feb409eda0
This change replaces the hard coded WSGI app creation with a pipeline of WSGI apps declared in a configuration file. Paste Deploy was used to create the pipeline since it is used by many other OpenStack projects and it is an active project with new contributors and supports Python 3. Dependency on Paste is localized so switching to another library would not be hard if OpenStack moves to another package in the future. The changes are small but the changes for the tests were large since many acl tests were assuming a hard coded WSGI app creation. blueprint declarative-filters Change-Id: I5ce05eab980271873269eca2945dc809f2923045
52 lines
1.6 KiB
Python
52 lines
1.6 KiB
Python
# -*- encoding: utf-8 -*-
|
|
#
|
|
# Copyright © 2012 New Dream Network, LLC (DreamHost)
|
|
#
|
|
# Author: Doug Hellmann <doug.hellmann@dreamhost.com>
|
|
#
|
|
# Licensed under the Apache License, Version 2.0 (the "License"); you may
|
|
# not use this file except in compliance with the License. You may obtain
|
|
# a copy of the License at
|
|
#
|
|
# http://www.apache.org/licenses/LICENSE-2.0
|
|
#
|
|
# Unless required by applicable law or agreed to in writing, software
|
|
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
|
|
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
|
|
# License for the specific language governing permissions and limitations
|
|
# under the License.
|
|
|
|
"""Access Control Lists (ACL's) control access the API server."""
|
|
|
|
from ceilometer.openstack.common import policy
|
|
|
|
_ENFORCER = None
|
|
|
|
|
|
def get_limited_to(headers):
|
|
"""Return the user and project the request should be limited to.
|
|
|
|
:param headers: HTTP headers dictionary
|
|
:return: A tuple of (user, project), set to None if there's no limit on
|
|
one of these.
|
|
|
|
"""
|
|
global _ENFORCER
|
|
if not _ENFORCER:
|
|
_ENFORCER = policy.Enforcer()
|
|
if not _ENFORCER.enforce('context_is_admin',
|
|
{},
|
|
{'roles': headers.get('X-Roles', "").split(",")}):
|
|
return headers.get('X-User-Id'), headers.get('X-Project-Id')
|
|
return None, None
|
|
|
|
|
|
def get_limited_to_project(headers):
|
|
"""Return the project the request should be limited to.
|
|
|
|
:param headers: HTTP headers dictionary
|
|
:return: A project, or None if there's no limit on it.
|
|
|
|
"""
|
|
return get_limited_to(headers)[1]
|