00638fa410
To keep consistent with other projects and enable 'admin_or_owner' rule in policy.json, this patch adds neccessary fields for policy check target and use correct method to get context dictionary. To be clear, the rule in policy.json 'project_id:%(project_id)s' comes from Nova originally, the policy module will get project_id from request URL to Nova service andn compare with project_id in the user credential. For other projects which don't contain project_id in URL, just get it from user credential to make the rule work properly. Change-Id: I5979f2c5204e373cc4a84b1f6997845aabc891cb
60 lines
1.6 KiB
Python
60 lines
1.6 KiB
Python
# Copyright (c) 2016 Catalyst IT Ltd.
|
|
#
|
|
# Licensed under the Apache License, Version 2.0 (the "License"); you may
|
|
# not use this file except in compliance with the License. You may obtain
|
|
# a copy of the License at
|
|
#
|
|
# http://www.apache.org/licenses/LICENSE-2.0
|
|
#
|
|
# Unless required by applicable law or agreed to in writing, software
|
|
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
|
|
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
|
|
# License for the specific language governing permissions and limitations
|
|
# under the License.
|
|
|
|
"""Policy enforcer of Distil"""
|
|
|
|
import flask
|
|
import functools
|
|
|
|
from oslo_config import cfg
|
|
from oslo_policy import policy
|
|
|
|
from distil import context
|
|
from distil import exceptions
|
|
|
|
ENFORCER = None
|
|
|
|
|
|
def setup_policy():
|
|
global ENFORCER
|
|
ENFORCER = policy.Enforcer(cfg.CONF)
|
|
|
|
|
|
def check_is_admin(ctx):
|
|
credentials = ctx.to_dict()
|
|
target = credentials
|
|
return ENFORCER.enforce('context_is_admin', target, credentials)
|
|
|
|
|
|
def enforce(rule):
|
|
def decorator(func):
|
|
@functools.wraps(func)
|
|
def handler(*args, **kwargs):
|
|
ctx = context.ctx()
|
|
ctx.is_admin = check_is_admin(ctx)
|
|
|
|
target = {
|
|
'project_id': ctx.project_id,
|
|
'user_id': ctx.user_id,
|
|
}
|
|
|
|
ENFORCER.enforce(rule, target, ctx.to_policy_values(),
|
|
do_raise=True, exc=exceptions.Forbidden)
|
|
|
|
return func(*args, **kwargs)
|
|
|
|
return handler
|
|
|
|
return decorator
|