openstack/neutron
Code Issues Proposed changes

Merge "[S-RBAC] Fix policies for the l3_conntrack_helpers APIs"

Browse Source
This commit is contained in:
Zuul
2025-09-25 18:44:19 +00:00
committed by Gerrit Code Review
parent 1930e3c80d cb3331e525
commit 783ce1cd4d
2 changed files with 19 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
neutron/conf/policies/l3_conntrack_helper.py
View File

@@ -32,7 +32,7 @@ rules = [
name='create_router_conntrack_helper',
check_str=neutron_policy.policy_or(
base.ADMIN_OR_PROJECT_MEMBER,
base.RULE_PARENT_OWNER),
base.PARENT_OWNER_MEMBER),
scope_types=['project'],
description='Create a router conntrack helper',
operations=[
@@ -51,7 +51,7 @@ rules = [
name='get_router_conntrack_helper',
check_str=neutron_policy.policy_or(
base.ADMIN_OR_PROJECT_READER,
base.RULE_PARENT_OWNER),
base.PARENT_OWNER_READER),
scope_types=['project'],
description='Get a router conntrack helper',
operations=[
@@ -74,7 +74,7 @@ rules = [
name='update_router_conntrack_helper',
check_str=neutron_policy.policy_or(
base.ADMIN_OR_PROJECT_MEMBER,
base.RULE_PARENT_OWNER),
base.PARENT_OWNER_MEMBER),
scope_types=['project'],
description='Update a router conntrack helper',
operations=[
@@ -93,7 +93,7 @@ rules = [
name='delete_router_conntrack_helper',
check_str=neutron_policy.policy_or(
base.ADMIN_OR_PROJECT_MEMBER,
base.RULE_PARENT_OWNER),
base.PARENT_OWNER_MEMBER),
scope_types=['project'],
description='Delete a router conntrack helper',
operations=[

19
neutron/tests/unit/conf/policies/test_l3_conntrack_helper.py
View File

@@ -29,18 +29,29 @@ class L3ConntrackHelperAPITestCase(base.PolicyBaseTestCase):
self.router = {
'id': uuidutils.generate_uuid(),
'project_id': self.project_id}
self.alt_router = {
'id': uuidutils.generate_uuid(),
'project_id': self.alt_project_id}
self.target = {
'project_id': self.project_id,
'router_id': self.router['id'],
'ext_parent_router_id': self.router['id']}
self.alt_target = {
'project_id': self.alt_project_id,
'router_id': self.router['id'],
'ext_parent_router_id': self.router['id']}
'router_id': self.alt_router['id'],
'ext_parent_router_id': self.alt_router['id']}
routers = {
self.router['id']: self.router,
self.alt_router['id']: self.alt_router,
}
def get_router(context, router_id, fields=None):
return routers[router_id]
self.plugin_mock = mock.Mock()
self.plugin_mock.get_router.return_value = self.router
self.plugin_mock.get_router.side_effect = get_router
mock.patch(
'neutron_lib.plugins.directory.get_plugin',
return_value=self.plugin_mock).start()