openstack/neutron-lib
Code Issues Proposed changes

Replace "target_tenant" with "target_project" in RBAC OVOs and models

Browse Source 
This is part of the remaining technical debt of the specs
https://specs.openstack.org/openstack/neutron-specs/specs/newton/moving-to-keystone-v3.html

Blueprint: https://blueprints.launchpad.net/neutron/+spec/keystone-v3
Depends-On: https://review.opendev.org/c/openstack/neutron/+/815855

Change-Id: Icde9bf452ea162dbb63fffa7b5b0edf8f664057a
This commit is contained in:
Rodolfo Alonso Hernandez 2021-12-02 15:27:55 +00:00
parent fab7a88062
commit 4d44f54544
1 changed files with 4 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
neutron_lib/db/model_query.py
View File

@ -127,8 +127,8 @@ def query_with_hooks(context, model, field=None, lazy_fields=None):
(model.tenant_id == context.tenant_id) |
(rbac_model.action.in_(
[constants.ACCESS_SHARED, constants.ACCESS_READONLY]) &
((rbac_model.target_tenant == context.tenant_id) |
(rbac_model.target_tenant == '*'))))
((rbac_model.target_project == context.tenant_id) |
(rbac_model.target_project == '*'))))
elif hasattr(model, 'shared'):
query_filter = ((model.tenant_id == context.tenant_id) |
(model.shared == sql.true()))
@ -217,9 +217,9 @@ def apply_filters(query, model, filters, context=None):
# translate a filter on shared into a query against the
# object's rbac entries
rbac = model.rbac_entries.property.mapper.class_
matches = [rbac.target_tenant == '*']
matches = [rbac.target_project == '*']
if context:
matches.append(rbac.target_tenant == context.tenant_id)
matches.append(rbac.target_project == context.tenant_id)
# any 'access_as_shared' records that match the
# wildcard or requesting tenant
is_shared = and_(rbac.action == constants.ACCESS_SHARED,