldset.clear = form.label :email, t(:email), :class => "alpha grid_3" = form.text_field :email, :class => "grid_5" --if has_user_modify? +-if check_privilege(Privilege::ACTION_MODIFY, User) %h3.grid_16 User Treatment %fieldset.clearfix = label_tag 'apply_treatment', t(:apply_treatment), :class => "alpha grid_3" diff --git a/src/app/views/admin/users/edit.haml b/src/app/views/admin/users/edit.haml index a367fec..69319e9 100644 --- a/src/app/views/admin/users/edit.haml +++ b/src/app/views/admin/users/edit.haml @@ -1,4 +1,4 @@ -- if has_user_modify? +- if check_privilege(Privilege::ACTION_MODIFY, User) %h2 Editing User: #{(a)user.first_name} #{(a)user.last_name} - else %h2 Editing Account diff --git a/src/app/views/dashboard/summary.haml b/src/app/views/dashboard/summary.haml index e6ba2dd..2f8600e 100644 --- a/src/app/views/dashboard/summary.haml +++ b/src/app/views/dashboard/summary.haml @@ -30,24 +30,24 @@ #actions_dashboard_section %h2 Actions - - if @is_admin + - if check_privilege(Privilege::ACTION_CREATE, Provider) %a{:href => url_for(:controller => "providers", :action => "new")} Add a Provider + - if check_privilege(Privilege::ACTION_CREATE, User) %a{:href => url_for(:controller => "users", :action => "new")} Create a User - %a{:href => url_for(:controller => "instances", :action => "index")} - View Instances - - else - %a{:href => url_for(:controller => "", :action => "")} - Launch Instances - %a{:href => url_for(:controller => "", :action => "")} - Enter a help ticket - - if BasePermissionObject.general_permission_scope.can_modify_images(@current_user) + %a{:href => url_for(:controller => "instances", :action => "index")} + View Instances + %a{:href => url_for(:controller => "", :action => "")} + Launch Instances + %a{:href => url_for(:controller => "", :action => "")} + Enter a help ticket + - if check_privilege(Privilege::ACTION_CREATE, Template) %a{:href => url_for(:controller => "templates", :action => "new")} Create a Template #service_quality_dashboard_section - - if @is_admin + - if check_privilege(Privilege::ACTION_MODIFY) %h2 Provider Service Quality .dashboard_section_summary diff --git a/src/app/views/layouts/_main_nav.html.erb b/src/app/views/layouts/_main_nav.html.erb index e85249b..c577a3b 100644 --- a/src/app/views/layouts/_main_nav.html.erb +++ b/src/app/views/layouts/_main_nav.html.erb @@ -14,6 +14,6 @@ <% } %> <% end %> </ul> -<% if BasePermissionObject.general_permission_scope.has_privilege(@current_user, Privilege::POOL_MODIFY) %> +<% if check_privilege(Privilege::ACTION_CREATE, Pool, BasePermissionObject.general_permission_scope) %> <%= link_to "Add a pool", {:controller => "pools", :action => "new"}, :class => "actionlink" %> <% end %> diff --git a/src/app/views/permissions/list.haml b/src/app/views/permissions/list.haml index 27831d0..263bbb5 100644 --- a/src/app/views/permissions/list.haml +++ b/src/app/views/permissions/list.haml @@ -14,7 +14,7 @@ %td= permission.user.login %td= permission.role.name %td - - if has_set_perms? + - if check_privilege(Privilege::ACTION_PERM_SET) - form_tag :action => 'destroy' do = hidden_field :permission, :id, :value => permission.id = submit_tag "delete", :class => "submit_link", :id => "delete_#{permission.id}" @@ -22,10 +22,10 @@ = link_to "Add a user", | {:controller => "users", | :action => "new"}, | - :class=>"actionlink" if has_user_modify?(BasePermissionObject.general_permission_scope) | + :class=>"actionlink" if check_privilege(Privilege::ACTION_CREATE,User,BasePermissionObject.general_permission_scope) | -# = link_to "Add a new permission record", | {:action => "new", | :permission_object_type => @permission_object.class, | :permission_object_id => @permission_object.id}, | - :class=>"actionlink" if has_set_perms? | + :class=>"actionlink" if check_privilege(Privilege::ACTION_PERM_SET) | diff --git a/src/app/views/pools/show.haml b/src/app/views/pools/show.haml index 229f3e2..ed14f4d 100644 --- a/src/app/views/pools/show.haml +++ b/src/app/views/pools/show.haml @@ -5,7 +5,7 @@ #pool-tabs %ul %li= link_to "Instances", {:action => "list", :id => @pool.id, :ajax => true} - - if has_view_perms? + - if check_privilege(Privilege::ACTION_PERM_VIEW) %li= link_to "User access", {:controller => "permissions", :action => "list", :pool_id => @pool.id, :ajax => true} %li= link_to "Hardware Profiles", {:action => "hardware_profiles", :id => @pool.id, :ajax => true} %li= link_to "Realms", {:action => "realms", :id => @pool.id, :ajax => true} diff --git a/src/app/views/providers/accounts.haml b/src/app/views/providers/accounts.haml index b136012..c9cb87c 100644 --- a/src/app/views/providers/accounts.haml +++ b/src/app/views/providers/accounts.haml @@ -26,7 +26,7 @@ = t('.quota_instances') %span.required * %fieldset.nomargin.clearfix - - disabled = 'disabled' unless has_account_modify?(@provider) + - disabled = 'disabled' unless check_privilege(Privilege::ACTION_MODIFY, Account, @provider) - cloud_account_id = "cloud_accounts[#{acct.id}]" = text_field cloud_account_id, :label, :title => t('.account_name'), :value => acct.label, :disabled => disabled, :class => "grid_4 alpha" = text_field cloud_account_id, :username, :title => t('.user_name'), :value => acct.username, :disabled => disabled, :class => "grid_3" @@ -56,7 +56,7 @@ = file_field cloud_account_id, :x509_cert_priv_file, :title => t('.account_private_cert'), :disabled => disabled .grid_3 = file_field cloud_account_id, :x509_cert_pub_file, :title => t('.account_public_cert'), :disabled => disabled - - remove_path = url_for :controller => 'cloud_accounts', :action => 'destroy', :id => acct.id if has_account_modify?(@provider) && acct.destroyable? + - remove_path = url_for :controller => 'cloud_accounts', :action => 'destroy', :id => acct.id if check_privilege(Privilege::ACTION_MODIFY, Account, @provider) && acct.destroyable? .grid_3.omega %a.button{ :href => remove_path, :name => "remove_acc_#{acct.id}", :class => "tiny #{'disabled' unless remove_path}" } = t(:remove) diff --git a/src/app/views/users/_form.haml b/src/app/views/users/_form.haml index 8d87a2f..8a48cd8 100644 --- a/src/app/views/users/_form.haml +++ b/src/app/views/users/_form.haml @@ -11,7 +11,7 @@ %fieldset = form.label :password_confirmation, t(:confirm_password), :class => "grid_3 alpha" = form.password_field :password_confirmation, :class => "grid_5" - -if has_user_modify? + -if check_privilege(Privilege::ACTION_MODIFY, User) %fieldset.clear = form.label :user_status, "User Status:", :class => "alpha grid_3" .grid_5 @@ -28,7 +28,7 @@ %fieldset.clear = form.label :email, t(:email), :class => "alpha grid_3" = form.text_field :email, :class => "grid_5" - -if has_user_modify? + -if check_privilege(Privilege::ACTION_MODIFY, User) %h3.grid_16 User Treatment %fieldset.clearfix = label_tag 'apply_treatment', t(:apply_treatment), :class => "alpha grid_3" diff --git a/src/app/views/users/edit.haml b/src/app/views/users/edit.haml index 0551bee..83c4236 100644 --- a/src/app/views/users/edit.haml +++ b/src/app/views/users/edit.haml @@ -1,5 +1,5 @@ .formwindow -- if has_user_modify? +- if check_privilege(Privilege::ACTION_MODIFY, User) %h2 Editing User: #{(a)user.first_name} #{(a)user.last_name} - else %h2 Editing Account diff --git a/src/db/migrate/20110107000000_privilege_model_refactor.rb b/src/db/migrate/20110107000000_privilege_model_refactor.rb new file mode 100644 index 0000000..78e0b99 --- /dev/null +++ b/src/db/migrate/20110107000000_privilege_model_refactor.rb @@ -0,0 +1,53 @@ +# +# Copyright (C) 2011 Red Hat, Inc. +# Written by Scott Seago <sseago(a)redhat.com> +# +# This program is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation; version 2 of the License. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program; if not, write to the Free Software +# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, +# MA 02110-1301, USA. A copy of the GNU General Public License is +# also available at http://www.gnu.org/copyleft/gpl.html. + +class PrivilegeModelRefactor < ActiveRecord::Migration + + + def self.up + # remove old privileges and role mapping + drop_table :privileges_roles + drop_table :privileges + + # new privilege model + create_table :privileges do |t| + t.integer :role_id, :null => false + t.string :target_type, :null => false + t.string :action, :null => false + t.integer :lock_version, :default => 0 + + t.timestamps + end + + end + + def self.down + drop_table :privileges + create_table :privileges do |t| + t.string :name, :null => false + t.integer :lock_version, :default => 0 + + t.timestamps + end + create_table :privileges_roles, :id => false do |t| + t.integer :privilege_id, :null => false + t.integer :role_id, :null => false + end + end +end diff --git a/src/db/seeds.rb b/src/db/seeds.rb index 934d432..9a6065c 100644 --- a/src/db/seeds.rb +++ b/src/db/seeds.rb @@ -4,108 +4,75 @@ PoolFamily.create!(:name => "default", :description => "default pool family") # Default Pool Pool.create!(:name => "default_pool", :quota => Quota.create, :pool_family => PoolFamily.find_by_name('default')) -# Create default privileges -privileges = ["set_perms", "view_perms", - "instance_modify", "instance_control", "instance_view", - "stats_view", - "account_modify", "account_view", - "pool_modify", "pool_view", - "quota_modify", "quota_view", - "provider_modify", "provider_view", - "user_modify", "user_view", - "image_modify", "image_view"] -Privilege.transaction do - privileges.each do |priv_name| - privilege = Privilege.create!(:name => priv_name) - end -end # Create default roles -roles = {"Instance Controller" => - {:role_scope => "Pool", - :privileges => ["instance_control", - "instance_view", - "pool_view"]}, - "Instance Controller With Monitoring" => - {:role_scope => "Pool", - :privileges => ["instance_control", - "instance_view", - "pool_view", - "stats_view"]}, - "Instance Creator and User" => - {:role_scope => "Pool", - :privileges => ["instance_control", - "instance_view", - "pool_view", - "stats_view", - "instance_modify", - "quota_view", - "set_perms", - "view_perms"]}, - "Pool Creator" => - {:role_scope => "Provider", - :privileges => ["provider_view", - "pool_modify", - "pool_view", - "quota_view"]}, - "Pool Administrator" => - {:role_scope => "Provider", - :privileges => ["provider_view", - "pool_modify", - "pool_view", - "quota_view", - "quota_modify", - "set_perms", - "view_perms"]}, - "Provider Administrator" => - {:role_scope => "Provider", - :privileges => ["provider_modify", - "provider_view", - "account_modify", - "account_view"]}, - "Account Administrator" => - {:role_scope => "CloudAccount", - :privileges => ["set_perms", - "view_perms", - "stats_view", - "account_view", - "account_modify"]}, - "Account Viewer" => - {:role_scope => "CloudAccount", - :privileges => ["account_view"]}, - "Provider Creator" => - {:role_scope => "BasePermissionObject", - :privileges => ["provider_modify", - "provider_view"]}, - "Administrator" => - {:role_scope => "BasePermissionObject", - :privileges => ["provider_modify", - "provider_view", - "account_modify", - "account_view", - "user_modify", - "user_view", - "set_perms", - "view_perms", - "pool_modify", - "pool_view", - "quota_modify", - "quota_view", - "stats_view", - "instance_modify", - "instance_control", - "instance_view", - "image_modify", - "image_view"]} +VIEW = "view" +USE = "use" +MOD = "modify" +CRE = "create" +VPRM = "view_perms" +GPRM = "set_perms" -} +roles = + {Instance => + {"Instance Controller" => {Instance => [VIEW,USE]}, + "Instance Owner" => {Instance => [VIEW,USE,MOD, VPRM,GPRM]}}, + PoolFamily => + {"Pool Family User" => {Pool => [VIEW]}, + "Pool Family Owner" => {PoolFamily => [VIEW, MOD, VPRM,GPRM], + Pool => [VIEW, MOD,CRE,VPRM,GPRM]}}, + Pool => + {"Pool User" => {Pool => [VIEW], + Instance => [ CRE], + Quota => [VIEW]}, + "Pool Owner" => {Pool => [VIEW, MOD, VPRM,GPRM], + Instance => [VIEW,USE,MOD,CRE], + Quota => [VIEW]}}, + Provider => + {"Provider Owner" => {Provider => [VIEW, MOD, VPRM,GPRM], + CloudAccount => [VIEW,USE,MOD,CRE,VPRM,GPRM]}}, + CloudAccount => + {"Provider Account User" => {CloudAccount => [VIEW,USE]}, + "Provider Account Owner" => {CloudAccount => [VIEW,USE,MOD, VPRM,GPRM]}}, + Template => + {"Template User" => {Template => [VIEW,USE]}, + "Template Owner" => {Template => [VIEW,USE,MOD, VPRM,GPRM]}}, + BasePermissionObject => + {"Provider Creator" => {Provider => [ CRE]}, + "Provider Administrator" => {Provider => [VIEW, MOD,CRE,VPRM,GPRM], + CloudAccount => [VIEW,USE,MOD,CRE,VPRM,GPRM]}, + "HWP Administrator" => {HardwareProfile => [ MOD,CRE,VPRM,GPRM]}, + "Realm Administrator" => {Realm => [ USE,MOD,CRE,VPRM,GPRM]}, + "Pool Creator" => {Pool => [ CRE]}, + "Pool Administrator" => {Pool => [VIEW, MOD,CRE,VPRM,GPRM], + Instance => [VIEW,USE,MOD,CRE,VPRM,GPRM], + Quota => [VIEW, MOD], + PoolFamily => [VIEW, MOD,CRE,VPRM,GPRM]}, + "Template Administrator" => {Template => [VIEW,USE,MOD,CRE,VPRM,GPRM]}, + "Administrator" => {Provider => [VIEW, MOD,CRE,VPRM,GPRM], + CloudAccount => [VIEW,USE,MOD,CRE,VPRM,GPRM], + HardwareProfile => [ MOD,CRE,VPRM,GPRM], + Realm => [ USE,MOD,CRE,VPRM,GPRM], + User => [VIEW, MOD,CRE], + Pool => [VIEW, MOD,CRE,VPRM,GPRM], + Instance => [VIEW,USE,MOD,CRE,VPRM,GPRM], + Quota => [VIEW, MOD], + PoolFamily => [VIEW, MOD,CRE,VPRM,GPRM], + Template => [VIEW,USE,MOD,CRE,VPRM,GPRM], + BasePermissionObject => [ MOD, VPRM,GPRM]}}} Role.transaction do - roles.each do |role_name, role_hash| - role = Role.create!(:name => role_name, :scope => role_hash[:role_scope]) - role.privileges = role_hash[:privileges].collect do |priv_name| - Privilege.find_by_name(priv_name) + roles.each do |role_scope, scoped_hash| + scoped_hash.each do |role_name, role_privileges| + role_privileges.each do |priv_type, priv_actions| + role = Role.find_or_initialize_by_name(role_name) + role.update_attributes({:name => role_name, :scope => role_scope.name}) + role.save! + priv_actions.each do |action| + Privilege.create!(:role => role, :target_type => priv_type.name, + :action => action) + end + end end - role.save! end end @@ -118,7 +85,7 @@ MetadataObject.set("default_pool_family", PoolFamily.find_by_name('default')) default_pool = Pool.find_by_name("default_pool") default_quota = Quota.create -default_role = Role.find_by_name("Instance Creator and User") +default_role = Role.find_by_name("Pool User") settings = {"allow_self_service_logins" => "true", "self_service_default_quota" => default_quota, "self_service_default_pool" => default_pool, diff --git a/src/features/support/custom.rb b/src/features/support/custom.rb index 6b0db10..ec9d052 100644 --- a/src/features/support/custom.rb +++ b/src/features/support/custom.rb @@ -1,8 +1,4 @@ #Seed the DB with fixture data -Fixtures.reset_cache -fixtures_folder = File.join(Rails.root, 'spec', 'fixtures') -fixtures = Dir[File.join(fixtures_folder, '*.yml')].map {|f| File.basename(f, '.yml') } -Fixtures.create_fixtures(fixtures_folder, fixtures) # We can't stub out these methods properly in cucumber, and we don't want to # couple these tests to require the core server be running (connections should be tested diff --git a/src/features/support/hooks.rb b/src/features/support/hooks.rb index c21d323..a00ac36 100644 --- a/src/features/support/hooks.rb +++ b/src/features/support/hooks.rb @@ -1,19 +1,2 @@ Before do - @default_pool_family_metadata = Factory.create(:default_pool_family_metadata) - @allow_self_service_logins = Factory(:metadata_object, :key => "allow_self_service_logins", :value => "true") - - @default_quota = Factory(:unlimited_quota) - @self_service_default_quota = Factory(:metadata_object, :key => "self_service_default_quota", - :value => @default_quota, - :object_type => "Quota") - - @default_pool = Factory(:pool, :name => "default_pool", :quota => @default_quota) - @self_service_default_pool = Factory(:metadata_object, :key => "self_service_default_pool", - :value => @default_pool, - :object_type => "Pool") - - @default_role = Role.find(:first, :conditions => ['name = ?', 'Instance Creator and User']) - @self_service_default_pool = Factory(:metadata_object, :key => "self_service_default_role", - :value => @default_role, - :object_type => "Role") end diff --git a/src/lib/tasks/cucumber.rake b/src/lib/tasks/cucumber.rake index 15034cd..453f43c 100644 --- a/src/lib/tasks/cucumber.rake +++ b/src/lib/tasks/cucumber.rake @@ -14,19 +14,19 @@ begin require 'cucumber/rake/task' namespace :cucumber do - Cucumber::Rake::Task.new({:ok => 'db:test:prepare'}, 'Run features that should pass') do |t| + Cucumber::Rake::Task.new({:ok => ['db:test:prepare','db:seed']}, 'Run features that should pass') do |t| t.binary = vendored_cucumber_bin # If nil, the gem's binary is used. t.fork = true # You may get faster startup if you set this to false t.profile = 'default' end - Cucumber::Rake::Task.new({:wip => 'db:test:prepare'}, 'Run features that are being worked on') do |t| + Cucumber::Rake::Task.new({:wip => ['db:test:prepare','db:seed']}, 'Run features that are being worked on') do |t| t.binary = vendored_cucumber_bin t.fork = true # You may get faster startup if you set this to false t.profile = 'wip' end - Cucumber::Rake::Task.new({:rerun => 'db:test:prepare'}, 'Record failing features and run only them if any exist') do |t| + Cucumber::Rake::Task.new({:rerun => ['db:test:prepare','db:seed']}, 'Record failing features and run only them if any exist') do |t| t.binary = vendored_cucumber_bin t.fork = true # You may get faster startup if you set this to false t.profile = 'rerun' diff --git a/src/spec/controllers/instance_controller_spec.rb b/src/spec/controllers/instance_controller_spec.rb index 241c05b..34a44c8 100644 --- a/src/spec/controllers/instance_controller_spec.rb +++ b/src/spec/controllers/instance_controller_spec.rb @@ -20,11 +20,11 @@ describe InstancesController do response.should_not be_success end - it "should allow instance creator to launch instance" do - @inst_user_permission = Factory :instance_creator_and_user_permission - @inst_user = @inst_user_permission.user - UserSession.create(@inst_user) - pool = Permission.first(:conditions => {:permission_object_type => 'Pool', :user_id => @inst_user.id}).permission_object + it "should allow pool user to launch instance" do + @pool_user_permission = Factory :pool_user_permission + @pool_user = @pool_user_permission.user + UserSession.create(@pool_user) + pool = Permission.first(:conditions => {:permission_object_type => 'Pool', :user_id => @pool_user.id}).permission_object template = Factory.build(:template) template.save! hwp = Factory.build(:mock_hwp1) @@ -36,6 +36,6 @@ describe InstancesController do :hardware_profile_id => hwp.id } end.should change(Instance, :count).by(1) inst = Instance.find(:first, :conditions => ['name = ?', 'mockinstance']) - inst.owner_id.should == @inst_user.id + inst.owner_id.should == @pool_user.id end end diff --git a/src/spec/controllers/users_controller_spec.rb b/src/spec/controllers/users_controller_spec.rb index c1fad30..f9a3dde 100644 --- a/src/spec/controllers/users_controller_spec.rb +++ b/src/spec/controllers/users_controller_spec.rb @@ -3,16 +3,9 @@ require 'spec_helper' describe UsersController do before(:each) do - unless BasePermissionObject.find_by_name(BasePermissionObject::GENERAL_PERMISSION_SCOPE) - Factory(:base_permission_object) - end @tuser = Factory :tuser @admin_permission = Factory :admin_permission - @admin_permission.role.privileges << Privilege.find_by_name('user_modify') @admin = @admin_permission.user - Factory.create(:default_quota_metadata) - Factory.create(:default_role_metadata) - Factory.create(:default_pool_metadata) activate_authlogic end diff --git a/src/spec/factories/base_permission_object.rb b/src/spec/factories/base_permission_object.rb deleted file mode 100644 index ccc2bf1..0000000 --- a/src/spec/factories/base_permission_object.rb +++ /dev/null @@ -1,3 +0,0 @@ -Factory.define :base_permission_object do |o| - o.name BasePermissionObject::GENERAL_PERMISSION_SCOPE -end diff --git a/src/spec/factories/metadata_object.rb b/src/spec/factories/metadata_object.rb deleted file mode 100644 index fea2f88..0000000 --- a/src/spec/factories/metadata_object.rb +++ /dev/null @@ -1,34 +0,0 @@ -Factory.define :metadata_object do |o| - o.key 'key' - o.value 'value' - o.object_type nil -end - -Factory.define :default_logins_metadata, :parent => :metadata_object do |o| - o.key 'allow_self_service_logins' - o.value 'true' -end - -Factory.define :default_pool_family_metadata, :parent => :metadata_object do |o| - o.key 'default_pool_family' - o.value {Factory.create(:pool_family).id} - o.object_type 'PoolFamily' -end - -Factory.define :default_quota_metadata, :parent => :metadata_object do |o| - o.key 'self_service_default_quota' - o.value {Factory.create(:quota).id} - o.object_type 'Quota' -end - -Factory.define :default_role_metadata, :parent => :metadata_object do |o| - o.key 'self_service_default_role' - o.value {Factory.create(:role).id} - o.object_type 'Role' -end - -Factory.define :default_pool_metadata, :parent => :metadata_object do |o| - o.key 'self_service_default_pool' - o.value {Factory.create(:pool).id} - o.object_type 'Pool' -end diff --git a/src/spec/factories/permission.rb b/src/spec/factories/permission.rb index 9ccd3e7..f260ad7 100644 --- a/src/spec/factories/permission.rb +++ b/src/spec/factories/permission.rb @@ -16,12 +16,12 @@ end Factory.define :pool_creator_permission, :parent => :permission do |p| p.role { |r| Role.first(:conditions => ['name = ?', 'Pool Creator']) || Factory(:role, :name => 'Pool Creator') } - p.permission_object { |r| r.association(:mock_provider) } - p.user { |u| u.association(:pool_creator) } + p.permission_object { |r| BasePermissionObject.general_permission_scope } + p.user { |u| u.association(:pool_creator_user) } end -Factory.define :instance_creator_and_user_permission, :parent => :permission do |p| - p.role { |r| Role.first(:conditions => ['name = ?', 'Instance Creator and User']) || Factory(:role, :name => 'Instance Creator and User') } +Factory.define :pool_user_permission, :parent => :permission do |p| + p.role { |r| Role.first(:conditions => ['name = ?', 'Pool User']) || Factory(:role, :name => 'Pool User') } p.permission_object { |r| r.association(:pool) } p.user { |u| u.association(:user) } end diff --git a/src/spec/factories/pool.rb b/src/spec/factories/pool.rb index 32e8c99..3b20f96 100644 --- a/src/spec/factories/pool.rb +++ b/src/spec/factories/pool.rb @@ -1,6 +1,6 @@ Factory.define :pool do |p| p.sequence(:name) { |n| "mypool#{n}" } - p.association :pool_family, :factory => :pool_family + p.pool_family { |p| PoolFamily.find_by_name('default') } p.association :quota end diff --git a/src/spec/factories/pool_family.rb b/src/spec/factories/pool_family.rb index 4a890ce..d0ca8e7 100644 --- a/src/spec/factories/pool_family.rb +++ b/src/spec/factories/pool_family.rb @@ -1,4 +1,4 @@ Factory.define :pool_family do |z| z.sequence(:name) { |n| "pool_family#{n}" } - z.description 'default pool family' + z.description 'pool family' end diff --git a/src/spec/factories/user.rb b/src/spec/factories/user.rb index e737a35..a9dd23e 100644 --- a/src/spec/factories/user.rb +++ b/src/spec/factories/user.rb @@ -14,10 +14,13 @@ end Factory.define :admin_user, :parent => :user do |u| end +Factory.define :pool_creator_user, :parent => :user do |u| +end + Factory.define :provider_admin_user, :parent => :user do |u| end Factory.define :pool_user, :parent => :user do |u| u.sequence(:login) { |n| "pool_user#{n}" } u.email { |e| "#{e.login}(a)example.com" } -end \ No newline at end of file +end diff --git a/src/spec/fixtures/base_permission_objects.yml b/src/spec/fixtures/base_permission_objects.yml deleted file mode 100644 index a520969..0000000 --- a/src/spec/fixtures/base_permission_objects.yml +++ /dev/null @@ -1,2 +0,0 @@ -general_permission_scope: - name: 'general_permission_scope' diff --git a/src/spec/fixtures/privileges.yml b/src/spec/fixtures/privileges.yml deleted file mode 100644 index 16723de..0000000 --- a/src/spec/fixtures/privileges.yml +++ /dev/null @@ -1,43 +0,0 @@ -# Read about fixtures at http://ar.rubyonrails.org/classes/Fixtures.html - -# one: -# column: value -# -# two: -# column: value -set_perms: - name: set_perms -view_perms: - name: view_perms -instance_modify: - name: instance_modify -instance_control: - name: instance_control -instance_view: - name: instance_view -stats_view: - name: stats_view -account_modify: - name: account_modify -account_view: - name: account_view -pool_modify: - name: pool_modify -pool_view: - name: pool_view -quota_modify: - name: quota_modify -quota_view: - name: quota_view -provider_modify: - name: provider_modify -provider_view: - name: provider_view -user_modify: - name: user_modify -user_view: - name: user_view -image_modify: - name: image_modify -image_view: - name: image_view diff --git a/src/spec/fixtures/roles.yml b/src/spec/fixtures/roles.yml deleted file mode 100644 index d3ed623..0000000 --- a/src/spec/fixtures/roles.yml +++ /dev/null @@ -1,47 +0,0 @@ -# Read about fixtures at http://ar.rubyonrails.org/classes/Fixtures.html - -# one: -# column: value -# -# two: -# column: value -instance_controller: - name: Instance Controller - scope: Pool - privileges: instance_control, instance_view, pool_view -instance_controller_with_monitoring: - name: Instance Controller With Monitoring - scope: Pool - privileges: instance_control, instance_view, pool_view, stats_view -instance_creator_and_user: - name: Instance Creator and User - scope: Pool - privileges: instance_control, instance_view, pool_view, stats_view, instance_modify, quota_view, set_perms, view_perms -pool_creator: - name: Pool Creator - scope: Provider - privileges: provider_view, pool_modify, pool_view, quota_view -pool_administrator: - name: Pool Administrator - scope: Provider - privileges: provider_view, pool_modify, pool_view, quota_modify, quota_view, stats_view, set_perms, view_perms -provider_administrator: - name: Provider Administrator - scope: Provider - privileges: provider_modify, provider_view, account_modify, account_view, stats_view -account_administrator: - name: Account Administrator - scope: CloudAccount - privileges: account_modify, account_view, stats_view, set_perms, view_perms -account_viewer: - name: Account Viewer - scope: CloudAccount - privileges: account_view -provider_creator: - name: Provider Creator - scope: BasePermissionObject - privileges: provider_modify, provider_view, stats_view -administrator: - name: Administrator - scope: BasePermissionObject - privileges: provider_modify, provider_view, account_modify, account_view, user_modify, user_view, set_perms, view_perms, pool_modify, pool_view, quota_modify, quota_view, stats_view, instance_modify, instance_control, instance_view, image_modify, image_view diff --git a/src/spec/models/metadata_object_spec.rb b/src/spec/models/metadata_object_spec.rb index e3a74f8..0290b57 100644 --- a/src/spec/models/metadata_object_spec.rb +++ b/src/spec/models/metadata_object_spec.rb @@ -3,7 +3,7 @@ require 'spec_helper' describe MetadataObject do before(:each) do - @default_pool_family_metadata = Factory :default_pool_family_metadata + @default_pool_family_metadata = MetadataObject.find_by_key("default_pool_family") end it "lookup on nonexistent key should return nil" do diff --git a/src/spec/models/permission_spec.rb b/src/spec/models/permission_spec.rb new file mode 100644 index 0000000..4da3ddf --- /dev/null +++ b/src/spec/models/permission_spec.rb @@ -0,0 +1,58 @@ +require 'spec_helper' + +describe Permission do + + before(:each) do + @admin_permission = Factory :admin_permission + @provider_admin_permission = Factory :provider_admin_permission + @pool_creator_permission = Factory :pool_creator_permission + @pool_user_permission = Factory :pool_user_permission + + @admin = @admin_permission.user + @provider_admin = @provider_admin_permission.user + @pool_creator = @pool_creator_permission.user + @pool_user = @pool_user_permission.user + + @provider = @provider_admin_permission.provider + @pool = @pool_user_permission.pool + end + + it "Admin should be able to create users" do + BasePermissionObject.general_permission_scope.has_privilege(@admin, + Privilege::ACTION_CREATE, + User).should be_true + end + + it "Provider Admin should NOT be able to create users" do + BasePermissionObject.general_permission_scope.has_privilege(@provider_admin, + Privilege::ACTION_CREATE, + User).should be_false + end + + it "Pool User should NOT be able to create users" do + BasePermissionObject.general_permission_scope.has_privilege(@pool_user, + Privilege::ACTION_CREATE, + User).should be_false + end + + it "Provider Admin should be able to edit provider" do + @provider.has_privilege(@provider_admin, Privilege::ACTION_MODIFY).should be_true + end + + it "Admin should be able to edit provider" do + @provider.has_privilege(@admin, Privilege::ACTION_MODIFY).should be_true + end + + it "Pool User should NOT be able to edit provider" do + @provider.has_privilege(@pool_user, Privilege::ACTION_MODIFY).should be_false + end + + it "Pool User should be able to create instances in @pool" do + @pool.has_privilege(@pool_user, Privilege::ACTION_CREATE, Instance).should be_true + end + + it "Pool User should NOT be able to create instances in another pool" do + Factory(:tpool).has_privilege(@pool_user, Privilege::ACTION_CREATE, Instance).should be_false + end + +end diff --git a/src/spec/models/pool_family_spec.rb b/src/spec/models/pool_family_spec.rb index 1210b48..2b69eab 100644 --- a/src/spec/models/pool_family_spec.rb +++ b/src/spec/models/pool_family_spec.rb @@ -22,8 +22,8 @@ describe PoolFamily do end it "should have pool" do - @pool_family.pools.size.should == 1 - @pool_family.pools[0].id.should == @pool.id + @pool_family.pools.size.should == 2 #default pool + pool created here + @pool.pool_family.id.should == @pool_family.id end it "should have account" do diff --git a/src/spec/services/registration_service_spec.rb b/src/spec/services/registration_service_spec.rb index 41f6764..bdb6d9f 100644 --- a/src/spec/services/registration_service_spec.rb +++ b/src/spec/services/registration_service_spec.rb @@ -3,9 +3,6 @@ require 'spec_helper' describe RegistrationService do before(:each) do - Factory.create(:default_quota_metadata) - Factory.create(:default_role_metadata) - Factory.create(:default_pool_metadata) end describe "with validations" do @@ -22,20 +19,15 @@ describe RegistrationService do it "should register a user with default pool/quota/role when default settings set" do @user = Factory :user - @pool = Factory(:pool, :name => "default_pool") - privilege = Privilege.find_by_name('instance_view') - @role = Factory(:role, :privileges => [privilege]) + @pool = MetadataObject.lookup("self_service_default_pool") + @role = MetadataObject.lookup("self_service_default_role") @quota = Factory :quota - - MetadataObject.set("allow_self_service_logins", "true") - MetadataObject.set("self_service_default_pool", @pool) - MetadataObject.set("self_service_default_role", @role) MetadataObject.set("self_service_default_quota", @quota) @registration_service = RegistrationService.new(@user) @registration_service.save - @pools = Pool.list_for_user(@user, Privilege::INSTANCE_VIEW) + @pools = Pool.list_for_user(@user, Privilege::ACTION_CREATE, :target_type => Instance) @pools.length.should == 1 @pools[0].name.should == "default_pool" diff --git a/src/spec/spec_helper.rb b/src/spec/spec_helper.rb index 90f0eaf..88413c0 100644 --- a/src/spec/spec_helper.rb +++ b/src/spec/spec_helper.rb @@ -56,7 +56,6 @@ Spec::Runner.configure do |config| # For more information take a look at Spec::Runner::Configuration and Spec::Runner config.before(:each, :type => :controller) do #activate_authlogic - @default_pool_family_metadata = Factory.create(:default_pool_family_metadata) end config.after(:each, :type => :controller) do #current_user_session.destroy @@ -66,6 +65,7 @@ Spec::Runner.configure do |config| config.before(:suite) do DatabaseCleaner.strategy = :truncation DatabaseCleaner.clean_with(:truncation) + load "#{Rails.root}/db/seeds.rb" end config.before(:each) do DatabaseCleaner.start -- 1.7.3.4

13 years, 3 months

1
0
0 / 0

[PATCH aeolus] admin, Hardware Profiles UI for new Hardware Profile Model

by Martyn Taylor

From: Martyn Taylor <mtaylor(a)redhat.com> This patch allows users to create Hardware Profiles based on the new matching model. N.B. Building the Hardware Profile in the HardwareProfile controller, is not very RESTy. This was a decision made to simplify the UI slightly, and create HardareProfile with breaking any validation. --- .../admin/hardware_profiles_controller.rb | 135 +++++++++++++++++++- src/app/models/hardware_profile.rb | 13 ++- src/app/models/hardware_profile_property.rb | 2 +- src/app/models/property_enum_entry.rb | 3 + src/app/stylesheets/newui.scss | 5 + src/app/views/admin/hardware_profiles/_form.haml | 28 ++++ src/app/views/admin/hardware_profiles/_list.haml | 35 +++--- .../_matching_provider_hardware_profiles.haml | 8 +- .../views/admin/hardware_profiles/_properties.haml | 1 + src/app/views/admin/hardware_profiles/create.haml | 6 + src/app/views/admin/hardware_profiles/edit.haml | 7 + src/app/views/admin/hardware_profiles/new.haml | 7 + src/app/views/admin/provider_accounts/new.haml | 2 +- src/config/routes.rb | 2 + .../20090804135630_create_hardware_profiles.rb | 2 +- src/features/hardware_profile.feature | 60 +++++++++ .../step_definitions/hardware_profile_steps.rb | 17 +++ src/features/support/paths.rb | 6 + 18 files changed, 310 insertions(+), 29 deletions(-) create mode 100644 src/app/views/admin/hardware_profiles/_form.haml create mode 100644 src/app/views/admin/hardware_profiles/create.haml create mode 100644 src/app/views/admin/hardware_profiles/edit.haml create mode 100644 src/app/views/admin/hardware_profiles/new.haml diff --git a/src/app/controllers/admin/hardware_profiles_controller.rb b/src/app/controllers/admin/hardware_profiles_controller.rb index 92edab0..f2b7e0f 100644 --- a/src/app/controllers/admin/hardware_profiles_controller.rb +++ b/src/app/controllers/admin/hardware_profiles_controller.rb @@ -1,7 +1,10 @@ class Admin::HardwareProfilesController < ApplicationController before_filter :require_user before_filter :set_params_and_header, :only => [:index, :show] - before_filter :load_hardware_profiles, :only => [:show] + before_filter :load_hardware_profiles, :only => [:index, :show] + before_filter :load_hardware_profile, :only => [:show] + before_filter :setup_new_hardware_profile, :only => [:new] + before_filter :setup_hardware_profile, :only => [:new, :create, :edit, :update] def index @params = params @@ -39,7 +42,77 @@ class Admin::HardwareProfilesController < ApplicationController end end + def new + end + + def create + build_hardware_profile(params[:hardware_profile]) + if params[:commit] == 'Save' + if @hardware_profile.save! + redirect_to admin_hardware_profiles_path + else + params.delete :commit + render :action => 'create' + end + else + matching_provider_hardware_profiles + render :action => 'new' + end + end + + def delete + end + + def edit + unless @hardware_profile + @hardware_profile = HardwareProfile.find(params[:id]) + end + matching_provider_hardware_profiles + end + + def update + if params[:commit] == "Reset" + redirect_to edit_admin_hardware_profile_url(@hardware_profile) and return + end + + if params[:id] + @hardware_profile = HardwareProfile.find(params[:id]) + build_hardware_profile(params[:hardware_profile]) + end + + if params[:commit] == "Check Matches" + matching_provider_hardware_profiles + render :edit and return + end + + unless @hardware_profile.save! + render :action => 'edit' and return + else + flash[:notice] = "Hardware Profile updated!" + redirect_to admin_hardware_profiles_path + end + end + + def multi_destroy + HardwareProfile.destroy(params[:hardware_profile_selected]) + redirect_to admin_hardware_profiles_path + end + private + def setup_new_hardware_profile + if params[:hardware_profile] + begin + @hardware_profile = HardwareProfile.new(remove_irrelevant_params(params[:hardware_profile])) + end + else + @hardware_profile = HardwareProfile.new(:memory => HardwareProfileProperty.new(:name => "memory", :unit => "MB"), + :cpu => HardwareProfileProperty.new(:name => "cpu", :unit => "count"), + :storage => HardwareProfileProperty.new(:name => "storage", :unit => "GB"), + :architecture => HardwareProfileProperty.new(:name => "architecture", :unit => "label")) + end + matching_provider_hardware_profiles + end + def properties @properties_header = [ { :name => "Name", :sort_attr => :name}, @@ -63,8 +136,26 @@ class Admin::HardwareProfilesController < ApplicationController { :name => "Storage", :sort_attr => :storage }, { :name => "Virtual CPU", :sort_attr => :cpus} ] - @matching_hwps = HardwareProfile.all(:include => "aggregator_hardware_profiles", - :conditions => {:hardware_profile_map => { :aggregator_hardware_profile_id => params[:id] }}) + + begin + @matching_hwps = HardwareProfile.matching_hwps((a)hardware_profile).map { |hwp| hwp[:hardware_profile] } + rescue + @matching_hwps = [] + end + end + + def setup_hardware_profile + @tab_captions = ['Matched Provider Hardware Profiles'] + @details_tab = 'matching_provider_hardware_profiles' + @url_params = params + @header = [ + { :name => "Name", :sort_attr => :name}, + { :name => "Unit", :sort_attr => :unit}, + { :name => "Kind", :sort_attr => :kind }, + { :name => "Value (Default)", :sort_attr => :value}, + { :name => "Enum Entries", :sort_attr => :false }, + { :name => "Range First", :sort_attr => :range_first}, + { :name => "Range Last", :sort_attr => :range_last }] end def set_params_and_header @@ -81,4 +172,42 @@ class Admin::HardwareProfilesController < ApplicationController def load_hardware_profiles @hardware_profiles = HardwareProfile.all(:conditions => 'provider_id IS NULL') end + + def load_hardware_profile + @hardware_profile = HardwareProfile.find(params[:id]) + end + + def build_hardware_profile(params) + hwpps = [:memory_attributes, :cpu_attributes, :storage_attributes, :architecture_attributes] + enum_values = {} + hwpps.each do |attr| + unless params[attr][:kind] == "range" + params[attr].delete(:range_first) + params[attr].delete(:range_last) + end + + unless params[attr][:kind] == "enum" + params[attr].delete(:enum) + else + enum_values[params[attr][:name]] = params[attr][:property_enum_entries].split(%r{,\s*}) + end + params[attr].delete(:property_enum_entries) + end + + @hardware_profile.nil? ? @hardware_profile = HardwareProfile.new(params) : @hardware_profile.update_attributes(params) + @hardware_profile.save! + + # Set Property Enum Entries on enum types + begin + [@hardware_profile.memory, @hardware_profile.cpu, @hardware_profile.architecture, @hardware_profile.storage].each do |hwpp| + if hwpp.kind == "enum" + hwpp.property_enum_entries = enum_values[hwpp.name].map { |value| PropertyEnumEntry.new(:value => value) } + end + end + @hardware_profile.save! + rescue => e + @hardware_profile.delete! + raise e + end + end end diff --git a/src/app/models/hardware_profile.rb b/src/app/models/hardware_profile.rb index 5e6e9e8..22dc5c4 100644 --- a/src/app/models/hardware_profile.rb +++ b/src/app/models/hardware_profile.rb @@ -41,13 +41,18 @@ class HardwareProfile < ActiveRecord::Base belongs_to :memory, :class_name => "HardwareProfileProperty", :dependent => :destroy + belongs_to :storage, :class_name => "HardwareProfileProperty", :dependent => :destroy + belongs_to :cpu, :class_name => "HardwareProfileProperty", :dependent => :destroy + belongs_to :architecture, :class_name => "HardwareProfileProperty", :dependent => :destroy + accepts_nested_attributes_for :memory, :cpu, :storage, :architecture + has_and_belongs_to_many :aggregator_hardware_profiles, :class_name => "HardwareProfile", :join_table => "hardware_profile_map", @@ -60,8 +65,8 @@ class HardwareProfile < ActiveRecord::Base :foreign_key => "aggregator_hardware_profile_id", :association_foreign_key => "provider_hardware_profile_id" - validates_presence_of :external_key - validates_uniqueness_of :external_key, :scope => [:provider_id] + #validates_presence_of :external_key + #validates_uniqueness_of :external_key, :scope => [:provider_id] validates_presence_of :name validates_uniqueness_of :name, :scope => [:provider_id] @@ -79,8 +84,8 @@ class HardwareProfile < ActiveRecord::Base def validate if provider.nil? if !aggregator_hardware_profiles.empty? - errors.add(:aggregator_hardware_profiles, - "Aggregator profiles only allowed for provider profiles") + #errors.add(:aggregator_hardware_profiles, + #"Aggregator profiles only allowed for provider profiles") end else if !provider_hardware_profiles.empty? diff --git a/src/app/models/hardware_profile_property.rb b/src/app/models/hardware_profile_property.rb index 46e4b8e..3f6bdfe 100644 --- a/src/app/models/hardware_profile_property.rb +++ b/src/app/models/hardware_profile_property.rb @@ -101,7 +101,7 @@ class HardwareProfileProperty < ActiveRecord::Base def to_s case kind when FIXED - value + value.to_s when RANGE range_first.to_s + " - " + range_last.to_s when ENUM diff --git a/src/app/models/property_enum_entry.rb b/src/app/models/property_enum_entry.rb index ff497ef..81bb67e 100644 --- a/src/app/models/property_enum_entry.rb +++ b/src/app/models/property_enum_entry.rb @@ -32,4 +32,7 @@ class PropertyEnumEntry < ActiveRecord::Base HardwareProfileProperty::STORAGE or p.hardware_profile_property.name == HardwareProfileProperty::CPU } + def to_s + value.to_s + ", " + end end diff --git a/src/app/stylesheets/newui.scss b/src/app/stylesheets/newui.scss index 513d510..d0fbcc9 100644 --- a/src/app/stylesheets/newui.scss +++ b/src/app/stylesheets/newui.scss @@ -1371,6 +1371,11 @@ $content-left: 180px; float: left; } +#list { + float: left; + width: 100%; +} + #details-view { border: 1px solid; position: absolute; diff --git a/src/app/views/admin/hardware_profiles/_form.haml b/src/app/views/admin/hardware_profiles/_form.haml new file mode 100644 index 0000000..65278f2 --- /dev/null +++ b/src/app/views/admin/hardware_profiles/_form.haml @@ -0,0 +1,28 @@ +=hwp_form.label :name +=hwp_form.text_field :name +%table + = sortable_table_header @header + - [:memory, :cpu, :storage, :architecture].each do |type| + - hwp_form.fields_for type do |hwpp_form| + %tr + %td + =hwpp_form.text_field(:name, :readonly => "readonly") + %td + =hwpp_form.text_field(:unit, :size => 5, :readonly => "readonly") + %td + -unless type == :architecture + =hwpp_form.select("kind", ["fixed", "range", "enum"], {}) + -else + =hwpp_form.select("kind", ["fixed", "enum"], {}) + %td + =hwpp_form.text_field(:value) + %td + =hwpp_form.text_field(:property_enum_entries) + %td + -unless type == :architecture + =hwpp_form.text_field(:range_first) + %td + -unless type == :architecture + =hwpp_form.text_field(:range_last) += hwp_form.submit 'Check Matches', :class => "submit formbutton" += hwp_form.submit 'Save', :class => 'submit formbutton' \ No newline at end of file diff --git a/src/app/views/admin/hardware_profiles/_list.haml b/src/app/views/admin/hardware_profiles/_list.haml index 1001db3..e2f344e 100644 --- a/src/app/views/admin/hardware_profiles/_list.haml +++ b/src/app/views/admin/hardware_profiles/_list.haml @@ -1,5 +1,7 @@ - form_tag do #object-actions + = link_to "New Hardware Profile", new_admin_hardware_profile_path, :class => 'button' + = restful_submit_tag "Delete", "destroy", multi_destroy_admin_hardware_profiles_path, "DELETE", :id => 'delete_button' #selections %p @@ -8,19 +10,20 @@ %span> ,  = link_to "None", @url_params.merge(:select => 'none') -%table - = sortable_table_header @header - - @hardware_profiles.each do |hwp| - %tr - %td - - selected = @url_params[:select] == 'all' - = check_box(:pool, "selected[#{hwp.id}]", :checked => selected) - = link_to hwp.name, admin_hardware_profile_path(hwp) - %td - =hwp.architecture.to_s - %td - =hwp.memory.to_s - %td - =hwp.storage.to_s - %td - =hwp.cpu.to_s + #list + %table + = sortable_table_header @header + - @hardware_profiles.each do |hwp| + %tr + %td + - selected = @url_params[:select] == 'all' + %input{:name => "hardware_profile_selected[]", :type => "checkbox", :value => hwp.id, :id => "hardware_profile_checkbox_#{hwp.id}", :checked => selected } + = link_to hwp.name, admin_hardware_profile_path(hwp) + %td + =hwp.architecture.to_s + %td + =hwp.memory.to_s + %td + =hwp.storage.to_s + %td + =hwp.cpu.to_s diff --git a/src/app/views/admin/hardware_profiles/_matching_provider_hardware_profiles.haml b/src/app/views/admin/hardware_profiles/_matching_provider_hardware_profiles.haml index cfbb856..0f4ba7b 100644 --- a/src/app/views/admin/hardware_profiles/_matching_provider_hardware_profiles.haml +++ b/src/app/views/admin/hardware_profiles/_matching_provider_hardware_profiles.haml @@ -1,11 +1,13 @@ -%h3 - = @hardware_profile.name +- if @hardware_profile + %h3 + =(a)hardware_profile.name %table = sortable_table_header @provider_hwps_header - @matching_hwps.each do |hwp| %tr %td - = link_to hwp.provider.name, admin_provider_path(hwp.provider) + - if hwp.provider + = link_to hwp.provider.name, admin_provider_path(hwp.provider) %td = link_to hwp.name, admin_hardware_profile_path(hwp) %td diff --git a/src/app/views/admin/hardware_profiles/_properties.haml b/src/app/views/admin/hardware_profiles/_properties.haml index 590edc5..bc91219 100644 --- a/src/app/views/admin/hardware_profiles/_properties.haml +++ b/src/app/views/admin/hardware_profiles/_properties.haml @@ -1,5 +1,6 @@ %h3 = @hardware_profile.name + "(" + (@hardware_profile.provider_id.nil? ? "Front End" : "Provider" ) + ")" += link_to 'Edit', edit_admin_hardware_profile_path(@hardware_profile), :class => 'button' %table = sortable_table_header @properties_header - @hwp_properties.each do |hwpp| diff --git a/src/app/views/admin/hardware_profiles/create.haml b/src/app/views/admin/hardware_profiles/create.haml new file mode 100644 index 0000000..c26bbe9 --- /dev/null +++ b/src/app/views/admin/hardware_profiles/create.haml @@ -0,0 +1,6 @@ +%h3 + Check Matching Hardware Profiles +- content_for :list do + = render :partial => "form" +- content_for :details do + = render :partial => 'layouts/details_pane' \ No newline at end of file diff --git a/src/app/views/admin/hardware_profiles/edit.haml b/src/app/views/admin/hardware_profiles/edit.haml new file mode 100644 index 0000000..e32eebd --- /dev/null +++ b/src/app/views/admin/hardware_profiles/edit.haml @@ -0,0 +1,7 @@ +- content_for :list do + %h3 + Edit Hardware Profile + -form_for @hardware_profile, :url => admin_hardware_profile_path(@hardware_profile), :html => { :multipart => true } do |hwp_form| + = render :partial => "form", :locals => { :hwp_form => hwp_form } +- content_for :details do + = render :partial => 'layouts/details_pane' diff --git a/src/app/views/admin/hardware_profiles/new.haml b/src/app/views/admin/hardware_profiles/new.haml new file mode 100644 index 0000000..3355c87 --- /dev/null +++ b/src/app/views/admin/hardware_profiles/new.haml @@ -0,0 +1,7 @@ +- content_for :list do + %h3 + New Hardware Profile + -form_for @hardware_profile, :url => admin_hardware_profiles_path, :html => { :multipart => true } do |hwp_form| + = render :partial => "form", :locals => { :hwp_form => hwp_form } +- content_for :details do + = render :partial => 'layouts/details_pane' \ No newline at end of file diff --git a/src/app/views/admin/provider_accounts/new.haml b/src/app/views/admin/provider_accounts/new.haml index e567bce..55e469c 100644 --- a/src/app/views/admin/provider_accounts/new.haml +++ b/src/app/views/admin/provider_accounts/new.haml @@ -13,4 +13,4 @@ %p.requirement %span.required * \- - = t('cloud_accounts.new.required_field') + = t('cloud_accounts.new.required_field') \ No newline at end of file diff --git a/src/config/routes.rb b/src/config/routes.rb index ad9fb67..ba5109e 100644 --- a/src/config/routes.rb +++ b/src/config/routes.rb @@ -49,6 +49,8 @@ ActionController::Routing::Routes.draw do |map| map.namespace 'admin' do |r| r.resources :hardware_profiles, :realms + r.resources :hardware_profiles, :collection => { :multi_destroy => :delete } + r.resources :pool_families, :realms r.resources :providers, :collection => { :multi_destroy => :delete } r.resources :users, :collection => { :multi_destroy => :delete } r.resources :provider_accounts, :collection => { :multi_destroy => :delete } diff --git a/src/db/migrate/20090804135630_create_hardware_profiles.rb b/src/db/migrate/20090804135630_create_hardware_profiles.rb index 5ad0435..ec4a50f 100644 --- a/src/db/migrate/20090804135630_create_hardware_profiles.rb +++ b/src/db/migrate/20090804135630_create_hardware_profiles.rb @@ -40,7 +40,7 @@ class CreateHardwareProfiles < ActiveRecord::Migration end create_table :hardware_profiles do |t| - t.string :external_key, :null => false + t.string :external_key t.string :name, :null => false, :limit => 1024 t.integer :memory_id t.integer :storage_id diff --git a/src/features/hardware_profile.feature b/src/features/hardware_profile.feature index 5f63c96..9c0572d 100644 --- a/src/features/hardware_profile.feature +++ b/src/features/hardware_profile.feature @@ -77,3 +77,63 @@ Feature: Manage Pools Then I should see "m1-small" And I should not see "m1-large" And I should not see "m1-xlarge" + + Scenario: Create a new Hardware Profile + Given I am an authorised user + And I am on the hardware profiles page + When I follow "New Hardware Profile" + Then I should be on the new hardware profile page + When I fill in "name" with "Test Hardware Profile" + And I enter the following details for the Hardware Profile Properties + | name | kind | range_first | range_last | property_enum_entries | value | unit | + | memory | fixed | | | | 1740 | MB | + | cpu | range | 1 | 4 | | 2 | count | + | storage | range | 250 | 500 | | 300 | GB | + | architecture | enum | | | i386, x86_64 | i386 | label | + And I press "Save" + Then I should be on the hardware profiles page + And I should see the following: + | Test Hardware Profile | 1740 | 1 - 4 | 250 - 500 | i386, x86_64 | + + Scenario: Check New Hardware Profile matching Provider Hardware Profiles + Given I am an authorised user + And there are the following provider hardware profiles: + | name | memory | cpu |storage | architecture | + | m1-small | 1740 | 1 | 250 | i386 | + | m1-medium | 1740 | 2 | 500 | i386 | + | m1-large | 2048 | 4 | 850 | x86_64 | + And I am on the new hardware profile page + When I fill in "name" with "Test Hardware Profile" + And I enter the following details for the Hardware Profile Properties + | name | kind | range_first | range_last | property_enum_entries | value | unit | + | memory | fixed | | | | 1740 | MB | + | cpu | range | 1 | 4 | | 2 | count | + | storage | range | 250 | 500 | | 300 | GB | + | architecture | enum | | | i386, x86_64 | i386 | label | + And I press "Check Matches" + Then I should see the following: + | Name | Memory | CPU | Storage | Architecture | + | m1-small | 1740 | 1 | 250 | i386 | + | m1-medium | 1740 | 2 | 500 | i386 | + + Scenario: Update a HardwareProfile + Given I am an authorised user + And there are the following aggregator hardware profiles: + | name | memory | cpu |storage | architecture | + | m1-small | 1740 | 2 | 160 | i386 | + And I am on the hardware profiles page + When I follow "m1-small" + Then I should see "Properties" + When I follow "edit" + Then I should be on the edit hardware profiles page + When I enter the following details for the Hardware Profile Properties + | name | kind | range_first | range_last | property_enum_entries | value | + | memory | fixed | | | | 1740 | + | cpu | range | 1 | 4 | | 1 | + | storage | range | 250 | 500 | | 300 | + | architecture | enum | | | i386, x86_64 | i386 | + And I press "Save" + Then I should be on the hardware profiles page + Then I should see the following: + | Name | Memory | CPU | Storage | Architecture | + | m1-small | 1740 | 1 - 4 | 250 - 500 | i386, x86_64 | diff --git a/src/features/step_definitions/hardware_profile_steps.rb b/src/features/step_definitions/hardware_profile_steps.rb index d29d136..9a8ecbf 100644 --- a/src/features/step_definitions/hardware_profile_steps.rb +++ b/src/features/step_definitions/hardware_profile_steps.rb @@ -19,4 +19,21 @@ def create_hwp(hash, provider=nil) cpu = Factory(:mock_hwp1_cpu, :value => hash[:cpu]) arch = Factory(:mock_hwp1_arch, :value => hash[:architecture]) Factory(:mock_hwp1, :name => hash[:name], :memory => memory, :cpu => cpu, :storage => storage, :architecture => arch, :provider => provider) +end + +When /^I enter the following details for the Hardware Profile Properties$/ do |table| + table.hashes.each do |hash| + hash.each_pair do |key, value| + unless (hash[:name] == "architecture" && (key == "range_first" || key == "range_last")) || key == "name" + When "I fill in \"#{"hardware_profile_" + hash[:name] + "_attributes_" + key}\" with \"#{value}\"" + end + end + end +end + +Given /^there are the following provider hardware profiles:$/ do |table| + provider = Factory :mock_provider + table.hashes.each do |hash| + create_hwp(hash, provider) + end end \ No newline at end of file diff --git a/src/features/support/paths.rb b/src/features/support/paths.rb index c0c77dc..4bc7ba4 100644 --- a/src/features/support/paths.rb +++ b/src/features/support/paths.rb @@ -98,6 +98,12 @@ module NavigationHelpers when /the hardware profiles page/ url_for admin_hardware_profiles_path + when /the new hardware profile page/ + url_for new_admin_hardware_profile_path + + when /the edit hardware profiles page/ + url_for :action => 'edit', :controller => 'hardware_profiles', :only_path => true + when /^(.*)'s provider account page$/ admin_provider_account_path(CloudAccount.find_by_label($1)) -- 1.7.2.3

13 years, 3 months

2
1
0 / 0

InstanceKey patch (rev. 3)

by Jan Provazník

Fixed one spec test, which for some reason passes for me but not for Tomas.

13 years, 3 months

3
4
0 / 0

Deltacloud Aggregator renamed to Aeolus Conductor

by Chris Lalancette

All, As promised[1], we have renamed the Deltacloud Aggregator to the Aeolus Conductor. The new website is http://www.aeolusproject.org. The now-obsolete deltacloud git repositories have been left in place, but set read-only; new code will be committed to the aeolus repositories (links to these are at the website). The yum repositories with in-progress packages have been moved from http://repos.fedorapeople.org/deltacloud/appliance to http://repos.fedorapeople.org/aeolus/packages . There is also a new mailing list for Aeolus development, aeolus-devel(a)fedorahosted.org [2]. The old mailing list will continue to function for now, but those who mail to that list will be gently asked to repost to aeolus-devel. As usual, any questions, comments, or requests for clarification are welcome. -- Chris Lalancette [1] https://fedorahosted.org/pipermail/deltacloud-devel/2011-January/003668.html [2] https://fedorahosted.org/mailman/listinfo/aeolus-devel

13 years, 3 months

1
0
0 / 0

[PATCH aeolus] Cucumber tests for Users search

by Tomas Sedovic

From: Tomas Sedovic <tsedovic(a)redhat.com> --- src/features/step_definitions/user_steps.rb | 4 +++- src/features/user.feature | 15 +++++++++++++++ 2 files changed, 18 insertions(+), 1 deletions(-) diff --git a/src/features/step_definitions/user_steps.rb b/src/features/step_definitions/user_steps.rb index ed474e3..13932fa 100644 --- a/src/features/step_definitions/user_steps.rb +++ b/src/features/step_definitions/user_steps.rb @@ -1,5 +1,7 @@ Given /^there is a user "([^"]*)"$/ do |name| - User.find_by_login(name).should_not == nil + unless User.find_by_login(name) + Factory :user, :login => name, :email => "#{name}(a)example.com" + end end Given /^there are (\d+) users$/ do |number| diff --git a/src/features/user.feature b/src/features/user.feature index 89dd7d5..1819cb5 100644 --- a/src/features/user.feature +++ b/src/features/user.feature @@ -42,3 +42,18 @@ Feature: Manage Users When I follow "cancel" Then there should only be 2 users And I should be on the admin users page + + Scenario: Search for hardware profiles + Given there is a user "myuser" + And there is a user "someuser" + And I am on the admin users page + Then I should see "myuser" + And I should see "someuser" + When I fill in "q" with "some" + And I press "Search" + Then I should see "someuser" + And I should not see "myuser" + When I fill in "q" with "myuser" + And I press "Search" + Then I should see "myuser" + And I should not see "someuser" -- 1.7.3.4

13 years, 3 months

2
1
0 / 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

deltacloud-devel January 2011