Policy in code
This patch introduces the implementation for registering default policy rules in code. Default rules are defined under cloudkitty.common.policies. Each API's policies are defined in a sub-folder under that path and __init__.py contains all the default policies in code which are registered in the ``init`` enforcer function in cloudkitty/common/policy.py. This commit does the following: - Creates the ``policies`` module that contains all the default policies in code. - Adds the base policy rules into code (context_is_admin, admin_or_owner and default rules). - Add policies in code for current APIs - Add a tox env to generate default policy sample file - Delete policy.json from repo as policies in code will be used. Change-Id: I257e8cefc2b699fc979c717531cd9ba77233d94b Implements: blueprint policy-in-code
This commit is contained in:
@@ -44,7 +44,7 @@ class ServiceInfoController(rest.RestController):
|
||||
|
||||
:return: List of every services.
|
||||
"""
|
||||
policy.enforce(pecan.request.context, 'info:list_services_info', {})
|
||||
policy.authorize(pecan.request.context, 'info:list_services_info', {})
|
||||
services_info_list = []
|
||||
for service, metadata in METADATA.items():
|
||||
info = metadata.copy()
|
||||
@@ -60,7 +60,7 @@ class ServiceInfoController(rest.RestController):
|
||||
|
||||
:param service_name: name of the service.
|
||||
"""
|
||||
policy.enforce(pecan.request.context, 'info:get_service_info', {})
|
||||
policy.authorize(pecan.request.context, 'info:get_service_info', {})
|
||||
try:
|
||||
info = METADATA[service_name].copy()
|
||||
info['service_id'] = service_name
|
||||
@@ -81,7 +81,7 @@ class InfoController(rest.RestController):
|
||||
})
|
||||
def config(self):
|
||||
"""Return current configuration."""
|
||||
policy.enforce(pecan.request.context, 'info:get_config', {})
|
||||
policy.authorize(pecan.request.context, 'info:get_config', {})
|
||||
info = {}
|
||||
info["collect"] = ck_utils.get_metrics_conf(CONF.collect.metrics_conf)
|
||||
return info
|
||||
|
||||
Reference in New Issue
Block a user