12:14 a.m.
Privileges are now a combination of a base action and a target object type (i.e.
"modify" on Pool instead of the flat string "pool_modify"). In
addition, the modeling has changed -- instead of a privileges model that was only
low-level privileges with an explicit mapping to roles, the privileges model now tracks
the privileges assigned to each role, with no separate mapping table.
This will require a database reload as the seeds.rb required substantial changes in
role/privilege loading
Signed-off-by: Scott Seago <sseago(a)redhat.com>
---
.../admin/provider_accounts_controller.rb | 11 +-
src/app/controllers/admin/providers_controller.rb | 15 +-
src/app/controllers/admin/settings_controller.rb | 15 +--
src/app/controllers/admin/users_controller.rb | 32 +---
src/app/controllers/application_controller.rb | 11 +-
src/app/controllers/builds_controller.rb | 10 +-
src/app/controllers/cloud_accounts_controller.rb | 20 ++--
src/app/controllers/dashboard_controller.rb | 10 --
.../controllers/hardware_profiles_controller.rb | 1 -
.../controllers/image_factory/builds_controller.rb | 8 +-
.../image_factory/templates_controller.rb | 66 ++++++---
src/app/controllers/instances_controller.rb | 12 +-
src/app/controllers/permissions_controller.rb | 14 +-
src/app/controllers/pools_controller.rb | 38 ++----
src/app/controllers/providers_controller.rb | 27 ++--
src/app/controllers/quotas_controller.rb | 8 +-
.../controllers/resources/instances_controller.rb | 10 +-
src/app/controllers/resources/pools_controller.rb | 15 +-
src/app/controllers/settings_controller.rb | 17 +--
src/app/controllers/templates_controller.rb | 50 ++++--
src/app/controllers/users_controller.rb | 79 ++++------
src/app/models/cloud_account.rb | 21 +++
src/app/models/instance.rb | 27 +++-
src/app/models/permission.rb | 6 +
src/app/models/permissioned_object.rb | 136 +++++++---------
src/app/models/privilege.rb | 168 +++++++++++++-------
src/app/models/role.rb | 7 +-
src/app/models/template.rb | 5 +
src/app/services/application_service.rb | 35 +++--
src/app/views/admin/users/_form.haml | 4 +-
src/app/views/admin/users/edit.haml | 2 +-
src/app/views/dashboard/summary.haml | 20 ++--
src/app/views/layouts/_main_nav.html.erb | 2 +-
src/app/views/permissions/list.haml | 6 +-
src/app/views/pools/show.haml | 2 +-
src/app/views/providers/accounts.haml | 4 +-
src/app/views/users/_form.haml | 4 +-
src/app/views/users/edit.haml | 2 +-
.../20110107000000_privilege_model_refactor.rb | 53 ++++++
src/db/seeds.rb | 163 ++++++++------------
src/features/support/custom.rb | 4 -
src/features/support/hooks.rb | 17 --
src/lib/tasks/cucumber.rake | 6 +-
src/spec/controllers/instance_controller_spec.rb | 12 +-
src/spec/controllers/users_controller_spec.rb | 7 -
src/spec/factories/base_permission_object.rb | 3 -
src/spec/factories/metadata_object.rb | 34 ----
src/spec/factories/permission.rb | 8 +-
src/spec/factories/pool.rb | 2 +-
src/spec/factories/pool_family.rb | 2 +-
src/spec/factories/user.rb | 5 +-
src/spec/fixtures/base_permission_objects.yml | 2 -
src/spec/fixtures/privileges.yml | 43 -----
src/spec/fixtures/roles.yml | 47 ------
src/spec/models/metadata_object_spec.rb | 2 +-
src/spec/models/permission_spec.rb | 58 +++++++
src/spec/models/pool_family_spec.rb | 4 +-
src/spec/services/registration_service_spec.rb | 14 +--
src/spec/spec_helper.rb | 2 +-
59 files changed, 705 insertions(+), 703 deletions(-)
create mode 100644 src/db/migrate/20110107000000_privilege_model_refactor.rb
delete mode 100644 src/spec/factories/base_permission_object.rb
delete mode 100644 src/spec/factories/metadata_object.rb
delete mode 100644 src/spec/fixtures/base_permission_objects.yml
delete mode 100644 src/spec/fixtures/privileges.yml
delete mode 100644 src/spec/fixtures/roles.yml
create mode 100644 src/spec/models/permission_spec.rb
diff --git a/src/app/controllers/admin/provider_accounts_controller.rb
b/src/app/controllers/admin/provider_accounts_controller.rb
index 2c331f7..960f4f5 100644
--- a/src/app/controllers/admin/provider_accounts_controller.rb
+++ b/src/app/controllers/admin/provider_accounts_controller.rb
@@ -8,6 +8,7 @@ class Admin::ProviderAccountsController < ApplicationController
def show
@tab_captions = ['Properties', 'Credentials', 'History',
'Permissions']
@account = CloudAccount.find(params[:id])
+ require_privilege(Privilege::ACTION_VIEW, @account)
@details_tab = params[:details_tab].blank? ? 'properties' :
params[:details_tab]
if params.delete :test_account
@@ -34,7 +35,7 @@ class Admin::ProviderAccountsController < ApplicationController
def create
@provider = Provider.find(params[:provider_id])
- require_privilege(Privilege::ACCOUNT_MODIFY, @provider)
+ require_privilege(Privilege::ACTION_CREATE, CloudAccount, @provider)
@providers = Provider.all
@cloud_account = CloudAccount.new(params[:cloud_account])
@@ -73,13 +74,13 @@ class Admin::ProviderAccountsController < ApplicationController
@cloud_account = CloudAccount.find(params[:id])
@quota = @cloud_account.quota
@provider = @cloud_account.provider
- require_privilege(Privilege::ACCOUNT_MODIFY,@provider)
+ require_privilege(Privilege::ACTION_MODIFY,@cloud_account)
end
def update
@cloud_account = CloudAccount.find(params[:id])
@provider = @cloud_account.provider
- require_privilege(Privilege::ACCOUNT_MODIFY, @provider)
+ require_privilege(Privilege::ACTION_MODIFY,@cloud_account)
@quota = @cloud_account.quota
if params.delete :test_account
@@ -101,7 +102,9 @@ class Admin::ProviderAccountsController < ApplicationController
if (not params[:accounts_selected]) or (params[:accounts_selected].length == 0)
flash[:notice] = "You must select some accounts first."
else
- CloudAccount.destroy(params[:accounts_selected])
+ CloudAccount.find(params[:accounts_selected]).each do |account|
+ account.destroy if check_privilege(Privilege::ACTION_MODIFY, account)
+ end
end
redirect_to admin_provider_accounts_url
end
diff --git a/src/app/controllers/admin/providers_controller.rb
b/src/app/controllers/admin/providers_controller.rb
index aac2c1d..61a405b 100644
--- a/src/app/controllers/admin/providers_controller.rb
+++ b/src/app/controllers/admin/providers_controller.rb
@@ -6,19 +6,20 @@ class Admin::ProvidersController < ApplicationController
end
def new
- require_privilege(Privilege::PROVIDER_MODIFY)
+ require_privilege(Privilege::ACTION_CREATE, Provider)
@provider = Provider.new
kick_condor
end
def edit
@provider = Provider.find_by_id(params[:id])
- require_privilege(Privilege::PROVIDER_MODIFY, @provider)
+ require_privilege(Privilege::ACTION_MODIFY, @provider)
end
def show
@provider = Provider.find(params[:id])
@url_params = params.clone
+ require_privilege(Privilege::ACTION_VIEW, @provider)
@tab_captions = ['Properties', 'HW Profiles', 'Realms',
'Provider Accounts', 'Services','History','Permissions']
@details_tab = params[:details_tab].blank? ? 'properties' :
params[:details_tab]
respond_to do |format|
@@ -33,7 +34,7 @@ class Admin::ProvidersController < ApplicationController
end
def create
- require_privilege(Privilege::PROVIDER_MODIFY)
+ require_privilege(Privilege::ACTION_CREATE, Provider)
@provider = Provider.new(params[:provider])
if params[:test_connection]
test_connection(@provider)
@@ -52,8 +53,8 @@ class Admin::ProvidersController < ApplicationController
end
def update
- require_privilege(Privilege::PROVIDER_MODIFY)
@provider = Provider.find_by_id(params[:id])
+ require_privilege(Privilege::ACTION_MODIFY, @provider)
previous_cloud_type = @provider.cloud_type
@provider.update_attributes(params[:provider])
if params[:test_connection]
@@ -77,7 +78,9 @@ class Admin::ProvidersController < ApplicationController
end
def multi_destroy
- Provider.destroy(params[:provider_selected])
+ Provider.find(params[:provider_selected]).each do |provider|
+ provider.destroy if check_privilege(Privilege::ACTION_MODIFY, provider)
+ end
redirect_to admin_providers_url
end
@@ -97,7 +100,7 @@ class Admin::ProvidersController < ApplicationController
@header = [{ :name => "Provider name", :sort_attr => :name },
{ :name => "Provider URL", :sort_attr => :name }
]
- @providers = Provider.list_for_user(@current_user, Privilege::PROVIDER_VIEW)
+ @providers = Provider.list_for_user(@current_user, Privilege::ACTION_VIEW)
@url_params = params.clone
end
end
diff --git a/src/app/controllers/admin/settings_controller.rb
b/src/app/controllers/admin/settings_controller.rb
index accf398..2b816d4 100644
--- a/src/app/controllers/admin/settings_controller.rb
+++ b/src/app/controllers/admin/settings_controller.rb
@@ -6,18 +6,12 @@ class Admin::SettingsController < ApplicationController
KEYS = [SELF_SERVICE_DEFAULT_QUOTA]
def self_service
- if !is_admin?
- raise PermissionError.new('You have insufficient privileges to perform
action.')
- return
- end
+ require_privilege(Privilege::ACTION_MODIFY)
@self_service_default_quota = MetadataObject.lookup(SELF_SERVICE_DEFAULT_QUOTA)
end
def general_settings
- if !is_admin?
- raise PermissionError.new('You have insufficient privileges to perform
action.')
- return
- end
+ require_privilege(Privilege::ACTION_MODIFY)
end
def update
@@ -47,9 +41,4 @@ class Admin::SettingsController < ApplicationController
redirect_to :action => 'self_service'
end
- private
- def is_admin?
- is_admin = @current_user.permissions.collect { |p| p.role }.find { |r| r.name ==
"Administrator" }
- return is_admin == nil ? false : true
- end
end
diff --git a/src/app/controllers/admin/users_controller.rb
b/src/app/controllers/admin/users_controller.rb
index 0e854a9..4648da9 100644
--- a/src/app/controllers/admin/users_controller.rb
+++ b/src/app/controllers/admin/users_controller.rb
@@ -1,9 +1,9 @@
class Admin::UsersController < ApplicationController
before_filter :require_user
- before_filter :only_admin, :only => [:index, :multi_destroy]
before_filter :load_users, :only => [:index, :show]
def new
+ require_privilege(Privilege::ACTION_CREATE, User) unless current_user.nil?
@user = User.new
@user.quota = Quota.new
end
@@ -13,8 +13,7 @@ class Admin::UsersController < ApplicationController
redirect_to :action => 'new' and return
end
- # TODO: Shouldn't it be if current_user.nil? instead?
- require_privilege(Privilege::USER_MODIFY) unless current_user.nil?
+ require_privilege(Privilege::ACTION_MODIFY, User) unless current_user.nil?
@user = User.new(params[:user])
@registration = RegistrationService.new(@user)
@@ -34,6 +33,7 @@ class Admin::UsersController < ApplicationController
def show
@user = User.find_by_id(params[:id]) || current_user
+ require_privilege(Privilege::ACTION_VIEW, User) unless current_user == @user
@quota_resources = @user.quota.quota_resources
@url_params = params.clone
@@ -52,15 +52,12 @@ class Admin::UsersController < ApplicationController
def edit
@user = User.find_by_id(params[:id]) || current_user
-
- if cannot_modify_different_user?(@user)
- flash[:notice] = "Invalid Permission to perform this operation"
- redirect_to dashboard_url and return
- end
+ require_privilege(Privilege::ACTION_MODIFY, User) unless @user == current_user
end
def update
@user = User.find_by_id(params[:id]) || current_user
+ require_privilege(Privilege::ACTION_MODIFY, User) unless @user == current_user
if params[:commit] == "Reset"
redirect_to edit_admin_user_url(@user) and return
@@ -68,20 +65,16 @@ class Admin::UsersController < ApplicationController
redirect_to dashboard_url and return unless @user
- if cannot_modify_different_user = cannot_modify_different_user?(@user)
- flash[:notice] = "Invalid Permission to perform this operation"
- redirect_to dashboard_url and return
- end
-
unless @user.update_attributes(params[:user])
render :action => 'edit' and return
else
flash[:notice] = "User updated!"
- redirect_to cannot_modify_different_user ? dashboard_url : admin_users_url
+ redirect_to (@user == current_user) ? dashboard_url : admin_users_url
end
end
def multi_destroy
+ require_privilege(Privilege::ACTION_MODIFY, User)
User.destroy(params[:user_selected])
redirect_to admin_users_url
end
@@ -101,15 +94,4 @@ class Admin::UsersController < ApplicationController
end
end
- def only_admin
- unless current_user.permissions.collect { |p| p.role }.find { |r| r.name ==
"Administrator" }
- flash[:notice] = "Invalid Permission to perform this operation"
- redirect_to dashboard_url
- end
- end
-
- def cannot_modify_different_user?(user)
- user && user != current_user &&
!BasePermissionObject.general_permission_scope.can_modify_users(current_user)
- end
-
end
diff --git a/src/app/controllers/application_controller.rb
b/src/app/controllers/application_controller.rb
index b77fe9c..b0386e0 100644
--- a/src/app/controllers/application_controller.rb
+++ b/src/app/controllers/application_controller.rb
@@ -60,13 +60,6 @@ class ApplicationController < ActionController::Base
'generic'
end
- perm_helper_string = ""
- Privilege::FULL_PRIVILEGE_LIST.each do |privilege|
- perm_helper_string += "def has_#{privilege}?(obj=@perm_obj); " +
- "check_privilege(\"#{privilege}\", obj) end; "
- end
- master_helper_module.module_eval perm_helper_string
-
helper_method :check_privilege
protected
@@ -162,8 +155,8 @@ class ApplicationController < ActionController::Base
def get_nav_items
if current_user.present?
- @providers = Provider.list_for_user(@current_user, Privilege::PROVIDER_VIEW)
- @pools = Pool.list_for_user(@current_user, Privilege::POOL_VIEW)
+ @providers = Provider.list_for_user(@current_user, Privilege::ACTION_VIEW)
+ @pools = Pool.list_for_user(@current_user, Privilege::ACTION_VIEW)
end
end
diff --git a/src/app/controllers/builds_controller.rb
b/src/app/controllers/builds_controller.rb
index 7cf0ad6..e205171 100644
--- a/src/app/controllers/builds_controller.rb
+++ b/src/app/controllers/builds_controller.rb
@@ -1,12 +1,12 @@
class BuildsController < ApplicationController
- before_filter [:require_user, :check_permission]
+ before_filter [:require_user]
def section_id
'build'
end
def index
- require_privilege(Privilege::IMAGE_VIEW)
+ require_privilege(Privilege::ACTION_VIEW, Template)
order = get_order('templates.name')
@running_images = Image.all(:include => :template, :conditions => ['status
IN (?)', Image::ACTIVE_STATES], :order => order)
@completed_images = Image.all(:include => :template, :conditions => {:status
=> Image::STATE_COMPLETE}, :order => order)
@@ -16,6 +16,7 @@ class BuildsController < ApplicationController
def new
raise "select template to build" unless id = params[:template_id]
@tpl = Template.find(id)
+ check_permission
if @tpl.imported
flash[:warning] = "Build imported template is not supported"
redirect_to templates_path
@@ -30,6 +31,7 @@ class BuildsController < ApplicationController
end
@tpl = Template.find(params[:template_id])
+ check_permission
@all_targets = Image.available_targets
if params[:targets].blank?
@@ -60,9 +62,11 @@ class BuildsController < ApplicationController
end
def edit
+ # FIXME: is @tpl defined here? do we need check_permission here?
end
def update
+ # FIXME: is @tpl defined here? do we need check_permission here?
end
private
@@ -82,6 +86,6 @@ class BuildsController < ApplicationController
end
def check_permission
- require_privilege(Privilege::IMAGE_MODIFY)
+ require_privilege(Privilege::ACTION_MODIFY, @tpl)
end
end
diff --git a/src/app/controllers/cloud_accounts_controller.rb
b/src/app/controllers/cloud_accounts_controller.rb
index 75a75d9..c2fe5e7 100644
--- a/src/app/controllers/cloud_accounts_controller.rb
+++ b/src/app/controllers/cloud_accounts_controller.rb
@@ -31,19 +31,19 @@ class CloudAccountsController < ApplicationController
def index
@provider = Provider.find(params[:provider_id])
- require_privilege(Privilege::ACCOUNT_VIEW, @provider)
+ require_privilege(Privilege::ACTION_VIEW, CloudAccount, @provider)
end
def new
@provider = Provider.find(params[:provider_id])
@cloud_account = CloudAccount.new
@quota = Quota.new
- require_privilege(Privilege::ACCOUNT_MODIFY, @provider)
+ require_privilege(Privilege::ACTION_CREATE, CloudAccount, @provider)
end
def create
@provider = Provider.find(params[:provider_id])
- require_privilege(Privilege::ACCOUNT_MODIFY,@provider)
+ require_privilege(Privilege::ACTION_CREATE, CloudAccount, @provider)
@cloud_account = CloudAccount.new(params[:cloud_account])
@cloud_account.provider = @provider
@cloud_account.quota = @quota = Quota.new
@@ -80,13 +80,13 @@ class CloudAccountsController < ApplicationController
@cloud_account = CloudAccount.find(params[:id])
@quota = @cloud_account.quota
@provider = @cloud_account.provider
- require_privilege(Privilege::ACCOUNT_MODIFY,@provider)
+ require_privilege(Privilege::ACTION_MODIFY, @cloud_account)
end
def update_accounts
@provider = Provider.find(params[:provider][:id])
- require_privilege(Privilege::ACCOUNT_MODIFY, @provider)
- @providers = Provider.list_for_user(@current_user, Privilege::PROVIDER_VIEW)
+ require_privilege(Privilege::ACTION_MODIFY, CloudAccount, @provider)
+ @providers = Provider.list_for_user(@current_user, Privilege::ACTION_VIEW)
success = true
@provider.cloud_accounts.each do |cloud_account|
@@ -130,7 +130,7 @@ class CloudAccountsController < ApplicationController
def update
@cloud_account = CloudAccount.find(params[:id])
@provider = @cloud_account.provider
- require_privilege(Privilege::ACCOUNT_MODIFY, @provider)
+ require_privilege(Privilege::ACTION_MODIFY, @cloud_account)
@quota = @cloud_account.quota
limit = params[:quota][:maximum_running_instances] if params[:quota]
@@ -145,7 +145,7 @@ class CloudAccountsController < ApplicationController
def key
@cloud_account = CloudAccount.find(params[:id])
- require_privilege(Privilege::ACCOUNT_MODIFY,@cloud_account.provider)
+ require_privilege(Privilege::ACTION_MODIFY,@cloud_account)
unless @cloud_account.instance_key.nil?
render :text => @cloud_account.instance_key.pem
end
@@ -154,7 +154,7 @@ class CloudAccountsController < ApplicationController
def destroy
account = CloudAccount.find(params[:id])
provider = account.provider
- require_privilege(Privilege::ACCOUNT_MODIFY, provider)
+ require_privilege(Privilege::ACTION_MODIFY, account)
if account.destroy
flash[:notice] = "Cloud Account destroyed"
else
@@ -176,6 +176,6 @@ class CloudAccountsController < ApplicationController
private
def load_providers
- @providers = Provider.list_for_user(@current_user, Privilege::PROVIDER_VIEW)
+ @providers = Provider.list_for_user(@current_user, Privilege::ACTION_VIEW)
end
end
diff --git a/src/app/controllers/dashboard_controller.rb
b/src/app/controllers/dashboard_controller.rb
index 8d37a12..5254dd7 100644
--- a/src/app/controllers/dashboard_controller.rb
+++ b/src/app/controllers/dashboard_controller.rb
@@ -70,16 +70,6 @@ class DashboardController < ApplicationController
@cloud_accounts = CloudAccount.find(:all)
- # Now need to check any permissions are set since default permission and pool
- # may not be set for the admin user
- if @current_user.permissions
- # FIXME remove general role based permission check, replace w/
- # more granular / per-permission-object permission checks on the
- # dashboard in the future (here and in dashboard views)
- @is_admin = @current_user.permissions.collect { |p| p.role }.
- find { |r| r.name == "Administrator" }
- end
-
render :action => 'monitor'
end
diff --git a/src/app/controllers/hardware_profiles_controller.rb
b/src/app/controllers/hardware_profiles_controller.rb
index c3afae2..d18110c 100644
--- a/src/app/controllers/hardware_profiles_controller.rb
+++ b/src/app/controllers/hardware_profiles_controller.rb
@@ -23,7 +23,6 @@ class HardwareProfilesController < ApplicationController
def index
@hardware_profiles = HardwareProfile.find(:all)
- #require_privilege(Privilege::PROVIDER_VIEW, @hardware_profile) ?
end
def new
diff --git a/src/app/controllers/image_factory/builds_controller.rb
b/src/app/controllers/image_factory/builds_controller.rb
index 97bd32f..df9aba6 100644
--- a/src/app/controllers/image_factory/builds_controller.rb
+++ b/src/app/controllers/image_factory/builds_controller.rb
@@ -1,9 +1,10 @@
class ImageFactory::BuildsController < ApplicationController
- before_filter [:require_user, :check_permission]
+ before_filter [:require_user]
def new
raise "select template to build" unless id = params[:template_id]
@tpl = Template.find(id)
+ check_permission
if @tpl.imported
flash[:warning] = "Build imported template is not supported"
redirect_to templates_path
@@ -13,6 +14,7 @@ class ImageFactory::BuildsController < ApplicationController
def create
@tpl = Template.find(params[:template_id])
+ check_permission
@all_targets = Image.available_targets
if params[:targets].blank?
@@ -43,9 +45,11 @@ class ImageFactory::BuildsController < ApplicationController
end
def edit
+ # FIXME: is @tpl defined here? do we need check_permission here?
end
def update
+ # FIXME: is @tpl defined here? do we need check_permission here?
end
private
@@ -65,6 +69,6 @@ class ImageFactory::BuildsController < ApplicationController
end
def check_permission
- require_privilege(Privilege::IMAGE_MODIFY)
+ require_privilege(Privilege::ACTION_MODIFY, @tpl)
end
end
diff --git a/src/app/controllers/image_factory/templates_controller.rb
b/src/app/controllers/image_factory/templates_controller.rb
index fbba625..a1b0fec 100644
--- a/src/app/controllers/image_factory/templates_controller.rb
+++ b/src/app/controllers/image_factory/templates_controller.rb
@@ -2,7 +2,6 @@ require 'util/repository_manager'
class ImageFactory::TemplatesController < ApplicationController
before_filter :require_user
- before_filter :check_permission, :except => [:index, :show]
before_filter :load_templates, :only => [:index, :show]
def index
@@ -10,6 +9,7 @@ class ImageFactory::TemplatesController < ApplicationController
def show
@tpl = Template.find(params[:id])
+ require_privilege(Privilege::ACTION_VIEW, @tpl)
@url_params = params.clone
@tab_captions = ['Properties', 'Images']
@details_tab = params[:details_tab].blank? ? 'properties' :
params[:details_tab]
@@ -26,6 +26,7 @@ class ImageFactory::TemplatesController < ApplicationController
end
def new
+ check_create_permission
# can't use @template variable - is used by compass (or something other)
@tpl = Template.new(params[:tpl])
@repository_manager = RepositoryManager.new(:repositories => params[:repository]
|| @tpl.platform)
@@ -34,9 +35,11 @@ class ImageFactory::TemplatesController < ApplicationController
def add_selected
if params[:tpl] and not params[:tpl][:id].blank?
@tpl = Template.find(params[:tpl][:id])
+ check_edit_permission
@tpl.attributes = params[:tpl]
else
@tpl = Template.new(params[:tpl])
+ check_create_permission
end
@repository_manager = RepositoryManager.new(:repositories => params[:repository]
|| @tpl.platform)
@tpl.add_software(params[:packages].to_a + params[:selected_packages].to_a +
params[:cached_packages].to_a,
@@ -46,11 +49,13 @@ class ImageFactory::TemplatesController < ApplicationController
def edit
@tpl = Template.find(params[:id])
+ check_edit_permission
@tpl.attributes = params[:tpl] unless params[:tpl].blank?
@repository_manager = RepositoryManager.new(:repositories => params[:repository]
|| @tpl.platform)
end
def create
+ check_create_permission
@tpl = Template.new(params[:tpl])
@tpl.packages = params[:packages]
if @tpl.save
@@ -65,6 +70,7 @@ class ImageFactory::TemplatesController < ApplicationController
def update
@tpl = Template.find(params[:id])
+ check_edit_permission
@tpl.packages = []
if @tpl.update_attributes(params[:tpl])
@@ -120,7 +126,13 @@ class ImageFactory::TemplatesController < ApplicationController
end
def managed_content
- @tpl = params[:template_id].blank? ? Template.new :
Template.find(params[:template_id])
+ if params[:template_id].blank?
+ @tpl = Template.new
+ check_create_permission
+ else
+ @tpl = Template.find(params[:template_id])
+ check_edit_permission
+ end
@tpl.add_software(params[:packages].to_a + params[:selected_packages].to_a,
params[:groups].to_a + params[:selected_groups].to_a)
render :layout => false
@@ -133,9 +145,11 @@ class ImageFactory::TemplatesController < ApplicationController
else
errs = {}
Template.find(ids).each do |t|
- t.destroy
- unless t.destroyed?
- errs[t.name] = t.errors.full_messages.join(". ")
+ if check_permission(Privilege::ACTION_MODIFY, t)
+ t.destroy
+ errs[t.name] = t.errors.full_messages.join(". ") unless t.destroyed?
+ else
+ errs[t.name] = "You don't have permission to delete #{t.name}"
end
end
if errs.empty?
@@ -148,9 +162,11 @@ class ImageFactory::TemplatesController < ApplicationController
end
def assembly
+ # FIXME: do we need perm check here?
end
def deployment_definition
+ # FIXME: do we need perm check here?
@all_targets = Image.available_targets
end
@@ -158,9 +174,11 @@ class ImageFactory::TemplatesController < ApplicationController
params[:packages].delete(params[:name]) unless params[:name].blank?
if params[:tpl] and not params[:tpl][:id].blank?
@tpl = Template.find(params[:tpl][:id])
+ check_edit_permission
@tpl.attributes = params[:tpl]
else
@tpl = Template.new(params[:tpl])
+ check_create_permission
end
@tpl.add_software(params[:packages].to_a, params[:groups].to_a)
@repository_manager = RepositoryManager.new(:repositories => params[:repository]
|| @tpl.platform)
@@ -168,9 +186,13 @@ class ImageFactory::TemplatesController < ApplicationController
end
def multi_destroy
- # FIXME: set correct check permission when we will have it
- require_privilege(Privilege::IMAGE_MODIFY)
- Template.destroy(params[:selected])
+ @tpl = Template.find(params[:selected])
+ if check_edit_permission
+ @tpl.destroy
+ errs[(a)tpl.name] = @tpl.errors.full_messages.join(". ") unless
@tpl.destroyed?
+ else
+ errs[(a)tpl.name] = "You don't have permission to delete #{(a)tpl.name}"
+ end
redirect_to image_factory_templates_url
end
@@ -184,7 +206,6 @@ class ImageFactory::TemplatesController < ApplicationController
{:name => 'ARCH', :sort_attr => 'templates.architecture'},
{:name => 'STATUS', :sort_attr => 'status'},
]
- require_privilege(Privilege::IMAGE_VIEW)
@images = tpl.images
end
@@ -197,18 +218,21 @@ class ImageFactory::TemplatesController < ApplicationController
{:name => 'ARCH', :sort_attr => 'architecture'},
]
- # TODO: add template permission check
- require_privilege(Privilege::IMAGE_VIEW)
- @templates = Template.find(
- :all,
- :include => :images,
- :order => get_order('name')
- )
+ @templates = Template.list_for_user(Privilege::ACTION_VIEW,
+ :include => :images,
+ :order => get_order('name')
+ )
@url_params = params.clone
end
def set_package_vars(set_all = false)
- @tpl = params[:id].blank? ? Template.new : Template.find(params[:id])
+ if params[:id].blank?
+ @tpl = Template.new
+ check_create_permission
+ else
+ @tpl = Template.find(params[:id])
+ check_edit_permission
+ end
@tpl.attributes = params[:tpl] unless params[:tpl].nil?
@repository_manager = RepositoryManager.new(:repositories => params[:repository]
|| @tpl.platform)
@groups = @repository_manager.groups
@@ -230,8 +254,12 @@ class ImageFactory::TemplatesController < ApplicationController
flash.now[:error][:failures].merge!(errs)
end
- def check_permission
- require_privilege(Privilege::IMAGE_MODIFY)
+ def check_create_permission
+ require_privilege(Privilege::ACTION_CREATE, Template)
+ end
+
+ def check_edit_permission
+ require_privilege(Privilege::ACTION_MODIFY, @tpl)
end
def get_selected_id
diff --git a/src/app/controllers/instances_controller.rb
b/src/app/controllers/instances_controller.rb
index 5e68b8e..142a336 100644
--- a/src/app/controllers/instances_controller.rb
+++ b/src/app/controllers/instances_controller.rb
@@ -35,7 +35,7 @@ class InstancesController < ApplicationController
end
def index
- @pools = Pool.list_for_user(@current_user, Privilege::INSTANCE_MODIFY)
+ @pools = Pool.list_for_user(@current_user, Privilege::ACTION_MODIFY, :target_type
=> Instance)
@order_dir = params[:order_dir] == 'desc' ? 'desc' : 'asc'
@order_field = params[:order_field] || 'name'
@@ -69,7 +69,7 @@ class InstancesController < ApplicationController
def new
@instance = Instance.new(params[:instance])
- require_privilege(Privilege::INSTANCE_MODIFY, @instance.pool) if @instance.pool
+ require_privilege(Privilege::ACTION_CREATE, Instance, @instance.pool) if
@instance.pool
# FIXME: we need to list only templates for particular user,
# => TODO: add TEMPLATE_* permissions
@templates = Template.paginate(
@@ -81,7 +81,7 @@ class InstancesController < ApplicationController
def configure
@instance = Instance.new(params[:instance])
- require_privilege(Privilege::INSTANCE_MODIFY, @instance.pool)
+ require_privilege(Privilege::ACTION_CREATE, Instance, @instance.pool)
@hardware_profiles = HardwareProfile.find(:all, :include => :architecture,
:conditions => {:provider_id => nil,
'hardware_profile_properties.value' =>
@instance.template.architecture})
@@ -97,7 +97,7 @@ class InstancesController < ApplicationController
@instance.state = Instance::STATE_NEW
@instance.owner = current_user
- require_privilege(Privilege::INSTANCE_MODIFY,
+ require_privilege(Privilege::ACTION_CREATE, Instance,
Pool.find((a)instance.pool_id))
#FIXME: This should probably be in a transaction
if @instance.save!
@@ -131,7 +131,7 @@ class InstancesController < ApplicationController
end
@instance = Instance.find((params[:id] || []).first)
- require_privilege(Privilege::INSTANCE_CONTROL,@instance.pool)
+ require_privilege(Privilege::ACTION_USE,@instance)
if params[:instance_details]
render :action => 'show'
@@ -190,7 +190,7 @@ class InstancesController < ApplicationController
def instance
@instance = Instance.find(params[:id])
- require_privilege(Privilege::INSTANCE_VIEW, @instance.pool)
+ require_privilege(Privilege::ACTION_VIEW, @instance)
end
end
diff --git a/src/app/controllers/permissions_controller.rb
b/src/app/controllers/permissions_controller.rb
index c326e14..a2991d9 100644
--- a/src/app/controllers/permissions_controller.rb
+++ b/src/app/controllers/permissions_controller.rb
@@ -21,15 +21,15 @@ class PermissionsController < ApplicationController
def show
@permission = Permission.find(params[:id])
- require_privilege(Privilege::PERM_VIEW, @permission.permission_object)
+ require_privilege(Privilege::ACTION_PERM_VIEW, @permission.permission_object)
end
def list
- set_permission_object Privilege::PERM_VIEW
+ set_permission_object Privilege::ACTION_PERM_VIEW
end
def new
- set_permission_object Privilege::PERM_SET
+ set_permission_object Privilege::ACTION_PERM_SET
@permission = Permission.new(:permission_object_type => @permission_object.class,
:permission_object_id => @permission_object.id)
@users = User.all
@@ -38,7 +38,7 @@ class PermissionsController < ApplicationController
def create
@permission = Permission.new(params[:permission])
- require_privilege(Privilege::PERM_SET, @permission.permission_object)
+ require_privilege(Privilege::ACTION_PERM_SET, @permission.permission_object)
if request.post? && @permission.save
flash[:notice] = "Permission record added."
redirect_to :action => "list",
@@ -55,7 +55,7 @@ class PermissionsController < ApplicationController
def destroy
if request.post?
p =Permission.find(params[:permission][:id])
- require_privilege(Privilege::PERM_SET, p.permission_object)
+ require_privilege(Privilege::ACTION_PERM_SET, p.permission_object)
p.destroy
end
redirect_to :action => "list",
@@ -65,7 +65,7 @@ class PermissionsController < ApplicationController
private
- def set_permission_object(privilege)
+ def set_permission_object(action)
if !params[:permission_object_type].nil?
@permission_object =
params[:permission_object_type].constantize.find(params[:permission_object_id])
@@ -83,7 +83,7 @@ class PermissionsController < ApplicationController
raise ActiveRecord::RecordNotFound if @permission_object.nil?
- require_privilege(privilege, @permission_object)
+ require_privilege(action, @permission_object)
end
end
diff --git a/src/app/controllers/pools_controller.rb
b/src/app/controllers/pools_controller.rb
index 47cdc77..fdc3650 100644
--- a/src/app/controllers/pools_controller.rb
+++ b/src/app/controllers/pools_controller.rb
@@ -44,16 +44,19 @@ class PoolsController < ApplicationController
def show
@pool = Pool.find(params[:id])
+ require_privilege(Privilege::ACTION_VIEW, @pool)
end
def edit
@pool = Pool.find(params[:id])
+ require_privilege(Privilege::ACTION_MODIFY, @pool)
end
def list
#FIXME: clean this up, many error cases here
@pool = Pool.find(params[:id])
- require_privilege(Privilege::INSTANCE_VIEW,@pool)
+ # FIXME: really we need perm-filtered list here
+ require_privilege(Privilege::ACTION_VIEW, Instance, @pool)
@pool.reload
@order_dir = params[:order_dir] == 'desc' ? 'desc' : 'asc'
@@ -74,23 +77,23 @@ class PoolsController < ApplicationController
def hardware_profiles
@pool = Pool.find(params[:id])
@hardware_profiles = @pool.hardware_profiles
- require_privilege(Privilege::POOL_VIEW, @pool)
+ require_privilege(Privilege::ACTION_VIEW, @pool)
end
def realms
@pool = Pool.find(params[:id])
@realm_names = @pool.realms
- require_privilege(Privilege::POOL_VIEW,@pool)
+ require_privilege(Privilege::ACTION_VIEW, @pool)
end
def new
- require_privilege(Privilege::POOL_MODIFY)
- @pools = Pool.list_for_user(@current_user, Privilege::POOL_MODIFY)
+ require_privilege(Privilege::ACTION_CREATE, Pool)
+ @pools = Pool.list_for_user(@current_user, Privilege::ACTION_MODIFY)
@pool = Pool.new
end
def create
- require_privilege(Privilege::POOL_MODIFY)
+ require_privilege(Privilege::ACTION_CREATE, Pool)
#FIXME: This should probably be in a transaction
@pool = Pool.new(params[:pool])
@@ -118,6 +121,7 @@ class PoolsController < ApplicationController
if type == "edit"
redirect_to :action => 'edit', :id => pool_id
elsif type == "delete"
+ require_privilege(Privilege::ACTION_MODIFY, Pool.find(pool_id))
params[:id] = pool_id
destroy
end
@@ -130,27 +134,5 @@ class PoolsController < ApplicationController
def delete
end
- def accounts_for_pool
- @pool = Pool.find(params[:pool_id])
- require_privilege(Privilege::ACCOUNT_VIEW,@pool)
- @cloud_accounts = []
- all_accounts = CloudAccount.list_for_user(@current_user, Privilege::ACCOUNT_ADD)
- all_accounts.each {|account|
- @cloud_accounts << account unless @pool.cloud_accounts.map{|x|
x.id}.include?(account.id)
- }
- end
-
- def add_account
- @pool = Pool.find(params[:pool])
- @cloud_account = CloudAccount.find(params[:cloud_account])
- require_privilege(Privilege::ACCOUNT_ADD,@pool)
- require_privilege(Privilege::ACCOUNT_ADD,@cloud_account)
- Pool.transaction do
- @pool.cloud_accounts << @cloud_account unless @pool.cloud_accounts.map{|x|
x.id}.include?((a)cloud_account.id)
- @pool.save!
- @pool.populate_realms([@cloud_account])
- end
- redirect_to :action => 'show', :id => @pool.id
- end
kick_condor
end
diff --git a/src/app/controllers/providers_controller.rb
b/src/app/controllers/providers_controller.rb
index 0754d65..0104f95 100644
--- a/src/app/controllers/providers_controller.rb
+++ b/src/app/controllers/providers_controller.rb
@@ -32,25 +32,25 @@ class ProvidersController < ApplicationController
def show
@provider = Provider.find(:first, :conditions => {:id => params[:id]})
- require_privilege(Privilege::PROVIDER_VIEW, @provider)
+ require_privilege(Privilege::ACTION_VIEW, @provider)
end
def edit
- @providers = Provider.list_for_user(@current_user, Privilege::PROVIDER_MODIFY)
+ @providers = Provider.list_for_user(@current_user, Privilege::ACTION_VIEW)
@provider = Provider.find(:first, :conditions => {:id => params[:id]})
- require_privilege(Privilege::PROVIDER_MODIFY, @provider)
+ require_privilege(Privilege::ACTION_MODIFY, @provider)
end
def new
- require_privilege(Privilege::PROVIDER_MODIFY)
- @providers = Provider.list_for_user(@current_user, Privilege::PROVIDER_MODIFY)
+ require_privilege(Privilege::ACTION_CREATE, Provider)
+ @providers = Provider.list_for_user(@current_user, Privilege::ACTION_MODIFY)
@provider = Provider.new(params[:provider])
kick_condor
end
def create
- require_privilege(Privilege::PROVIDER_MODIFY)
- @providers = Provider.list_for_user(@current_user, Privilege::PROVIDER_MODIFY)
+ require_privilege(Privilege::ACTION_CREATE, Provider)
+ @providers = Provider.list_for_user(@current_user, Privilege::ACTION_MODIFY)
@provider = Provider.new(params[:provider])
if params[:test_connection]
@@ -70,9 +70,9 @@ class ProvidersController < ApplicationController
end
def update
- require_privilege(Privilege::PROVIDER_MODIFY)
- @providers = Provider.list_for_user(@current_user, Privilege::PROVIDER_MODIFY)
+ @providers = Provider.list_for_user(@current_user, Privilege::ACTION_MODIFY)
@provider = Provider.find(:first, :conditions => {:id => params[:id]})
+ require_privilege(Privilege::ACTION_MODIFY, @provider)
previous_cloud_type = @provider.cloud_type
@provider.update_attributes(params[:provider])
@@ -99,7 +99,7 @@ class ProvidersController < ApplicationController
def destroy
if request.post? || request.delete?
@provider = Provider.find(params[:id])
- require_privilege(Privilege::PROVIDER_MODIFY, @provider)
+ require_privilege(Privilege::ACTION_MODIFY, @provider)
if @provider.destroy and @provider.destroyed?
redirect_to :action => "index"
flash[:notice] = "Provider Deleted"
@@ -117,17 +117,18 @@ class ProvidersController < ApplicationController
def hardware_profiles
@provider = Provider.find(params[:id])
@hardware_profiles = @provider.hardware_profiles
- require_privilege(Privilege::PROVIDER_VIEW, @provider)
+ require_privilege(Privilege::ACTION_VIEW, @provider)
end
def realms
@provider = Provider.find(params[:id])
@realm_names = @provider.realms.collect { |r| r.name }
- require_privilege(Privilege::PROVIDER_VIEW, @provider)
+ require_privilege(Privilege::ACTION_VIEW, @provider)
end
def settings
@provider = Provider.find(params[:id])
+ require_privilege(Privilege::ACTION_VIEW, @provider)
end
def list
@@ -145,6 +146,6 @@ class ProvidersController < ApplicationController
protected
def load_providers
- @providers = Provider.list_for_user(@current_user, Privilege::PROVIDER_VIEW)
+ @providers = Provider.list_for_user(@current_user, Privilege::ACTION_VIEW)
end
end
diff --git a/src/app/controllers/quotas_controller.rb
b/src/app/controllers/quotas_controller.rb
index e9937fb..df9bb41 100644
--- a/src/app/controllers/quotas_controller.rb
+++ b/src/app/controllers/quotas_controller.rb
@@ -28,7 +28,7 @@ class QuotasController < ApplicationController
@parent_type = params[:parent_type]
@quota = @parent.quota
- require_privilege(Privilege::QUOTA_VIEW, @parent)
+ require_privilege(Privilege::ACTION_VIEW, Quota, @parent)
end
def edit
@@ -38,13 +38,13 @@ class QuotasController < ApplicationController
@quota = @parent.quota
- require_privilege(Privilege::QUOTA_MODIFY, @parent)
+ require_privilege(Privilege::ACTION_MODIFY, Quota, @parent)
end
def update
@parent = @parent = get_parent_object(params)
@parent_type = params[:parent_type]
- require_privilege(Privilege::QUOTA_MODIFY, @parent)
+ require_privilege(Privilege::ACTION_MODIFY, Quota, @parent)
@quota = @parent.quota
@name = get_parent_name(@parent, @parent_type)
@@ -60,7 +60,7 @@ class QuotasController < ApplicationController
def reset
@parent = @parent = get_parent_object(params)
@parent_type = params[:parent_type]
- require_privilege(Privilege::QUOTA_MODIFY, @parent)
+ require_privilege(Privilege::ACTION_MODIFY, Quota, @parent)
@quota = @parent.quota
@quota.maximum_running_instances = Quota::NO_LIMIT
diff --git a/src/app/controllers/resources/instances_controller.rb
b/src/app/controllers/resources/instances_controller.rb
index 3bd0c45..241dbba 100644
--- a/src/app/controllers/resources/instances_controller.rb
+++ b/src/app/controllers/resources/instances_controller.rb
@@ -5,7 +5,7 @@ class Resources::InstancesController < ApplicationController
def new
@instance = Instance.new(params[:instance])
- #require_privilege(Privilege::INSTANCE_MODIFY, @instance.pool) if @instance.pool
+ #require_privilege(Privilege::ACTION_CREATE, Instance, @instance.pool) if
@instance.pool
unless @instance.template
redirect_to select_template_resources_instances_path
@@ -36,7 +36,7 @@ class Resources::InstancesController < ApplicationController
@instance.owner = current_user
begin
- require_privilege(Privilege::INSTANCE_MODIFY,
+ require_privilege(Privilege::ACTION_CREATE, Instance,
Pool.find((a)instance.pool_id))
free_quota = Quota.can_start_instance?(@instance, nil)
@instance.transaction do
@@ -120,11 +120,11 @@ class Resources::InstancesController < ApplicationController
def load_instance
@instance = Instance.find((params[:id] || []).first)
- require_privilege(Privilege::INSTANCE_CONTROL,@instance.pool)
+ require_privilege(Privilege::ACTION_USE,@instance)
end
def init_new_instance_attrs
- @pools = Pool.list_for_user(@current_user, Privilege::INSTANCE_MODIFY)
+ @pools = Pool.list_for_user(@current_user, Privilege::ACTION_MODIFY, :target_type
=> Instance)
@realms = Realm.find(:all, :conditions => { :provider_id => nil })
@hardware_profiles = HardwareProfile.all(
:include => :architecture,
@@ -145,7 +145,7 @@ class Resources::InstancesController < ApplicationController
{:name => 'CREATED BY', :sort_attr => 'users.last_name'},
]
- pools = Pool.list_for_user(@current_user, Privilege::INSTANCE_MODIFY)
+ pools = Pool.list_for_user(@current_user, Privilege::ACTION_MODIFY, :target_type
=> Instance)
@instances = Instance.all(
:include => [:template, :owner],
:conditions => {:pool_id => pools},
diff --git a/src/app/controllers/resources/pools_controller.rb
b/src/app/controllers/resources/pools_controller.rb
index ffd1f55..3205da9 100644
--- a/src/app/controllers/resources/pools_controller.rb
+++ b/src/app/controllers/resources/pools_controller.rb
@@ -18,6 +18,7 @@ class Resources::PoolsController < ApplicationController
def show
@pool = Pool.find(params[:id])
+ require_privilege(Privilege::ACTION_VIEW, @pool)
@url_params = params.clone
@tab_captions = ['Properties', 'Deployments', 'Instances',
'History', 'Permissions']
@details_tab = params[:details_tab].blank? ? 'properties' :
params[:details_tab]
@@ -33,12 +34,12 @@ class Resources::PoolsController < ApplicationController
end
def new
- require_privilege(Privilege::POOL_MODIFY)
+ require_privilege(Privilege::ACTION_CREATE, Pool)
@pool = Pool.new
end
def create
- require_privilege(Privilege::POOL_MODIFY)
+ require_privilege(Privilege::ACTION_CREATE, Pool)
@pool = Pool.new(params[:pool])
quota = Quota.new
@@ -55,15 +56,13 @@ class Resources::PoolsController < ApplicationController
end
def edit
- require_privilege(Privilege::POOL_MODIFY)
-
@pool = Pool.find(params[:id])
+ require_privilege(Privilege::ACTION_MODIFY, @pool)
end
def update
- require_privilege(Privilege::POOL_MODIFY)
-
@pool = Pool.find(params[:id])
+ require_privilege(Privilege::ACTION_MODIFY, @pool)
if @pool.update_attributes(params[:pool])
flash[:notice] = "Pool updated."
redirect_to :action => 'show', :id => @pool.id
@@ -73,7 +72,9 @@ class Resources::PoolsController < ApplicationController
end
def multi_destroy
- Pool.destroy(params[:pools_selected])
+ Pool.find(params[:pools_selected]).each do |pool|
+ pool.destroy if check_privilege(Privilege::ACTION_MODIFY, pool)
+ end
redirect_to resources_pools_url
end
diff --git a/src/app/controllers/settings_controller.rb
b/src/app/controllers/settings_controller.rb
index ae20e12..0166e71 100644
--- a/src/app/controllers/settings_controller.rb
+++ b/src/app/controllers/settings_controller.rb
@@ -31,22 +31,16 @@ class SettingsController < ApplicationController
end
def index
- @providers = Provider.list_for_user(@current_user, Privilege::PROVIDER_VIEW)
+ @providers = Provider.list_for_user(@current_user, Privilege::ACTION_VIEW)
end
def self_service
- if !is_admin?
- raise PermissionError.new('You have insufficient privileges to perform
action.')
- return
- end
+ require_privilege(Privilege::ACTION_MODIFY)
@self_service_default_quota = MetadataObject.lookup(SELF_SERVICE_DEFAULT_QUOTA)
end
def general_settings
- if !is_admin?
- raise PermissionError.new('You have insufficient privileges to perform
action.')
- return
- end
+ require_privilege(Privilege::ACTION_MODIFY)
end
def update
@@ -76,9 +70,4 @@ class SettingsController < ApplicationController
redirect_to :action => 'self_service'
end
- private
- def is_admin?
- is_admin = @current_user.permissions.collect { |p| p.role }.find { |r| r.name ==
"Administrator" }
- return is_admin == nil ? false : true
- end
end
diff --git a/src/app/controllers/templates_controller.rb
b/src/app/controllers/templates_controller.rb
index 403e6c3..e19c8e6 100644
--- a/src/app/controllers/templates_controller.rb
+++ b/src/app/controllers/templates_controller.rb
@@ -2,7 +2,6 @@ require 'util/repository_manager'
class TemplatesController < ApplicationController
before_filter :require_user
- before_filter :check_permission, :except => :index
layout :layout
def layout
@@ -14,13 +13,10 @@ class TemplatesController < ApplicationController
end
def index
- # TODO: add template permission check
- require_privilege(Privilege::IMAGE_VIEW)
- @templates = Template.find(
- :all,
- :include => :images,
- :order => get_order('name')
- )
+ @templates = Template.list_for_user(current_user,
+ Privilege::ACTION_VIEW,
+ :include => :images,
+ :order => get_order('name'))
end
def index_action
@@ -81,6 +77,7 @@ class TemplatesController < ApplicationController
end
def new
+ check_create_permission
# can't use @template variable - is used by compass (or something other)
@tpl = Template.new(params[:tpl])
@repository_manager = RepositoryManager.new(:repositories => params[:repository]
|| @tpl.platform)
@@ -91,12 +88,14 @@ class TemplatesController < ApplicationController
def edit
@tpl = Template.find(params[:id])
+ check_edit_permission
@tpl.attributes = params[:tpl] unless params[:tpl].blank?
@repository_manager = RepositoryManager.new(:repositories => params[:repository]
|| @tpl.platform)
render :action => :edit
end
def create
+ check_create_permission
@tpl = Template.new(params[:tpl])
@tpl.packages = params[:packages]
if @tpl.save
@@ -112,6 +111,7 @@ class TemplatesController < ApplicationController
def update
@tpl = Template.find(params[:id])
@tpl.packages = []
+ check_edit_permission
if @tpl.update_attributes(params[:tpl])
@tpl.set_complete
@@ -163,7 +163,13 @@ class TemplatesController < ApplicationController
end
def managed_content
- @tpl = params[:template_id].blank? ? Template.new :
Template.find(params[:template_id])
+ if params[:template_id].blank?
+ @tpl = Template.new
+ check_create_permission
+ else
+ @tpl = Template.find(params[:template_id])
+ check_edit_permission
+ end
@tpl.add_software(params[:packages].to_a + params[:selected_packages].to_a,
params[:groups].to_a + params[:selected_groups].to_a)
render :layout => false
@@ -176,9 +182,11 @@ class TemplatesController < ApplicationController
else
errs = {}
Template.find(ids).each do |t|
- t.destroy
- unless t.destroyed?
- errs[t.name] = t.errors.full_messages.join(". ")
+ if check_permission(Privilege::ACTION_MODIFY, t)
+ t.destroy
+ errs[t.name] = t.errors.full_messages.join(". ") unless t.destroyed?
+ else
+ errs[t.name] = "You don't have permission to delete #{t.name}"
end
end
if errs.empty?
@@ -191,16 +199,24 @@ class TemplatesController < ApplicationController
end
def assembly
+ # FIXME: do we need perm check here?
end
def deployment_definition
+ # FIXME: do we need perm check here?
@all_targets = Image.available_targets
end
private
def set_package_vars(set_all = false)
- @tpl = params[:id].blank? ? Template.new : Template.find(params[:id])
+ if params[:id].blank?
+ @tpl = Template.new
+ check_create_permission
+ else
+ @tpl = Template.find(params[:id])
+ check_edit_permission
+ end
@tpl.attributes = params[:tpl] unless params[:tpl].nil?
@repository_manager = RepositoryManager.new(:repositories => params[:repository]
|| @tpl.platform)
@groups = @repository_manager.groups
@@ -222,8 +238,12 @@ class TemplatesController < ApplicationController
flash.now[:error][:failures].merge!(errs)
end
- def check_permission
- require_privilege(Privilege::IMAGE_MODIFY)
+ def check_create_permission
+ require_privilege(Privilege::ACTION_CREATE, Template)
+ end
+
+ def check_edit_permission
+ require_privilege(Privilege::ACTION_MODIFY, @tpl)
end
def get_selected_id
diff --git a/src/app/controllers/users_controller.rb
b/src/app/controllers/users_controller.rb
index 0e3220f..b462893 100644
--- a/src/app/controllers/users_controller.rb
+++ b/src/app/controllers/users_controller.rb
@@ -24,12 +24,13 @@ class UsersController < ApplicationController
before_filter :current_user
def new
+ require_privilege(Privilege::ACTION_CREATE, User) unless current_user.nil?
@user = User.new
@user.quota = Quota.new
end
def create
- require_privilege(Privilege::USER_MODIFY) unless current_user.nil?
+ require_privilege(Privilege::ACTION_CREATE, User) unless current_user.nil?
@user = User.new(params[:user])
if params[:commit] == "Reset"
@@ -58,39 +59,26 @@ class UsersController < ApplicationController
else
@user = current_user
end
+ require_privilege(Privilege::ACTION_VIEW, User) unless current_user == @user
@quota_resources = @user.quota.quota_resources()
end
def edit
- @user = params[:id] ? User.find(params[:id]) : @current_user
-
- if @user
- if @user != @current_user
- if
!BasePermissionObject.general_permission_scope.can_modify_users(@current_user)
- flash[:notice] = "Invalid Permission to perform this operation"
- redirect_to users_path
- end
- end
- end
+ @user = params[:id] ? User.find(params[:id]) : current_user
+ require_privilege(Privilege::ACTION_MODIFY, User) unless current_user == @user
end
def update
@user = params[:user][:id] ? User.find(params[:user][:id]) : @current_user
+ require_privilege(Privilege::ACTION_MODIFY, User) unless current_user == @user
if params[:commit] == "Save"
if @user
- has_users_modify =
BasePermissionObject.general_permission_scope.can_modify_users(@current_user)
- if @user != @current_user
- if !has_users_modify
- flash[:notice] = "Invalid Permission to perform this operation"
- redirect_to :dashboard
- end
- end
if @user.update_attributes(params[:user])
flash[:notice] = "User updated!"
- if has_users_modify
- redirect_to users_path
- else
+ if @user == current_user
redirect_to :dashboard
+ else
+ redirect_to users_path
end
else
render :action => :edit
@@ -102,21 +90,17 @@ class UsersController < ApplicationController
end
def index
- if @current_user.permissions.collect { |p| p.role }.find { |r| r.name ==
"Administrator" }
+ require_privilege(Privilege::ACTION_VIEW, User)
+ @users = User.all
+ sort_order = params[:sort_by].nil? ? "login" : params[:sort_by]
+ if sort_order == "percentage_quota_used"
@users = User.all
- sort_order = params[:sort_by].nil? ? "login" : params[:sort_by]
- if sort_order == "percentage_quota_used"
- @users = User.all
- @users.sort! {|x,y| y.quota.percentage_used <=> x.quota.percentage_used }
- elsif sort_order == "quota"
- @users = User.all
- @users.sort! {|x,y| (x.quota.maximum_running_instances and
y.quota.maximum_running_instances) ? x.quota.maximum_running_instances <=>
y.quota.maximum_running_instances : (x ? 1 : -1) }
- else
- @users = User.find(:all, :order => sort_order)
- end
+ @users.sort! {|x,y| y.quota.percentage_used <=> x.quota.percentage_used }
+ elsif sort_order == "quota"
+ @users = User.all
+ @users.sort! {|x,y| (x.quota.maximum_running_instances and
y.quota.maximum_running_instances) ? x.quota.maximum_running_instances <=>
y.quota.maximum_running_instances : (x ? 1 : -1) }
else
- flash[:notice] = "Invalid Permission to perform this operation"
- redirect_to :dashboard
+ @users = User.find(:all, :order => sort_order)
end
end
@@ -138,22 +122,19 @@ class UsersController < ApplicationController
end
def destroy
- if @current_user.permissions.collect { |p| p.role }.find { |r| r.name ==
"Administrator" }
- if request.post? || request.delete?
- @user = User.find(params[:id])
- if @user == @current_user
- flash[:notice] = "Can not delete the currently logged in user!"
- elsif @user.destroy
- flash[:notice] = "User Deleted"
- else
- flash[:error] = {
- :summary => "Failed to delete User",
- :failures => @user.errors.full_messages,
- }
- end
+ require_privilege(Privilege::ACTION_MODIFY, User)
+ if request.post? || request.delete?
+ @user = User.find(params[:id])
+ if @user == @current_user
+ flash[:notice] = "Can not delete the currently logged in user!"
+ elsif @user.destroy
+ flash[:notice] = "User Deleted"
+ else
+ flash[:error] = {
+ :summary => "Failed to delete User",
+ :failures => @user.errors.full_messages,
+ }
end
- else
- flash[:notice] = "Invalid Permission to perform this operation"
end
redirect_to users_path
end
diff --git a/src/app/models/cloud_account.rb b/src/app/models/cloud_account.rb
index e4fe6c6..ee07b8d 100644
--- a/src/app/models/cloud_account.rb
+++ b/src/app/models/cloud_account.rb
@@ -66,6 +66,27 @@ class CloudAccount < ActiveRecord::Base
before_destroy :destroyable?
before_validation :read_x509_files
+ def object_list
+ super << provider
+ end
+ class << self
+ alias orig_list_for_user_include list_for_user_include
+ alias orig_list_for_user_conditions list_for_user_conditions
+ end
+
+ def self.list_for_user_include
+ includes = orig_list_for_user_include
+ includes << { :provider => {:permissions => {:role => :privileges}}}
+ includes
+ end
+
+ def self.list_for_user_conditions
+ "(#{orig_list_for_user_conditions}) or
+ (permissions_providers.user_id=:user and
+ privileges_roles.target_type=:target_type and
+ privileges_roles.action=:action)"
+ end
+
def destroyable?
instances.empty?
end
diff --git a/src/app/models/instance.rb b/src/app/models/instance.rb
index 8573c5a..5aa500d 100644
--- a/src/app/models/instance.rb
+++ b/src/app/models/instance.rb
@@ -36,6 +36,10 @@ class Instance < ActiveRecord::Base
belongs_to :instance_key
belongs_to :instance_hwp
+ has_many :permissions, :as => :permission_object, :dependent => :destroy,
+ :include => [:role],
+ :order => "permissions.id ASC"
+
validates_presence_of :pool_id
validates_presence_of :hardware_profile_id
validates_presence_of :template_id
@@ -66,6 +70,27 @@ class Instance < ActiveRecord::Base
validates_inclusion_of :state,
:in => STATES
+ def object_list
+ super << pool
+ end
+ class << self
+ alias orig_list_for_user_include list_for_user_include
+ alias orig_list_for_user_conditions list_for_user_conditions
+ end
+
+ def self.list_for_user_include
+ includes = orig_list_for_user_include
+ includes << { :pool => {:permissions => {:role => :privileges}}}
+ includes
+ end
+
+ def self.list_for_user_conditions
+ "(#{orig_list_for_user_conditions}) or
+ (permissions_pools.user_id=:user and
+ privileges_roles.target_type=:target_type and
+ privileges_roles.action=:action)"
+ end
+
def get_action_list(user=nil)
# return empty list rather than nil
# FIXME: not handling pending state now -- only current state
@@ -142,7 +167,7 @@ class Instance < ActiveRecord::Base
}
instances = []
- pools = Pool.list_for_user(user, Privilege::INSTANCE_VIEW)
+ pools = Pool.list_for_user(user, Privilege::ACTION_VIEW, Instance)
pools.each{|pool| pool.instances.each {|i| instances << i}}
instances.each do |i|
if i.state == Instance::STATE_RUNNING
diff --git a/src/app/models/permission.rb b/src/app/models/permission.rb
index 349b6a7..22b228a 100644
--- a/src/app/models/permission.rb
+++ b/src/app/models/permission.rb
@@ -29,12 +29,18 @@ class Permission < ActiveRecord::Base
belongs_to :permission_object, :polymorphic => true
# type-specific associations
+ belongs_to :pool_family, :class_name => "PoolFamily",
+ :foreign_key =>
"permission_object_id"
belongs_to :pool, :class_name => "Pool",
:foreign_key =>
"permission_object_id"
+ belongs_to :instance, :class_name => "Instance",
+ :foreign_key =>
"permission_object_id"
belongs_to :provider, :class_name => "Provider",
:foreign_key =>
"permission_object_id"
belongs_to :cloud_account, :class_name => "CloudAccount",
:foreign_key =>
"permission_object_id"
+ belongs_to :template, :class_name => "Template",
+ :foreign_key =>
"permission_object_id"
belongs_to :base_permission_object, :class_name =>
"BasePermissionObject",
:foreign_key =>
"permission_object_id"
diff --git a/src/app/models/permissioned_object.rb
b/src/app/models/permissioned_object.rb
index 24aebe0..34efec8 100644
--- a/src/app/models/permissioned_object.rb
+++ b/src/app/models/permissioned_object.rb
@@ -17,91 +17,77 @@
# MA 02110-1301, USA. A copy of the GNU General Public License is
# also available at http://www.gnu.org/copyleft/gpl.html.
module PermissionedObject
- def can_view_perms(user)
- has_privilege(user, Privilege::PERM_VIEW)
- end
- def can_set_perms(user)
- has_privilege(user, Privilege::PERM_SET)
- end
-
- def can_view_instances(user)
- has_privilege(user, Privilege::INSTANCE_VIEW)
- end
- def can_modify_instances(user)
- has_privilege(user, Privilege::INSTANCE_MODIFY)
- end
- def can_control_instances(user)
- has_privilege(user, Privilege::INSTANCE_CONTROL)
- end
-
- def can_view_stats(user)
- has_privilege(user, Privilege::STATS_VIEW)
- end
-
- def can_view_accounts(user)
- has_privilege(user, Privilege::ACCOUNT_VIEW)
- end
- def can_modify_accounts(user)
- has_privilege(user, Privilege::ACCOUNT_MODIFY)
- end
-
- def can_view_pools(user)
- has_privilege(user, Privilege::POOL_VIEW)
- end
- def can_modify_pools(user)
- has_privilege(user, Privilege::POOL_MODIFY)
- end
- def can_view_quotas(user)
- has_privilege(user, Privilege::QUOTA_VIEW)
- end
- def can_modify_quotas(user)
- has_privilege(user, Privilege::QUOTA_MODIFY)
- end
-
- def can_view_providers(user)
- has_privilege(user, Privilege::PROVIDER_VIEW)
- end
- def can_modify_providers(user)
- has_privilege(user, Privilege::PROVIDER_MODIFY)
- end
-
- def can_view_users(user)
- has_privilege(user, Privilege::USER_VIEW)
- end
- def can_modify_users(user)
- has_privilege(user, Privilege::USER_MODIFY)
- end
-
- def can_view_images(user)
- has_privilege(user, Privilege::IMAGE_VIEW)
- end
- def can_modify_images(user)
- has_privilege(user, Privilege::IMAGE_MODIFY)
+ def has_privilege(user, action, target_type=nil)
+ return false if user.nil? or action.nil?
+ target_type = self.class.default_privilege_target_type if target_type.nil?
+ object_list.each do |obj|
+ return true if obj.permissions.find(:first,
+ :include => [:role => :privileges],
+ :conditions =>
+ ["permissions.user_id=:user and
+ privileges.target_type=:target_type and
+ privileges.action=:action",
+ { :user => user.id,
+ :target_type => target_type.name,
+ :action => action}])
+ end
+ return false
end
- def has_privilege(user, privilege)
- return false if user.nil?
- permissions.find(:first, :include => [:role => :privileges],
- :conditions => ["permissions.user_id=:user and
- privileges.name=:priv",
- { :user => user.id,
- :priv => privilege }])
+ # Returns the list of objects to check for permissions on -- by default
+ # this object plus the Base permission object
+ def object_list
+ [self, BasePermissionObject.general_permission_scope]
end
# Any methods here will be able to use the context of the
# ActiveRecord model the module is included in.
def self.included(base)
base.class_eval do
- def self.list_for_user(user, privilege)
- if BasePermissionObject.general_permission_scope.has_privilege(user, privilege)
- all
+ def self.default_privilege_target_type
+ self.name.constantize
+ end
+ def self.list_for_user_include
+ [{:permissions => {:role => :privileges}}]
+ end
+ def self.list_for_user_conditions
+ "permissions.user_id=:user and
+ privileges.target_type=:target_type and
+ privileges.action=:action"
+ end
+ # :conditions in hash must match form ["foo=:param and ...", {:param
=> value}]
+ def self.list_for_user(user, action, find_hash={})
+ target_type = find_hash.fetch(:target_type, self.default_privilege_target_type)
+ query_include = find_hash[:include]
+ query_order = find_hash[:order]
+ query_conditions = find_hash[:conditions]
+ return [] if user.nil? or action.nil? or target_type.nil?
+ if BasePermissionObject.general_permission_scope.has_privilege(user,
+ action,
+ target_type)
+ find(:all, :include => query_include,
+ :order => query_order,
+ :conditions => query_conditions)
else
- find(:all, :include => {:permissions => {:role => :privileges}},
- :conditions => ["permissions.user_id=:user and
- privileges.name=:priv",
- {:user => user.id,
- :priv => privilege }])
+ include_clause = self.list_for_user_include
+ if query_include.is_a?(Array)
+ include_clause += query_include
+ elsif !query_include.nil?
+ include_clause << query_include
+ end
+ conditions_hash = {:user => user.id,
+ :target_type => target_type.name,
+ :action => action}
+ if query_conditions.nil?
+ conditions_str = self.list_for_user_conditions
+ else
+ conditions_str = "(#{self.list_for_user_include}) and
(#{query_conditions[0]})"
+ conditions_hash.merge!(query_conditions[1]) { |key, h1, h2| h1 }
+ end
+ find(:all, :include => include_clause,
+ :conditions => [conditions_str, conditions_hash],
+ :order => query_order)
end
end
end
diff --git a/src/app/models/privilege.rb b/src/app/models/privilege.rb
index 552beef..6456d66 100644
--- a/src/app/models/privilege.rb
+++ b/src/app/models/privilege.rb
@@ -18,66 +18,122 @@
# also available at http://www.gnu.org/copyleft/gpl.html.
class Privilege < ActiveRecord::Base
- has_and_belongs_to_many :roles
- validates_presence_of :name
- validates_uniqueness_of :name
+ ACTION_PERM_SET = "set_perms" # can create/modify/delete permission
+ # records on this object
+ ACTION_PERM_VIEW = "view_perms" # can view permission records on this
+ # object
+ ACTION_CREATE = "create" # can create objects of this type here
+ ACTION_MODIFY = "modify" # can modify objects of this type here
+ ACTION_VIEW = "view" # can view objects of this type here
+ ACTION_USE = "use" # can use objects of this type here
+ # the meaning of 'use' is type-specific:
+ # Template: add this template to an assembly
+ # Assembly: add this assembly to a deployable
+ # Deployable: choose this deployable to launch
+ # Instance: may perform actions on this instance
+ # Realm: may map this realm
+ # CloudAccount: May add this account to PoolFamily
- #default privileges
- PERM_SET = "set_perms" # can create/modify/delete
permission
- # records on this object
- PERM_VIEW = "view_perms" # can view permission records on
this
- # object
- # instance privileges normally checked at the pool level, although
- # instance-specific overrides could be a future enhancement.
- INSTANCE_MODIFY = "instance_modify" # can create, modify, delete, or
- # control (start, stop, etc) instances
- INSTANCE_CONTROL = "instance_control" # can control (start, stop, etc)
- # instances
- INSTANCE_VIEW = "instance_view" # can view instance metadata
- # do we need a separate "connect" privilege?
+ ACTIONS = [ ACTION_CREATE, ACTION_MODIFY, ACTION_USE, ACTION_VIEW,
+ ACTION_PERM_SET, ACTION_PERM_VIEW]
+ TYPES = { BasePermissionObject => [ACTION_MODIFY, ACTION_PERM_SET,
ACTION_PERM_VIEW],
+ Template => ACTIONS,
+ Pool => ACTIONS - [ACTION_USE],
+ PoolFamily => ACTIONS - [ACTION_USE],
+ Instance => ACTIONS,
+ Quota => [ACTION_VIEW, ACTION_MODIFY],
+ HardwareProfile => ACTIONS - [ACTION_USE, ACTION_VIEW],
+ Realm => ACTIONS - [ACTION_VIEW],
+ Provider => ACTIONS - [ACTION_USE],
+ CloudAccount => ACTIONS,
+ User => [ ACTION_CREATE, ACTION_MODIFY, ACTION_VIEW] }
- # stats privileges normally checked at the pool level, although
- # instance-specific overrides could be a future enhancement.
- STATS_VIEW = "stats_view" # can view monitoring data for
- # instances
+ belongs_to :role
+ validates_presence_of :role_id
+ validates_presence_of :target_type
+ validates_presence_of :action
+ validates_uniqueness_of :action, :scope => [:target_type, :role_id]
- # to create(i.e. import) an account on a provider needs ACCOUNT_MODIFY on the
- # provider.
- ACCOUNT_MODIFY = "account_modify" # can create or modify cloud
accounts
- ACCOUNT_VIEW = "account_view" # can view cloud accounts
+ # notes on available privilege action/type pairs. Format is:
+ # Type Scope
+ # Action Notes (action defined on scope above unless specified)
+ #
+ # BasePermissionObject the base perm object
+ # modify Can modify system settings, etc.
+ # view_perms Can view permissions
+ # set_perms Can set permissions
+ #
+ # Template This template/assembly/deployable or all T/A/D in this TADCollection
+ # view Can view
+ # use Can assign T/A/D to TAD collection;
+ # (if template) can add to assembly or can use to launch instance
+ # (if assembly) can add to deployable
+ # (if deployable) can use to launch deployment
+ # (if TAD Collection) not used
+ # modify Can modify
+ # create Can create (on BasePermissionObject)
+ # view_perms Can view permissions
+ # set_perms Can set permissions
+ #
+ # Pool This pool
+ # view Can view
+ # modify Can modify
+ # create Can create (on BasePermissionObject)
+ # view_perms Can view permissions
+ # set_perms Can set permissions
+ #
+ # PoolFamily This PoolFamily
+ # view Can view
+ # modify Can modify
+ # create Can create (on BasePermissionObject)
+ # view_perms Can view permissions
+ # set_perms Can set permissions
+ #
+ # Instance This Instance or instances within this Pool
+ # view Can view
+ # use Can perform lifecycle actions on and/or view console
+ # modify Can modify
+ # create Can create (within this Pool)
+ # view_perms Can view permissions
+ # set_perms Can set permissions (or can set instance permissions on this pool)
+ #
+ # Quota The Pool/CloudAccount/PoolFamily/User assigned the quota
+ # view Can view quota on this obj
+ # modify Can edit quota on this obj
+ #
+ # HardwareProfile This HardwareProfile
+ # modify (for Aeolus HWPs) Can modify
+ # create Can create (on BasePermissionObject)
+ # view_perms Can view permissions
+ # set_perms Can set permissions
+ #
+ # Realm This Realm (or realms within this provider)
+ # use (for provider Realm) can map realm or provider to aeolus realm
+ # modify (for Aeolus realms) Can modify
+ # create Can create (within this Pool)
+ # view_perms Can view permissions
+ # set_perms Can set permissions
+ #
+ # Provider This Provider
+ # view Can view
+ # modify Can modify
+ # create Can create (on BasePermissionObject)
+ # view_perms Can view permissions
+ # set_perms Can set permissions
+ #
+ # CloudAccount This CloudAccount
+ # view Can view
+ # use Can map to PoolFamily
+ # modify Can modify
+ # create Can create (within this Provider)
+ # view_perms Can view permissions
+ # set_perms Can set permissions
+ #
+ # User This User (set on BasePermissionObject)
+ # view Can view
+ # modify Can modify
+ # create Can create
- POOL_MODIFY = "pool_modify" # can create or modify a pool
- POOL_VIEW = "pool_view" # can view a pool
-
- # quota privileges normally checked at the pool or account level,
- # depending on which quota level we're dealing with
- QUOTA_MODIFY = "quota_modify" # can create or modify a quota
- QUOTA_VIEW = "quota_view" # can view a quota
-
- # provider privileges normally checked at the provider level, although
- # 'new provider' action requires this privilege at the SystemPermission level
- PROVIDER_MODIFY = "provider_modify" # can create or modify a provider
- PROVIDER_VIEW = "provider_view" # can view a provider
-
- # normally checked at the SystemPermission level
- USER_MODIFY = "user_modify" # can create a new user (other than
- # self-registration) or modify another
- # user's metadata (for admin-level
- # actions)
- USER_VIEW = "user_view" # can view a user's profile data
-
- IMAGE_VIEW = "image_view" # can view existing images
(templates)
- IMAGE_MODIFY = "image_modify" # can create or modify images
(templates)
-
- FULL_PRIVILEGE_LIST = [PERM_SET, PERM_VIEW,
- INSTANCE_MODIFY, INSTANCE_CONTROL, INSTANCE_VIEW,
- STATS_VIEW,
- ACCOUNT_MODIFY, ACCOUNT_VIEW,
- POOL_MODIFY, POOL_VIEW,
- QUOTA_MODIFY, QUOTA_VIEW,
- PROVIDER_MODIFY, PROVIDER_VIEW,
- USER_MODIFY, USER_VIEW,
- IMAGE_VIEW, IMAGE_MODIFY]
end
diff --git a/src/app/models/role.rb b/src/app/models/role.rb
index db4a9ac..300dad8 100644
--- a/src/app/models/role.rb
+++ b/src/app/models/role.rb
@@ -18,10 +18,13 @@
# also available at http://www.gnu.org/copyleft/gpl.html.
class Role < ActiveRecord::Base
- has_many :permissions
- has_and_belongs_to_many :privileges, :uniq => true
+ has_many :permissions, :dependent => :destroy
+ has_many :privileges, :dependent => :destroy
+ validates_presence_of :scope
validates_presence_of :name
validates_uniqueness_of :name
+ validates_associated :privileges
+
end
diff --git a/src/app/models/template.rb b/src/app/models/template.rb
index d545f9b..bff586d 100644
--- a/src/app/models/template.rb
+++ b/src/app/models/template.rb
@@ -2,12 +2,17 @@ require 'util/image_descriptor_xml'
require 'typhoeus'
class Template < ActiveRecord::Base
+ include PermissionedObject
has_many :images, :dependent => :destroy
has_many :instances
before_validation :generate_uuid
before_save :update_xml
before_destroy :no_instances?
+ has_many :permissions, :as => :permission_object, :dependent => :destroy,
+ :include => [:role],
+ :order => "permissions.id ASC"
+
WAREHOUSE_CONFIG =
YAML.load_file("#{RAILS_ROOT}/config/image_warehouse.yml")
validates_presence_of :uuid
diff --git a/src/app/services/application_service.rb
b/src/app/services/application_service.rb
index 8161718..079c200 100644
--- a/src/app/services/application_service.rb
+++ b/src/app/services/application_service.rb
@@ -40,19 +40,34 @@ module ApplicationService
# @current_user must be defined
- def check_privilege(privilege, perm_obj)
- ((perm_obj and perm_obj.has_privilege(current_user, privilege)) or
- BasePermissionObject.general_permission_scope.has_privilege(current_user,
- privilege))
+ def check_privilege(action, *type_and_perm_obj)
+ target_type = nil
+ perm_obj = nil
+ type_and_perm_obj.each do |obj|
+ target_type=obj if obj.class==Class
+ perm_obj=obj if obj.is_a?(ActiveRecord::Base)
+ end
+ perm_obj=@perm_obj if perm_obj.nil?
+ perm_obj=BasePermissionObject.general_permission_scope if perm_obj.nil?
+ perm_obj.has_privilege(current_user, action, target_type)
end
- def authorized?(privilege, perm_obj=nil)
+ # Require a given privilege level to view this page
+ # 1. action is always required -- what action is being done (from
Privilege::ACTIONS)
+ # 2. perm_obj is optional -- This is the resource on which to look for permission
+ # records. If omitted, check for site-wide permissions on BasePermissionObject
+ # 3. type is also optional -- if omitted it's taken from perm_obj.
+ # For example, if action is 'view', perm_obj is a Pool and type is
omitted,
+ # then check for current user's "view pool" permission on this
pool.
+ # if action is 'view', perm_obj is a Pool and type is Quota,
+ # then check for current user's "view quota" permission on this
pool.
+ def require_privilege(action, *type_and_perm_obj)
+ perm_obj = nil
+ type_and_perm_obj.each do |obj|
+ perm_obj=obj if obj.is_a?(ActiveRecord::Base)
+ end
@perm_obj = perm_obj
- check_privilege(privilege,@perm_obj)
- end
-
- def require_privilege(privilege, perm_obj=nil)
- unless authorized?(privilege, perm_obj)
+ unless check_privilege(action, *type_and_perm_obj)
raise PermissionError.new(
'You have insufficient privileges to perform action.')
end
diff --git a/src/app/views/admin/users/_form.haml b/src/app/views/admin/users/_form.haml
index 3fdf33f..2d0945e 100644
--- a/src/app/views/admin/users/_form.haml
+++ b/src/app/views/admin/users/_form.haml
@@ -8,7 +8,7 @@
%fieldset
= form.label :password_confirmation, t(:confirm_password), :class => "grid_3
alpha"
= form.password_field :password_confirmation, :class => "grid_5"
--if has_user_modify?
+-if check_privilege(Privilege::ACTION_MODIFY, User)
%fieldset.clear
= form.label :user_status, "User Status:", :class => "alpha
grid_3"
.grid_5
@@ -25,7 +25,7 @@
%fieldset.clear
= form.label :email, t(:email), :class => "alpha grid_3"
= form.text_field :email, :class => "grid_5"
--if has_user_modify?
+-if check_privilege(Privilege::ACTION_MODIFY, User)
%h3.grid_16 User Treatment
%fieldset.clearfix
= label_tag 'apply_treatment', t(:apply_treatment), :class => "alpha
grid_3"
diff --git a/src/app/views/admin/users/edit.haml b/src/app/views/admin/users/edit.haml
index a367fec..69319e9 100644
--- a/src/app/views/admin/users/edit.haml
+++ b/src/app/views/admin/users/edit.haml
@@ -1,4 +1,4 @@
-- if has_user_modify?
+- if check_privilege(Privilege::ACTION_MODIFY, User)
%h2 Editing User: #{(a)user.first_name} #{(a)user.last_name}
- else
%h2 Editing Account
diff --git a/src/app/views/dashboard/summary.haml b/src/app/views/dashboard/summary.haml
index e6ba2dd..2f8600e 100644
--- a/src/app/views/dashboard/summary.haml
+++ b/src/app/views/dashboard/summary.haml
@@ -30,24 +30,24 @@
#actions_dashboard_section
%h2
Actions
- - if @is_admin
+ - if check_privilege(Privilege::ACTION_CREATE, Provider)
%a{:href => url_for(:controller => "providers", :action =>
"new")}
Add a Provider
+ - if check_privilege(Privilege::ACTION_CREATE, User)
%a{:href => url_for(:controller => "users", :action =>
"new")}
Create a User
- %a{:href => url_for(:controller => "instances", :action =>
"index")}
- View Instances
- - else
- %a{:href => url_for(:controller => "", :action =>
"")}
- Launch Instances
- %a{:href => url_for(:controller => "", :action =>
"")}
- Enter a help ticket
- - if BasePermissionObject.general_permission_scope.can_modify_images(@current_user)
+ %a{:href => url_for(:controller => "instances", :action =>
"index")}
+ View Instances
+ %a{:href => url_for(:controller => "", :action => "")}
+ Launch Instances
+ %a{:href => url_for(:controller => "", :action => "")}
+ Enter a help ticket
+ - if check_privilege(Privilege::ACTION_CREATE, Template)
%a{:href => url_for(:controller => "templates", :action =>
"new")}
Create a Template
#service_quality_dashboard_section
- - if @is_admin
+ - if check_privilege(Privilege::ACTION_MODIFY)
%h2
Provider Service Quality
.dashboard_section_summary
diff --git a/src/app/views/layouts/_main_nav.html.erb
b/src/app/views/layouts/_main_nav.html.erb
index e85249b..c577a3b 100644
--- a/src/app/views/layouts/_main_nav.html.erb
+++ b/src/app/views/layouts/_main_nav.html.erb
@@ -14,6 +14,6 @@
<% } %>
<% end %>
</ul>
-<% if BasePermissionObject.general_permission_scope.has_privilege(@current_user,
Privilege::POOL_MODIFY) %>
+<% if check_privilege(Privilege::ACTION_CREATE, Pool,
BasePermissionObject.general_permission_scope) %>
<%= link_to "Add a pool", {:controller => "pools", :action
=> "new"}, :class => "actionlink" %>
<% end %>
diff --git a/src/app/views/permissions/list.haml b/src/app/views/permissions/list.haml
index 27831d0..263bbb5 100644
--- a/src/app/views/permissions/list.haml
+++ b/src/app/views/permissions/list.haml
@@ -14,7 +14,7 @@
%td= permission.user.login
%td= permission.role.name
%td
- - if has_set_perms?
+ - if check_privilege(Privilege::ACTION_PERM_SET)
- form_tag :action => 'destroy' do
= hidden_field :permission, :id, :value => permission.id
= submit_tag "delete", :class => "submit_link", :id
=> "delete_#{permission.id}"
@@ -22,10 +22,10 @@
= link_to "Add a user",
|
{:controller => "users",
|
:action => "new"},
|
- :class=>"actionlink" if
has_user_modify?(BasePermissionObject.general_permission_scope) |
+ :class=>"actionlink" if
check_privilege(Privilege::ACTION_CREATE,User,BasePermissionObject.general_permission_scope)
|
-#
= link_to "Add a new permission record", |
{:action => "new", |
:permission_object_type => @permission_object.class, |
:permission_object_id => @permission_object.id}, |
- :class=>"actionlink" if has_set_perms? |
+ :class=>"actionlink" if check_privilege(Privilege::ACTION_PERM_SET) |
diff --git a/src/app/views/pools/show.haml b/src/app/views/pools/show.haml
index 229f3e2..ed14f4d 100644
--- a/src/app/views/pools/show.haml
+++ b/src/app/views/pools/show.haml
@@ -5,7 +5,7 @@
#pool-tabs
%ul
%li= link_to "Instances", {:action => "list", :id =>
@pool.id, :ajax => true}
- - if has_view_perms?
+ - if check_privilege(Privilege::ACTION_PERM_VIEW)
%li= link_to "User access", {:controller => "permissions",
:action => "list", :pool_id => @pool.id, :ajax => true}
%li= link_to "Hardware Profiles", {:action =>
"hardware_profiles", :id => @pool.id, :ajax => true}
%li= link_to "Realms", {:action => "realms", :id =>
@pool.id, :ajax => true}
diff --git a/src/app/views/providers/accounts.haml
b/src/app/views/providers/accounts.haml
index b136012..c9cb87c 100644
--- a/src/app/views/providers/accounts.haml
+++ b/src/app/views/providers/accounts.haml
@@ -26,7 +26,7 @@
= t('.quota_instances')
%span.required *
%fieldset.nomargin.clearfix
- - disabled = 'disabled' unless has_account_modify?(@provider)
+ - disabled = 'disabled' unless check_privilege(Privilege::ACTION_MODIFY,
Account, @provider)
- cloud_account_id = "cloud_accounts[#{acct.id}]"
= text_field cloud_account_id, :label, :title => t('.account_name'),
:value => acct.label, :disabled => disabled, :class => "grid_4 alpha"
= text_field cloud_account_id, :username, :title => t('.user_name'),
:value => acct.username, :disabled => disabled, :class => "grid_3"
@@ -56,7 +56,7 @@
= file_field cloud_account_id, :x509_cert_priv_file, :title =>
t('.account_private_cert'), :disabled => disabled
.grid_3
= file_field cloud_account_id, :x509_cert_pub_file, :title =>
t('.account_public_cert'), :disabled => disabled
- - remove_path = url_for :controller => 'cloud_accounts', :action =>
'destroy', :id => acct.id if has_account_modify?(@provider) &&
acct.destroyable?
+ - remove_path = url_for :controller => 'cloud_accounts', :action =>
'destroy', :id => acct.id if check_privilege(Privilege::ACTION_MODIFY, Account,
@provider) && acct.destroyable?
.grid_3.omega
%a.button{ :href => remove_path, :name =>
"remove_acc_#{acct.id}", :class => "tiny #{'disabled' unless
remove_path}" }
= t(:remove)
diff --git a/src/app/views/users/_form.haml b/src/app/views/users/_form.haml
index 8d87a2f..8a48cd8 100644
--- a/src/app/views/users/_form.haml
+++ b/src/app/views/users/_form.haml
@@ -11,7 +11,7 @@
%fieldset
= form.label :password_confirmation, t(:confirm_password), :class =>
"grid_3 alpha"
= form.password_field :password_confirmation, :class => "grid_5"
- -if has_user_modify?
+ -if check_privilege(Privilege::ACTION_MODIFY, User)
%fieldset.clear
= form.label :user_status, "User Status:", :class => "alpha
grid_3"
.grid_5
@@ -28,7 +28,7 @@
%fieldset.clear
= form.label :email, t(:email), :class => "alpha grid_3"
= form.text_field :email, :class => "grid_5"
- -if has_user_modify?
+ -if check_privilege(Privilege::ACTION_MODIFY, User)
%h3.grid_16 User Treatment
%fieldset.clearfix
= label_tag 'apply_treatment', t(:apply_treatment), :class =>
"alpha grid_3"
diff --git a/src/app/views/users/edit.haml b/src/app/views/users/edit.haml
index 0551bee..83c4236 100644
--- a/src/app/views/users/edit.haml
+++ b/src/app/views/users/edit.haml
@@ -1,5 +1,5 @@
.formwindow
-- if has_user_modify?
+- if check_privilege(Privilege::ACTION_MODIFY, User)
%h2 Editing User: #{(a)user.first_name} #{(a)user.last_name}
- else
%h2 Editing Account
diff --git a/src/db/migrate/20110107000000_privilege_model_refactor.rb
b/src/db/migrate/20110107000000_privilege_model_refactor.rb
new file mode 100644
index 0000000..78e0b99
--- /dev/null
+++ b/src/db/migrate/20110107000000_privilege_model_refactor.rb
@@ -0,0 +1,53 @@
+#
+# Copyright (C) 2011 Red Hat, Inc.
+# Written by Scott Seago <sseago(a)redhat.com>
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; version 2 of the License.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston,
+# MA 02110-1301, USA. A copy of the GNU General Public License is
+# also available at http://www.gnu.org/copyleft/gpl.html.
+
+class PrivilegeModelRefactor < ActiveRecord::Migration
+
+
+ def self.up
+ # remove old privileges and role mapping
+ drop_table :privileges_roles
+ drop_table :privileges
+
+ # new privilege model
+ create_table :privileges do |t|
+ t.integer :role_id, :null => false
+ t.string :target_type, :null => false
+ t.string :action, :null => false
+ t.integer :lock_version, :default => 0
+
+ t.timestamps
+ end
+
+ end
+
+ def self.down
+ drop_table :privileges
+ create_table :privileges do |t|
+ t.string :name, :null => false
+ t.integer :lock_version, :default => 0
+
+ t.timestamps
+ end
+ create_table :privileges_roles, :id => false do |t|
+ t.integer :privilege_id, :null => false
+ t.integer :role_id, :null => false
+ end
+ end
+end
diff --git a/src/db/seeds.rb b/src/db/seeds.rb
index 934d432..9a6065c 100644
--- a/src/db/seeds.rb
+++ b/src/db/seeds.rb
@@ -4,108 +4,75 @@ PoolFamily.create!(:name => "default", :description =>
"default pool family")
# Default Pool
Pool.create!(:name => "default_pool", :quota => Quota.create,
:pool_family => PoolFamily.find_by_name('default'))
-# Create default privileges
-privileges = ["set_perms", "view_perms",
- "instance_modify", "instance_control", "instance_view",
- "stats_view",
- "account_modify", "account_view",
- "pool_modify", "pool_view",
- "quota_modify", "quota_view",
- "provider_modify", "provider_view",
- "user_modify", "user_view",
- "image_modify", "image_view"]
-Privilege.transaction do
- privileges.each do |priv_name|
- privilege = Privilege.create!(:name => priv_name)
- end
-end
# Create default roles
-roles = {"Instance Controller" =>
- {:role_scope => "Pool",
- :privileges => ["instance_control",
- "instance_view",
- "pool_view"]},
- "Instance Controller With Monitoring" =>
- {:role_scope => "Pool",
- :privileges => ["instance_control",
- "instance_view",
- "pool_view",
- "stats_view"]},
- "Instance Creator and User" =>
- {:role_scope => "Pool",
- :privileges => ["instance_control",
- "instance_view",
- "pool_view",
- "stats_view",
- "instance_modify",
- "quota_view",
- "set_perms",
- "view_perms"]},
- "Pool Creator" =>
- {:role_scope => "Provider",
- :privileges => ["provider_view",
- "pool_modify",
- "pool_view",
- "quota_view"]},
- "Pool Administrator" =>
- {:role_scope => "Provider",
- :privileges => ["provider_view",
- "pool_modify",
- "pool_view",
- "quota_view",
- "quota_modify",
- "set_perms",
- "view_perms"]},
- "Provider Administrator" =>
- {:role_scope => "Provider",
- :privileges => ["provider_modify",
- "provider_view",
- "account_modify",
- "account_view"]},
- "Account Administrator" =>
- {:role_scope => "CloudAccount",
- :privileges => ["set_perms",
- "view_perms",
- "stats_view",
- "account_view",
- "account_modify"]},
- "Account Viewer" =>
- {:role_scope => "CloudAccount",
- :privileges => ["account_view"]},
- "Provider Creator" =>
- {:role_scope => "BasePermissionObject",
- :privileges => ["provider_modify",
- "provider_view"]},
- "Administrator" =>
- {:role_scope => "BasePermissionObject",
- :privileges => ["provider_modify",
- "provider_view",
- "account_modify",
- "account_view",
- "user_modify",
- "user_view",
- "set_perms",
- "view_perms",
- "pool_modify",
- "pool_view",
- "quota_modify",
- "quota_view",
- "stats_view",
- "instance_modify",
- "instance_control",
- "instance_view",
- "image_modify",
- "image_view"]}
+VIEW = "view"
+USE = "use"
+MOD = "modify"
+CRE = "create"
+VPRM = "view_perms"
+GPRM = "set_perms"
-}
+roles =
+ {Instance =>
+ {"Instance Controller" => {Instance => [VIEW,USE]},
+ "Instance Owner" => {Instance => [VIEW,USE,MOD,
VPRM,GPRM]}},
+ PoolFamily =>
+ {"Pool Family User" => {Pool => [VIEW]},
+ "Pool Family Owner" => {PoolFamily => [VIEW, MOD,
VPRM,GPRM],
+ Pool => [VIEW, MOD,CRE,VPRM,GPRM]}},
+ Pool =>
+ {"Pool User" => {Pool => [VIEW],
+ Instance => [ CRE],
+ Quota => [VIEW]},
+ "Pool Owner" => {Pool => [VIEW, MOD,
VPRM,GPRM],
+ Instance => [VIEW,USE,MOD,CRE],
+ Quota => [VIEW]}},
+ Provider =>
+ {"Provider Owner" => {Provider => [VIEW, MOD,
VPRM,GPRM],
+ CloudAccount => [VIEW,USE,MOD,CRE,VPRM,GPRM]}},
+ CloudAccount =>
+ {"Provider Account User" => {CloudAccount => [VIEW,USE]},
+ "Provider Account Owner" => {CloudAccount => [VIEW,USE,MOD,
VPRM,GPRM]}},
+ Template =>
+ {"Template User" => {Template => [VIEW,USE]},
+ "Template Owner" => {Template => [VIEW,USE,MOD,
VPRM,GPRM]}},
+ BasePermissionObject =>
+ {"Provider Creator" => {Provider => [ CRE]},
+ "Provider Administrator" => {Provider => [VIEW,
MOD,CRE,VPRM,GPRM],
+ CloudAccount => [VIEW,USE,MOD,CRE,VPRM,GPRM]},
+ "HWP Administrator" => {HardwareProfile => [
MOD,CRE,VPRM,GPRM]},
+ "Realm Administrator" => {Realm => [
USE,MOD,CRE,VPRM,GPRM]},
+ "Pool Creator" => {Pool => [ CRE]},
+ "Pool Administrator" => {Pool => [VIEW,
MOD,CRE,VPRM,GPRM],
+ Instance => [VIEW,USE,MOD,CRE,VPRM,GPRM],
+ Quota => [VIEW, MOD],
+ PoolFamily => [VIEW, MOD,CRE,VPRM,GPRM]},
+ "Template Administrator" => {Template =>
[VIEW,USE,MOD,CRE,VPRM,GPRM]},
+ "Administrator" => {Provider => [VIEW,
MOD,CRE,VPRM,GPRM],
+ CloudAccount => [VIEW,USE,MOD,CRE,VPRM,GPRM],
+ HardwareProfile => [ MOD,CRE,VPRM,GPRM],
+ Realm => [ USE,MOD,CRE,VPRM,GPRM],
+ User => [VIEW, MOD,CRE],
+ Pool => [VIEW, MOD,CRE,VPRM,GPRM],
+ Instance => [VIEW,USE,MOD,CRE,VPRM,GPRM],
+ Quota => [VIEW, MOD],
+ PoolFamily => [VIEW, MOD,CRE,VPRM,GPRM],
+ Template => [VIEW,USE,MOD,CRE,VPRM,GPRM],
+ BasePermissionObject => [ MOD, VPRM,GPRM]}}}
Role.transaction do
- roles.each do |role_name, role_hash|
- role = Role.create!(:name => role_name, :scope => role_hash[:role_scope])
- role.privileges = role_hash[:privileges].collect do |priv_name|
- Privilege.find_by_name(priv_name)
+ roles.each do |role_scope, scoped_hash|
+ scoped_hash.each do |role_name, role_privileges|
+ role_privileges.each do |priv_type, priv_actions|
+ role = Role.find_or_initialize_by_name(role_name)
+ role.update_attributes({:name => role_name, :scope => role_scope.name})
+ role.save!
+ priv_actions.each do |action|
+ Privilege.create!(:role => role, :target_type => priv_type.name,
+ :action => action)
+ end
+ end
end
- role.save!
end
end
@@ -118,7 +85,7 @@ MetadataObject.set("default_pool_family",
PoolFamily.find_by_name('default'))
default_pool = Pool.find_by_name("default_pool")
default_quota = Quota.create
-default_role = Role.find_by_name("Instance Creator and User")
+default_role = Role.find_by_name("Pool User")
settings = {"allow_self_service_logins" => "true",
"self_service_default_quota" => default_quota,
"self_service_default_pool" => default_pool,
diff --git a/src/features/support/custom.rb b/src/features/support/custom.rb
index 6b0db10..ec9d052 100644
--- a/src/features/support/custom.rb
+++ b/src/features/support/custom.rb
@@ -1,8 +1,4 @@
#Seed the DB with fixture data
-Fixtures.reset_cache
-fixtures_folder = File.join(Rails.root, 'spec', 'fixtures')
-fixtures = Dir[File.join(fixtures_folder, '*.yml')].map {|f| File.basename(f,
'.yml') }
-Fixtures.create_fixtures(fixtures_folder, fixtures)
# We can't stub out these methods properly in cucumber, and we don't want to
# couple these tests to require the core server be running (connections should be tested
diff --git a/src/features/support/hooks.rb b/src/features/support/hooks.rb
index c21d323..a00ac36 100644
--- a/src/features/support/hooks.rb
+++ b/src/features/support/hooks.rb
@@ -1,19 +1,2 @@
Before do
- @default_pool_family_metadata = Factory.create(:default_pool_family_metadata)
- @allow_self_service_logins = Factory(:metadata_object, :key =>
"allow_self_service_logins", :value => "true")
-
- @default_quota = Factory(:unlimited_quota)
- @self_service_default_quota = Factory(:metadata_object, :key =>
"self_service_default_quota",
- :value => @default_quota,
- :object_type =>
"Quota")
-
- @default_pool = Factory(:pool, :name => "default_pool", :quota =>
@default_quota)
- @self_service_default_pool = Factory(:metadata_object, :key =>
"self_service_default_pool",
- :value => @default_pool,
- :object_type =>
"Pool")
-
- @default_role = Role.find(:first, :conditions => ['name = ?', 'Instance
Creator and User'])
- @self_service_default_pool = Factory(:metadata_object, :key =>
"self_service_default_role",
- :value => @default_role,
- :object_type =>
"Role")
end
diff --git a/src/lib/tasks/cucumber.rake b/src/lib/tasks/cucumber.rake
index 15034cd..453f43c 100644
--- a/src/lib/tasks/cucumber.rake
+++ b/src/lib/tasks/cucumber.rake
@@ -14,19 +14,19 @@ begin
require 'cucumber/rake/task'
namespace :cucumber do
- Cucumber::Rake::Task.new({:ok => 'db:test:prepare'}, 'Run features
that should pass') do |t|
+ Cucumber::Rake::Task.new({:ok => ['db:test:prepare','db:seed']},
'Run features that should pass') do |t|
t.binary = vendored_cucumber_bin # If nil, the gem's binary is used.
t.fork = true # You may get faster startup if you set this to false
t.profile = 'default'
end
- Cucumber::Rake::Task.new({:wip => 'db:test:prepare'}, 'Run features
that are being worked on') do |t|
+ Cucumber::Rake::Task.new({:wip => ['db:test:prepare','db:seed']},
'Run features that are being worked on') do |t|
t.binary = vendored_cucumber_bin
t.fork = true # You may get faster startup if you set this to false
t.profile = 'wip'
end
- Cucumber::Rake::Task.new({:rerun => 'db:test:prepare'}, 'Record
failing features and run only them if any exist') do |t|
+ Cucumber::Rake::Task.new({:rerun =>
['db:test:prepare','db:seed']}, 'Record failing features and run only
them if any exist') do |t|
t.binary = vendored_cucumber_bin
t.fork = true # You may get faster startup if you set this to false
t.profile = 'rerun'
diff --git a/src/spec/controllers/instance_controller_spec.rb
b/src/spec/controllers/instance_controller_spec.rb
index 241c05b..34a44c8 100644
--- a/src/spec/controllers/instance_controller_spec.rb
+++ b/src/spec/controllers/instance_controller_spec.rb
@@ -20,11 +20,11 @@ describe InstancesController do
response.should_not be_success
end
- it "should allow instance creator to launch instance" do
- @inst_user_permission = Factory :instance_creator_and_user_permission
- @inst_user = @inst_user_permission.user
- UserSession.create(@inst_user)
- pool = Permission.first(:conditions => {:permission_object_type =>
'Pool', :user_id => @inst_user.id}).permission_object
+ it "should allow pool user to launch instance" do
+ @pool_user_permission = Factory :pool_user_permission
+ @pool_user = @pool_user_permission.user
+ UserSession.create(@pool_user)
+ pool = Permission.first(:conditions => {:permission_object_type =>
'Pool', :user_id => @pool_user.id}).permission_object
template = Factory.build(:template)
template.save!
hwp = Factory.build(:mock_hwp1)
@@ -36,6 +36,6 @@ describe InstancesController do
:hardware_profile_id => hwp.id }
end.should change(Instance, :count).by(1)
inst = Instance.find(:first, :conditions => ['name = ?',
'mockinstance'])
- inst.owner_id.should == @inst_user.id
+ inst.owner_id.should == @pool_user.id
end
end
diff --git a/src/spec/controllers/users_controller_spec.rb
b/src/spec/controllers/users_controller_spec.rb
index c1fad30..f9a3dde 100644
--- a/src/spec/controllers/users_controller_spec.rb
+++ b/src/spec/controllers/users_controller_spec.rb
@@ -3,16 +3,9 @@ require 'spec_helper'
describe UsersController do
before(:each) do
- unless
BasePermissionObject.find_by_name(BasePermissionObject::GENERAL_PERMISSION_SCOPE)
- Factory(:base_permission_object)
- end
@tuser = Factory :tuser
@admin_permission = Factory :admin_permission
- @admin_permission.role.privileges <<
Privilege.find_by_name('user_modify')
@admin = @admin_permission.user
- Factory.create(:default_quota_metadata)
- Factory.create(:default_role_metadata)
- Factory.create(:default_pool_metadata)
activate_authlogic
end
diff --git a/src/spec/factories/base_permission_object.rb
b/src/spec/factories/base_permission_object.rb
deleted file mode 100644
index ccc2bf1..0000000
--- a/src/spec/factories/base_permission_object.rb
+++ /dev/null
@@ -1,3 +0,0 @@
-Factory.define :base_permission_object do |o|
- o.name BasePermissionObject::GENERAL_PERMISSION_SCOPE
-end
diff --git a/src/spec/factories/metadata_object.rb
b/src/spec/factories/metadata_object.rb
deleted file mode 100644
index fea2f88..0000000
--- a/src/spec/factories/metadata_object.rb
+++ /dev/null
@@ -1,34 +0,0 @@
-Factory.define :metadata_object do |o|
- o.key 'key'
- o.value 'value'
- o.object_type nil
-end
-
-Factory.define :default_logins_metadata, :parent => :metadata_object do |o|
- o.key 'allow_self_service_logins'
- o.value 'true'
-end
-
-Factory.define :default_pool_family_metadata, :parent => :metadata_object do |o|
- o.key 'default_pool_family'
- o.value {Factory.create(:pool_family).id}
- o.object_type 'PoolFamily'
-end
-
-Factory.define :default_quota_metadata, :parent => :metadata_object do |o|
- o.key 'self_service_default_quota'
- o.value {Factory.create(:quota).id}
- o.object_type 'Quota'
-end
-
-Factory.define :default_role_metadata, :parent => :metadata_object do |o|
- o.key 'self_service_default_role'
- o.value {Factory.create(:role).id}
- o.object_type 'Role'
-end
-
-Factory.define :default_pool_metadata, :parent => :metadata_object do |o|
- o.key 'self_service_default_pool'
- o.value {Factory.create(:pool).id}
- o.object_type 'Pool'
-end
diff --git a/src/spec/factories/permission.rb b/src/spec/factories/permission.rb
index 9ccd3e7..f260ad7 100644
--- a/src/spec/factories/permission.rb
+++ b/src/spec/factories/permission.rb
@@ -16,12 +16,12 @@ end
Factory.define :pool_creator_permission, :parent => :permission do |p|
p.role { |r| Role.first(:conditions => ['name = ?', 'Pool Creator'])
|| Factory(:role, :name => 'Pool Creator') }
- p.permission_object { |r| r.association(:mock_provider) }
- p.user { |u| u.association(:pool_creator) }
+ p.permission_object { |r| BasePermissionObject.general_permission_scope }
+ p.user { |u| u.association(:pool_creator_user) }
end
-Factory.define :instance_creator_and_user_permission, :parent => :permission do |p|
- p.role { |r| Role.first(:conditions => ['name = ?', 'Instance Creator
and User']) || Factory(:role, :name => 'Instance Creator and User') }
+Factory.define :pool_user_permission, :parent => :permission do |p|
+ p.role { |r| Role.first(:conditions => ['name = ?', 'Pool User']) ||
Factory(:role, :name => 'Pool User') }
p.permission_object { |r| r.association(:pool) }
p.user { |u| u.association(:user) }
end
diff --git a/src/spec/factories/pool.rb b/src/spec/factories/pool.rb
index 32e8c99..3b20f96 100644
--- a/src/spec/factories/pool.rb
+++ b/src/spec/factories/pool.rb
@@ -1,6 +1,6 @@
Factory.define :pool do |p|
p.sequence(:name) { |n| "mypool#{n}" }
- p.association :pool_family, :factory => :pool_family
+ p.pool_family { |p| PoolFamily.find_by_name('default') }
p.association :quota
end
diff --git a/src/spec/factories/pool_family.rb b/src/spec/factories/pool_family.rb
index 4a890ce..d0ca8e7 100644
--- a/src/spec/factories/pool_family.rb
+++ b/src/spec/factories/pool_family.rb
@@ -1,4 +1,4 @@
Factory.define :pool_family do |z|
z.sequence(:name) { |n| "pool_family#{n}" }
- z.description 'default pool family'
+ z.description 'pool family'
end
diff --git a/src/spec/factories/user.rb b/src/spec/factories/user.rb
index e737a35..a9dd23e 100644
--- a/src/spec/factories/user.rb
+++ b/src/spec/factories/user.rb
@@ -14,10 +14,13 @@ end
Factory.define :admin_user, :parent => :user do |u|
end
+Factory.define :pool_creator_user, :parent => :user do |u|
+end
+
Factory.define :provider_admin_user, :parent => :user do |u|
end
Factory.define :pool_user, :parent => :user do |u|
u.sequence(:login) { |n| "pool_user#{n}" }
u.email { |e| "#{e.login}(a)example.com" }
-end
\ No newline at end of file
+end
diff --git a/src/spec/fixtures/base_permission_objects.yml
b/src/spec/fixtures/base_permission_objects.yml
deleted file mode 100644
index a520969..0000000
--- a/src/spec/fixtures/base_permission_objects.yml
+++ /dev/null
@@ -1,2 +0,0 @@
-general_permission_scope:
- name: 'general_permission_scope'
diff --git a/src/spec/fixtures/privileges.yml b/src/spec/fixtures/privileges.yml
deleted file mode 100644
index 16723de..0000000
--- a/src/spec/fixtures/privileges.yml
+++ /dev/null
@@ -1,43 +0,0 @@
-# Read about fixtures at http://ar.rubyonrails.org/classes/Fixtures.html
-
-# one:
-# column: value
-#
-# two:
-# column: value
-set_perms:
- name: set_perms
-view_perms:
- name: view_perms
-instance_modify:
- name: instance_modify
-instance_control:
- name: instance_control
-instance_view:
- name: instance_view
-stats_view:
- name: stats_view
-account_modify:
- name: account_modify
-account_view:
- name: account_view
-pool_modify:
- name: pool_modify
-pool_view:
- name: pool_view
-quota_modify:
- name: quota_modify
-quota_view:
- name: quota_view
-provider_modify:
- name: provider_modify
-provider_view:
- name: provider_view
-user_modify:
- name: user_modify
-user_view:
- name: user_view
-image_modify:
- name: image_modify
-image_view:
- name: image_view
diff --git a/src/spec/fixtures/roles.yml b/src/spec/fixtures/roles.yml
deleted file mode 100644
index d3ed623..0000000
--- a/src/spec/fixtures/roles.yml
+++ /dev/null
@@ -1,47 +0,0 @@
-# Read about fixtures at http://ar.rubyonrails.org/classes/Fixtures.html
-
-# one:
-# column: value
-#
-# two:
-# column: value
-instance_controller:
- name: Instance Controller
- scope: Pool
- privileges: instance_control, instance_view, pool_view
-instance_controller_with_monitoring:
- name: Instance Controller With Monitoring
- scope: Pool
- privileges: instance_control, instance_view, pool_view, stats_view
-instance_creator_and_user:
- name: Instance Creator and User
- scope: Pool
- privileges: instance_control, instance_view, pool_view, stats_view, instance_modify,
quota_view, set_perms, view_perms
-pool_creator:
- name: Pool Creator
- scope: Provider
- privileges: provider_view, pool_modify, pool_view, quota_view
-pool_administrator:
- name: Pool Administrator
- scope: Provider
- privileges: provider_view, pool_modify, pool_view, quota_modify, quota_view,
stats_view, set_perms, view_perms
-provider_administrator:
- name: Provider Administrator
- scope: Provider
- privileges: provider_modify, provider_view, account_modify, account_view, stats_view
-account_administrator:
- name: Account Administrator
- scope: CloudAccount
- privileges: account_modify, account_view, stats_view, set_perms, view_perms
-account_viewer:
- name: Account Viewer
- scope: CloudAccount
- privileges: account_view
-provider_creator:
- name: Provider Creator
- scope: BasePermissionObject
- privileges: provider_modify, provider_view, stats_view
-administrator:
- name: Administrator
- scope: BasePermissionObject
- privileges: provider_modify, provider_view, account_modify, account_view, user_modify,
user_view, set_perms, view_perms, pool_modify, pool_view, quota_modify, quota_view,
stats_view, instance_modify, instance_control, instance_view, image_modify, image_view
diff --git a/src/spec/models/metadata_object_spec.rb
b/src/spec/models/metadata_object_spec.rb
index e3a74f8..0290b57 100644
--- a/src/spec/models/metadata_object_spec.rb
+++ b/src/spec/models/metadata_object_spec.rb
@@ -3,7 +3,7 @@ require 'spec_helper'
describe MetadataObject do
before(:each) do
- @default_pool_family_metadata = Factory :default_pool_family_metadata
+ @default_pool_family_metadata =
MetadataObject.find_by_key("default_pool_family")
end
it "lookup on nonexistent key should return nil" do
diff --git a/src/spec/models/permission_spec.rb b/src/spec/models/permission_spec.rb
new file mode 100644
index 0000000..4da3ddf
--- /dev/null
+++ b/src/spec/models/permission_spec.rb
@@ -0,0 +1,58 @@
+require 'spec_helper'
+
+describe Permission do
+
+ before(:each) do
+ @admin_permission = Factory :admin_permission
+ @provider_admin_permission = Factory :provider_admin_permission
+ @pool_creator_permission = Factory :pool_creator_permission
+ @pool_user_permission = Factory :pool_user_permission
+
+ @admin = @admin_permission.user
+ @provider_admin = @provider_admin_permission.user
+ @pool_creator = @pool_creator_permission.user
+ @pool_user = @pool_user_permission.user
+
+ @provider = @provider_admin_permission.provider
+ @pool = @pool_user_permission.pool
+ end
+
+ it "Admin should be able to create users" do
+ BasePermissionObject.general_permission_scope.has_privilege(@admin,
+
Privilege::ACTION_CREATE,
+ User).should be_true
+ end
+
+ it "Provider Admin should NOT be able to create users" do
+ BasePermissionObject.general_permission_scope.has_privilege(@provider_admin,
+
Privilege::ACTION_CREATE,
+ User).should be_false
+ end
+
+ it "Pool User should NOT be able to create users" do
+ BasePermissionObject.general_permission_scope.has_privilege(@pool_user,
+
Privilege::ACTION_CREATE,
+ User).should be_false
+ end
+
+ it "Provider Admin should be able to edit provider" do
+ @provider.has_privilege(@provider_admin, Privilege::ACTION_MODIFY).should be_true
+ end
+
+ it "Admin should be able to edit provider" do
+ @provider.has_privilege(@admin, Privilege::ACTION_MODIFY).should be_true
+ end
+
+ it "Pool User should NOT be able to edit provider" do
+ @provider.has_privilege(@pool_user, Privilege::ACTION_MODIFY).should be_false
+ end
+
+ it "Pool User should be able to create instances in @pool" do
+ @pool.has_privilege(@pool_user, Privilege::ACTION_CREATE, Instance).should be_true
+ end
+
+ it "Pool User should NOT be able to create instances in another pool" do
+ Factory(:tpool).has_privilege(@pool_user, Privilege::ACTION_CREATE, Instance).should
be_false
+ end
+
+end
diff --git a/src/spec/models/pool_family_spec.rb b/src/spec/models/pool_family_spec.rb
index 1210b48..2b69eab 100644
--- a/src/spec/models/pool_family_spec.rb
+++ b/src/spec/models/pool_family_spec.rb
@@ -22,8 +22,8 @@ describe PoolFamily do
end
it "should have pool" do
- @pool_family.pools.size.should == 1
- @pool_family.pools[0].id.should == @pool.id
+ @pool_family.pools.size.should == 2 #default pool + pool created here
+ @pool.pool_family.id.should == @pool_family.id
end
it "should have account" do
diff --git a/src/spec/services/registration_service_spec.rb
b/src/spec/services/registration_service_spec.rb
index 41f6764..bdb6d9f 100644
--- a/src/spec/services/registration_service_spec.rb
+++ b/src/spec/services/registration_service_spec.rb
@@ -3,9 +3,6 @@ require 'spec_helper'
describe RegistrationService do
before(:each) do
- Factory.create(:default_quota_metadata)
- Factory.create(:default_role_metadata)
- Factory.create(:default_pool_metadata)
end
describe "with validations" do
@@ -22,20 +19,15 @@ describe RegistrationService do
it "should register a user with default pool/quota/role when default settings
set" do
@user = Factory :user
- @pool = Factory(:pool, :name => "default_pool")
- privilege = Privilege.find_by_name('instance_view')
- @role = Factory(:role, :privileges => [privilege])
+ @pool = MetadataObject.lookup("self_service_default_pool")
+ @role = MetadataObject.lookup("self_service_default_role")
@quota = Factory :quota
-
- MetadataObject.set("allow_self_service_logins", "true")
- MetadataObject.set("self_service_default_pool", @pool)
- MetadataObject.set("self_service_default_role", @role)
MetadataObject.set("self_service_default_quota", @quota)
@registration_service = RegistrationService.new(@user)
@registration_service.save
- @pools = Pool.list_for_user(@user, Privilege::INSTANCE_VIEW)
+ @pools = Pool.list_for_user(@user, Privilege::ACTION_CREATE, :target_type =>
Instance)
@pools.length.should == 1
@pools[0].name.should == "default_pool"
diff --git a/src/spec/spec_helper.rb b/src/spec/spec_helper.rb
index 90f0eaf..88413c0 100644
--- a/src/spec/spec_helper.rb
+++ b/src/spec/spec_helper.rb
@@ -56,7 +56,6 @@ Spec::Runner.configure do |config|
# For more information take a look at Spec::Runner::Configuration and Spec::Runner
config.before(:each, :type => :controller) do
#activate_authlogic
- @default_pool_family_metadata = Factory.create(:default_pool_family_metadata)
end
config.after(:each, :type => :controller) do
#current_user_session.destroy
@@ -66,6 +65,7 @@ Spec::Runner.configure do |config|
config.before(:suite) do
DatabaseCleaner.strategy = :truncation
DatabaseCleaner.clean_with(:truncation)
+ load "#{Rails.root}/db/seeds.rb"
end
config.before(:each) do
DatabaseCleaner.start
--
1.7.3.4