You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@trafficcontrol.apache.org by mi...@apache.org on 2017/07/25 18:56:36 UTC
[05/17] incubator-trafficcontrol git commit: Delivery service tenancy
verification - index crud operation
Delivery service tenancy verification - index crud operation
Project: http://git-wip-us.apache.org/repos/asf/incubator-trafficcontrol/repo
Commit: http://git-wip-us.apache.org/repos/asf/incubator-trafficcontrol/commit/d3987111
Tree: http://git-wip-us.apache.org/repos/asf/incubator-trafficcontrol/tree/d3987111
Diff: http://git-wip-us.apache.org/repos/asf/incubator-trafficcontrol/diff/d3987111
Branch: refs/heads/master
Commit: d39871119330c87c0a0a82a62d88f04cb5cc58de
Parents: 0aaa448
Author: nir-sopher <ni...@qwilt.com>
Authored: Wed Jun 21 05:23:49 2017 +0300
Committer: Jeremy Mitchell <mi...@gmail.com>
Committed: Tue Jul 25 12:55:59 2017 -0600
----------------------------------------------------------------------
traffic_ops/app/lib/API/Deliveryservice.pm | 9 +++++++--
traffic_ops/app/lib/Utils/Tenant.pm | 24 ++++++++++++++++++++++++
2 files changed, 31 insertions(+), 2 deletions(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/incubator-trafficcontrol/blob/d3987111/traffic_ops/app/lib/API/Deliveryservice.pm
----------------------------------------------------------------------
diff --git a/traffic_ops/app/lib/API/Deliveryservice.pm b/traffic_ops/app/lib/API/Deliveryservice.pm
index 1b8406d..3115467 100644
--- a/traffic_ops/app/lib/API/Deliveryservice.pm
+++ b/traffic_ops/app/lib/API/Deliveryservice.pm
@@ -54,7 +54,10 @@ sub index {
$criteria{'me.logs_enabled'} = $logs_enabled ? 1 : 0; # converts bool to 0|1
}
- if ( !&is_privileged($self) ) {
+ my $tenant_utils = UI::TenantUtils->new($self);
+ my $tenants_data = $tenant_utils->create_tenants_data_from_db();
+
+ if ( !&is_privileged($self) and !$tenant_utils->ignore_ds_users_table()) {
my $tm_user = $self->db->resultset('TmUser')->search( { username => $current_user } )->single();
my @ds_ids = $self->db->resultset('DeliveryserviceTmuser')->search( { tm_user_id => $tm_user->id } )->get_column('deliveryservice')->all();
$criteria{'me.id'} = { -in => \@ds_ids },;
@@ -66,7 +69,9 @@ sub index {
);
while ( my $row = $rs_data->next ) {
-
+ if (!$tenant_utils->is_ds_resource_accessible($tenants_data, $row->tenant_id)) {
+ next;
+ }
# build example urls for each delivery service
my @example_urls = ();
my $cdn_domain = $row->cdn->domain_name;
http://git-wip-us.apache.org/repos/asf/incubator-trafficcontrol/blob/d3987111/traffic_ops/app/lib/Utils/Tenant.pm
----------------------------------------------------------------------
diff --git a/traffic_ops/app/lib/Utils/Tenant.pm b/traffic_ops/app/lib/Utils/Tenant.pm
index 0327e46..4735c0c 100644
--- a/traffic_ops/app/lib/Utils/Tenant.pm
+++ b/traffic_ops/app/lib/Utils/Tenant.pm
@@ -64,6 +64,10 @@ sub new {
->get_column('value')->single();
my $ignore_tenancy = defined($ignore_tenancy_value) ? $ignore_tenancy_value : 0;
+ my $ignore_ds_tmuser_assignment_value = $dbh->resultset("Parameter")->search( { config_file => 'global', name => 'ignore-ds-tmuser-assignment' } )
+ ->get_column('value')->single();
+ my $ignore_ds_tmuser_assignment = defined($ignore_ds_tmuser_assignment_value) ? $ignore_ds_tmuser_assignment_value : 0;
+
my $self = {
dbh => $dbh,
context => $context, #saving the context - use it only for log please...
@@ -72,6 +76,7 @@ sub new {
# the below parameters are held temporarily until the info is taken from the jwt
current_user_tenant => $current_user_tenant,
ignore_tenancy => $ignore_tenancy,
+ ignore_ds_tmuser_assignment => $ignore_ds_tmuser_assignment,
};
bless $self, $class;
return $self;
@@ -211,6 +216,25 @@ sub is_user_resource_accessible {
return $self->_is_resource_accessable( $tenants_data, $resource_tenancy);
}
+sub is_ds_resource_accessible {
+ my $self = shift;
+ my $tenants_data = shift;
+ my $resource_tenancy = shift;
+
+ return $self->_is_resource_accessable( $tenants_data, $resource_tenancy);
+}
+
+sub ignore_ds_users_table {
+ # With tenancy, the DS/User mapping is no longer required for isolation.
+ # So we need a knob to turn of this mechanisem if/as-long it is not depraceted.
+ my $self = shift;
+ if ($self->{ignore_ds_tmuser_assignment}) {
+ #mechanisem disabled
+ return 1;
+ }
+ return 0;
+}
+
sub get_tenant_heirarchy_depth {
#return "undef" in case of error