You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@cloudstack.apache.org by "bernardodemarco (via GitHub)" <gi...@apache.org> on 2025/01/25 20:55:29 UTC
[PR] Grant access to 2FA APIs for default read-only and support roles [cloudstack]
bernardodemarco opened a new pull request, #10273:
URL: https://github.com/apache/cloudstack/pull/10273
### Description
Accounts created with the `Read-Only User - Default` and `Support User - Default` roles do not have access to `setupUserTwoFactorAuthentication`, `validateUserTwoFactorAuthenticationCode` and `listUserTwoFactorAuthenticatorProviders` APIs. Additionally, accounts created with the `Read-Only Admin - Default` and `Support Admin - Default` roles only have access to the `listUserTwoFactorAuthenticatorProviders` API.
As a consequence, when 2FA is required for authentication, accounts with these roles cannot login into CloudStack. Thus, this PR proposes to grant access to the 2FA-related APIs for the previously mentioned roles.
---
Fixes #10269
### Types of changes
- [ ] Breaking change (fix or feature that would cause existing functionality to change)
- [ ] New feature (non-breaking change which adds functionality)
- [ ] Bug fix (non-breaking change which fixes an issue)
- [X] Enhancement (improves an existing feature and functionality)
- [ ] Cleanup (Code refactoring and cleanup, that may add test cases)
- [ ] build/CI
- [ ] test (unit or integration test code)
### Feature/Enhancement Scale or Bug Severity
#### Feature/Enhancement Scale
- [ ] Major
- [X] Minor
### Screenshots (if appropriate):
### How Has This Been Tested?
### `Read-Only User - Default`
<details>
<summary>Role permissions before changes</summary>
```sql
MariaDB [(none)]> select * from cloud.role_permissions where role_id = (select id from cloud.roles where name = 'Read-Only User - Default') order by sort_order;
+------+--------------------------------------+---------+---------------------------------+------------+-------------+------------+
| id | uuid | role_id | rule | permission | description | sort_order |
+------+--------------------------------------+---------+---------------------------------+------------+-------------+------------+
| 894 | 36edece5-a510-11ef-8a39-9a34acb639ea | 6 | listAccounts | ALLOW | NULL | 0 |
| 895 | 36edf63d-a510-11ef-8a39-9a34acb639ea | 6 | listAffinityGroupTypes | ALLOW | NULL | 1 |
| 896 | 36edfd6c-a510-11ef-8a39-9a34acb639ea | 6 | listAffinityGroups | ALLOW | NULL | 2 |
| 897 | 36ee0450-a510-11ef-8a39-9a34acb639ea | 6 | listApis | ALLOW | NULL | 3 |
// (...)
| 971 | 36f02736-a510-11ef-8a39-9a34acb639ea | 6 | cloudianIsEnabled | ALLOW | NULL | 77 |
| 972 | 36f02baf-a510-11ef-8a39-9a34acb639ea | 6 | queryAsyncJobResult | ALLOW | NULL | 78 |
| 973 | 36f02fc1-a510-11ef-8a39-9a34acb639ea | 6 | quotaIsEnabled | ALLOW | NULL | 79 |
| 974 | 36f0336d-a510-11ef-8a39-9a34acb639ea | 6 | quotaTariffList | ALLOW | NULL | 80 |
| 975 | 36f0371a-a510-11ef-8a39-9a34acb639ea | 6 | quotaSummary | ALLOW | NULL | 81 |
| 1117 | 38c4a78b-a510-11ef-8a39-9a34acb639ea | 6 | quotaBalance | ALLOW | NULL | 82 |
| 1116 | 38c4617d-a510-11ef-8a39-9a34acb639ea | 6 | quotaStatement | ALLOW | NULL | 83 |
| 1125 | 39fc9915-a510-11ef-8a39-9a34acb639ea | 6 | quotaStatementDetails | ALLOW | NULL | 83 |
| 1132 | 39fd0d57-a510-11ef-8a39-9a34acb639ea | 6 | quotaCreditsList | ALLOW | NULL | 83 |
| 976 | 36f040d1-a510-11ef-8a39-9a34acb639ea | 6 | * | DENY | NULL | 84 |
+------+--------------------------------------+---------+---------------------------------+------------+-------------+------------+
84 rows in set (0.002 sec)
```
</details>
<details>
<summary>Role permissions after changes</summary>
```sql
MariaDB [(none)]> select * from cloud.role_permissions where role_id = (select id from cloud.roles where name = 'Read-Only User - Default') order by sort_order;
+------+--------------------------------------+---------+-----------------------------------------+------------+-------------+------------+
| id | uuid | role_id | rule | permission | description | sort_order |
+------+--------------------------------------+---------+-----------------------------------------+------------+-------------+------------+
| 894 | 36edece5-a510-11ef-8a39-9a34acb639ea | 6 | listAccounts | ALLOW | NULL | 0 |
| 895 | 36edf63d-a510-11ef-8a39-9a34acb639ea | 6 | listAffinityGroupTypes | ALLOW | NULL | 1 |
| 896 | 36edfd6c-a510-11ef-8a39-9a34acb639ea | 6 | listAffinityGroups | ALLOW | NULL | 2 |
| 897 | 36ee0450-a510-11ef-8a39-9a34acb639ea | 6 | listApis | ALLOW | NULL | 3 |
(...)
| 971 | 36f02736-a510-11ef-8a39-9a34acb639ea | 6 | cloudianIsEnabled | ALLOW | NULL | 77 |
| 972 | 36f02baf-a510-11ef-8a39-9a34acb639ea | 6 | queryAsyncJobResult | ALLOW | NULL | 78 |
| 973 | 36f02fc1-a510-11ef-8a39-9a34acb639ea | 6 | quotaIsEnabled | ALLOW | NULL | 79 |
| 974 | 36f0336d-a510-11ef-8a39-9a34acb639ea | 6 | quotaTariffList | ALLOW | NULL | 80 |
| 975 | 36f0371a-a510-11ef-8a39-9a34acb639ea | 6 | quotaSummary | ALLOW | NULL | 81 |
| 1117 | 38c4a78b-a510-11ef-8a39-9a34acb639ea | 6 | quotaBalance | ALLOW | NULL | 82 |
| 1116 | 38c4617d-a510-11ef-8a39-9a34acb639ea | 6 | quotaStatement | ALLOW | NULL | 83 |
| 1125 | 39fc9915-a510-11ef-8a39-9a34acb639ea | 6 | quotaStatementDetails | ALLOW | NULL | 83 |
| 1132 | 39fd0d57-a510-11ef-8a39-9a34acb639ea | 6 | quotaCreditsList | ALLOW | NULL | 83 |
| 1133 | 1da34356-db5a-11ef-878d-9a34acb639ea | 6 | setupUserTwoFactorAuthentication | ALLOW | NULL | 84 |
| 1134 | 1da3b3a9-db5a-11ef-878d-9a34acb639ea | 6 | validateUserTwoFactorAuthenticationCode | ALLOW | NULL | 85 |
| 1135 | 1e15b3aa-db5a-11ef-878d-9a34acb639ea | 6 | listUserTwoFactorAuthenticatorProviders | ALLOW | NULL | 86 |
| 976 | 36f040d1-a510-11ef-8a39-9a34acb639ea | 6 | * | DENY | NULL | 87 |
+------+--------------------------------------+---------+-----------------------------------------+------------+-------------+------------+
87 rows in set (0.001 sec)
```
</details>
### `Support User - Default`
<details>
<summary>Role permissions before changes</summary>
```sql
MariaDB [(none)]> select * from cloud.role_permissions where role_id = (select id from cloud.roles where name = 'Support User - Default') order by sort_order;
+------+--------------------------------------+---------+---------------------------------+------------+-------------+------------+
| id | uuid | role_id | rule | permission | description | sort_order |
+------+--------------------------------------+---------+---------------------------------+------------+-------------+------------+
| 1006 | 36f134fd-a510-11ef-8a39-9a34acb639ea | 8 | listAccounts | ALLOW | NULL | 0 |
| 1007 | 36f13e2d-a510-11ef-8a39-9a34acb639ea | 8 | listAffinityGroupTypes | ALLOW | NULL | 1 |
| 1008 | 36f1432c-a510-11ef-8a39-9a34acb639ea | 8 | listAffinityGroups | ALLOW | NULL | 2 |
| 1009 | 36f1478f-a510-11ef-8a39-9a34acb639ea | 8 | listApis | ALLOW | NULL | 3 |
| 1010 | 36f14ba1-a510-11ef-8a39-9a34acb639ea | 8 | listAsyncJobs | ALLOW | NULL | 4 |
(...)
| 1093 | 36f3c18c-a510-11ef-8a39-9a34acb639ea | 8 | createVolume | ALLOW | NULL | 87 |
| 1094 | 36f3c780-a510-11ef-8a39-9a34acb639ea | 8 | attachVolume | ALLOW | NULL | 88 |
| 1095 | 36f3cb45-a510-11ef-8a39-9a34acb639ea | 8 | detachVolume | ALLOW | NULL | 89 |
| 1096 | 36f3cee0-a510-11ef-8a39-9a34acb639ea | 8 | uploadVolume | ALLOW | NULL | 90 |
| 1097 | 36f3d2da-a510-11ef-8a39-9a34acb639ea | 8 | attachIso | ALLOW | NULL | 91 |
| 1098 | 36f3d6f6-a510-11ef-8a39-9a34acb639ea | 8 | detachIso | ALLOW | NULL | 92 |
| 1099 | 36f3da8a-a510-11ef-8a39-9a34acb639ea | 8 | registerTemplate | ALLOW | NULL | 93 |
| 1100 | 36f3de07-a510-11ef-8a39-9a34acb639ea | 8 | registerIso | ALLOW | NULL | 94 |
| 1101 | 36f3e187-a510-11ef-8a39-9a34acb639ea | 8 | getUploadParamsFor* | ALLOW | NULL | 95 |
| 1102 | 36f3e4fe-a510-11ef-8a39-9a34acb639ea | 8 | * | DENY | NULL | 96 |
+------+--------------------------------------+---------+---------------------------------+------------+-------------+------------+
94 rows in set (0.002 sec)
```
</details>
<details>
<summary>Role permissions after changes</summary>
```sql
MariaDB [(none)]> select * from cloud.role_permissions where role_id = (select id from cloud.roles where name = 'Support User - Default') order by sort_order;
+------+--------------------------------------+---------+-----------------------------------------+------------+-------------+------------+
| id | uuid | role_id | rule | permission | description | sort_order |
+------+--------------------------------------+---------+-----------------------------------------+------------+-------------+------------+
| 1006 | 36f134fd-a510-11ef-8a39-9a34acb639ea | 8 | listAccounts | ALLOW | NULL | 0 |
| 1007 | 36f13e2d-a510-11ef-8a39-9a34acb639ea | 8 | listAffinityGroupTypes | ALLOW | NULL | 1 |
| 1008 | 36f1432c-a510-11ef-8a39-9a34acb639ea | 8 | listAffinityGroups | ALLOW | NULL | 2 |
| 1009 | 36f1478f-a510-11ef-8a39-9a34acb639ea | 8 | listApis | ALLOW | NULL | 3 |
| 1010 | 36f14ba1-a510-11ef-8a39-9a34acb639ea | 8 | listAsyncJobs | ALLOW | NULL | 4 |
(...)
| 1093 | 36f3c18c-a510-11ef-8a39-9a34acb639ea | 8 | createVolume | ALLOW | NULL | 87 |
| 1094 | 36f3c780-a510-11ef-8a39-9a34acb639ea | 8 | attachVolume | ALLOW | NULL | 88 |
| 1095 | 36f3cb45-a510-11ef-8a39-9a34acb639ea | 8 | detachVolume | ALLOW | NULL | 89 |
| 1096 | 36f3cee0-a510-11ef-8a39-9a34acb639ea | 8 | uploadVolume | ALLOW | NULL | 90 |
| 1097 | 36f3d2da-a510-11ef-8a39-9a34acb639ea | 8 | attachIso | ALLOW | NULL | 91 |
| 1098 | 36f3d6f6-a510-11ef-8a39-9a34acb639ea | 8 | detachIso | ALLOW | NULL | 92 |
| 1099 | 36f3da8a-a510-11ef-8a39-9a34acb639ea | 8 | registerTemplate | ALLOW | NULL | 93 |
| 1100 | 36f3de07-a510-11ef-8a39-9a34acb639ea | 8 | registerIso | ALLOW | NULL | 94 |
| 1101 | 36f3e187-a510-11ef-8a39-9a34acb639ea | 8 | getUploadParamsFor* | ALLOW | NULL | 95 |
| 1136 | 5984107f-db5a-11ef-878d-9a34acb639ea | 8 | setupUserTwoFactorAuthentication | ALLOW | NULL | 96 |
| 1137 | 5984d54a-db5a-11ef-878d-9a34acb639ea | 8 | validateUserTwoFactorAuthenticationCode | ALLOW | NULL | 97 |
| 1138 | 5a25bb08-db5a-11ef-878d-9a34acb639ea | 8 | listUserTwoFactorAuthenticatorProviders | ALLOW | NULL | 98 |
| 1102 | 36f3e4fe-a510-11ef-8a39-9a34acb639ea | 8 | * | DENY | NULL | 99 |
+------+--------------------------------------+---------+-----------------------------------------+------------+-------------+------------+
97 rows in set (0.003 sec)
```
</details>
### `Read-Only Admin - Default`
<details>
<summary>Role permissions before changes</summary>
```sql
MariaDB [(none)]> select * from cloud.role_permissions where role_id = (select id from cloud.roles where name = 'Read-Only Admin - Default') order by sort_order;
+------+--------------------------------------+---------+-----------------------+------------+-------------+------------+
| id | uuid | role_id | rule | permission | description | sort_order |
+------+--------------------------------------+---------+-----------------------+------------+-------------+------------+
| 885 | 36ed8afa-a510-11ef-8a39-9a34acb639ea | 5 | list* | ALLOW | NULL | 0 |
| 886 | 36ed9278-a510-11ef-8a39-9a34acb639ea | 5 | getUploadParamsFor* | DENY | NULL | 1 |
| 887 | 36ed97b5-a510-11ef-8a39-9a34acb639ea | 5 | get* | ALLOW | NULL | 2 |
| 888 | 36ed9bb8-a510-11ef-8a39-9a34acb639ea | 5 | cloudianIsEnabled | ALLOW | NULL | 3 |
| 889 | 36ed9f83-a510-11ef-8a39-9a34acb639ea | 5 | queryAsyncJobResult | ALLOW | NULL | 4 |
| 890 | 36eda459-a510-11ef-8a39-9a34acb639ea | 5 | quotaIsEnabled | ALLOW | NULL | 5 |
| 891 | 36eda8be-a510-11ef-8a39-9a34acb639ea | 5 | quotaTariffList | ALLOW | NULL | 6 |
| 892 | 36edada1-a510-11ef-8a39-9a34acb639ea | 5 | quotaSummary | ALLOW | NULL | 7 |
| 1115 | 38c3b20d-a510-11ef-8a39-9a34acb639ea | 5 | quotaBalance | ALLOW | NULL | 8 |
| 1114 | 38c35a0f-a510-11ef-8a39-9a34acb639ea | 5 | quotaStatement | ALLOW | NULL | 9 |
| 1124 | 39fc98e9-a510-11ef-8a39-9a34acb639ea | 5 | quotaStatementDetails | ALLOW | NULL | 9 |
| 1131 | 39fd0d35-a510-11ef-8a39-9a34acb639ea | 5 | quotaCreditsList | ALLOW | NULL | 9 |
| 893 | 36edb1f6-a510-11ef-8a39-9a34acb639ea | 5 | * | DENY | NULL | 10 |
+------+--------------------------------------+---------+-----------------------+------------+-------------+------------+
13 rows in set (0.001 sec)
```
</details>
<details>
<summary>Role permissions after changes</summary>
```sql
MariaDB [(none)]> select * from cloud.role_permissions where role_id = (select id from cloud.roles where name = 'Read-Only Admin - Default') order by sort_order;
+------+--------------------------------------+---------+-----------------------------------------+------------+-------------+------------+
| id | uuid | role_id | rule | permission | description | sort_order |
+------+--------------------------------------+---------+-----------------------------------------+------------+-------------+------------+
| 885 | 36ed8afa-a510-11ef-8a39-9a34acb639ea | 5 | list* | ALLOW | NULL | 0 |
| 886 | 36ed9278-a510-11ef-8a39-9a34acb639ea | 5 | getUploadParamsFor* | DENY | NULL | 1 |
| 887 | 36ed97b5-a510-11ef-8a39-9a34acb639ea | 5 | get* | ALLOW | NULL | 2 |
| 888 | 36ed9bb8-a510-11ef-8a39-9a34acb639ea | 5 | cloudianIsEnabled | ALLOW | NULL | 3 |
| 889 | 36ed9f83-a510-11ef-8a39-9a34acb639ea | 5 | queryAsyncJobResult | ALLOW | NULL | 4 |
| 890 | 36eda459-a510-11ef-8a39-9a34acb639ea | 5 | quotaIsEnabled | ALLOW | NULL | 5 |
| 891 | 36eda8be-a510-11ef-8a39-9a34acb639ea | 5 | quotaTariffList | ALLOW | NULL | 6 |
| 892 | 36edada1-a510-11ef-8a39-9a34acb639ea | 5 | quotaSummary | ALLOW | NULL | 7 |
| 1115 | 38c3b20d-a510-11ef-8a39-9a34acb639ea | 5 | quotaBalance | ALLOW | NULL | 8 |
| 1114 | 38c35a0f-a510-11ef-8a39-9a34acb639ea | 5 | quotaStatement | ALLOW | NULL | 9 |
| 1124 | 39fc98e9-a510-11ef-8a39-9a34acb639ea | 5 | quotaStatementDetails | ALLOW | NULL | 9 |
| 1131 | 39fd0d35-a510-11ef-8a39-9a34acb639ea | 5 | quotaCreditsList | ALLOW | NULL | 9 |
| 1139 | 98c7cfdf-db5a-11ef-878d-9a34acb639ea | 5 | setupUserTwoFactorAuthentication | ALLOW | NULL | 10 |
| 1140 | 9a27c65c-db5a-11ef-878d-9a34acb639ea | 5 | validateUserTwoFactorAuthenticationCode | ALLOW | NULL | 11 |
| 893 | 36edb1f6-a510-11ef-8a39-9a34acb639ea | 5 | * | DENY | NULL | 12 |
+------+--------------------------------------+---------+-----------------------------------------+------------+-------------+------------+
15 rows in set (0.000 sec)
```
</details>
### `Support Admin - Default`
<details>
<summary>Role permissions before changes</summary>
```sql
MariaDB [(none)]> select * from cloud.role_permissions where role_id = (select id from cloud.roles where name = 'Support Admin - Default') order by sort_order;
+------+--------------------------------------+---------+---------------------------+------------+-------------+------------+
| id | uuid | role_id | rule | permission | description | sort_order |
+------+--------------------------------------+---------+---------------------------+------------+-------------+------------+
| 977 | 36f07380-a510-11ef-8a39-9a34acb639ea | 7 | list* | ALLOW | NULL | 0 |
| 978 | 36f07a1d-a510-11ef-8a39-9a34acb639ea | 7 | get* | ALLOW | NULL | 1 |
| 979 | 36f07f3b-a510-11ef-8a39-9a34acb639ea | 7 | cloudianIsEnabled | ALLOW | NULL | 2 |
| 980 | 36f084f5-a510-11ef-8a39-9a34acb639ea | 7 | queryAsyncJobResult | ALLOW | NULL | 3 |
| 981 | 36f0893b-a510-11ef-8a39-9a34acb639ea | 7 | quotaIsEnabled | ALLOW | NULL | 4 |
(...)
| 1002 | 36f0e049-a510-11ef-8a39-9a34acb639ea | 7 | detachIso | ALLOW | NULL | 25 |
| 1003 | 36f0e45b-a510-11ef-8a39-9a34acb639ea | 7 | registerTemplate | ALLOW | NULL | 26 |
| 1004 | 36f0eabb-a510-11ef-8a39-9a34acb639ea | 7 | registerIso | ALLOW | NULL | 27 |
| 1005 | 36f0f3c4-a510-11ef-8a39-9a34acb639ea | 7 | * | DENY | NULL | 28 |
+------+--------------------------------------+---------+---------------------------+------------+-------------+------------+
29 rows in set (0.001 sec)
```
</details>
<details>
<summary>Role permissions after changes</summary>
```sql
MariaDB [(none)]> select * from cloud.role_permissions where role_id = (select id from cloud.roles where name = 'Support Admin - Default') order by sort_order;
+------+--------------------------------------+---------+-----------------------------------------+------------+-------------+------------+
| id | uuid | role_id | rule | permission | description | sort_order |
+------+--------------------------------------+---------+-----------------------------------------+------------+-------------+------------+
| 977 | 36f07380-a510-11ef-8a39-9a34acb639ea | 7 | list* | ALLOW | NULL | 0 |
| 978 | 36f07a1d-a510-11ef-8a39-9a34acb639ea | 7 | get* | ALLOW | NULL | 1 |
| 979 | 36f07f3b-a510-11ef-8a39-9a34acb639ea | 7 | cloudianIsEnabled | ALLOW | NULL | 2 |
| 980 | 36f084f5-a510-11ef-8a39-9a34acb639ea | 7 | queryAsyncJobResult | ALLOW | NULL | 3 |
| 981 | 36f0893b-a510-11ef-8a39-9a34acb639ea | 7 | quotaIsEnabled | ALLOW | NULL | 4 |
(...)
| 1002 | 36f0e049-a510-11ef-8a39-9a34acb639ea | 7 | detachIso | ALLOW | NULL | 25 |
| 1003 | 36f0e45b-a510-11ef-8a39-9a34acb639ea | 7 | registerTemplate | ALLOW | NULL | 26 |
| 1004 | 36f0eabb-a510-11ef-8a39-9a34acb639ea | 7 | registerIso | ALLOW | NULL | 27 |
| 1141 | a1159975-db5a-11ef-878d-9a34acb639ea | 7 | setupUserTwoFactorAuthentication | ALLOW | NULL | 28 |
| 1142 | a11714c1-db5a-11ef-878d-9a34acb639ea | 7 | validateUserTwoFactorAuthenticationCode | ALLOW | NULL | 29 |
| 1005 | 36f0f3c4-a510-11ef-8a39-9a34acb639ea | 7 | * | DENY | NULL | 30 |
+------+--------------------------------------+---------+-----------------------------------------+------------+-------------+------------+
31 rows in set (0.001 sec)
```
</details>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Grant access to 2FA APIs for default read-only and support roles [cloudstack]
Posted by "bernardodemarco (via GitHub)" <gi...@apache.org>.
bernardodemarco commented on PR #10273:
URL: https://github.com/apache/cloudstack/pull/10273#issuecomment-2615512031
@harikrishna-patnala, thanks for your review. I believe that it would be better to create the SQL procedure to abstract this operation. I'll be working on it and, in the meantime, I'll put the PR in draft.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Grant access to 2FA APIs for default read-only and support roles [cloudstack]
Posted by "codecov[bot] (via GitHub)" <gi...@apache.org>.
codecov[bot] commented on PR #10273:
URL: https://github.com/apache/cloudstack/pull/10273#issuecomment-2614098948
## [Codecov](https://app.codecov.io/gh/apache/cloudstack/pull/10273?dropdown=coverage&src=pr&el=h1&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) Report
All modified and coverable lines are covered by tests :white_check_mark:
> Project coverage is 4.01%. Comparing base [(`98f5663`)](https://app.codecov.io/gh/apache/cloudstack/commit/98f5663954199e6658530b544a394296ad223e1c?dropdown=coverage&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) to head [(`8debae2`)](https://app.codecov.io/gh/apache/cloudstack/commit/8debae2f09b3ec25d14c4d6ef03303f65b589482?dropdown=coverage&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache).
> :exclamation: There is a different number of reports uploaded between BASE (98f5663) and HEAD (8debae2). Click for more details.
>
> <details><summary>HEAD has 1 upload less than BASE</summary>
>
>| Flag | BASE (98f5663) | HEAD (8debae2) |
>|------|------|------|
>|unittests|1|0|
></details>
<details><summary>Additional details and impacted files</summary>
```diff
@@ Coverage Diff @@
## main #10273 +/- ##
=============================================
- Coverage 16.19% 4.01% -12.18%
=============================================
Files 5645 394 -5251
Lines 494567 32390 -462177
Branches 59955 5730 -54225
=============================================
- Hits 80088 1301 -78787
+ Misses 405642 30940 -374702
+ Partials 8837 149 -8688
```
| [Flag](https://app.codecov.io/gh/apache/cloudstack/pull/10273/flags?src=pr&el=flags&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | Coverage Δ | |
|---|---|---|
| [uitests](https://app.codecov.io/gh/apache/cloudstack/pull/10273/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `4.01% <ø> (ø)` | |
| [unittests](https://app.codecov.io/gh/apache/cloudstack/pull/10273/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `?` | |
Flags with carried forward coverage won't be shown. [Click here](https://docs.codecov.io/docs/carryforward-flags?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache#carryforward-flags-in-the-pull-request-comment) to find out more.
</details>
[:umbrella: View full report in Codecov by Sentry](https://app.codecov.io/gh/apache/cloudstack/pull/10273?dropdown=coverage&src=pr&el=continue&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache).
:loudspeaker: Have feedback on the report? [Share it here](https://about.codecov.io/codecov-pr-comment-feedback/?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache).
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Grant access to 2FA APIs for default read-only and support roles [cloudstack]
Posted by "DaanHoogland (via GitHub)" <gi...@apache.org>.
DaanHoogland merged PR #10273:
URL: https://github.com/apache/cloudstack/pull/10273
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Grant access to 2FA APIs for default read-only and support roles [cloudstack]
Posted by "bernardodemarco (via GitHub)" <gi...@apache.org>.
bernardodemarco commented on PR #10273:
URL: https://github.com/apache/cloudstack/pull/10273#issuecomment-2614098910
Guys, should the changes in this PR also be applied to versions 4.19 and 4.20? If so, I think it would be necessary to open a new PR targeting each version branch, right?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Grant access to 2FA APIs for default read-only and support roles [cloudstack]
Posted by "blueorangutan (via GitHub)" <gi...@apache.org>.
blueorangutan commented on PR #10273:
URL: https://github.com/apache/cloudstack/pull/10273#issuecomment-2623849740
Packaging result [SF]: ✔️ el8 ✔️ el9 ✔️ debian ✔️ suse15. SL-JID 12268
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] draft: Grant access to 2FA APIs for default read-only and support roles [cloudstack]
Posted by "blueorangutan (via GitHub)" <gi...@apache.org>.
blueorangutan commented on PR #10273:
URL: https://github.com/apache/cloudstack/pull/10273#issuecomment-2620330103
Packaging result [SF]: ✔️ el8 ✔️ el9 ✔️ debian ✔️ suse15. SL-JID 12247
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Grant access to 2FA APIs for default read-only and support roles [cloudstack]
Posted by "blueorangutan (via GitHub)" <gi...@apache.org>.
blueorangutan commented on PR #10273:
URL: https://github.com/apache/cloudstack/pull/10273#issuecomment-2623747523
@harikrishna-patnala a [SL] Jenkins job has been kicked to build packages. It will be bundled with KVM, XenServer and VMware SystemVM templates. I'll keep you posted as I make progress.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Grant access to 2FA APIs for default read-only and support roles [cloudstack]
Posted by "DaanHoogland (via GitHub)" <gi...@apache.org>.
DaanHoogland commented on PR #10273:
URL: https://github.com/apache/cloudstack/pull/10273#issuecomment-2624960332
> @DaanHoogland, should I open another PR targeting the `4.20` branch and adding the SQL queries to the `schema-42000to42010.sql` file?
those are two half statements @bernardodemarco , and the answer to both is "maybe yes", but...
on 4.20 you should add the statements to the 419xx to 4.20 file and
on main you should add those statements to the file you nention.
I am not sure if these are needed in all cases. It depends on our order of releasing a bit. But to make sure we don't forget it is wisest to add both PRs for now and we can discuss/decide later.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Grant access to 2FA APIs for default read-only and support roles [cloudstack]
Posted by "harikrishna-patnala (via GitHub)" <gi...@apache.org>.
harikrishna-patnala commented on PR #10273:
URL: https://github.com/apache/cloudstack/pull/10273#issuecomment-2623745868
@blueorangutan package
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Grant access to 2FA APIs for default read-only and support roles [cloudstack]
Posted by "bernardodemarco (via GitHub)" <gi...@apache.org>.
bernardodemarco commented on PR #10273:
URL: https://github.com/apache/cloudstack/pull/10273#issuecomment-2624858586
@DaanHoogland, should I open another PR targeting the `4.20` branch and adding the SQL queries to the `schema-42000to42010.sql` file?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Grant access to 2FA APIs for default read-only and support roles [cloudstack]
Posted by "blueorangutan (via GitHub)" <gi...@apache.org>.
blueorangutan commented on PR #10273:
URL: https://github.com/apache/cloudstack/pull/10273#issuecomment-2614115198
Packaging result [SF]: ✔️ el8 ✔️ el9 ✔️ debian ✔️ suse15. SL-JID 12208
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Grant access to 2FA APIs for default read-only and support roles [cloudstack]
Posted by "blueorangutan (via GitHub)" <gi...@apache.org>.
blueorangutan commented on PR #10273:
URL: https://github.com/apache/cloudstack/pull/10273#issuecomment-2614099246
@bernardodemarco a [SL] Jenkins job has been kicked to build packages. It will be bundled with KVM, XenServer and VMware SystemVM templates. I'll keep you posted as I make progress.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Grant access to 2FA APIs for default read-only and support roles [cloudstack]
Posted by "bernardodemarco (via GitHub)" <gi...@apache.org>.
bernardodemarco commented on PR #10273:
URL: https://github.com/apache/cloudstack/pull/10273#issuecomment-2620256598
@blueorangutan package
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] draft: Grant access to 2FA APIs for default read-only and support roles [cloudstack]
Posted by "DaanHoogland (via GitHub)" <gi...@apache.org>.
DaanHoogland commented on PR #10273:
URL: https://github.com/apache/cloudstack/pull/10273#issuecomment-2621126471
@bernardodemarco , this is marked for release 21 now, would you consider moving it to an earlier release?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] draft: Grant access to 2FA APIs for default read-only and support roles [cloudstack]
Posted by "bernardodemarco (via GitHub)" <gi...@apache.org>.
bernardodemarco commented on PR #10273:
URL: https://github.com/apache/cloudstack/pull/10273#issuecomment-2621393873
> @bernardodemarco , this is marked for release 21 now, would you consider moving it to an earlier release?
Yes, no problem. Should I target it to 4.19 or 4.20?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] draft: Grant access to 2FA APIs for default read-only and support roles [cloudstack]
Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] commented on PR #10273:
URL: https://github.com/apache/cloudstack/pull/10273#issuecomment-2621384263
This pull request has merge conflicts. Dear author, please fix the conflicts and sync your branch with the base branch.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Grant access to 2FA APIs for default read-only and support roles [cloudstack]
Posted by "bernardodemarco (via GitHub)" <gi...@apache.org>.
bernardodemarco commented on PR #10273:
URL: https://github.com/apache/cloudstack/pull/10273#issuecomment-2622348322
> 4.19 is fine but a bit late and as this needs adjustment of the sql file , you could choose to go for 4.20. On the other hand the current implementation is suitable to be in more than one upgrade path, so if you are adventurous ... ;)
@DaanHoogland @harikrishna-patnala, I've just fixed the SQL syntax errors and targeted it to 4.19
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Grant access to 2FA APIs for default read-only and support roles [cloudstack]
Posted by "bernardodemarco (via GitHub)" <gi...@apache.org>.
bernardodemarco commented on PR #10273:
URL: https://github.com/apache/cloudstack/pull/10273#issuecomment-2614099066
@blueorangutan package
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Grant access to 2FA APIs for default read-only and support roles [cloudstack]
Posted by "blueorangutan (via GitHub)" <gi...@apache.org>.
blueorangutan commented on PR #10273:
URL: https://github.com/apache/cloudstack/pull/10273#issuecomment-2620257695
@bernardodemarco a [SL] Jenkins job has been kicked to build packages. It will be bundled with KVM, XenServer and VMware SystemVM templates. I'll keep you posted as I make progress.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] draft: Grant access to 2FA APIs for default read-only and support roles [cloudstack]
Posted by "bernardodemarco (via GitHub)" <gi...@apache.org>.
bernardodemarco commented on PR #10273:
URL: https://github.com/apache/cloudstack/pull/10273#issuecomment-2620297517
Okay, it seems there are some syntax errors in the SQL script. I'll take a closer look at it tomorrow.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] draft: Grant access to 2FA APIs for default read-only and support roles [cloudstack]
Posted by "DaanHoogland (via GitHub)" <gi...@apache.org>.
DaanHoogland commented on PR #10273:
URL: https://github.com/apache/cloudstack/pull/10273#issuecomment-2621555662
> > @bernardodemarco , this is marked for release 21 now, would you consider moving it to an earlier release?
>
> Yes, no problem. Should I target it to 4.19 or 4.20?
4.19 is fine but a bit late and as this needs adjustment of the sql file , you could choose to go for 4.20. On the other hand the current implementation is suitable to be in more than one upgrade path, so if you are adventurous ... ;)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org