Added policy checking for all all_tenent=True contexts

Change-Id: I6cc23ce083a7758efa9d34719ac89dfb135a4a42

designate.sublime-project

@@ -38,7 +38,8 @@
                 ".venv",
                 ".testrepository",
                 "doc/build",
-                "doc/source/api"
+                "doc/source/api",
+                "build"
             ],
             "path": "."
         }

designate/api/middleware.py

@@ -22,7 +22,6 @@ from designate import exceptions
 from designate import notifications
 from designate import wsgi
 from designate import context
-from designate import policy
 from designate.openstack.common import jsonutils as json
 from designate.openstack.common import log as logging
 from designate.openstack.common import strutils
@@ -71,15 +70,12 @@ class ContextMiddleware(wsgi.Middleware):
         params = request.params
 
         if headers.get('X-Auth-All-Projects'):
-            policy.check('all_tenants', ctxt)
             ctxt.all_tenants = \
                 strutils.bool_from_string(headers.get('X-Auth-All-Projects'))
         elif 'all_projects' in params:
-            policy.check('all_tenants', ctxt)
             ctxt.all_tenants = \
                 strutils.bool_from_string(params['all_projects'])
         elif 'all_tenants' in params:
-            policy.check('all_tenants', ctxt)
             ctxt.all_tenants = \
                 strutils.bool_from_string(params['all_tenants'])
         else:

designate/api/service.py

@@ -21,7 +21,6 @@ from designate.i18n import _LI
 from designate.openstack.deprecated import wsgi
 from designate import exceptions
 from designate import utils
-from designate import policy
 
 
 LOG = logging.getLogger(__name__)
@@ -39,8 +38,6 @@ class Service(wsgi.Service):
 
         LOG.info(_LI('Using api-paste-config found at: %s') % config_paths[0])
 
-        policy.init()
-
         application = deploy.loadapp("config:%s" % config_paths[0],
                                      name='osapi_dns')
 

designate/central/service.py

@@ -80,8 +80,6 @@ class Service(service.Service):
         backend_driver = cfg.CONF['service:central'].backend_driver
         self.backend = backend.get_backend(backend_driver, self)
 
-        policy.init()
-
         # Get a storage connection
         storage_driver = cfg.CONF['service:central'].storage_driver
         self.storage = storage.get_storage(storage_driver)
@@ -1416,8 +1414,8 @@ class Service(service.Service):
         except exceptions.DomainNotFound:
             msg = _LI('Creating zone for %(fip_id)s:%(region)s - '
                       '%(fip_addr)s zone %(zonename)s') % \
-                  {'fip_id': floatingip_id, 'region': region,
-                   'fip_addr': fip['address'], 'zonename': zone_name}
+                    {'fip_id': floatingip_id, 'region': region,
+                    'fip_addr': fip['address'], 'zonename': zone_name}
             LOG.info(msg)
 
             email = cfg.CONF['service:central'].managed_resource_email

designate/context.py

@@ -19,12 +19,16 @@ import copy
 from designate.openstack.common import context
 from designate.openstack.common import local
 from designate.openstack.common import log as logging
+from designate import policy
 
 
 LOG = logging.getLogger(__name__)
 
 
 class DesignateContext(context.RequestContext):
+
+    _all_tenants = False
+
     def __init__(self, auth_token=None, user=None, tenant=None, domain=None,
                  user_domain=None, project_domain=None, is_admin=False,
                  read_only=False, show_deleted=False, request_id=None,
@@ -49,6 +53,7 @@ class DesignateContext(context.RequestContext):
 
         self.roles = roles
         self.service_catalog = service_catalog
+
         self.all_tenants = all_tenants
 
         if not hasattr(local.store, 'context'):
@@ -112,3 +117,13 @@ class DesignateContext(context.RequestContext):
                 return arg
 
         return None
+
+    @property
+    def all_tenants(self):
+        return self._all_tenants
+
+    @all_tenants.setter
+    def all_tenants(self, value):
+        if value:
+            policy.check('all_tenants', self)
+        self._all_tenants = value

designate/service.py

@@ -24,6 +24,7 @@ from designate.openstack.common import service
 from designate.openstack.common import log as logging
 from designate.i18n import _
 from designate import rpc
+from designate import policy
 from designate import version
 
 
@@ -50,6 +51,8 @@ class Service(service.Service):
         self.topic = topic
         self.service_name = service_name
 
+        policy.init()
+
         # TODO(ekarlso): change this to be loadable via mod import or
         # stevedore?
         self.endpoints = endpoints or [self]

designate/tests/test_context.py

@@ -13,8 +13,11 @@
 # WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
 # License for the specific language governing permissions and limitations
 # under the License.
+import testtools
+
 from designate.tests import TestCase
 from designate import context
+from designate import exceptions
 from designate.openstack.common import log as logging
 
 LOG = logging.getLogger(__name__)
@@ -34,3 +37,17 @@ class TestDesignateContext(TestCase):
         self.assertFalse(ctxt.is_admin)
         self.assertTrue(admin_ctxt.is_admin)
         self.assertEqual(0, len(ctxt.roles))
+
+    def test_all_tenants(self):
+        ctxt = context.DesignateContext(user='12345', tenant='54321')
+        admin_ctxt = ctxt.elevated()
+
+        admin_ctxt.all_tenants = True
+        self.assertFalse(ctxt.is_admin)
+        self.assertTrue(admin_ctxt.is_admin)
+        self.assertTrue(admin_ctxt.all_tenants)
+
+    def test_all_tenants_policy_failure(self):
+        ctxt = context.DesignateContext(user='12345', tenant='54321')
+        with testtools.ExpectedException(exceptions.Forbidden):
+            ctxt.all_tenants = True