Skip to content

Commit 6583cb3

Browse files
minchen07minchen07
committed
Add listAclGroupsByAccount to QuerySelector adapters and remove
AclProxyService interface.
1 parent fac9f2d commit 6583cb3

10 files changed

Lines changed: 52 additions & 112 deletions

File tree

‎api/src/org/apache/cloudstack/acl/AclProxyService.java‎

Lines changed: 0 additions & 13 deletions
This file was deleted.

‎api/src/org/apache/cloudstack/acl/QuerySelector.java‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -62,4 +62,11 @@ public interface QuerySelector extends Adapter {
6262
*/
6363
boolean isGrantedAll(Account caller, String action);
6464

65+
/**
66+
* List of ACL group the given account belongs to
67+
* @param accountId account id.
68+
* @return ACL group names
69+
*/
70+
List<String> listAclGroupsByAccount(long accountId);
71+
6572
}

‎server/src/com/cloud/api/query/dao/AccountJoinDaoImpl.java‎

Lines changed: 2 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,6 @@
2424
import org.apache.log4j.Logger;
2525
import org.springframework.stereotype.Component;
2626

27-
import org.apache.cloudstack.acl.AclProxyService;
2827
import org.apache.cloudstack.api.ResponseObject.ResponseView;
2928
import org.apache.cloudstack.api.response.AccountResponse;
3029
import org.apache.cloudstack.api.response.ResourceLimitAndCountResponse;
@@ -48,9 +47,7 @@ public class AccountJoinDaoImpl extends GenericDaoBase<AccountJoinVO, Long> impl
4847

4948
private final SearchBuilder<AccountJoinVO> acctIdSearch;
5049
@Inject
51-
public AccountManager _accountMgr;
52-
@Inject
53-
AclProxyService _aclProxy;
50+
AccountManager _acctMgr;
5451

5552
protected AccountJoinDaoImpl() {
5653

@@ -106,7 +103,7 @@ public AccountResponse newAccountResponse(ResponseView view, AccountJoinVO accou
106103
accountResponse.setObjectName("account");
107104

108105
// add all the acl groups for an account
109-
accountResponse.setGroups(_aclProxy.listAclGroupsByAccount(account.getId()));
106+
accountResponse.setGroups(_acctMgr.listAclGroupsByAccount(account.getId()));
110107

111108
return accountResponse;
112109
}

‎server/src/com/cloud/user/AccountManager.java‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -191,6 +191,8 @@ void buildACLViewSearchCriteria(SearchCriteria<? extends ControlledEntity> sc, S
191191
*/
192192
Account lockAccount(String accountName, Long domainId, Long accountId);
193193

194+
List<String> listAclGroupsByAccount(Long accountId);
195+
194196
public static final String MESSAGE_ADD_ACCOUNT_EVENT = "Message.AddAccount.Event";
195197

196198
public static final String MESSAGE_REMOVE_ACCOUNT_EVENT = "Message.RemoveAccount.Event";

‎server/src/com/cloud/user/AccountManagerImpl.java‎

Lines changed: 27 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -40,7 +40,6 @@
4040
import org.apache.commons.codec.binary.Base64;
4141
import org.apache.log4j.Logger;
4242

43-
import org.apache.cloudstack.acl.AclProxyService;
4443
import org.apache.cloudstack.acl.ControlledEntity;
4544
import org.apache.cloudstack.acl.QuerySelector;
4645
import org.apache.cloudstack.acl.RoleType;
@@ -253,8 +252,7 @@ public class AccountManagerImpl extends ManagerBase implements AccountManager, M
253252
@Inject
254253
private GlobalLoadBalancerRuleDao _gslbRuleDao;
255254

256-
@Inject
257-
QuerySelector _aclQuerySelector; // we assume that there should be one type of QuerySelector adapter
255+
List<QuerySelector> _querySelectors;
258256

259257
@Inject
260258
MessageBus _messageBus;
@@ -302,6 +300,14 @@ public void setSecurityCheckers(List<SecurityChecker> securityCheckers) {
302300
_securityCheckers = securityCheckers;
303301
}
304302

303+
public List<QuerySelector> getQuerySelectors() {
304+
return _querySelectors;
305+
}
306+
307+
public void setQuerySelectors(List<QuerySelector> querySelectors) {
308+
_querySelectors = querySelectors;
309+
}
310+
305311
@Override
306312
public boolean configure(final String name, final Map<String, Object> params) throws ConfigurationException {
307313
_systemAccount = _accountDao.findById(AccountVO.ACCOUNT_ID_SYSTEM);
@@ -2249,16 +2255,21 @@ public void buildACLSearchParameters(Account caller, Long id, String accountName
22492255
// search for policy permissions associated with caller to get all his authorized domains, accounts, and resources
22502256
// Assumption: if a domain is in grantedDomains, then all the accounts under this domain will not be returned in "grantedAccounts". Similarly, if an account
22512257
// is in grantedAccounts, then all the resources owned by this account will not be returned in "grantedResources".
2252-
boolean grantedAll = _aclQuerySelector.isGrantedAll(caller, action);
2258+
// assume that there is only one query selector adapter
2259+
if (_querySelectors == null || _querySelectors.size() == 0)
2260+
return; // no futher filtering
2261+
2262+
QuerySelector qs = _querySelectors.get(0);
2263+
boolean grantedAll = qs.isGrantedAll(caller, action);
22532264
if ( grantedAll ){
22542265
if ( domainId != null ){
22552266
permittedDomains.add(domainId);
22562267
}
22572268
}
22582269
else {
2259-
List<Long> grantedDomains = _aclQuerySelector.getAuthorizedDomains(caller, action);
2260-
List<Long> grantedAccounts = _aclQuerySelector.getAuthorizedAccounts(caller, action);
2261-
List<Long> grantedResources = _aclQuerySelector.getAuthorizedResources(caller, action);
2270+
List<Long> grantedDomains = qs.getAuthorizedDomains(caller, action);
2271+
List<Long> grantedAccounts = qs.getAuthorizedAccounts(caller, action);
2272+
List<Long> grantedResources = qs.getAuthorizedResources(caller, action);
22622273

22632274
if (domainId != null) {
22642275
// specific domain is specified
@@ -2437,4 +2448,13 @@ public void buildACLViewSearchCriteria(SearchCriteria<? extends ControlledEntity
24372448
sc.addAnd("accountId", SearchCriteria.Op.SC, aclSc);
24382449
}
24392450

2451+
@Override
2452+
public List<String> listAclGroupsByAccount(Long accountId) {
2453+
if (_querySelectors == null || _querySelectors.size() == 0)
2454+
return new ArrayList<String>();
2455+
2456+
QuerySelector qs = _querySelectors.get(0);
2457+
return qs.listAclGroupsByAccount(accountId);
2458+
}
2459+
24402460
}

‎services/iam/plugin/src/org/apache/cloudstack/acl/RoleBasedEntityQuerySelector.java‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,7 @@
2323

2424
import org.apache.log4j.Logger;
2525

26+
import org.apache.cloudstack.iam.api.AclGroup;
2627
import org.apache.cloudstack.iam.api.AclPolicy;
2728
import org.apache.cloudstack.iam.api.AclPolicyPermission;
2829
import org.apache.cloudstack.iam.api.IAMService;
@@ -112,4 +113,14 @@ public boolean isGrantedAll(Account caller, String action) {
112113
return false;
113114
}
114115

116+
@Override
117+
public List<String> listAclGroupsByAccount(long accountId) {
118+
List<AclGroup> groups = _iamService.listAclGroups(accountId);
119+
List<String> groupNames = new ArrayList<String>();
120+
for (AclGroup grp : groups) {
121+
groupNames.add(grp.getName());
122+
}
123+
return groupNames;
124+
}
125+
115126
}

‎services/iam/plugin/src/org/apache/cloudstack/acl/api/AclApiService.java‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,6 @@
1818

1919
import java.util.List;
2020

21-
import org.apache.cloudstack.acl.AclProxyService;
2221
import org.apache.cloudstack.acl.PermissionScope;
2322
import org.apache.cloudstack.acl.api.response.AclGroupResponse;
2423
import org.apache.cloudstack.acl.api.response.AclPolicyResponse;
@@ -31,7 +30,7 @@
3130
import com.cloud.user.Account;
3231
import com.cloud.utils.component.PluggableService;
3332

34-
public interface AclApiService extends AclProxyService, PluggableService {
33+
public interface AclApiService extends PluggableService {
3534

3635
/* ACL group related interfaces */
3736
AclGroup createAclGroup(Account caller, String aclGroupName, String description);

‎services/iam/plugin/src/org/apache/cloudstack/acl/api/AclApiServiceImpl.java‎

Lines changed: 2 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -150,15 +150,6 @@ public List<AclGroup> listAclGroups(long accountId) {
150150
return _iamSrv.listAclGroups(accountId);
151151
}
152152

153-
@Override
154-
public List<String> listAclGroupsByAccount(long accountId) {
155-
List<AclGroup> groups = listAclGroups(accountId);
156-
List<String> groupNames = new ArrayList<String>();
157-
for (AclGroup grp : groups) {
158-
groupNames.add(grp.getName());
159-
}
160-
return groupNames;
161-
}
162153

163154
@DB
164155
@Override
@@ -167,8 +158,7 @@ public AclGroup addAccountsToGroup(final List<Long> acctIds, final Long groupId)
167158
return _iamSrv.addAccountsToGroup(acctIds, groupId);
168159
}
169160

170-
@Override
171-
public void removeAccountFromAclGroups(long accountId) {
161+
private void removeAccountFromAclGroups(long accountId) {
172162
List<AclGroup> groups = listAclGroups(accountId);
173163
List<Long> accts = new ArrayList<Long>();
174164
accts.add(accountId);
@@ -179,8 +169,7 @@ public void removeAccountFromAclGroups(long accountId) {
179169
}
180170
}
181171

182-
@Override
183-
public void addAccountToAclGroup(long accountId, long groupId) {
172+
private void addAccountToAclGroup(long accountId, long groupId) {
184173
List<Long> accts = new ArrayList<Long>();
185174
accts.add(accountId);
186175
addAccountsToGroup(accts, groupId);

‎services/pom.xml‎

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -27,9 +27,6 @@
2727
<version>4.3.0-SNAPSHOT</version>
2828
<relativePath>../pom.xml</relativePath>
2929
</parent>
30-
<build>
31-
<defaultGoal>install</defaultGoal>
32-
</build>
3330
<modules>
3431
<module>console-proxy</module>
3532
<module>secondary-storage</module>

‎setup/db/db/schema-421to430.sql‎

Lines changed: 0 additions & 69 deletions
Original file line numberDiff line numberDiff line change
@@ -397,75 +397,6 @@ INSERT IGNORE INTO `cloud`.`acl_policy_permission` (id, policy_id, action, permi
397397
INSERT IGNORE INTO `cloud`.`acl_policy_permission` (id, policy_id, action, permission, created) VALUES (2, 3, 'DomainCapability', 'Allow', Now());
398398
INSERT IGNORE INTO `cloud`.`acl_policy_permission` (id, policy_id, action, permission, created) VALUES (3, 4, 'DomainResourceCapability', 'Allow', Now());
399399

400-
CREATE OR REPLACE VIEW `cloud`.`acl_policy_view` AS
401-
select
402-
acl_policy.id id,
403-
acl_policy.uuid uuid,
404-
acl_policy.name name,
405-
acl_policy.description description,
406-
acl_policy.removed removed,
407-
acl_policy.created created,
408-
domain.id domain_id,
409-
domain.uuid domain_uuid,
410-
domain.name domain_name,
411-
domain.path domain_path,
412-
account.id account_id,
413-
account.uuid account_uuid,
414-
account.account_name account_name,
415-
account.type account_type,
416-
acl_policy_permission.action permission_action,
417-
acl_policy_permission.resource_type permission_entity_type,
418-
acl_policy_permission.scope permission_scope,
419-
acl_policy_permission.scope_id permission_scope_id,
420-
acl_policy_permission.access_type permission_access_type,
421-
acl_policy_permission.permission permission_allow_deny
422-
from
423-
`cloud`.`acl_policy`
424-
inner join
425-
`cloud`.`domain` ON acl_policy.domain_id = domain.id
426-
inner join
427-
`cloud`.`account` ON acl_policy.account_id = account.id
428-
left join
429-
`cloud`.`acl_policy_permission` ON acl_policy.id = acl_policy_permission.policy_id;
430-
431-
432-
CREATE OR REPLACE VIEW `cloud`.`acl_group_view` AS
433-
select
434-
acl_group.id id,
435-
acl_group.uuid uuid,
436-
acl_group.name name,
437-
acl_group.description description,
438-
acl_group.removed removed,
439-
acl_group.created created,
440-
domain.id domain_id,
441-
domain.uuid domain_uuid,
442-
domain.name domain_name,
443-
domain.path domain_path,
444-
account.id account_id,
445-
account.uuid account_uuid,
446-
account.account_name account_name,
447-
account.type account_type,
448-
member_account.id member_account_id,
449-
member_account.uuid member_account_uuid,
450-
member_account.account_name member_account_name,
451-
acl_policy.id policy_id,
452-
acl_policy.uuid policy_uuid,
453-
acl_policy.name policy_name
454-
from
455-
`cloud`.`acl_group`
456-
inner join
457-
`cloud`.`domain` ON acl_group.domain_id = domain.id
458-
inner join
459-
`cloud`.`account` ON acl_group.account_id = account.id
460-
left join
461-
`cloud`.`acl_group_policy_map` ON acl_group.id = acl_group_policy_map.group_id
462-
left join
463-
`cloud`.`acl_policy` ON acl_group_policy_map.policy_id = acl_policy.id
464-
left join
465-
`cloud`.`acl_group_account_map` ON acl_group.id = acl_group_account_map.group_id
466-
left join
467-
`cloud`.`account` member_account ON acl_group_account_map.account_id = member_account.id;
468-
469400

470401

471402
DROP VIEW IF EXISTS `cloud`.`volume_view`;

0 commit comments

Comments
 (0)