openstack/horizon
Code Issues Proposed changes

Sync nova policy

Browse Source 
Based on nova commit 32c8ac6b7dfe4ca0c211cbce7c5a67d88558126f

The new file was generated by oslopolicy-sample-generator:
  oslopolicy-sample-generator --namespace nova --format json

nova uses policy-in-code now, so there is a lot of differences.
Sorted version diff is http://paste.openstack.org/show/628742/

All policies with "@" have been dropped.
Dropped policies used in horizon are:
  os_compute_api:os-certificates:create
  os_compute_api:os-scheduler-hints:discoverable
  os_compute_api:os-server-groups:discoverable

[discoverable]
"discoverable" policies are related to nova API extensions
but the API extension mechanism has gone in Nova Queens,
so these policies now make no sense in Nova.
In Horizon side, we are still use a bit older API version
to launch instance, so it seems some fallback policies are needed
and they are added as conf/nova_policy.d.

[os_compute_api:os-certificates:create]
No corresponding policy is found, so the related policy check is dropped.
EC2 API is provided as a separate project from nova.
I guess this is the reason the policy was dropped.
DownloadEC2 action referred to it, but we already checks EC2 service
is available so I believe the policy can be dropped safely.

[openstack_dashboard.test.unit.api.rest.test_policy]
Unit tests are updated according to the nova policy change.
Note that test_rule_alone previously succeeded because it used
non-existing policy and fallbacked to 'default' rule.
The rule is changed to a policy for non-admin user.

Change-Id: I68f91bc29b20a4ecd613fc75735d38b9a48162ee
This commit is contained in:
Akihiro Motoki 2017-12-13 18:08:56 +09:00
parent 6a501248f0
commit 67410193b3
7 changed files with 73 additions and 143 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
doc/source/configuration/settings.rst
View File

@ -788,6 +788,7 @@ Default:
.. code-block:: python
{
'compute': ['nova_policy.d'],
'volume': ['cinder_policy.d'],
}
@ -798,7 +799,7 @@ additional policies specified in ``POLICY_DIRS`` are not loaded.
.. note::
``cinder_policy.d`` is registered by default
``cinder_policy.d`` and ``nova_policy.d`` are registered by default
to maintain policies which have ben dropped from nova and cinder
but horizon still uses. We recommend not to drop them.

3
openstack_dashboard/conf/nova_policy.d/api-extensions.yaml Normal file
View File

@ -0,0 +1,3 @@
# extra policies for retired nova API extensions
"os_compute_api:os-scheduler-hints:discoverable": "@"
"os_compute_api:os-server-groups:discoverable": "@"

132
openstack_dashboard/conf/nova_policy.json
View File

@ -1,21 +1,14 @@
{
"context_is_admin": "role:admin",
"admin_or_owner": "is_admin:True or project_id:%(project_id)s",
"default": "rule:admin_or_owner",
"context_is_admin": "role:admin",
"admin_or_owner": "is_admin:True or project_id:%(project_id)s",
"admin_api": "is_admin:True",
"os_compute_api:os-admin-actions:discoverable": "@",
"os_compute_api:os-admin-actions:reset_state": "rule:admin_api",
"os_compute_api:os-admin-actions:inject_network_info": "rule:admin_api",
"os_compute_api:os-admin-actions": "rule:admin_api",
"os_compute_api:os-admin-actions:reset_network": "rule:admin_api",
"os_compute_api:os-admin-password:discoverable": "@",
"os_compute_api:os-admin-password": "rule:admin_or_owner",
"os_compute_api:os-agents": "rule:admin_api",
"os_compute_api:os-agents:discoverable": "@",
"os_compute_api:os-aggregates:set_metadata": "rule:admin_api",
"os_compute_api:os-aggregates:add_host": "rule:admin_api",
"os_compute_api:os-aggregates:discoverable": "@",
"os_compute_api:os-aggregates:create": "rule:admin_api",
"os_compute_api:os-aggregates:remove_host": "rule:admin_api",
"os_compute_api:os-aggregates:update": "rule:admin_api",
@ -24,19 +17,12 @@
"os_compute_api:os-aggregates:show": "rule:admin_api",
"os_compute_api:os-assisted-volume-snapshots:create": "rule:admin_api",
"os_compute_api:os-assisted-volume-snapshots:delete": "rule:admin_api",
"os_compute_api:os-assisted-volume-snapshots:discoverable": "@",
"os_compute_api:os-attach-interfaces": "rule:admin_or_owner",
"os_compute_api:os-attach-interfaces:create": "rule:admin_or_owner",
"os_compute_api:os-attach-interfaces:delete": "rule:admin_or_owner",
"os_compute_api:os-attach-interfaces:discoverable": "@",
"os_compute_api:os-availability-zone:list": "rule:admin_or_owner",
"os_compute_api:os-availability-zone:discoverable": "@",
"os_compute_api:os-availability-zone:detail": "rule:admin_api",
"os_compute_api:os-baremetal-nodes:discoverable": "@",
"os_compute_api:os-baremetal-nodes": "rule:admin_api",
"network:attach_external_network": "is_admin:True",
"os_compute_api:os-block-device-mapping:discoverable": "@",
"os_compute_api:os-block-device-mapping-v1:discoverable": "@",
"os_compute_api:os-cells:discoverable": "@",
"os_compute_api:os-cells:update": "rule:admin_api",
"os_compute_api:os-cells:create": "rule:admin_api",
"os_compute_api:os-cells": "rule:admin_api",
@ -44,173 +30,114 @@
"os_compute_api:os-cells:delete": "rule:admin_api",
"cells_scheduler_filter:DifferentCellFilter": "is_admin:True",
"cells_scheduler_filter:TargetCellFilter": "is_admin:True",
"os_compute_api:os-certificates:discoverable": "@",
"os_compute_api:os-certificates:create": "rule:admin_or_owner",
"os_compute_api:os-certificates:show": "rule:admin_or_owner",
"os_compute_api:os-cloudpipe": "rule:admin_api",
"os_compute_api:os-cloudpipe:discoverable": "@",
"os_compute_api:os-config-drive:discoverable": "@",
"os_compute_api:os-config-drive": "rule:admin_or_owner",
"os_compute_api:os-console-auth-tokens:discoverable": "@",
"os_compute_api:os-console-auth-tokens": "rule:admin_api",
"os_compute_api:os-console-output:discoverable": "@",
"os_compute_api:os-console-output": "rule:admin_or_owner",
"os_compute_api:os-consoles:create": "rule:admin_or_owner",
"os_compute_api:os-consoles:show": "rule:admin_or_owner",
"os_compute_api:os-consoles:delete": "rule:admin_or_owner",
"os_compute_api:os-consoles:discoverable": "@",
"os_compute_api:os-consoles:index": "rule:admin_or_owner",
"os_compute_api:os-create-backup:discoverable": "@",
"os_compute_api:os-create-backup": "rule:admin_or_owner",
"os_compute_api:os-deferred-delete:discoverable": "@",
"os_compute_api:os-deferred-delete": "rule:admin_or_owner",
"os_compute_api:os-evacuate:discoverable": "@",
"os_compute_api:os-evacuate": "rule:admin_api",
"os_compute_api:os-extended-availability-zone": "rule:admin_or_owner",
"os_compute_api:os-extended-availability-zone:discoverable": "@",
"os_compute_api:os-extended-server-attributes": "rule:admin_api",
"os_compute_api:os-extended-server-attributes:discoverable": "@",
"os_compute_api:os-extended-status:discoverable": "@",
"os_compute_api:os-extended-status": "rule:admin_or_owner",
"os_compute_api:os-extended-volumes": "rule:admin_or_owner",
"os_compute_api:os-extended-volumes:discoverable": "@",
"os_compute_api:extension_info:discoverable": "@",
"os_compute_api:extensions": "rule:admin_or_owner",
"os_compute_api:extensions:discoverable": "@",
"os_compute_api:os-fixed-ips:discoverable": "@",
"os_compute_api:os-fixed-ips": "rule:admin_api",
"os_compute_api:os-flavor-access:add_tenant_access": "rule:admin_api",
"os_compute_api:os-flavor-access:discoverable": "@",
"os_compute_api:os-flavor-access:remove_tenant_access": "rule:admin_api",
"os_compute_api:os-flavor-access": "rule:admin_or_owner",
"os_compute_api:os-flavor-extra-specs:show": "rule:admin_or_owner",
"os_compute_api:os-flavor-extra-specs:create": "rule:admin_api",
"os_compute_api:os-flavor-extra-specs:discoverable": "@",
"os_compute_api:os-flavor-extra-specs:update": "rule:admin_api",
"os_compute_api:os-flavor-extra-specs:delete": "rule:admin_api",
"os_compute_api:os-flavor-extra-specs:index": "rule:admin_or_owner",
"os_compute_api:os-flavor-manage": "rule:admin_api",
"os_compute_api:os-flavor-manage:discoverable": "@",
"os_compute_api:os-flavor-manage:create": "rule:os_compute_api:os-flavor-manage",
"os_compute_api:os-flavor-manage:update": "rule:admin_api",
"os_compute_api:os-flavor-manage:delete": "rule:os_compute_api:os-flavor-manage",
"os_compute_api:os-flavor-rxtx": "rule:admin_or_owner",
"os_compute_api:os-flavor-rxtx:discoverable": "@",
"os_compute_api:flavors:discoverable": "@",
"os_compute_api:flavors": "rule:admin_or_owner",
"os_compute_api:os-floating-ip-dns": "rule:admin_or_owner",
"os_compute_api:os-floating-ip-dns:domain:update": "rule:admin_api",
"os_compute_api:os-floating-ip-dns:discoverable": "@",
"os_compute_api:os-floating-ip-dns:domain:delete": "rule:admin_api",
"os_compute_api:os-floating-ip-pools:discoverable": "@",
"os_compute_api:os-floating-ip-pools": "rule:admin_or_owner",
"os_compute_api:os-floating-ips": "rule:admin_or_owner",
"os_compute_api:os-floating-ips:discoverable": "@",
"os_compute_api:os-floating-ips-bulk:discoverable": "@",
"os_compute_api:os-floating-ips-bulk": "rule:admin_api",
"os_compute_api:os-fping:all_tenants": "rule:admin_api",
"os_compute_api:os-fping:discoverable": "@",
"os_compute_api:os-fping": "rule:admin_or_owner",
"os_compute_api:os-hide-server-addresses:discoverable": "@",
"os_compute_api:os-hide-server-addresses": "is_admin:False",
"os_compute_api:os-hosts:discoverable": "@",
"os_compute_api:os-hosts": "rule:admin_api",
"os_compute_api:os-hypervisors:discoverable": "@",
"os_compute_api:os-hypervisors": "rule:admin_api",
"os_compute_api:image-metadata:discoverable": "@",
"os_compute_api:image-size:discoverable": "@",
"os_compute_api:image-size": "rule:admin_or_owner",
"os_compute_api:images:discoverable": "@",
"os_compute_api:os-instance-actions:events": "rule:admin_api",
"os_compute_api:os-instance-actions": "rule:admin_or_owner",
"os_compute_api:os-instance-actions:discoverable": "@",
"os_compute_api:os-instance-usage-audit-log": "rule:admin_api",
"os_compute_api:os-instance-usage-audit-log:discoverable": "@",
"os_compute_api:ips:discoverable": "@",
"os_compute_api:ips:show": "rule:admin_or_owner",
"os_compute_api:ips:index": "rule:admin_or_owner",
"os_compute_api:os-keypairs:discoverable": "@",
"os_compute_api:os-keypairs:index": "rule:admin_api or user_id:%(user_id)s",
"os_compute_api:os-keypairs:create": "rule:admin_api or user_id:%(user_id)s",
"os_compute_api:os-keypairs:delete": "rule:admin_api or user_id:%(user_id)s",
"os_compute_api:os-keypairs:show": "rule:admin_api or user_id:%(user_id)s",
"os_compute_api:os-keypairs": "rule:admin_or_owner",
"os_compute_api:limits:discoverable": "@",
"os_compute_api:limits": "rule:admin_or_owner",
"os_compute_api:os-lock-server:discoverable": "@",
"os_compute_api:os-lock-server:lock": "rule:admin_or_owner",
"os_compute_api:os-lock-server:unlock:unlock_override": "rule:admin_api",
"os_compute_api:os-lock-server:unlock": "rule:admin_or_owner",
"os_compute_api:os-lock-server:unlock:unlock_override": "rule:admin_api",
"os_compute_api:os-migrate-server:migrate": "rule:admin_api",
"os_compute_api:os-migrate-server:discoverable": "@",
"os_compute_api:os-migrate-server:migrate_live": "rule:admin_api",
"os_compute_api:os-migrations:index": "rule:admin_api",
"os_compute_api:os-migrations:discoverable": "@",
"os_compute_api:os-multinic": "rule:admin_or_owner",
"os_compute_api:os-multinic:discoverable": "@",
"os_compute_api:os-multiple-create:discoverable": "@",
"os_compute_api:os-networks:discoverable": "@",
"os_compute_api:os-networks": "rule:admin_api",
"os_compute_api:os-networks:view": "rule:admin_or_owner",
"os_compute_api:os-networks-associate": "rule:admin_api",
"os_compute_api:os-networks-associate:discoverable": "@",
"os_compute_api:os-pause-server:unpause": "rule:admin_or_owner",
"os_compute_api:os-pause-server:discoverable": "@",
"os_compute_api:os-pause-server:pause": "rule:admin_or_owner",
"os_compute_api:os-pci:index": "rule:admin_api",
"os_compute_api:os-pci:detail": "rule:admin_api",
"os_compute_api:os-pci:pci_servers": "rule:admin_or_owner",
"os_compute_api:os-pci:show": "rule:admin_api",
"os_compute_api:os-pci:discoverable": "@",
"os_compute_api:os-pause-server:unpause": "rule:admin_or_owner",
"os_compute_api:os-quota-class-sets:show": "is_admin:True or quota_class:%(quota_class)s",
"os_compute_api:os-quota-class-sets:discoverable": "@",
"os_compute_api:os-quota-class-sets:update": "rule:admin_api",
"os_compute_api:os-quota-sets:update": "rule:admin_api",
"os_compute_api:os-quota-sets:defaults": "@",
"os_compute_api:os-quota-sets:show": "rule:admin_or_owner",
"os_compute_api:os-quota-sets:delete": "rule:admin_api",
"os_compute_api:os-quota-sets:discoverable": "@",
"os_compute_api:os-quota-sets:detail": "rule:admin_api",
"os_compute_api:os-quota-sets:detail": "rule:admin_or_owner",
"os_compute_api:os-remote-consoles": "rule:admin_or_owner",
"os_compute_api:os-remote-consoles:discoverable": "@",
"os_compute_api:os-rescue:discoverable": "@",
"os_compute_api:os-rescue": "rule:admin_or_owner",
"os_compute_api:os-scheduler-hints:discoverable": "@",
"os_compute_api:os-security-group-default-rules:discoverable": "@",
"os_compute_api:os-security-group-default-rules": "rule:admin_api",
"os_compute_api:os-security-groups": "rule:admin_or_owner",
"os_compute_api:os-security-groups:discoverable": "@",
"os_compute_api:os-server-diagnostics": "rule:admin_api",
"os_compute_api:os-server-diagnostics:discoverable": "@",
"os_compute_api:os-server-external-events:create": "rule:admin_api",
"os_compute_api:os-server-external-events:discoverable": "@",
"os_compute_api:os-server-groups:discoverable": "@",
"os_compute_api:os-server-groups": "rule:admin_or_owner",
"os_compute_api:os-server-groups:create": "rule:os_compute_api:os-server-groups",
"os_compute_api:os-server-groups:delete": "rule:os_compute_api:os-server-groups",
"os_compute_api:os-server-groups:index": "rule:os_compute_api:os-server-groups",
"os_compute_api:os-server-groups:show": "rule:os_compute_api:os-server-groups",
"os_compute_api:server-metadata:index": "rule:admin_or_owner",
"os_compute_api:server-metadata:show": "rule:admin_or_owner",
"os_compute_api:server-metadata:create": "rule:admin_or_owner",
"os_compute_api:server-metadata:discoverable": "@",
"os_compute_api:server-metadata:update_all": "rule:admin_or_owner",
"os_compute_api:server-metadata:delete": "rule:admin_or_owner",
"os_compute_api:server-metadata:update": "rule:admin_or_owner",
"os_compute_api:server-metadata:delete": "rule:admin_or_owner",
"os_compute_api:os-server-password": "rule:admin_or_owner",
"os_compute_api:os-server-password:discoverable": "@",
"os_compute_api:os-server-tags:delete_all": "@",
"os_compute_api:os-server-tags:index": "@",
"os_compute_api:os-server-tags:update_all": "@",
"os_compute_api:os-server-tags:delete": "@",
"os_compute_api:os-server-tags:update": "@",
"os_compute_api:os-server-tags:show": "@",
"os_compute_api:os-server-tags:discoverable": "@",
"os_compute_api:os-server-tags:delete_all": "rule:admin_or_owner",
"os_compute_api:os-server-tags:index": "rule:admin_or_owner",
"os_compute_api:os-server-tags:update_all": "rule:admin_or_owner",
"os_compute_api:os-server-tags:delete": "rule:admin_or_owner",
"os_compute_api:os-server-tags:update": "rule:admin_or_owner",
"os_compute_api:os-server-tags:show": "rule:admin_or_owner",
"os_compute_api:os-server-usage": "rule:admin_or_owner",
"os_compute_api:os-server-usage:discoverable": "@",
"os_compute_api:servers:index": "rule:admin_or_owner",
"os_compute_api:servers:detail": "rule:admin_or_owner",
"os_compute_api:servers:detail:get_all_tenants": "rule:admin_api",
"os_compute_api:servers:index:get_all_tenants": "rule:admin_api",
"os_compute_api:servers:detail:get_all_tenants": "rule:admin_api",
"os_compute_api:servers:show": "rule:admin_or_owner",
"os_compute_api:servers:show:host_status": "rule:admin_api",
"os_compute_api:servers:create": "rule:admin_or_owner",
"os_compute_api:servers:create:forced_host": "rule:admin_or_owner",
"os_compute_api:servers:create:forced_host": "rule:admin_api",
"os_compute_api:servers:create:attach_volume": "rule:admin_or_owner",
"os_compute_api:servers:create:attach_network": "rule:admin_or_owner",
"network:attach_external_network": "is_admin:True",
"os_compute_api:servers:delete": "rule:admin_or_owner",
"os_compute_api:servers:update": "rule:admin_or_owner",
"os_compute_api:servers:confirm_resize": "rule:admin_or_owner",
@ -223,38 +150,25 @@
"os_compute_api:servers:start": "rule:admin_or_owner",
"os_compute_api:servers:stop": "rule:admin_or_owner",
"os_compute_api:servers:trigger_crash_dump": "rule:admin_or_owner",
"os_compute_api:servers:discoverable": "@",
"os_compute_api:servers:migrations:show": "rule:admin_api",
"os_compute_api:servers:migrations:force_complete": "rule:admin_api",
"os_compute_api:servers:migrations:delete": "rule:admin_api",
"os_compute_api:servers:migrations:index": "rule:admin_api",
"os_compute_api:server-migrations:discoverable": "@",
"os_compute_api:os-services": "rule:admin_api",
"os_compute_api:os-services:discoverable": "@",
"os_compute_api:os-shelve:shelve": "rule:admin_or_owner",
"os_compute_api:os-shelve:unshelve": "rule:admin_or_owner",
"os_compute_api:os-shelve:shelve_offload": "rule:admin_api",
"os_compute_api:os-shelve:discoverable": "@",
"os_compute_api:os-simple-tenant-usage:show": "rule:admin_or_owner",
"os_compute_api:os-simple-tenant-usage:list": "rule:admin_api",
"os_compute_api:os-simple-tenant-usage:discoverable": "@",
"os_compute_api:os-suspend-server:resume": "rule:admin_or_owner",
"os_compute_api:os-suspend-server:suspend": "rule:admin_or_owner",
"os_compute_api:os-suspend-server:discoverable": "@",
"os_compute_api:os-tenant-networks": "rule:admin_or_owner",
"os_compute_api:os-tenant-networks:discoverable": "@",
"os_compute_api:os-used-limits:discoverable": "@",
"os_compute_api:os-used-limits": "rule:admin_api",
"os_compute_api:os-user-data:discoverable": "@",
"os_compute_api:versions:discoverable": "@",
"os_compute_api:os-virtual-interfaces:discoverable": "@",
"os_compute_api:os-virtual-interfaces": "rule:admin_or_owner",
"os_compute_api:os-volumes:discoverable": "@",
"os_compute_api:os-volumes": "rule:admin_or_owner",
"os_compute_api:os-volumes-attachments:index": "rule:admin_or_owner",
"os_compute_api:os-volumes-attachments:create": "rule:admin_or_owner",
"os_compute_api:os-volumes-attachments:show": "rule:admin_or_owner",
"os_compute_api:os-volumes-attachments:discoverable": "@",
"os_compute_api:os-volumes-attachments:update": "rule:admin_api",
"os_compute_api:os-volumes-attachments:delete": "rule:admin_or_owner"
}

1
openstack_dashboard/dashboards/project/api_access/tables.py
View File

@ -39,7 +39,6 @@ class DownloadEC2(tables.LinkAction):
verbose_name_plural = _("EC2 Credentials")
icon = "download"
url = "horizon:project:api_access:ec2"
policy_rules = (("compute", "os_compute_api:os-certificates:create"),)
def allowed(self, request, datum=None):
return api.base.is_service_enabled(request, 'ec2')

5
openstack_dashboard/dashboards/project/static/dashboard/project/workflow/launch-instance/launch-instance.module.js
View File

@ -45,6 +45,11 @@
* @description Policies for displaying steps in the workflow.
*/
.constant('horizon.dashboard.project.workflow.launch-instance.step-policy', {
// TODO(future): Nova API exntension has gone, so 'discoverable' policy are no longer
// needed. API extension availability depends on Nova API micro version, so the migration
// needs to be done carefully. It might be better to be moved to the server side and
// be merged into 'features' from horizon microversion support.
// This policy determines if the scheduler hints extension is discoverable when listing
// available extensions. It's possible the extension is installed but not discoverable.
schedulerHints: { rules: [['compute', 'os_compute_api:os-scheduler-hints:discoverable']] },

1
openstack_dashboard/settings.py
View File

@ -268,6 +268,7 @@ POLICY_FILES = {
# Services for which horizon has extra policies are defined
# in POLICY_DIRS by default.
POLICY_DIRS = {
'compute': ['nova_policy.d'],
'volume': ['cinder_policy.d'],
}

71
openstack_dashboard/test/unit/api/rest/test_policy.py
View File

@ -10,6 +10,8 @@
# See the License for the specific language governing permissions and
# limitations under the License.
import json
from django.test.utils import override_settings
from openstack_dashboard.api.rest import policy
@ -17,55 +19,59 @@ from openstack_dashboard.test import helpers as test
class PolicyRestTestCase(test.TestCase):
@override_settings(POLICY_CHECK_FUNCTION='openstack_auth.policy.check')
def test_policy(self, body='{"rules": []}'):
def _test_policy(self, body, expected=True):
request = self.mock_rest_request(body=body)
response = policy.Policy().post(request)
self.assertStatusCode(response, 200)
self.assertEqual({"allowed": True}, response.json)
self.assertEqual({"allowed": expected}, response.json)
def test_policy(self):
body = json.dumps({"rules": []})
self._test_policy(body)
@override_settings(POLICY_CHECK_FUNCTION='openstack_auth.policy.check')
def test_rule_alone(self):
body = '{"rules": [["compute", \
"os_compute_api:index:get_all_tenants"]]}'
self.test_policy(body)
body = json.dumps({"rules":
[["compute", "os_compute_api:servers:index"]]})
self._test_policy(body)
@override_settings(POLICY_CHECK_FUNCTION='openstack_auth.policy.check')
def test_multiple_rule(self):
body = '{"rules": [["compute", "os_compute_api:stop"],' \
' ["compute", "os_compute_api:start"]]}'
self.test_policy(body)
body = json.dumps(
{"rules": [["compute", "os_compute_api:servers:stop"],
["compute", "os_compute_api:servers:start"]]})
self._test_policy(body)
@override_settings(POLICY_CHECK_FUNCTION='openstack_auth.policy.check')
def test_rule_with_empty_target(self):
body = '{"rules": [["compute", "os_compute_api:stop"],' \
' ["compute", "os_compute_api:start"]],' \
' "target": {}}'
self.test_policy(body)
body = json.dumps(
{"rules": [["compute", "os_compute_api:servers:stop"],
["compute", "os_compute_api:servers:start"]],
"target": {}})
self._test_policy(body)
@override_settings(POLICY_CHECK_FUNCTION='openstack_auth.policy.check')
def test_rule_with_target(self):
body = '{"rules": [["compute", "os_compute_api:stop"],' \
' ["compute", "os_compute_api:start"]],' \
' "target": {"project_id": "1"}}'
self.test_policy(body)
body = json.dumps(
{"rules": [["compute", "os_compute_api:servers:stop"],
["compute", "os_compute_api:servers:start"]],
"target": {"project_id": "1"}})
self._test_policy(body)
@override_settings(POLICY_CHECK_FUNCTION='openstack_auth.policy.check')
def test_policy_fail(self):
# admin only rule, default test case user should fail
request = self.mock_rest_request(
body=('{"rules": ['
'["compute",'
'"os_compute_api:servers:index:get_all_tenants"]]}'))
response = policy.Policy().post(request)
self.assertStatusCode(response, 200)
self.assertEqual({"allowed": False}, response.json)
body = json.dumps(
{"rules": [["compute",
"os_compute_api:servers:index:get_all_tenants"]]})
self._test_policy(body, expected=False)
def test_policy_fail_with_nonexisting(self):
body = json.dumps(
{"rules": [["compute", "non-existing"]]})
self._test_policy(body, expected=True)
@override_settings(POLICY_CHECK_FUNCTION='openstack_auth.policy.check')
def test_policy_error(self):
# admin only rule, default test case user should fail
request = self.mock_rest_request(
body='''{"bad": "compute"}''')
body=json.dumps({"bad": "compute"}))
response = policy.Policy().post(request)
self.assertStatusCode(response, 400)
@ -73,8 +79,9 @@ class PolicyRestTestCase(test.TestCase):
class AdminPolicyRestTestCase(test.BaseAdminViewTests):
@override_settings(POLICY_CHECK_FUNCTION='openstack_auth.policy.check')
def test_rule_with_target(self):
body = '{"rules": [["compute", \
"os_compute_api:index:get_all_tenants"]]}'
body = json.dumps(
{"rules": [["compute",
"os_compute_api:servers:index:get_all_tenants"]]})
request = self.mock_rest_request(body=body)
response = policy.Policy().post(request)
self.assertStatusCode(response, 200)