diff --git a/storyboard/api/v1/user_preferences.py b/storyboard/api/v1/user_preferences.py index a88daad4..5525ef26 100644 --- a/storyboard/api/v1/user_preferences.py +++ b/storyboard/api/v1/user_preferences.py @@ -23,6 +23,7 @@ import wsmeext.pecan as wsme_pecan from storyboard.api.auth import authorization_checks as checks import storyboard.db.api.users as user_api +from storyboard.openstack.common.gettextutils import _ # noqa from storyboard.openstack.common import log @@ -37,7 +38,7 @@ class UserPreferencesController(rest.RestController): """Return all preferences for the current user. """ if request.current_user_id != user_id: - abort(403) + abort(403, _("You can't read preferences of other users.")) return return user_api.user_get_preferences(user_id) @@ -53,6 +54,6 @@ class UserPreferencesController(rest.RestController): :param body A dictionary of preference values. """ if request.current_user_id != user_id: - abort(403) + abort(403, _("You can't change preferences of other users.")) return user_api.user_update_preferences(user_id, body) diff --git a/storyboard/api/v1/user_tokens.py b/storyboard/api/v1/user_tokens.py index 4878cf98..5b9919c4 100644 --- a/storyboard/api/v1/user_tokens.py +++ b/storyboard/api/v1/user_tokens.py @@ -89,7 +89,7 @@ class UserTokensController(rest.RestController): self._assert_can_access(user_id, access_token) if not access_token: - abort(404) + abort(404, _("Token not found.")) return wmodels.AccessToken.from_db_model(access_token) @@ -111,7 +111,7 @@ class UserTokensController(rest.RestController): # Token duplication check. dupes = token_api.access_token_get_all(access_token=body.access_token) if dupes: - abort(409, _('This token already exists.')) + abort(409, _('This token already exist.')) token = token_api.access_token_create(body.as_dict()) @@ -134,7 +134,7 @@ class UserTokensController(rest.RestController): self._assert_can_access(user_id, target_token) if not target_token: - abort(404) + abort(404, _("Token not found.")) # We only allow updating the expiration date. target_token.expires_in = body.expires_in @@ -157,7 +157,7 @@ class UserTokensController(rest.RestController): self._assert_can_access(user_id, access_token) if not access_token: - abort(404) + abort(404, _("Token not found.")) token_api.access_token_delete(access_token_id) @@ -167,18 +167,18 @@ class UserTokensController(rest.RestController): current_user = user_api.user_get(request.current_user_id) if not user_id: - abort(400) + abort(400, _("user_id is missing.")) # The user must be logged in. if not current_user: - abort(401) + abort(401, _("You must log in to do this.")) # If the impacted user is not the current user, the current user must # be an admin. if not current_user.is_superuser and current_user.id != user_id: - abort(403) + abort(403, _("You are not admin and can't do this.")) # The path-based impacted user and the user found in the entity must # be identical. No PUT /users/1/tokens { user_id: 2 } if token_entity and token_entity.user_id != user_id: - abort(403) + abort(403, _("token_entity.user_id or user_id is wrong."))