From 97fd99b09a7a82b7bd62a8ff7cfdeca5a0063c33 Mon Sep 17 00:00:00 2001 From: Min Chen Date: Thu, 26 Sep 2013 17:48:29 -0700 Subject: [PATCH] Add all Apis for AclRole. --- api/src/com/cloud/event/EventTypes.java | 7 + .../org/apache/cloudstack/acl/AclService.java | 19 +-- .../apache/cloudstack/api/ApiConstants.java | 3 +- .../admin/acl/AddAclRoleToAclGroupCmd.java | 20 ++- .../command/admin/acl/CreateAclRoleCmd.java | 45 +++++- .../command/admin/acl/DeleteAclRoleCmd.java | 21 ++- .../acl/GrantPermissionToAclRoleCmd.java | 120 ++++++++++++++++ .../acl/RemoveAclRoleFromAclGroupCmd.java | 20 ++- .../acl/RevokePermissionFromAclRoleCmd.java | 120 ++++++++++++++++ .../api/response/AclRoleResponse.java | 2 +- client/tomcatconf/applicationContext.xml.in | 2 + client/tomcatconf/commands.properties.in | 10 ++ .../cloudstack/acl/AclApiPermissionVO.java | 18 +++ .../acl/dao/AclGroupRoleMapDao.java | 2 + .../acl/dao/AclGroupRoleMapDaoImpl.java | 14 ++ server/src/com/cloud/api/ApiDBUtils.java | 5 + .../src/com/cloud/api/ApiResponseHelper.java | 23 +-- .../cloud/server/ManagementServerImpl.java | 16 ++- .../apache/cloudstack/acl/AclServiceImpl.java | 131 +++++++++++++++--- 19 files changed, 535 insertions(+), 63 deletions(-) create mode 100644 api/src/org/apache/cloudstack/api/command/admin/acl/GrantPermissionToAclRoleCmd.java create mode 100644 api/src/org/apache/cloudstack/api/command/admin/acl/RevokePermissionFromAclRoleCmd.java diff --git a/api/src/com/cloud/event/EventTypes.java b/api/src/com/cloud/event/EventTypes.java index b3aa91a442a..4b98433f35c 100755 --- a/api/src/com/cloud/event/EventTypes.java +++ b/api/src/com/cloud/event/EventTypes.java @@ -445,6 +445,13 @@ public class EventTypes { public static final String EVENT_UCS_ASSOCIATED_PROFILE = "UCS.ASSOCIATEPROFILE"; + public static final String EVENT_ACL_ROLE_CREATE = "ACLROLE.CREATE"; + public static final String EVENT_ACL_ROLE_DELETE = "ACLROLE.DELETE"; + public static final String EVENT_ACL_ROLE_GRANT = "ACLROLE.GRANT"; + public static final String EVENT_ACL_ROLE_REVOKE = "ACLROLE.REVOKE"; + + public static final String EVENT_ACL_GROUP_UPDATE = "ACLGROUP.UPDATE"; + static { // TODO: need a way to force author adding event types to declare the entity details as well, with out braking diff --git a/api/src/org/apache/cloudstack/acl/AclService.java b/api/src/org/apache/cloudstack/acl/AclService.java index ff4fa2956e8..a8ed501ed4b 100644 --- a/api/src/org/apache/cloudstack/acl/AclService.java +++ b/api/src/org/apache/cloudstack/acl/AclService.java @@ -40,24 +40,9 @@ public interface AclService { */ boolean deleteAclRole(long aclRoleId); - /** Lists Acl roles for a domain - * @param domainId - * @param aclRoleId - * @param aclRoleName - * @param startIndex - * @param pageSize - * @return - */ - Pair, Integer> listAclRoles(Long aclRoleId, String aclRoleName, - Long domainId, Long startIndex, Long pageSize); + AclRole grantPermissionToAclRole(long aclRoleId, List apiNames); - - /** - * Get the acl role for the given role id. - * @param roleId - * @return AclRole - */ - AclRole getAclRole(Long roleId); + AclRole revokePermissionFromAclRole(long aclRoleId, List apiNames); AclGroup addAclRolesToGroup(List roleIds, Long groupId); diff --git a/api/src/org/apache/cloudstack/api/ApiConstants.java b/api/src/org/apache/cloudstack/api/ApiConstants.java index 7bb4276cf83..da5e3d6a555 100755 --- a/api/src/org/apache/cloudstack/api/ApiConstants.java +++ b/api/src/org/apache/cloudstack/api/ApiConstants.java @@ -523,7 +523,8 @@ public class ApiConstants { public static final String ACL_PARENT_ROLE_NAME = "parentrolename"; public static final String ACL_ROLES = "roles"; public static final String ACL_ROLE_IDS = "roleids"; - public static final String ACL_ALLOWED_APIS = "allowedapis"; + public static final String ACL_APIS = "apis"; + public enum HostDetails { all, capacity, events, stats, min; } diff --git a/api/src/org/apache/cloudstack/api/command/admin/acl/AddAclRoleToAclGroupCmd.java b/api/src/org/apache/cloudstack/api/command/admin/acl/AddAclRoleToAclGroupCmd.java index f700831bd52..4a6fccaab5d 100644 --- a/api/src/org/apache/cloudstack/api/command/admin/acl/AddAclRoleToAclGroupCmd.java +++ b/api/src/org/apache/cloudstack/api/command/admin/acl/AddAclRoleToAclGroupCmd.java @@ -23,22 +23,24 @@ import org.apache.log4j.Logger; import org.apache.cloudstack.acl.AclGroup; import org.apache.cloudstack.api.ACL; import org.apache.cloudstack.api.APICommand; +import org.apache.cloudstack.api.ApiCommandJobType; import org.apache.cloudstack.api.ApiConstants; import org.apache.cloudstack.api.ApiErrorCode; -import org.apache.cloudstack.api.BaseCmd; +import org.apache.cloudstack.api.BaseAsyncCmd; import org.apache.cloudstack.api.Parameter; import org.apache.cloudstack.api.ServerApiException; import org.apache.cloudstack.api.response.AclGroupResponse; import org.apache.cloudstack.api.response.AclRoleResponse; import org.apache.cloudstack.context.CallContext; +import com.cloud.event.EventTypes; import com.cloud.exception.InsufficientCapacityException; import com.cloud.exception.ResourceUnavailableException; import com.cloud.user.Account; @APICommand(name = "addAclRoleToAclGroup", description = "add acl role to an acl group", responseObject = AclGroupResponse.class) -public class AddAclRoleToAclGroupCmd extends BaseCmd { +public class AddAclRoleToAclGroupCmd extends BaseAsyncCmd { public static final Logger s_logger = Logger.getLogger(AddAclRoleToAclGroupCmd.class.getName()); private static final String s_name = "addaclroletoaclgroupresponse"; @@ -101,5 +103,19 @@ public class AddAclRoleToAclGroupCmd extends BaseCmd { } } + @Override + public String getEventType() { + return EventTypes.EVENT_ACL_GROUP_UPDATE; + } + + @Override + public String getEventDescription() { + return "adding acl roles to acl group"; + } + + @Override + public ApiCommandJobType getInstanceType() { + return ApiCommandJobType.AclGroup; + } } diff --git a/api/src/org/apache/cloudstack/api/command/admin/acl/CreateAclRoleCmd.java b/api/src/org/apache/cloudstack/api/command/admin/acl/CreateAclRoleCmd.java index 59bc7ae4c84..0e6867acf40 100644 --- a/api/src/org/apache/cloudstack/api/command/admin/acl/CreateAclRoleCmd.java +++ b/api/src/org/apache/cloudstack/api/command/admin/acl/CreateAclRoleCmd.java @@ -20,18 +20,21 @@ import org.apache.log4j.Logger; import org.apache.cloudstack.acl.AclRole; import org.apache.cloudstack.api.APICommand; +import org.apache.cloudstack.api.ApiCommandJobType; import org.apache.cloudstack.api.ApiConstants; import org.apache.cloudstack.api.ApiErrorCode; -import org.apache.cloudstack.api.BaseCmd; +import org.apache.cloudstack.api.BaseAsyncCreateCmd; import org.apache.cloudstack.api.Parameter; import org.apache.cloudstack.api.ServerApiException; import org.apache.cloudstack.api.response.AclRoleResponse; import org.apache.cloudstack.api.response.DomainResponse; +import com.cloud.event.EventTypes; +import com.cloud.exception.ResourceAllocationException; import com.cloud.user.Account; @APICommand(name = "createAclRole", responseObject = AclRoleResponse.class, description = "Creates an acl role") -public class CreateAclRoleCmd extends BaseCmd { +public class CreateAclRoleCmd extends BaseAsyncCreateCmd { public static final Logger s_logger = Logger.getLogger(CreateAclRoleCmd.class.getName()); private static final String s_name = "createaclroleresponse"; @@ -84,7 +87,7 @@ public class CreateAclRoleCmd extends BaseCmd { @Override public void execute() { - AclRole role = _aclService.createAclRole(domainId, name, description); + AclRole role = _entityMgr.findById(AclRole.class, getEntityId()); if (role != null) { AclRoleResponse response = _responseGenerator.createAclRoleResponse(role); response.setResponseName(getCommandName()); @@ -94,5 +97,41 @@ public class CreateAclRoleCmd extends BaseCmd { } } + @Override + public void create() throws ResourceAllocationException { + AclRole result = _aclService.createAclRole(domainId, name, description); + if (result != null) { + setEntityId(result.getId()); + setEntityUuid(result.getUuid()); + } else { + throw new ServerApiException(ApiErrorCode.INTERNAL_ERROR, "Failed to create acl role entity" + name); + } + + } + + @Override + public String getEventType() { + return EventTypes.EVENT_ACL_ROLE_CREATE; + } + + @Override + public String getEventDescription() { + return "creating Acl role"; + } + + @Override + public String getCreateEventType() { + return EventTypes.EVENT_ACL_ROLE_CREATE; + } + + @Override + public String getCreateEventDescription() { + return "creating acl role"; + } + + @Override + public ApiCommandJobType getInstanceType() { + return ApiCommandJobType.AclRole; + } } diff --git a/api/src/org/apache/cloudstack/api/command/admin/acl/DeleteAclRoleCmd.java b/api/src/org/apache/cloudstack/api/command/admin/acl/DeleteAclRoleCmd.java index 3f1be71454f..5a2afe13ddd 100644 --- a/api/src/org/apache/cloudstack/api/command/admin/acl/DeleteAclRoleCmd.java +++ b/api/src/org/apache/cloudstack/api/command/admin/acl/DeleteAclRoleCmd.java @@ -20,18 +20,20 @@ import org.apache.log4j.Logger; import org.apache.cloudstack.api.ACL; import org.apache.cloudstack.api.APICommand; +import org.apache.cloudstack.api.ApiCommandJobType; import org.apache.cloudstack.api.ApiConstants; import org.apache.cloudstack.api.ApiErrorCode; -import org.apache.cloudstack.api.BaseCmd; +import org.apache.cloudstack.api.BaseAsyncCmd; import org.apache.cloudstack.api.Parameter; import org.apache.cloudstack.api.ServerApiException; import org.apache.cloudstack.api.response.AclRoleResponse; import org.apache.cloudstack.api.response.SuccessResponse; +import com.cloud.event.EventTypes; import com.cloud.user.Account; @APICommand(name = "deleteAclRole", description = "Deletes acl role", responseObject = SuccessResponse.class) -public class DeleteAclRoleCmd extends BaseCmd { +public class DeleteAclRoleCmd extends BaseAsyncCmd { public static final Logger s_logger = Logger.getLogger(DeleteAclRoleCmd.class.getName()); private static final String s_name = "deleteaclroleresponse"; @@ -76,4 +78,19 @@ public class DeleteAclRoleCmd extends BaseCmd { throw new ServerApiException(ApiErrorCode.INTERNAL_ERROR, "Failed to delete acl role"); } } + + @Override + public String getEventType() { + return EventTypes.EVENT_ACL_ROLE_DELETE; + } + + @Override + public String getEventDescription() { + return "Deleting Acl role"; + } + + @Override + public ApiCommandJobType getInstanceType() { + return ApiCommandJobType.AclRole; + } } diff --git a/api/src/org/apache/cloudstack/api/command/admin/acl/GrantPermissionToAclRoleCmd.java b/api/src/org/apache/cloudstack/api/command/admin/acl/GrantPermissionToAclRoleCmd.java new file mode 100644 index 00000000000..a93e790e29a --- /dev/null +++ b/api/src/org/apache/cloudstack/api/command/admin/acl/GrantPermissionToAclRoleCmd.java @@ -0,0 +1,120 @@ +// Licensed to the Apache Software Foundation (ASF) under one +// or more contributor license agreements. See the NOTICE file +// distributed with this work for additional information +// regarding copyright ownership. The ASF licenses this file +// to you under the Apache License, Version 2.0 (the +// "License"); you may not use this file except in compliance +// with the License. You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, +// software distributed under the License is distributed on an +// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +// KIND, either express or implied. See the License for the +// specific language governing permissions and limitations +// under the License. +package org.apache.cloudstack.api.command.admin.acl; + +import java.util.List; + +import org.apache.log4j.Logger; + +import org.apache.cloudstack.acl.AclRole; +import org.apache.cloudstack.api.ACL; +import org.apache.cloudstack.api.APICommand; +import org.apache.cloudstack.api.ApiCommandJobType; +import org.apache.cloudstack.api.ApiConstants; +import org.apache.cloudstack.api.ApiErrorCode; +import org.apache.cloudstack.api.BaseAsyncCmd; +import org.apache.cloudstack.api.Parameter; +import org.apache.cloudstack.api.ServerApiException; +import org.apache.cloudstack.api.response.AclRoleResponse; +import org.apache.cloudstack.context.CallContext; + +import com.cloud.event.EventTypes; +import com.cloud.exception.InsufficientCapacityException; +import com.cloud.exception.ResourceUnavailableException; +import com.cloud.user.Account; + + +@APICommand(name = "grantPermissionToAclRole", description = "Grant api permission to an acl role", responseObject = AclRoleResponse.class) +public class GrantPermissionToAclRoleCmd extends BaseAsyncCmd { + public static final Logger s_logger = Logger.getLogger(GrantPermissionToAclRoleCmd.class.getName()); + private static final String s_name = "grantpermissiontoroleresponse"; + + ///////////////////////////////////////////////////// + //////////////// API parameters ///////////////////// + ///////////////////////////////////////////////////// + + + @ACL + @Parameter(name = ApiConstants.ID, type = CommandType.UUID, entityType = AclRoleResponse.class, + required = true, description = "The ID of the acl role") + private Long id; + + @ACL + @Parameter(name = ApiConstants.ACL_APIS, type = CommandType.LIST, collectionType = CommandType.STRING, description = "comma separated list of apis granted to the acl role. ") + private List apiList; + + + ///////////////////////////////////////////////////// + /////////////////// Accessors /////////////////////// + ///////////////////////////////////////////////////// + + + public Long getId() { + return id; + } + + + public List getApiList() { + return apiList; + } + + ///////////////////////////////////////////////////// + /////////////// API Implementation/////////////////// + ///////////////////////////////////////////////////// + + + @Override + public String getCommandName() { + return s_name; + } + + + @Override + public long getEntityOwnerId() { + return Account.ACCOUNT_ID_SYSTEM; // no account info given, parent this command to SYSTEM so ERROR events are tracked + } + + @Override + public void execute() throws ResourceUnavailableException, + InsufficientCapacityException, ServerApiException { + CallContext.current().setEventDetails("Acl role Id: " + getId()); + AclRole result = _aclService.grantPermissionToAclRole(id, apiList); + if (result != null) { + AclRoleResponse response = _responseGenerator.createAclRoleResponse(result); + response.setResponseName(getCommandName()); + setResponseObject(response); + } else { + throw new ServerApiException(ApiErrorCode.INTERNAL_ERROR, "Failed to grant permission to acl role " + getId()); + } + } + + @Override + public String getEventType() { + return EventTypes.EVENT_ACL_ROLE_GRANT; + } + + @Override + public String getEventDescription() { + return "granting permission to acl role"; + } + + @Override + public ApiCommandJobType getInstanceType() { + return ApiCommandJobType.AclRole; + } + +} diff --git a/api/src/org/apache/cloudstack/api/command/admin/acl/RemoveAclRoleFromAclGroupCmd.java b/api/src/org/apache/cloudstack/api/command/admin/acl/RemoveAclRoleFromAclGroupCmd.java index 11ea8c260ff..b06bb46381f 100644 --- a/api/src/org/apache/cloudstack/api/command/admin/acl/RemoveAclRoleFromAclGroupCmd.java +++ b/api/src/org/apache/cloudstack/api/command/admin/acl/RemoveAclRoleFromAclGroupCmd.java @@ -23,22 +23,24 @@ import org.apache.log4j.Logger; import org.apache.cloudstack.acl.AclGroup; import org.apache.cloudstack.api.ACL; import org.apache.cloudstack.api.APICommand; +import org.apache.cloudstack.api.ApiCommandJobType; import org.apache.cloudstack.api.ApiConstants; import org.apache.cloudstack.api.ApiErrorCode; -import org.apache.cloudstack.api.BaseCmd; +import org.apache.cloudstack.api.BaseAsyncCmd; import org.apache.cloudstack.api.Parameter; import org.apache.cloudstack.api.ServerApiException; import org.apache.cloudstack.api.response.AclGroupResponse; import org.apache.cloudstack.api.response.AclRoleResponse; import org.apache.cloudstack.context.CallContext; +import com.cloud.event.EventTypes; import com.cloud.exception.InsufficientCapacityException; import com.cloud.exception.ResourceUnavailableException; import com.cloud.user.Account; @APICommand(name = "removeAclRoleFromAclGroup", description = "remove acl role to an acl group", responseObject = AclGroupResponse.class) -public class RemoveAclRoleFromAclGroupCmd extends BaseCmd { +public class RemoveAclRoleFromAclGroupCmd extends BaseAsyncCmd { public static final Logger s_logger = Logger.getLogger(RemoveAclRoleFromAclGroupCmd.class.getName()); private static final String s_name = "removeaclroletoaclgroupresponse"; @@ -101,5 +103,19 @@ public class RemoveAclRoleFromAclGroupCmd extends BaseCmd { } } + @Override + public String getEventType() { + return EventTypes.EVENT_ACL_GROUP_UPDATE; + } + + @Override + public String getEventDescription() { + return "removing acl roles from acl group"; + } + + @Override + public ApiCommandJobType getInstanceType() { + return ApiCommandJobType.AclGroup; + } } diff --git a/api/src/org/apache/cloudstack/api/command/admin/acl/RevokePermissionFromAclRoleCmd.java b/api/src/org/apache/cloudstack/api/command/admin/acl/RevokePermissionFromAclRoleCmd.java new file mode 100644 index 00000000000..68db1181203 --- /dev/null +++ b/api/src/org/apache/cloudstack/api/command/admin/acl/RevokePermissionFromAclRoleCmd.java @@ -0,0 +1,120 @@ +// Licensed to the Apache Software Foundation (ASF) under one +// or more contributor license agreements. See the NOTICE file +// distributed with this work for additional information +// regarding copyright ownership. The ASF licenses this file +// to you under the Apache License, Version 2.0 (the +// "License"); you may not use this file except in compliance +// with the License. You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, +// software distributed under the License is distributed on an +// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +// KIND, either express or implied. See the License for the +// specific language governing permissions and limitations +// under the License. +package org.apache.cloudstack.api.command.admin.acl; + +import java.util.List; + +import org.apache.log4j.Logger; + +import org.apache.cloudstack.acl.AclRole; +import org.apache.cloudstack.api.ACL; +import org.apache.cloudstack.api.APICommand; +import org.apache.cloudstack.api.ApiCommandJobType; +import org.apache.cloudstack.api.ApiConstants; +import org.apache.cloudstack.api.ApiErrorCode; +import org.apache.cloudstack.api.BaseAsyncCmd; +import org.apache.cloudstack.api.Parameter; +import org.apache.cloudstack.api.ServerApiException; +import org.apache.cloudstack.api.response.AclRoleResponse; +import org.apache.cloudstack.context.CallContext; + +import com.cloud.event.EventTypes; +import com.cloud.exception.InsufficientCapacityException; +import com.cloud.exception.ResourceUnavailableException; +import com.cloud.user.Account; + + +@APICommand(name = "revokePermissionFromAclRole", description = "Revoke api permission from an acl role", responseObject = AclRoleResponse.class) +public class RevokePermissionFromAclRoleCmd extends BaseAsyncCmd { + public static final Logger s_logger = Logger.getLogger(RevokePermissionFromAclRoleCmd.class.getName()); + private static final String s_name = "revokepermissionfromroleresponse"; + + ///////////////////////////////////////////////////// + //////////////// API parameters ///////////////////// + ///////////////////////////////////////////////////// + + + @ACL + @Parameter(name = ApiConstants.ID, type = CommandType.UUID, entityType = AclRoleResponse.class, + required = true, description = "The ID of the acl role") + private Long id; + + @ACL + @Parameter(name = ApiConstants.ACL_APIS, type = CommandType.LIST, collectionType = CommandType.STRING, description = "comma separated list of apis granted to the acl role. ") + private List apiList; + + + ///////////////////////////////////////////////////// + /////////////////// Accessors /////////////////////// + ///////////////////////////////////////////////////// + + + public Long getId() { + return id; + } + + + public List getApiList() { + return apiList; + } + + ///////////////////////////////////////////////////// + /////////////// API Implementation/////////////////// + ///////////////////////////////////////////////////// + + + @Override + public String getCommandName() { + return s_name; + } + + + @Override + public long getEntityOwnerId() { + return Account.ACCOUNT_ID_SYSTEM; // no account info given, parent this command to SYSTEM so ERROR events are tracked + } + + @Override + public void execute() throws ResourceUnavailableException, + InsufficientCapacityException, ServerApiException { + CallContext.current().setEventDetails("Acl role Id: " + getId()); + AclRole result = _aclService.revokePermissionFromAclRole(id, apiList); + if (result != null) { + AclRoleResponse response = _responseGenerator.createAclRoleResponse(result); + response.setResponseName(getCommandName()); + setResponseObject(response); + } else { + throw new ServerApiException(ApiErrorCode.INTERNAL_ERROR, "Failed to revoke permission from acl role " + getId()); + } + } + + @Override + public String getEventType() { + return EventTypes.EVENT_ACL_ROLE_REVOKE; + } + + @Override + public String getEventDescription() { + return "revoking permission from acl role"; + } + + @Override + public ApiCommandJobType getInstanceType() { + return ApiCommandJobType.AclRole; + } + +} diff --git a/api/src/org/apache/cloudstack/api/response/AclRoleResponse.java b/api/src/org/apache/cloudstack/api/response/AclRoleResponse.java index 527261fd779..68a9a598a92 100644 --- a/api/src/org/apache/cloudstack/api/response/AclRoleResponse.java +++ b/api/src/org/apache/cloudstack/api/response/AclRoleResponse.java @@ -60,7 +60,7 @@ public class AclRoleResponse extends BaseResponse { @Param(description = "the domain name of the acl role") private String domainName; - @SerializedName(ApiConstants.ACL_ALLOWED_APIS) + @SerializedName(ApiConstants.ACL_APIS) @Param(description = "allowed apis for the acl role ") private List apiList; diff --git a/client/tomcatconf/applicationContext.xml.in b/client/tomcatconf/applicationContext.xml.in index 96b09516276..78aa661248a 100644 --- a/client/tomcatconf/applicationContext.xml.in +++ b/client/tomcatconf/applicationContext.xml.in @@ -371,10 +371,12 @@ + +