Change new policy rules for availability zones API

It was previously set that both SYSTEM and PROJECT READER could get
access to it. But this resource don't have project_id so PROJECT_READER
should be removed from that rule and only SYSTEM scope users should be
able to get it.

This patch also adds UT for policies for that API.

Related-blueprint: bp/secure-rbac-roles
Change-Id: Idfaf36c3dd003c9c5c1ce3f9ee889ba54643e831

neutron/conf/policies/availability_zone.py

@@ -22,7 +22,7 @@ DEPRECATION_REASON = (
 rules = [
     policy.DocumentedRuleDefault(
         name='get_availability_zone',
-        check_str=base.SYSTEM_OR_PROJECT_READER,
+        check_str=base.SYSTEM_READER,
         description='List availability zones',
         operations=[
             {
@@ -30,7 +30,7 @@ rules = [
                 'path': '/availability_zones',
             },
         ],
-        scope_types=['system', 'project'],
+        scope_types=['system'],
         deprecated_rule=policy.DeprecatedRule(
             name='get_availability_zone',
             check_str=base.RULE_ANY,

neutron/tests/unit/conf/policies/test_availability_zone.py

@@ -0,0 +1,37 @@
+# Copyright (c) 2021 Red Hat Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+# implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+from oslo_policy import policy as base_policy
+
+from neutron import policy
+from neutron.tests.unit.conf.policies import base
+
+
+class AvailabilityZoneAPITestCase(base.PolicyBaseTestCase):
+
+    def setUp(self):
+        super(AvailabilityZoneAPITestCase, self).setUp()
+        self.target = {}
+
+    def test_system_reader_can_get_availability_zone(self):
+        self.assertTrue(
+            policy.enforce(self.system_reader_ctx, "get_availability_zone",
+                           self.target))
+
+    def test_project_reader_can_not_get_availability_zone(self):
+        self.assertRaises(
+            base_policy.PolicyNotAuthorized,
+            policy.enforce,
+            self.project_reader_ctx, "get_availability_zone", self.target)