00638fa410
To keep consistent with other projects and enable 'admin_or_owner' rule in policy.json, this patch adds neccessary fields for policy check target and use correct method to get context dictionary. To be clear, the rule in policy.json 'project_id:%(project_id)s' comes from Nova originally, the policy module will get project_id from request URL to Nova service andn compare with project_id in the user credential. For other projects which don't contain project_id in URL, just get it from user credential to make the rule work properly. Change-Id: I5979f2c5204e373cc4a84b1f6997845aabc891cb
12 lines
397 B
Plaintext
12 lines
397 B
Plaintext
{
|
|
"context_is_admin": "role:admin",
|
|
"admin_or_owner": "is_admin:True or project_id:%(project_id)s",
|
|
"default": "rule:admin_or_owner",
|
|
|
|
"rating:credits:get": "rule:admin_or_owner",
|
|
"rating:measurements:get": "rule:admin_or_owner",
|
|
"rating:invoices:get": "rule:admin_or_owner",
|
|
"rating:quotations:get": "rule:admin_or_owner",
|
|
"health:get": "rule:context_is_admin",
|
|
}
|