[Kimchi-devel] [PATCH 5/9] authorization: Remove authorization config from UrlSubNode

From: Aline Manera <alinefm(a)linux.vnet.ibm.com&gt; UrlSubNode is used to automatically load the application configuration and set kimchiauth tool when needed. If we use it to also handle the authorization configuration, we won't be able to specify different configuration to collection and its resource as Kimchi uses the same base URL to both. Example: @UrlSubNode("vms", True, ["POST", "PUT", "DELETE"], 'guests') It meant that all the methods listed were exclusive for admin users. Which it is not correct, as a user assigned to a VM can also perform POST, PUT and DELETE actions. To be able to distinguish the configuration for resource and collection, the autorization mechanism was moved to controller. Signed-off-by: Aline Manera <alinefm(a)linux.vnet.ibm.com&gt; --- src/kimchi/auth.py | 16 +--------------- src/kimchi/control/debugreports.py | 2 +- src/kimchi/control/host.py | 2 +- src/kimchi/control/interfaces.py | 2 +- src/kimchi/control/networks.py | 2 +- src/kimchi/control/storagepools.py | 2 +- src/kimchi/control/storageservers.py | 2 +- src/kimchi/control/templates.py | 2 +- src/kimchi/control/utils.py | 6 +----- src/kimchi/control/vms.py | 2 +- src/kimchi/server.py | 4 ---- 11 files changed, 10 insertions(+), 32 deletions(-) diff --git a/src/kimchi/auth.py b/src/kimchi/auth.py index aabcb6c..93a47b3 100644 --- a/src/kimchi/auth.py +++ b/src/kimchi/auth.py @@ -243,27 +243,13 @@ def logout(): cherrypy.lib.sessions.close() -def has_permission(admin_methods, tab): - cherrypy.session.acquire_lock() - role = cherrypy.session.get(USER_ROLES, {}).get(tab, 'user') - cherrypy.session.release_lock() - - return not admin_methods or \ - cherrypy.request.method not in admin_methods or \ - (cherrypy.request.method in admin_methods and role == "admin") - - -def kimchiauth(admin_methods=None, tab=None): +def kimchiauth(): debug("Entering kimchiauth...") session_missing = cherrypy.session.missing if check_auth_session(): - if not has_permission(admin_methods, tab): - raise cherrypy.HTTPError(403) return if check_auth_httpba(): - if not has_permission(admin_methods, tab): - raise cherrypy.HTTPError(403) return # not a REST full request, redirect login page directly diff --git a/src/kimchi/control/debugreports.py b/src/kimchi/control/debugreports.py index a561b99..debc2eb 100644 --- a/src/kimchi/control/debugreports.py +++ b/src/kimchi/control/debugreports.py @@ -22,7 +22,7 @@ from kimchi.control.utils import UrlSubNode -@UrlSubNode('debugreports', True, ['GET', 'PUT', 'POST', 'DELETE'], 'host') +@UrlSubNode('debugreports', True) class DebugReports(AsyncCollection): def __init__(self, model): super(DebugReports, self).__init__(model) diff --git a/src/kimchi/control/host.py b/src/kimchi/control/host.py index 1b55a29..172f4fe 100644 --- a/src/kimchi/control/host.py +++ b/src/kimchi/control/host.py @@ -25,7 +25,7 @@ from kimchi.template import render -@UrlSubNode('host', True, ['GET', 'PUT', 'POST', 'DELETE'], 'host') +@UrlSubNode('host', True) class Host(Resource): def __init__(self, model, id=None): super(Host, self).__init__(model, id) diff --git a/src/kimchi/control/interfaces.py b/src/kimchi/control/interfaces.py index 944cae6..317cc6f 100644 --- a/src/kimchi/control/interfaces.py +++ b/src/kimchi/control/interfaces.py @@ -21,7 +21,7 @@ from kimchi.control.utils import UrlSubNode -@UrlSubNode('interfaces', True, ['GET'], 'network') +@UrlSubNode('interfaces', True) class Interfaces(Collection): def __init__(self, model): super(Interfaces, self).__init__(model) diff --git a/src/kimchi/control/networks.py b/src/kimchi/control/networks.py index f7696e7..760295c 100644 --- a/src/kimchi/control/networks.py +++ b/src/kimchi/control/networks.py @@ -21,7 +21,7 @@ from kimchi.control.utils import UrlSubNode -@UrlSubNode('networks', True, ['PUT', 'POST', 'DELETE'], 'network') +@UrlSubNode('networks', True) class Networks(Collection): def __init__(self, model): super(Networks, self).__init__(model) diff --git a/src/kimchi/control/storagepools.py b/src/kimchi/control/storagepools.py index 9e57992..c023505 100644 --- a/src/kimchi/control/storagepools.py +++ b/src/kimchi/control/storagepools.py @@ -28,7 +28,7 @@ from kimchi.control.utils import UrlSubNode -@UrlSubNode('storagepools', True, ['PUT', 'POST', 'DELETE'], 'storage') +@UrlSubNode('storagepools', True) class StoragePools(Collection): def __init__(self, model): super(StoragePools, self).__init__(model) diff --git a/src/kimchi/control/storageservers.py b/src/kimchi/control/storageservers.py index e86f920..4b70c39 100644 --- a/src/kimchi/control/storageservers.py +++ b/src/kimchi/control/storageservers.py @@ -22,7 +22,7 @@ from kimchi.control.utils import get_class_name, model_fn, UrlSubNode -@UrlSubNode('storageservers', True, ['GET'], 'storage') +@UrlSubNode('storageservers', True) class StorageServers(Collection): def __init__(self, model): super(StorageServers, self).__init__(model) diff --git a/src/kimchi/control/templates.py b/src/kimchi/control/templates.py index 167e19e..020902d 100644 --- a/src/kimchi/control/templates.py +++ b/src/kimchi/control/templates.py @@ -21,7 +21,7 @@ from kimchi.control.utils import UrlSubNode -@UrlSubNode('templates', True, ['GET', 'PUT', 'POST', 'DELETE'], 'templates') +@UrlSubNode('templates', True) class Templates(Collection): def __init__(self, model): super(Templates, self).__init__(model) diff --git a/src/kimchi/control/utils.py b/src/kimchi/control/utils.py index aa5f452..c39dbd8 100644 --- a/src/kimchi/control/utils.py +++ b/src/kimchi/control/utils.py @@ -113,21 +113,17 @@ def validate_params(params, instance, action): class UrlSubNode(object): - def __init__(self, name, auth=False, admin_methods=None, tab=None): + def __init__(self, name, auth=False): """ admin_methods must be None, or a list containing zero or more of the string values ['GET', 'POST', 'PUT', 'DELETE'] """ self.name = name self.auth = auth - self.tab = tab - self.admin_methods = admin_methods def __call__(self, fun): fun._url_sub_node_name = {"name": self.name} fun.url_auth = self.auth - fun.tab = self.tab - fun.admin_methods = self.admin_methods return fun diff --git a/src/kimchi/control/vms.py b/src/kimchi/control/vms.py index c36d72a..28ad775 100644 --- a/src/kimchi/control/vms.py +++ b/src/kimchi/control/vms.py @@ -22,7 +22,7 @@ from kimchi.control.vm import sub_nodes -@UrlSubNode('vms', True, ['POST', 'PUT', 'DELETE'], 'guests') +@UrlSubNode('vms', True) class VMs(Collection): def __init__(self, model): super(VMs, self).__init__(model) diff --git a/src/kimchi/server.py b/src/kimchi/server.py index b0e9474..3f49f6c 100644 --- a/src/kimchi/server.py +++ b/src/kimchi/server.py @@ -129,10 +129,6 @@ def __init__(self, options): cfg = self.configObj ident = "/%s" % ident cfg[ident] = {'tools.kimchiauth.on': True} - if node.admin_methods: - cfg[ident]['tools.kimchiauth.tab'] = node.tab - cfg[ident][ - 'tools.kimchiauth.admin_methods'] = node.admin_methods self.app = cherrypy.tree.mount(KimchiRoot(model_instance, dev_env), config=self.configObj) -- 1.9.3