You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@cloudstack.apache.org by da...@apache.org on 2023/01/13 05:16:56 UTC
[cloudstack] branch main updated: updates roles read-only (#7080)
This is an automated email from the ASF dual-hosted git repository.
dahn pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/cloudstack.git
The following commit(s) were added to refs/heads/main by this push:
new 3ea2f1dc9fd updates roles read-only (#7080)
3ea2f1dc9fd is described below
commit 3ea2f1dc9fdd7a1b714ecad7215e7436a0e9c67e
Author: Rodrigo D. Lopez <19...@users.noreply.github.com>
AuthorDate: Fri Jan 13 02:16:48 2023 -0300
updates roles read-only (#7080)
---
.../resources/META-INF/db/schema-41720to41800.sql | 32 ++++++++++++++++++++++
1 file changed, 32 insertions(+)
diff --git a/engine/schema/src/main/resources/META-INF/db/schema-41720to41800.sql b/engine/schema/src/main/resources/META-INF/db/schema-41720to41800.sql
index 18985eb0ab6..191e98e48bc 100644
--- a/engine/schema/src/main/resources/META-INF/db/schema-41720to41800.sql
+++ b/engine/schema/src/main/resources/META-INF/db/schema-41720to41800.sql
@@ -998,6 +998,38 @@ BEGIN
CALL `cloud`.`IDEMPOTENT_ADD_KEY`('i_user_ip_address_state','user_ip_address', '(state)');
+UPDATE `cloud`.`role_permissions`
+SET sort_order = sort_order + 2
+WHERE rule = '*'
+AND permission = 'DENY'
+AND role_id in (SELECT id FROM `cloud`.`roles` WHERE name = 'Read-Only Admin - Default');
+
+INSERT INTO `cloud`.`role_permissions` (uuid, role_id, rule, permission, sort_order)
+SELECT UUID(), role_id, 'quotaStatement', 'ALLOW', MAX(sort_order)-1
+FROM `cloud`.`role_permissions` RP
+WHERE role_id = (SELECT id FROM `cloud`.`roles` WHERE name = 'Read-Only Admin - Default');
+
+INSERT INTO `cloud`.`role_permissions` (uuid, role_id, rule, permission, sort_order)
+SELECT UUID(), role_id, 'quotaBalance', 'ALLOW', MAX(sort_order)-2
+FROM `cloud`.`role_permissions` RP
+WHERE role_id = (SELECT id FROM `cloud`.`roles` WHERE name = 'Read-Only Admin - Default');
+
+UPDATE `cloud`.`role_permissions`
+SET sort_order = sort_order + 2
+WHERE rule = '*'
+AND permission = 'DENY'
+AND role_id in (SELECT id FROM `cloud`.`roles` WHERE name = 'Read-Only User - Default');
+
+INSERT INTO `cloud`.`role_permissions` (uuid, role_id, rule, permission, sort_order)
+SELECT UUID(), role_id, 'quotaStatement', 'ALLOW', MAX(sort_order)-1
+FROM `cloud`.`role_permissions` RP
+WHERE role_id = (SELECT id FROM `cloud`.`roles` WHERE name = 'Read-Only User - Default');
+
+INSERT INTO `cloud`.`role_permissions` (uuid, role_id, rule, permission, sort_order)
+SELECT UUID(), role_id, 'quotaBalance', 'ALLOW', MAX(sort_order)-2
+FROM `cloud`.`role_permissions` RP
+WHERE role_id = (SELECT id FROM `cloud`.`roles` WHERE name = 'Read-Only User - Default');
+
-- Add permission for domain admins to call isAccountAllowedToCreateOfferingsWithTags API
INSERT INTO `cloud`.`role_permissions` (`uuid`, `role_id`, `rule`, `permission`)