You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@cloudstack.apache.org by da...@apache.org on 2023/11/28 13:50:44 UTC
(cloudstack) branch 4.18 updated: allow filtering of listDiskOffering and listServiceOffering APIs by account or project (#7082)
This is an automated email from the ASF dual-hosted git repository.
dahn pushed a commit to branch 4.18
in repository https://gitbox.apache.org/repos/asf/cloudstack.git
The following commit(s) were added to refs/heads/4.18 by this push:
new 956efb27d93 allow filtering of listDiskOffering and listServiceOffering APIs by account or project (#7082)
956efb27d93 is described below
commit 956efb27d9307e7145afab02a93f751f8772ef83
Author: Rodrigo D. Lopez <19...@users.noreply.github.com>
AuthorDate: Tue Nov 28 10:50:37 2023 -0300
allow filtering of listDiskOffering and listServiceOffering APIs by account or project (#7082)
---
.../user/offering/ListDiskOfferingsCmd.java | 4 +--
.../user/offering/ListServiceOfferingsCmd.java | 4 +--
.../java/com/cloud/api/query/QueryManagerImpl.java | 35 ++++++++++++----------
3 files changed, 24 insertions(+), 19 deletions(-)
diff --git a/api/src/main/java/org/apache/cloudstack/api/command/user/offering/ListDiskOfferingsCmd.java b/api/src/main/java/org/apache/cloudstack/api/command/user/offering/ListDiskOfferingsCmd.java
index 5fa24ec1630..5ab675ae435 100644
--- a/api/src/main/java/org/apache/cloudstack/api/command/user/offering/ListDiskOfferingsCmd.java
+++ b/api/src/main/java/org/apache/cloudstack/api/command/user/offering/ListDiskOfferingsCmd.java
@@ -16,6 +16,7 @@
// under the License.
package org.apache.cloudstack.api.command.user.offering;
+import org.apache.cloudstack.api.BaseListProjectAndAccountResourcesCmd;
import org.apache.cloudstack.api.response.StoragePoolResponse;
import org.apache.cloudstack.api.response.VolumeResponse;
import org.apache.cloudstack.api.response.ZoneResponse;
@@ -23,14 +24,13 @@ import org.apache.log4j.Logger;
import org.apache.cloudstack.api.APICommand;
import org.apache.cloudstack.api.ApiConstants;
-import org.apache.cloudstack.api.BaseListDomainResourcesCmd;
import org.apache.cloudstack.api.Parameter;
import org.apache.cloudstack.api.response.DiskOfferingResponse;
import org.apache.cloudstack.api.response.ListResponse;
@APICommand(name = "listDiskOfferings", description = "Lists all available disk offerings.", responseObject = DiskOfferingResponse.class,
requestHasSensitiveInfo = false, responseHasSensitiveInfo = false)
-public class ListDiskOfferingsCmd extends BaseListDomainResourcesCmd {
+public class ListDiskOfferingsCmd extends BaseListProjectAndAccountResourcesCmd {
public static final Logger s_logger = Logger.getLogger(ListDiskOfferingsCmd.class.getName());
diff --git a/api/src/main/java/org/apache/cloudstack/api/command/user/offering/ListServiceOfferingsCmd.java b/api/src/main/java/org/apache/cloudstack/api/command/user/offering/ListServiceOfferingsCmd.java
index 3208ef58a4f..cb155d24ad8 100644
--- a/api/src/main/java/org/apache/cloudstack/api/command/user/offering/ListServiceOfferingsCmd.java
+++ b/api/src/main/java/org/apache/cloudstack/api/command/user/offering/ListServiceOfferingsCmd.java
@@ -16,12 +16,12 @@
// under the License.
package org.apache.cloudstack.api.command.user.offering;
+import org.apache.cloudstack.api.BaseListProjectAndAccountResourcesCmd;
import org.apache.cloudstack.api.response.ZoneResponse;
import org.apache.log4j.Logger;
import org.apache.cloudstack.api.APICommand;
import org.apache.cloudstack.api.ApiConstants;
-import org.apache.cloudstack.api.BaseListDomainResourcesCmd;
import org.apache.cloudstack.api.Parameter;
import org.apache.cloudstack.api.response.ListResponse;
import org.apache.cloudstack.api.response.ServiceOfferingResponse;
@@ -29,7 +29,7 @@ import org.apache.cloudstack.api.response.UserVmResponse;
@APICommand(name = "listServiceOfferings", description = "Lists all available service offerings.", responseObject = ServiceOfferingResponse.class,
requestHasSensitiveInfo = false, responseHasSensitiveInfo = false)
-public class ListServiceOfferingsCmd extends BaseListDomainResourcesCmd {
+public class ListServiceOfferingsCmd extends BaseListProjectAndAccountResourcesCmd {
public static final Logger s_logger = Logger.getLogger(ListServiceOfferingsCmd.class.getName());
diff --git a/server/src/main/java/com/cloud/api/query/QueryManagerImpl.java b/server/src/main/java/com/cloud/api/query/QueryManagerImpl.java
index ce9252fb045..51aed5af66c 100644
--- a/server/src/main/java/com/cloud/api/query/QueryManagerImpl.java
+++ b/server/src/main/java/com/cloud/api/query/QueryManagerImpl.java
@@ -2929,6 +2929,8 @@ public class QueryManagerImpl extends MutualExclusiveIdsManagerBase implements Q
Object id = cmd.getId();
Object keyword = cmd.getKeyword();
Long domainId = cmd.getDomainId();
+ Long projectId = cmd.getProjectId();
+ String accountName = cmd.getAccountName();
Boolean isRootAdmin = _accountMgr.isRootAdmin(account.getAccountId());
Boolean isRecursive = cmd.isRecursive();
Long zoneId = cmd.getZoneId();
@@ -2938,7 +2940,7 @@ public class QueryManagerImpl extends MutualExclusiveIdsManagerBase implements Q
// Keeping this logic consistent with domain specific zones
// if a domainId is provided, we just return the disk offering
// associated with this domain
- if (domainId != null) {
+ if (domainId != null && accountName == null) {
if (_accountMgr.isRootAdmin(account.getId()) || isPermissible(account.getDomainId(), domainId)) {
// check if the user's domain == do's domain || user's domain is
// a child of so's domain for non-root users
@@ -3019,9 +3021,9 @@ public class QueryManagerImpl extends MutualExclusiveIdsManagerBase implements Q
// Filter offerings that are not associated with caller's domain
// Fetch the offering ids from the details table since theres no smart way to filter them in the join ... yet!
- Account caller = CallContext.current().getCallingAccount();
- if (caller.getType() != Account.Type.ADMIN) {
- Domain callerDomain = _domainDao.findById(caller.getDomainId());
+ account = _accountMgr.finalizeOwner(account, accountName, domainId, projectId);
+ if (!Account.Type.ADMIN.equals(account.getType())) {
+ Domain callerDomain = _domainDao.findById(account.getDomainId());
List<Long> domainIds = findRelatedDomainIds(callerDomain, isRecursive);
List<Long> ids = _diskOfferingDetailsDao.findOfferingIdsByDomainIds(domainIds);
@@ -3100,6 +3102,8 @@ public class QueryManagerImpl extends MutualExclusiveIdsManagerBase implements Q
searchFilter.addOrderBy(ServiceOfferingJoinVO.class, "id", true);
Account caller = CallContext.current().getCallingAccount();
+ Long projectId = cmd.getProjectId();
+ String accountName = cmd.getAccountName();
Object name = cmd.getServiceOfferingName();
Object id = cmd.getId();
Object keyword = cmd.getKeyword();
@@ -3115,9 +3119,10 @@ public class QueryManagerImpl extends MutualExclusiveIdsManagerBase implements Q
Integer cpuSpeed = cmd.getCpuSpeed();
Boolean encryptRoot = cmd.getEncryptRoot();
+ final Account owner = _accountMgr.finalizeOwner(caller, accountName, domainId, projectId);
SearchCriteria<ServiceOfferingJoinVO> sc = _srvOfferingJoinDao.createSearchCriteria();
if (!_accountMgr.isRootAdmin(caller.getId()) && isSystem) {
- throw new InvalidParameterValueException("Only ROOT admins can access system's offering");
+ throw new InvalidParameterValueException("Only ROOT admins can access system offerings.");
}
// Keeping this logic consistent with domain specific zones
@@ -3126,8 +3131,8 @@ public class QueryManagerImpl extends MutualExclusiveIdsManagerBase implements Q
if (domainId != null && !_accountMgr.isRootAdmin(caller.getId())) {
// check if the user's domain == so's domain || user's domain is a
// child of so's domain
- if (!isPermissible(caller.getDomainId(), domainId)) {
- throw new PermissionDeniedException("The account:" + caller.getAccountName() + " does not fall in the same domain hierarchy as the service offering");
+ if (!isPermissible(owner.getDomainId(), domainId)) {
+ throw new PermissionDeniedException("The account:" + owner.getAccountName() + " does not fall in the same domain hierarchy as the service offering");
}
}
@@ -3139,7 +3144,7 @@ public class QueryManagerImpl extends MutualExclusiveIdsManagerBase implements Q
throw ex;
}
- _accountMgr.checkAccess(caller, null, true, vmInstance);
+ _accountMgr.checkAccess(owner, null, true, vmInstance);
currentVmOffering = _srvOfferingDao.findByIdIncludingRemoved(vmInstance.getId(), vmInstance.getServiceOfferingId());
if (! currentVmOffering.isDynamic()) {
@@ -3187,22 +3192,22 @@ public class QueryManagerImpl extends MutualExclusiveIdsManagerBase implements Q
}
// boolean includePublicOfferings = false;
- if ((_accountMgr.isNormalUser(caller.getId()) || _accountMgr.isDomainAdmin(caller.getId())) || caller.getType() == Account.Type.RESOURCE_DOMAIN_ADMIN) {
+ if ((_accountMgr.isNormalUser(owner.getId()) || _accountMgr.isDomainAdmin(owner.getId())) || owner.getType() == Account.Type.RESOURCE_DOMAIN_ADMIN) {
// For non-root users.
if (isSystem) {
throw new InvalidParameterValueException("Only root admins can access system's offering");
}
if (isRecursive) { // domain + all sub-domains
- if (caller.getType() == Account.Type.NORMAL) {
+ if (owner.getType() == Account.Type.NORMAL) {
throw new InvalidParameterValueException("Only ROOT admins and Domain admins can list service offerings with isrecursive=true");
}
}
} else {
// for root users
- if (caller.getDomainId() != 1 && isSystem) { // NON ROOT admin
- throw new InvalidParameterValueException("Non ROOT admins cannot access system's offering");
+ if (owner.getDomainId() != 1 && isSystem) { // NON ROOT admin
+ throw new InvalidParameterValueException("Non ROOT admins cannot access system's offering.");
}
- if (domainId != null) {
+ if (domainId != null && accountName == null) {
sc.addAnd("domainId", Op.FIND_IN_SET, String.valueOf(domainId));
}
}
@@ -3286,8 +3291,8 @@ public class QueryManagerImpl extends MutualExclusiveIdsManagerBase implements Q
// Filter offerings that are not associated with caller's domain
// Fetch the offering ids from the details table since theres no smart way to filter them in the join ... yet!
- if (caller.getType() != Account.Type.ADMIN) {
- Domain callerDomain = _domainDao.findById(caller.getDomainId());
+ if (owner.getType() != Account.Type.ADMIN) {
+ Domain callerDomain = _domainDao.findById(owner.getDomainId());
List<Long> domainIds = findRelatedDomainIds(callerDomain, isRecursive);
List<Long> ids = _srvOfferingDetailsDao.findOfferingIdsByDomainIds(domainIds);