--- /dev/null
+# Copyright 2019 Nokia
+
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+import access_management.db.amdb as amdb
+from am_api_base import *
+
+
+class Roles(AMApiBase):
+
+ """
+ Role create operations
+
+ .. :quickref: Roles;Role create operations
+
+ .. http:post:: /am/v1/roles
+
+ **Start Role create**
+
+ **Example request**:
+
+ .. sourcecode:: http
+
+ POST am/v1/roles HTTP/1.1
+ Host: haproxyvip:61200
+ Accept: application/json
+ {
+ "role_name": "test_role"
+ "desc": "This is a test role"
+ }
+
+ :> json string role_name: The created role name.
+ :> json string desc: A short description from the created role.
+
+ **Example response**:
+
+ .. sourcecode:: http
+
+ HTTP/1.1 200 OK
+ {
+ "code": 0,
+ "description": "Role created."
+ }
+
+ :> json int code: the status code
+ :> json string description: the error description, present if code is non zero
+
+ Role modify operations
+
+ .. :quickref: Roles;Role modify operations
+
+ .. http:put:: /am/v1/roles
+
+ **Start Role modify**
+
+ **Example request**:
+
+ .. sourcecode:: http
+
+ PUT am/v1/roles HTTP/1.1
+ Host: haproxyvip:61200
+ Accept: application/json
+ {
+ "role_name": "test_role"
+ "desc": "This is a test role"
+ }
+
+ :> json string role_name: The modified role name.
+ :> json string desc: A short description from the modified role.
+
+ **Example response**:
+
+ .. sourcecode:: http
+
+ HTTP/1.1 200 OK
+ {
+ "code": 0,
+ "description": "Role modified."
+ }
+
+ :> json int code: the status code
+ :> json string description: the error description, present if code is non zero
+
+ Role delete operations
+
+ .. :quickref: Roles;Role delete operations
+
+ .. http:delete:: /am/v1/roles
+
+ **Start Role delete**
+
+ **Example request**:
+
+ .. sourcecode:: http
+
+ DELETE am/v1/roles HTTP/1.1
+ Host: haproxyvip:61200
+ Accept: application/json
+ {
+ "role_name": "test_role"
+ }
+
+ :> json string role_name: The deleted role name.
+
+ **Example response**:
+
+ .. sourcecode:: http
+
+ HTTP/1.1 200 OK
+ {
+ "code": 0,
+ "description": "Role deleted."
+ }
+
+ :> json int code: the status code
+ :> json string description: the error description, present if code is non zero
+
+ Role list operations
+
+ .. :quickref: Roles;Role list operations
+
+ .. http:get:: /am/v1/roles
+
+ **Start Role list**
+
+ **Example request**:
+
+ .. sourcecode:: http
+
+ GET am/v1/roles HTTP/1.1
+ Host: haproxyvip:61200
+ Accept: application/json
+
+ **Example response**:
+
+ .. sourcecode:: http
+
+ HTTP/1.1 200 OK
+ {
+ "code": 0,
+ "description": "Role list."
+ "data":
+ {
+ "alarm_admin":
+ {
+ "desc": "Alarm Administrator",
+ "is_chroot": false,
+ "is_service": true,
+ "role_name": "alarm_admin"
+ },
+ "alarm_viewer":
+ {
+ "desc": "Alarm Viewer",
+ "is_chroot": false,
+ "is_service": true,
+ "role_name": "alarm_viewer"
+ }
+ }
+ }
+
+ :> json int code: the status code
+ :> json string description: the error description, present if code is non zero
+ :> json object data: a dictionary with the existing roles
+ :> json string role_name: The role name.
+ :> json string desc: The role description.
+ :> json string is_chroot: If this field is true, then this is a chroot user role.
+ :> json string is_service: If this field is true, then this is a service role and we created this role in deploymnet time.
+ """
+
+ endpoints = ['roles']
+ parser_arguments = ['role_name',
+ 'desc']
+
+ def post(self):
+ self.logger.info("Received a role create request!")
+ args = self.parse_args()
+ if args["desc"] is None:
+ args["desc"] = ""
+ state, result = self._role_create(args)
+
+ if state:
+ self.logger.info("The {0} role created!".format(args["role_name"]))
+ return AMApiBase.embed_data({}, 0, result)
+ else:
+ self.logger.error("The {0} role creation failed: {1}".format(args["role_name"], result))
+ return AMApiBase.construct_error_response(1, result)
+
+ def put(self):
+ self.logger.info("Received a role modify request!")
+ args = self.parse_args()
+ if args["desc"] is None:
+ args["desc"] = ""
+ state, result = self._role_modify(args)
+
+ if state:
+ self.logger.info("The {0} role modified!".format(args["role_name"]))
+ return AMApiBase.embed_data({}, 0, result)
+ else:
+ self.logger.error("The {0} role modify failed: {1}".format(args["role_name"], result))
+ return AMApiBase.construct_error_response(1, result)
+
+ def get(self):
+ self.logger.info("Received a role list request!")
+ state, roles = self._role_list()
+
+ if state:
+ self.logger.info("The role list response done!")
+ return AMApiBase.embed_data(roles, 0, "Role list.")
+ else:
+ self.logger.error("Role list creation failed: {0}".format(roles))
+ return AMApiBase.construct_error_response(1, roles)
+
+ def delete(self):
+ self.logger.info("Received a role delete request!")
+ args = self.parse_args()
+
+ state, message = self._role_delete(args)
+
+ if state:
+ self.logger.info("The {0} role deleted!".format(args["role_name"]))
+ return AMApiBase.embed_data({}, 0, message)
+ else:
+ self.logger.error("The {0} role deletion failed: {1}".format(args["role_name"], message))
+ return AMApiBase.construct_error_response(1, message)
+
+ def _role_modify(self, args):
+ state_open, message_open = self._open_db()
+ if state_open:
+ try:
+ self.db.set_role_param(args["role_name"], args["desc"])
+ except amdb.NotAllowedOperation:
+ self.logger.error("Modifying service role is not allowed: {0}".format(args["role_name"]))
+ return False, "Modifying service role is not allowed: {0}".format(args["role_name"])
+ except Exception as ex:
+ self.logger.error("Internal error: {0}".format(ex))
+ return False, "Internal error: {0}".format(ex)
+ finally:
+ state_close, message_close = self._close_db()
+ if not state_close:
+ self._close_db()
+ return True, "Role modified."
+ else:
+ return False, message_open
+
+ def _role_create(self, args):
+ state_open, message_open = self._open_db()
+ if state_open:
+ try:
+ self.db.create_role(args["role_name"], args["desc"])
+ try:
+ self.keystone.roles.create(args["role_name"])
+ except Exception as ex:
+ self.db.delete_role(args["role_name"])
+ self.logger.error("Role {} already exists".format(args["role_name"]))
+ return False, "Role {} already exists".format(args["role_name"])
+ except amdb.AlreadyExist:
+ self.logger.error("Role already exists in table: {0}".format(args["role_name"]))
+ return False, "Role already exists in table: {0}".format(args["role_name"])
+ except Exception as ex:
+ self.logger.error("Internal error: {0}".format(ex))
+ return False, "Internal error: {0}".format(ex)
+ finally:
+ state_close, message_close = self._close_db()
+ if not state_close:
+ self._close_db()
+ else:
+ return False, message_open
+ return True, "Role created."
+
+ def _role_list(self):
+ state_open, message_open = self._open_db()
+ if state_open:
+ try:
+ roles = self.db.get_all_roles()
+ except Exception as ex:
+ self.logger.error("Internal error: {0}".format(ex))
+ return False, "Internal error: {0}".format(ex)
+ finally:
+ state_close, message_close = self._close_db()
+ if not state_close:
+ self._close_db()
+ return True, roles
+ else:
+ return False, message_open
+
+ def _add_roles_back_to_users(self, role_name):
+ uuid_list = self.db.get_role_users(role_name)
+ for uuid in uuid_list:
+ username, def_project = self.get_user_from_uuid(uuid)
+ state, message = self.modify_role_in_keystone(role_name, uuid, "put", def_project)
+ if not state:
+ return False, "Role deletion failed, please try again!"
+ return False, "Role deletion failed, try again"
+
+ def _role_delete(self, args):
+ state_open, message_open = self._open_db()
+ if state_open:
+ try:
+ db_role = self.db.get_role(args["role_name"])
+ if not db_role._data["is_service"]:
+ role_id = self.get_role_id(args["role_name"])
+ if role_id is not None:
+ try:
+ self.keystone.roles.delete(role_id)
+ except Exception as ex:
+ self.logger.error("Some problem occured: {}".format(ex))
+ return False, "Some problem occured: {}".format(ex)
+
+ try:
+ self.db.delete_role(args["role_name"])
+ except Exception:
+ try:
+ self.keystone.roles.create(args["role_name"])
+ except Exception:
+ self.logger.error("Error during deleting role: {}".format(args["role_name"]))
+ return False, "Error during deleting role: {}".format(args["role_name"])
+ state, message = self._add_roles_back_to_users(args["role_name"])
+ return state, message
+ else:
+ raise amdb.NotAllowedOperation("")
+ except amdb.NotAllowedOperation:
+ self.logger.error("Deleting service role is not allowed: {0}".format(args["role_name"]))
+ return False, "Deleting service role is not allowed: {0}".format(args["role_name"])
+ except Exception as ex:
+ self.logger.error("Internal error: {0}".format(ex))
+ return False, "Internal error: {0}".format(ex)
+ finally:
+ state_close, message_close = self._close_db()
+ if not state_close:
+ self._close_db()
+ return True, "Role deleted."
+ else:
+ return False, message_open
Code Review / ta / access-management.git / blobdiff