RPC API: Add an InvalidTenant exception

Change-Id: I0bd91c3ba15166d728f9e0570f787fdcc6a1cdc6
Signed-off-by: Zane Bitter <zbitter@redhat.com>

heat/api/aws/exception.py

@@ -246,6 +246,7 @@ def map_remote_error(ex):
         inval_param_errors = (
             'AttributeError',
             'ValueError',
+            'InvalidTenant',
         )
 
         if ex.exc_type in inval_param_errors:

heat/api/openstack/v1/util.py

@@ -91,6 +91,7 @@ def remote_error(ex, force_exists=False):
     error_map = {
         'AttributeError': client_error,
         'ValueError': client_error,
+        'InvalidTenant': exc.HTTPForbidden,
     }
 
     Exc = error_map.get(ex.exc_type, exc.HTTPInternalServerError)

heat/common/exception.py

@@ -202,3 +202,8 @@ class UserKeyPairMissing(OpenstackException):
 
 class ImageNotFound(OpenstackException):
     message = _("The Image (%(image_name)s) could not be found.")
+
+
+class InvalidTenant(OpenstackException):
+    message = _("Searching Tenant %(target)s "
+                "from Tenant %(actual)s forbidden.")

heat/engine/service.py

@@ -128,7 +128,8 @@ class EngineService(service.Service):
         identity = identifier.HeatIdentifier(**stack_identity)
 
         if identity.tenant != context.tenant_id:
-            raise AttributeError('Invalid tenant')
+            raise exception.InvalidTenant(target=identity.tenant,
+                                          actual=context.tenant_id)
 
         s = db_api.stack_get(context, identity.stack_id)
 

heat/tests/test_api_cfn_v1.py

@@ -315,6 +315,28 @@ class StackControllerTest(unittest.TestCase):
 
         self.assertEqual(response, expected)
 
+    def test_describe_arn_invalidtenant(self):
+        # Format a dummy GET request to pass into the WSGI handler
+        stack_name = u"wordpress"
+        stack_identifier = identifier.HeatIdentifier('wibble', stack_name, '6')
+        identity = dict(stack_identifier)
+        params = {'Action': 'DescribeStacks',
+                  'StackName': stack_identifier.arn()}
+        dummy_req = self._dummy_GET_request(params)
+
+        self.m.StubOutWithMock(rpc, 'call')
+        rpc.call(dummy_req.context, self.topic,
+                 {'method': 'show_stack',
+                  'args': {'stack_identity': identity},
+                  'version': self.api_version},
+                 None).AndRaise(rpc_common.RemoteError("InvalidTenant"))
+
+        self.m.ReplayAll()
+
+        result = self.controller.describe(dummy_req)
+        self.assertEqual(type(result),
+                         exception.HeatInvalidParameterValueError)
+
     def test_describe_aterr(self):
         stack_name = "wordpress"
         identity = dict(identifier.HeatIdentifier('t', stack_name, '6'))

heat/tests/test_api_openstack_v1.py

@@ -578,6 +578,26 @@ class StackControllerTest(ControllerTest, unittest.TestCase):
                           stack_id=identity.stack_id)
         self.m.VerifyAll()
 
+    def test_show_invalidtenant(self):
+        identity = identifier.HeatIdentifier('wibble', 'wordpress', '6')
+
+        req = self._get('/stacks/%(stack_name)s/%(stack_id)s' % identity)
+
+        self.m.StubOutWithMock(rpc, 'call')
+        rpc.call(req.context, self.topic,
+                 {'method': 'show_stack',
+                  'args': {'stack_identity': dict(identity)},
+                  'version': self.api_version},
+                 None).AndRaise(rpc_common.RemoteError("InvalidTenant"))
+        self.m.ReplayAll()
+
+        self.assertRaises(webob.exc.HTTPForbidden,
+                          self.controller.show,
+                          req, tenant_id=identity.tenant,
+                          stack_name=identity.stack_name,
+                          stack_id=identity.stack_id)
+        self.m.VerifyAll()
+
     def test_get_template(self):
         identity = identifier.HeatIdentifier(self.tenant, 'wordpress', '6')
         req = self._get('/stacks/%(stack_name)s/%(stack_id)s' % identity)

heat/tests/test_engine_service.py

@@ -496,6 +496,13 @@ class stackServiceTest(unittest.TestCase):
                           self.man.show_stack,
                           self.ctx, nonexist)
 
+    def test_stack_describe_bad_tenant(self):
+        nonexist = dict(self.stack_identity)
+        nonexist['tenant'] = 'wibble'
+        self.assertRaises(exception.InvalidTenant,
+                          self.man.show_stack,
+                          self.ctx, nonexist)
+
     def test_stack_describe(self):
         sl = self.man.show_stack(self.ctx, self.stack_identity)