Versions Compared

Old Version 4

changes.mady.by.user Prachi Damle

Saved on

compared with

New Version 5

changes.mady.by.user Min Chen

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

Guidelines for adding a new R* API

...

(listXXX commands)

In new IAM model, we have updated the following interfaces in AccountManager to build search criteria by considering IAM group/policy/permissions. In these interfaces, we have added "permittedDomains", "permittedAccounts" and "permittedResources" lists to account for granting by domain, account and resource, respectively. 

 

Code Block
    // new ACL model routine for query api 
    void buildACLSearchParameters(Account caller, Long id,
            String accountName, Long projectId, List<Long> permittedDomains, List<Long> permittedAccounts, List<Long> permittedResources,
            Ternary<Long, Boolean, ListProjectResourcesCriteria> domainIdRecursiveListProject, boolean listAll, boolean forProjectInvitation, String action);
    void buildACLSearchBuilder(SearchBuilder<? extends ControlledEntity> sb, boolean isRecursive,
            List<Long> permittedDomains,
            List<Long> permittedAccounts, List<Long> permittedResources, ListProjectResourcesCriteria listProjectResourcesCriteria);
    void buildACLSearchCriteria(SearchCriteria<? extends ControlledEntity> sc, boolean isRecursive,
            List<Long> permittedDomains,
            List<Long> permittedAccounts, List<Long> permittedResources, ListProjectResourcesCriteria listProjectResourcesCriteria);
    void buildACLViewSearchCriteria(SearchCriteria<? extends ControlledEntity> sc, SearchCriteria<? extends ControlledEntity> aclSc, boolean isRecursive,
            List<Long> permittedDomains, List<Long> permittedAccounts,
            List<Long> permittedResources, ListProjectResourcesCriteria listProjectResourcesCriteria);

Currently in CloudStack code, we have two types of ControlledEntity: one with db view created (like VirtualMachineTemplate, Volume, etc) whose list logic is mainly implemented in QueryManagerImpl; the other with no db view created (like FirewallRule,etc) whose list logic is scattered around at service layer. 

  • Boilerplate code for list controlled entity with db view created
Code Block
        Ternary<Long, Boolean, ListProjectResourcesCriteria> domainIdRecursiveListProject = new Ternary<Long, Boolean, ListProjectResourcesCriteria>(
                cmd.getDomainId(), cmd.isRecursive(), null);
        _accountMgr.buildACLSearchParameters(caller, id, cmd.getAccountName(), cmd.getProjectId(), permittedDomains, permittedAccounts, permittedResources,
                domainIdRecursiveListProject, listAll, false, "listVirtualMachines");
		......
        SearchBuilder<UserVmJoinVO> sb = _userVmJoinDao.createSearchBuilder();
		......
        SearchCriteria<UserVmJoinVO> sc = sb.create();
        SearchCriteria<UserVmJoinVO> aclSc = _userVmJoinDao.createSearchCriteria();
        // building ACL search criteria to join with sc
        _accountMgr.buildACLViewSearchCriteria(sc, aclSc, isRecursive, permittedDomains, permittedAccounts, permittedResources, listProjectResourcesCriteria);

 

  • Boilerplate code for list controlled entity with no db view created
Code Block
        Ternary<Long, Boolean, ListProjectResourcesCriteria> domainIdRecursiveListProject = new Ternary<Long, Boolean, ListProjectResourcesCriteria>(cmd.getDomainId(), cmd.isRecursive(), null);
        _accountMgr.buildACLSearchParameters(caller, id, cmd.getAccountName(), cmd.getProjectId(), permittedDomains, permittedAccounts, permittedResources, domainIdRecursiveListProject, cmd.listAll(), false, "listFirewallRules");
		.......
        SearchBuilder<FirewallRuleVO> sb = _firewallDao.createSearchBuilder();
        _accountMgr.buildACLSearchBuilder(sb, isRecursive, permittedDomains, permittedAccounts, permittedResources, listProjectResourcesCriteria);
		......
        SearchCriteria<FirewallRuleVO> sc = sb.create();
        _accountMgr.buildACLSearchCriteria(sc, isRecursive, permittedDomains, permittedAccounts, permittedResources, listProjectResourcesCriteria);