[policy in code] Add support for share and type extra resource [8/10]

This patch adds policy in code support for share instance,
share export location and share type extra specs resources.

Change-Id: I9a89b4ececc583e85249cc925950e462e805b215
Partial-Implements: blueprint policy-in-code

etc/manila/policy.json

@@ -1,20 +1,6 @@
 {
     "availability_zone:index": "rule:default",
 
-    "share_export_location:index": "rule:default",
-    "share_export_location:show": "rule:default",
-
-    "share_instance:index": "rule:admin_api",
-    "share_instance:show": "rule:admin_api",
-    "share_instance:force_delete": "rule:admin_api",
-    "share_instance:reset_status": "rule:admin_api",
-
-    "share_types_extra_spec:create": "rule:admin_api",
-    "share_types_extra_spec:update": "rule:admin_api",
-    "share_types_extra_spec:show": "rule:admin_api",
-    "share_types_extra_spec:index": "rule:admin_api",
-    "share_types_extra_spec:delete": "rule:admin_api",
-
     "scheduler_stats:pools:index": "rule:admin_api",
     "scheduler_stats:pools:detail": "rule:admin_api",
 

manila/policies/__init__.py

@@ -21,10 +21,12 @@ from manila.policies import quota_class_set
 from manila.policies import quota_set
 from manila.policies import security_service
 from manila.policies import service
+from manila.policies import share_export_location
 from manila.policies import share_group
 from manila.policies import share_group_snapshot
 from manila.policies import share_group_type
 from manila.policies import share_group_types_spec
+from manila.policies import share_instance
 from manila.policies import share_instance_export_location
 from manila.policies import share_network
 from manila.policies import share_replica
@@ -34,6 +36,7 @@ from manila.policies import share_snapshot_export_location
 from manila.policies import share_snapshot_instance
 from manila.policies import share_snapshot_instance_export_location
 from manila.policies import share_type
+from manila.policies import share_types_extra_spec
 from manila.policies import shares
 
 
@@ -43,6 +46,7 @@ def list_rules():
         shares.list_rules(),
         share_instance_export_location.list_rules(),
         share_type.list_rules(),
+        share_types_extra_spec.list_rules(),
         share_snapshot.list_rules(),
         share_snapshot_export_location.list_rules(),
         share_snapshot_instance.list_rules(),
@@ -58,4 +62,6 @@ def list_rules():
         share_replica.list_rules(),
         share_network.list_rules(),
         security_service.list_rules(),
+        share_export_location.list_rules(),
+        share_instance.list_rules(),
     )

manila/policies/share_export_location.py

@@ -0,0 +1,47 @@
+#    Licensed under the Apache License, Version 2.0 (the "License"); you may
+#    not use this file except in compliance with the License. You may obtain
+#    a copy of the License at
+#
+#         http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#    License for the specific language governing permissions and limitations
+#    under the License.
+
+from oslo_policy import policy
+
+from manila.policies import base
+
+
+BASE_POLICY_NAME = 'share_export_location:%s'
+
+
+share_export_location_policies = [
+    policy.DocumentedRuleDefault(
+        name=BASE_POLICY_NAME % 'index',
+        check_str=base.RULE_DEFAULT,
+        description="Get all export locations of a given share.",
+        operations=[
+            {
+                'method': 'GET',
+                'path': '/shares/{share_id}/export_locations',
+            }
+        ]),
+    policy.DocumentedRuleDefault(
+        name=BASE_POLICY_NAME % 'show',
+        check_str=base.RULE_DEFAULT,
+        description="Get details about the requested export location.",
+        operations=[
+            {
+                'method': 'GET',
+                'path': ('/shares/{share_id}/export_locations/'
+                         '{export_location_id}'),
+            }
+        ]),
+]
+
+
+def list_rules():
+    return share_export_location_policies

manila/policies/share_instance.py

@@ -0,0 +1,70 @@
+#    Licensed under the Apache License, Version 2.0 (the "License"); you may
+#    not use this file except in compliance with the License. You may obtain
+#    a copy of the License at
+#
+#         http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#    License for the specific language governing permissions and limitations
+#    under the License.
+
+from oslo_policy import policy
+
+from manila.policies import base
+
+
+BASE_POLICY_NAME = 'share_instance:%s'
+
+
+shares_policies = [
+    policy.DocumentedRuleDefault(
+        name=BASE_POLICY_NAME % 'index',
+        check_str=base.RULE_ADMIN_API,
+        description="Get all share instances.",
+        operations=[
+            {
+                'method': 'GET',
+                'path': '/share_instances',
+            },
+            {
+                'method': 'GET',
+                'path': '/share_instances?{query}',
+            }
+        ]),
+    policy.DocumentedRuleDefault(
+        name=BASE_POLICY_NAME % 'show',
+        check_str=base.RULE_ADMIN_API,
+        description="Get details of a share instance.",
+        operations=[
+            {
+                'method': 'GET',
+                'path': '/share_instances/{share_instance_id}'
+            },
+        ]),
+    policy.DocumentedRuleDefault(
+        name=BASE_POLICY_NAME % 'force_delete',
+        check_str=base.RULE_ADMIN_API,
+        description="Force delete a share instance.",
+        operations=[
+            {
+                'method': 'POST',
+                'path': '/share_instances/{share_instance_id}/action',
+            }
+        ]),
+    policy.DocumentedRuleDefault(
+        name=BASE_POLICY_NAME % 'reset_status',
+        check_str=base.RULE_ADMIN_API,
+        description="Reset share instance's status.",
+        operations=[
+            {
+                'method': 'POST',
+                'path': '/share_instances/{share_instance_id}/action',
+            }
+        ]),
+]
+
+
+def list_rules():
+    return shares_policies

manila/policies/share_types_extra_spec.py

@@ -0,0 +1,75 @@
+#    Licensed under the Apache License, Version 2.0 (the "License"); you may
+#    not use this file except in compliance with the License. You may obtain
+#    a copy of the License at
+#
+#         http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#    License for the specific language governing permissions and limitations
+#    under the License.
+
+from oslo_policy import policy
+
+from manila.policies import base
+
+
+BASE_POLICY_NAME = 'share_types_extra_spec:%s'
+
+share_types_extra_spec_policies = [
+    policy.DocumentedRuleDefault(
+        name=BASE_POLICY_NAME % 'create',
+        check_str=base.RULE_ADMIN_API,
+        description="Create share type extra spec.",
+        operations=[
+            {
+                'method': 'POST',
+                'path': '/types/{share_type_id}/extra_specs',
+            }
+        ]),
+    policy.DocumentedRuleDefault(
+        name=BASE_POLICY_NAME % 'show',
+        check_str=base.RULE_ADMIN_API,
+        description="Get share type extra specs of a given share type.",
+        operations=[
+            {
+                'method': 'GET',
+                'path': '/types/{share_type_id}/extra_specs',
+            }
+        ]),
+    policy.DocumentedRuleDefault(
+        name=BASE_POLICY_NAME % 'index',
+        check_str=base.RULE_ADMIN_API,
+        description="Get details of a share type extra spec.",
+        operations=[
+            {
+                'method': 'GET',
+                'path': '/types/{share_type_id}/extra_specs/{extra_spec_id}',
+            },
+        ]),
+    policy.DocumentedRuleDefault(
+        name=BASE_POLICY_NAME % 'update',
+        check_str=base.RULE_ADMIN_API,
+        description="Update share type extra spec.",
+        operations=[
+            {
+                'method': 'PUT',
+                'path': '/types/{share_type_id}/extra_specs',
+            }
+        ]),
+    policy.DocumentedRuleDefault(
+        name=BASE_POLICY_NAME % 'delete',
+        check_str=base.RULE_ADMIN_API,
+        description="Delete share type extra spec.",
+        operations=[
+            {
+                'method': 'DELETE',
+                'path': '/types/{share_type_id}/extra_specs/{key}',
+            }
+        ]),
+]
+
+
+def list_rules():
+    return share_types_extra_spec_policies

manila/policy.py

@@ -216,7 +216,9 @@ def check_policy(context, resource, action, target_obj=None):
                     'quota_set', 'quota_class_set', 'service',
                     'share_server', 'share_group', 'share_group_snapshot',
                     'share_group_type', 'share_group_types_spec',
-                    'share_replica', 'share_network', 'security_service', ):
+                    'share_replica', 'share_network', 'security_service',
+                    'share_types_extra_spec', 'share_instance',
+                    'share_export_location', ):
         authorize(context, _action, target)
     else:
         enforce(context, _action, target)