Merge "Implement RBAC for USM"

software/software/authapi/hooks.py

@@ -16,7 +16,7 @@
 # License for the specific language governing permissions and limitations
 # under the License.
 #
-# Copyright (c) 2023 Wind River Systems, Inc.
+# Copyright (c) 2023,2025 Wind River Systems, Inc.
 #
 # SPDX-License-Identifier: Apache-2.0
 #
@@ -25,6 +25,7 @@ from oslo_serialization import jsonutils
 from pecan import hooks
 from webob import exc
 
+from software.authapi.policies import base as base_policy
 from software.authapi.context import RequestContext
 from software.authapi import policy
 from software import utils
@@ -87,7 +88,7 @@ class ContextHook(hooks.PecanHook):
             'project_name': project_name,
             'roles': roles
         }
-        is_admin = policy.authorize('admin_in_system_projects', {},
+        is_admin = policy.authorize(base_policy.ADMIN_OR_CONFIGURATOR, {},
                                     credentials, do_raise=False)
 
         path = utils.safe_rstrip(state.request.path, '/')
@@ -121,8 +122,17 @@ class AccessPolicyHook(hooks.PecanHook):
                 except Exception:
                     raise exc.HTTPForbidden()
             else:
-                has_api_access = policy.authorize(
-                    'admin_in_system_projects', {},
-                    context.to_dict(), do_raise=False)
+                role = ""
+                method = state.request.method
+                if method == 'GET':
+                    role = "reader or operator"
+                    has_api_access = policy.authorize(
+                        base_policy.READER_OR_OPERATOR_OR_CONFIGURATOR, {},
+                        context.to_dict(), do_raise=False)
+                else:
+                    role = "admin or configurator"
+                    has_api_access = policy.authorize(
+                        base_policy.ADMIN_OR_CONFIGURATOR, {},
+                        context.to_dict(), do_raise=False)
                 if not has_api_access:
-                    raise exc.HTTPForbidden()
+                    raise exc.HTTPForbidden("Not allowed/Role " + role + " is needed")

software/software/authapi/policies/__init__.py

@@ -0,0 +1,15 @@
+#
+# Copyright (c) 2025 Wind River Systems, Inc.
+#
+# SPDX-License-Identifier: Apache-2.0
+#
+
+import itertools
+
+from software.authapi.policies import base
+
+
+def list_rules():
+    return itertools.chain(
+        base.list_rules(),
+    )

software/software/authapi/policies/base.py

@@ -0,0 +1,32 @@
+#
+# Copyright (c) 2025 Wind River Systems, Inc.
+#
+# SPDX-License-Identifier: Apache-2.0
+#
+
+from oslo_policy import policy
+
+ADMIN_OR_CONFIGURATOR = "admin_or_configurator"
+READER_OR_OPERATOR_OR_CONFIGURATOR = "reader_or_operator_or_configurator"
+
+
+base_rules = [
+    policy.RuleDefault('default', 'rule:admin_in_system_projects',
+                       description='Default rule.'),
+    policy.RuleDefault(
+        name=ADMIN_OR_CONFIGURATOR,
+        check_str="(role:admin or role:configurator) and (project_name:admin or "
+        + "project_name:services)",
+        description="admin,configurator roles of admin,services projects",
+    ),
+    policy.RuleDefault(
+        name=READER_OR_OPERATOR_OR_CONFIGURATOR,
+        check_str="(role:reader or role:operator or role:configurator) and "
+        + "(project_name:admin or project_name:services)",
+        description="reader,operator,configurator roles of admin,services projects",
+    ),
+]
+
+
+def list_rules():
+    return base_rules

software/software/authapi/policy.py

@@ -14,7 +14,7 @@
 #    License for the specific language governing permissions and limitations
 #    under the License.
 #
-# Copyright (c) 2023 Wind River Systems, Inc.
+# Copyright (c) 2023,2025 Wind River Systems, Inc.
 #
 # SPDX-License-Identifier: Apache-2.0
 #
@@ -24,15 +24,8 @@
 from oslo_config import cfg
 from oslo_policy import policy
 
+from software.authapi import policies as controller_policies
 
-base_rules = [
-    policy.RuleDefault('admin_in_system_projects',
-                       'role:admin and (project_name:admin or ' +
-                       'project_name:services)',
-                       description='Admin user in system projects.'),
-    policy.RuleDefault('default', 'rule:admin_in_system_projects',
-                       description='Default rule.'),
-]
 
 CONF = cfg.CONF
 _ENFORCER = None
@@ -69,7 +62,7 @@ def init(policy_file=None, rules=None,
                                     default_rule=default_rule,
                                     use_conf=use_conf,
                                     overwrite=overwrite)
-        _ENFORCER.register_defaults(base_rules)
+        _ENFORCER.register_defaults(controller_policies.list_rules())
     return _ENFORCER