mirror of
https://github.com/yunionio/cloudpods.git
synced 2026-06-23 19:53:17 +08:00
292 lines
11 KiB
Go
292 lines
11 KiB
Go
// Copyright 2019 Yunion
|
|
//
|
|
// Licensed under the Apache License, Version 2.0 (the "License");
|
|
// you may not use this file except in compliance with the License.
|
|
// You may obtain a copy of the License at
|
|
//
|
|
// http://www.apache.org/licenses/LICENSE-2.0
|
|
//
|
|
// Unless required by applicable law or agreed to in writing, software
|
|
// distributed under the License is distributed on an "AS IS" BASIS,
|
|
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
// See the License for the specific language governing permissions and
|
|
// limitations under the License.
|
|
|
|
package db
|
|
|
|
import (
|
|
"context"
|
|
|
|
"yunion.io/x/jsonutils"
|
|
"yunion.io/x/log"
|
|
"yunion.io/x/pkg/utils"
|
|
"yunion.io/x/sqlchemy"
|
|
|
|
"yunion.io/x/onecloud/pkg/cloudcommon/consts"
|
|
"yunion.io/x/onecloud/pkg/cloudcommon/policy"
|
|
"yunion.io/x/onecloud/pkg/httperrors"
|
|
"yunion.io/x/onecloud/pkg/mcclient"
|
|
"yunion.io/x/onecloud/pkg/util/rbacutils"
|
|
)
|
|
|
|
type SSharableVirtualResourceBase struct {
|
|
SVirtualResourceBase
|
|
|
|
IsPublic bool `default:"false" nullable:"false" create:"domain_optional" list:"user"`
|
|
PublicScope string `width:"16" charset:"ascii" nullable:"false" default:"system" create:"domain_optional" list:"user"`
|
|
}
|
|
|
|
type SSharableVirtualResourceBaseManager struct {
|
|
SVirtualResourceBaseManager
|
|
}
|
|
|
|
func NewSharableVirtualResourceBaseManager(dt interface{}, tableName string, keyword string, keywordPlural string) SSharableVirtualResourceBaseManager {
|
|
return SSharableVirtualResourceBaseManager{SVirtualResourceBaseManager: NewVirtualResourceBaseManager(dt, tableName, keyword, keywordPlural)}
|
|
}
|
|
|
|
func (manager *SSharableVirtualResourceBaseManager) GetISharableVirtualModelManager() ISharableVirtualModelManager {
|
|
return manager.GetVirtualObject().(ISharableVirtualModelManager)
|
|
}
|
|
|
|
func (manager *SSharableVirtualResourceBaseManager) FilterByOwner(q *sqlchemy.SQuery, owner mcclient.IIdentityProvider, scope rbacutils.TRbacScope) *sqlchemy.SQuery {
|
|
if owner != nil {
|
|
switch scope {
|
|
case rbacutils.ScopeProject:
|
|
ownerProjectid := owner.GetProjectId()
|
|
if len(ownerProjectid) > 0 {
|
|
subq := SharedResourceManager.Query("resource_id")
|
|
subq = subq.Equals("resource_type", manager.Keyword())
|
|
subq = subq.Equals("target_project_id", ownerProjectid)
|
|
subq = subq.Equals("owner_project_id", q.Field("tenant_id"))
|
|
q = q.Filter(sqlchemy.OR(
|
|
sqlchemy.Equals(q.Field("tenant_id"), ownerProjectid),
|
|
sqlchemy.AND(
|
|
sqlchemy.IsTrue(q.Field("is_public")),
|
|
sqlchemy.Equals(q.Field("public_scope"), rbacutils.ScopeSystem),
|
|
),
|
|
sqlchemy.AND(
|
|
sqlchemy.IsTrue(q.Field("is_public")),
|
|
sqlchemy.Equals(q.Field("public_scope"), rbacutils.ScopeDomain),
|
|
sqlchemy.Equals(q.Field("domain_id"), owner.GetProjectDomainId()),
|
|
),
|
|
sqlchemy.AND(
|
|
sqlchemy.IsFalse(q.Field("is_public")),
|
|
sqlchemy.In(q.Field("id"), subq.SubQuery()),
|
|
),
|
|
))
|
|
}
|
|
case rbacutils.ScopeDomain:
|
|
if len(owner.GetProjectDomainId()) > 0 {
|
|
q = q.Filter(sqlchemy.OR(
|
|
sqlchemy.Equals(q.Field("domain_id"), owner.GetProjectDomainId()),
|
|
sqlchemy.AND(
|
|
sqlchemy.IsTrue(q.Field("is_public")),
|
|
sqlchemy.Equals(q.Field("public_scope"), rbacutils.ScopeSystem),
|
|
),
|
|
))
|
|
}
|
|
}
|
|
}
|
|
return q
|
|
}
|
|
|
|
func (model *SSharableVirtualResourceBase) AllowGetDetails(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool {
|
|
return model.IsOwner(userCred) || model.IsPublic || IsAllowGet(rbacutils.ScopeSystem, userCred, model)
|
|
}
|
|
|
|
func (model *SSharableVirtualResourceBase) IsSharable(reqUsrId mcclient.IIdentityProvider) bool {
|
|
if model.IsPublic {
|
|
switch rbacutils.String2Scope(model.PublicScope) {
|
|
case rbacutils.ScopeSystem:
|
|
return true
|
|
case rbacutils.ScopeDomain:
|
|
ownerId := model.GetOwnerId()
|
|
if ownerId != nil && ownerId.GetProjectDomainId() == reqUsrId.GetProjectDomainId() {
|
|
return true
|
|
}
|
|
}
|
|
}
|
|
return false
|
|
}
|
|
|
|
func (model *SSharableVirtualResourceBase) AllowPerformPublic(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
|
|
return IsAllowPerform(rbacutils.ScopeSystem, userCred, model, "public")
|
|
}
|
|
|
|
func (model *SSharableVirtualResourceBase) PerformPublic(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) {
|
|
targetScopeStr, _ := data.GetString("scope")
|
|
targetScope := rbacutils.String2ScopeDefault(targetScopeStr, rbacutils.ScopeSystem)
|
|
if targetScope == rbacutils.ScopeProject {
|
|
if sharedProjects, err := data.GetArray("shared_projects"); err == nil {
|
|
delProjects := make([]*SSharedResource, 0)
|
|
addProjects := make([]string, 0)
|
|
ops := make(map[string]*SSharedResource, 0)
|
|
nps := make([]string, 0)
|
|
srs := make([]SSharedResource, 0)
|
|
q := SharedResourceManager.Query()
|
|
err := q.Filter(sqlchemy.AND(
|
|
sqlchemy.Equals(q.Field("owner_project_id"), model.ProjectId),
|
|
sqlchemy.Equals(q.Field("resource_id"), model.GetId()),
|
|
sqlchemy.Equals(q.Field("resource_type"), model.GetModelManager().Keyword()),
|
|
)).All(&srs)
|
|
if err != nil {
|
|
return nil, httperrors.NewInternalServerError("Fetch project error %s", err)
|
|
}
|
|
for i := 0; i < len(srs); i++ {
|
|
ops[srs[i].TargetProjectId] = &srs[i]
|
|
}
|
|
for i := 0; i < len(sharedProjects); i++ {
|
|
sharedProject, _ := sharedProjects[i].GetString()
|
|
tenant, err := TenantCacheManager.FetchTenantByIdOrName(ctx, sharedProject)
|
|
if err != nil {
|
|
return nil, httperrors.NewBadRequestError("fetch tenant %s error %s", sharedProject, err)
|
|
}
|
|
if tenant.DomainId != model.DomainId {
|
|
return nil, httperrors.NewBadRequestError("can't shared project to other domain")
|
|
}
|
|
if tenant.GetId() == model.ProjectId {
|
|
return nil, httperrors.NewBadRequestError("Can't share project to yourself")
|
|
}
|
|
nps = append(nps, tenant.GetId())
|
|
if _, ok := ops[tenant.GetId()]; !ok {
|
|
addProjects = append(addProjects, tenant.GetId())
|
|
}
|
|
}
|
|
for k, v := range ops {
|
|
if !utils.IsInStringArray(k, nps) {
|
|
delProjects = append(delProjects, v)
|
|
}
|
|
}
|
|
|
|
for i := 0; i < len(addProjects); i++ {
|
|
sharedResource := new(SSharedResource)
|
|
sharedResource.ResourceType = model.GetModelManager().Keyword()
|
|
sharedResource.ResourceId = model.Id
|
|
sharedResource.OwnerProjectId = model.ProjectId
|
|
sharedResource.TargetProjectId = addProjects[i]
|
|
if insetErr := SharedResourceManager.TableSpec().Insert(sharedResource); insetErr != nil {
|
|
return nil, httperrors.NewInternalServerError("Insert shared resource failed %s", insetErr)
|
|
}
|
|
}
|
|
for i := 0; i < len(delProjects); i++ {
|
|
delProjects[i].SetModelManager(SharedResourceManager, delProjects[i])
|
|
if err := delProjects[i].Delete(ctx, userCred); err != nil {
|
|
return nil, httperrors.NewInternalServerError("Unshare project failed %s", err)
|
|
}
|
|
}
|
|
|
|
if (len(addProjects) + len(srs) - len(delProjects)) > 0 {
|
|
diff, err := Update(model, func() error {
|
|
model.IsPublic = false
|
|
model.PublicScope = string(targetScope)
|
|
return nil
|
|
})
|
|
if err == nil {
|
|
OpsLog.LogEvent(model, ACT_UPDATE, diff, userCred)
|
|
} else {
|
|
return nil, err
|
|
}
|
|
}
|
|
} else {
|
|
return nil, httperrors.NewMissingParameterError("shared_projects")
|
|
}
|
|
} else {
|
|
allowScope := policy.PolicyManager.AllowScope(userCred, consts.GetServiceType(), model.GetModelManager().KeywordPlural(), policy.PolicyActionPerform, "public")
|
|
if targetScope.HigherThan(allowScope) {
|
|
return nil, httperrors.NewForbiddenError("not enough privilege")
|
|
}
|
|
if targetScope != rbacutils.ScopeSystem && targetScope != rbacutils.ScopeDomain {
|
|
return nil, httperrors.NewInputParameterError("invalid scope %s", targetScope)
|
|
}
|
|
diff, err := Update(model, func() error {
|
|
model.IsPublic = true
|
|
model.PublicScope = string(targetScope)
|
|
return nil
|
|
})
|
|
if err == nil {
|
|
OpsLog.LogEvent(model, ACT_UPDATE, diff, userCred)
|
|
} else {
|
|
return nil, err
|
|
}
|
|
}
|
|
model.GetIStandaloneModel().ClearSchedDescCache()
|
|
return nil, nil
|
|
}
|
|
|
|
func (model *SSharableVirtualResourceBase) AllowPerformPrivate(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
|
|
return IsAllowPerform(rbacutils.ScopeSystem, userCred, model, "private")
|
|
}
|
|
|
|
func (model *SSharableVirtualResourceBase) PerformPrivate(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) {
|
|
if model.IsPublic {
|
|
allowScope := policy.PolicyManager.AllowScope(userCred, consts.GetServiceType(), model.GetModelManager().KeywordPlural(), policy.PolicyActionPerform, "private")
|
|
requireScope := rbacutils.String2ScopeDefault(model.PublicScope, rbacutils.ScopeSystem)
|
|
if requireScope.HigherThan(allowScope) {
|
|
return nil, httperrors.NewForbiddenError("not enough privileges: allow %s require %s", allowScope, requireScope)
|
|
}
|
|
diff, err := Update(model, func() error {
|
|
model.PublicScope = string(rbacutils.ScopeNone)
|
|
model.IsPublic = false
|
|
return nil
|
|
})
|
|
if err == nil {
|
|
OpsLog.LogEvent(model, ACT_UPDATE, diff, userCred)
|
|
} else {
|
|
return nil, httperrors.NewInternalServerError("Update shared resource error: %s", err)
|
|
}
|
|
}
|
|
|
|
if err := SharedResourceManager.CleanModelSharedProjects(ctx, userCred, &model.SVirtualResourceBase); err != nil {
|
|
return nil, err
|
|
}
|
|
model.GetIStandaloneModel().ClearSchedDescCache()
|
|
return nil, nil
|
|
}
|
|
|
|
func (model *SSharableVirtualResourceBase) GetISharableVirtualModel() ISharableVirtualModel {
|
|
return model.GetVirtualObject().(ISharableVirtualModel)
|
|
}
|
|
|
|
func (model *SSharableVirtualResourceBase) GetSharedProjects() []string {
|
|
sharedResources := make([]SSharedResource, 0)
|
|
res := make([]string, 0)
|
|
SharedResourceManager.Query().Equals("resource_type", model.GetModelManager().Keyword()).Equals("resource_id", model.GetId()).All(&sharedResources)
|
|
for i := 0; i < len(sharedResources); i++ {
|
|
res = append(res, sharedResources[i].TargetProjectId)
|
|
}
|
|
return res
|
|
}
|
|
|
|
func (model *SSharableVirtualResourceBase) getMoreDetails(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, extra *jsonutils.JSONDict) *jsonutils.JSONDict {
|
|
sharedProjects := jsonutils.NewArray()
|
|
projects := model.GetSharedProjects()
|
|
for i := 0; i < len(projects); i++ {
|
|
tenant, err := TenantCacheManager.FetchTenantByIdOrName(ctx, projects[i])
|
|
if err != nil {
|
|
log.Errorf("failed fetch tenant by id %s", projects[i])
|
|
continue
|
|
}
|
|
p := jsonutils.NewDict()
|
|
p.Set("id", jsonutils.NewString(tenant.GetId()))
|
|
p.Set("name", jsonutils.NewString(tenant.GetName()))
|
|
sharedProjects.Add(p)
|
|
}
|
|
if sharedProjects.Length() > 0 {
|
|
extra.Set("shared_projects", sharedProjects)
|
|
}
|
|
return extra
|
|
}
|
|
|
|
func (model *SSharableVirtualResourceBase) GetCustomizeColumns(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) *jsonutils.JSONDict {
|
|
extra := model.SVirtualResourceBase.GetCustomizeColumns(ctx, userCred, query)
|
|
return model.getMoreDetails(ctx, userCred, query, extra)
|
|
}
|
|
|
|
func (model *SSharableVirtualResourceBase) GetExtraDetails(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) (*jsonutils.JSONDict, error) {
|
|
extra, err := model.SVirtualResourceBase.GetExtraDetails(ctx, userCred, query)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
return model.getMoreDetails(ctx, userCred, query, extra), nil
|
|
}
|