Introduce scope_types in hosts policy

Appropriate scope_type for nova case:
- https://specs.openstack.org/openstack/nova-specs/specs/ussuri/approved/policy-defaults-refresh.html#scope

This commit introduce scope_type for hosts policies
as 'system'.

Partial implement blueprint policy-defaults-refresh-deprecated-apis

Change-Id: I0108e11f9a75b893d221770d0bf05c39fd8fb2fc

nova/policies/hosts.py

@@ -23,12 +23,12 @@ BASE_POLICY_NAME = 'os_compute_api:os-hosts'
 
 hosts_policies = [
     policy.DocumentedRuleDefault(
-        BASE_POLICY_NAME,
-        base.RULE_ADMIN_API,
-        """List, show and manage physical hosts.
+        name=BASE_POLICY_NAME,
+        check_str=base.RULE_ADMIN_API,
+        description="""List, show and manage physical hosts.
 
 These APIs are all deprecated in favor of os-hypervisors and os-services.""",
-        [
+        operations=[
             {
                 'method': 'GET',
                 'path': '/os-hosts'
@@ -53,7 +53,8 @@ These APIs are all deprecated in favor of os-hypervisors and os-services.""",
                 'method': 'GET',
                 'path': '/os-hosts/{host_name}/startup'
             }
-        ]),
+        ],
+        scope_types=['system']),
 ]
 
 

nova/tests/unit/policies/test_hosts.py

@@ -108,3 +108,15 @@ class HostsScopeTypePolicyTest(HostsPolicyTest):
     def setUp(self):
         super(HostsScopeTypePolicyTest, self).setUp()
         self.flags(enforce_scope=True, group="oslo_policy")
+
+        # Check that system admin is able to perform operations on hosts.
+        self.admin_authorized_contexts = [
+            self.system_admin_context]
+        # Check that system non-admin is not able to perform operations
+        # on hosts.
+        self.admin_unauthorized_contexts = [
+            self.legacy_admin_context, self.project_admin_context,
+            self.system_member_context, self.system_reader_context,
+            self.system_foo_context, self.other_project_member_context,
+            self.project_foo_context, self.project_member_context,
+            self.project_reader_context, self.other_project_reader_context]