added rbac for viewing objects
diff --git a/planetstack/core/models/deployment.py b/planetstack/core/models/deployment.py
index 1e5e6dc..ea77dea 100644
--- a/planetstack/core/models/deployment.py
+++ b/planetstack/core/models/deployment.py
@@ -32,3 +32,27 @@
def __unicode__(self): return u'%s %s %s' % (self.deployment, self.user, self.role)
+
+ def can_update(self, user):
+ if user.is_readonly:
+ return False
+ if user.is_admin:
+ return True
+ dprivs = DeploymentPrivilege.objects.filter(user=user)
+ for dpriv in dprivs:
+ if dpriv.role.role_type == 'admin':
+ return True
+ return False
+
+ def save_by_user(self, user, *args, **kwds):
+ if self.can_update(user):
+ super(DeploymentPrivilege, self).save(*args, **kwds)
+
+ @staticmethod
+ def select_by_user(user):
+ if user.is_admin:
+ qs = DeploymentPrivilege.objects.all()
+ else:
+ dpriv_ids = [dp.id for dp in DeploymentPrivilege.objects.filter(user=user)]
+ qs = DeploymentPrivilege.objects.filter(id__in=dpriv_ids)
+ return qs
diff --git a/planetstack/core/models/network.py b/planetstack/core/models/network.py
index 72e7a5f..7b9364c 100644
--- a/planetstack/core/models/network.py
+++ b/planetstack/core/models/network.py
@@ -50,6 +50,22 @@
self.subnet = find_unused_subnet(existing_subnets=[x.subnet for x in Network.objects.all()])
super(Network, self).save(*args, **kwds)
+ def can_update(self, user):
+ return self.slice.can_update(user)
+
+ def save_by_user(self, user, *args, **kwds):
+ if self.slice.can_update(user):
+ super(Network, self).save(*args, **kwds)
+
+ @staticmethod
+ def select_by_user(user):
+ if user.is_admin:
+ qs = Network.objects.all()
+ else:
+ slice_ids = [s.id for s in Slice.select_by_user(user)]
+ qs = Network.objects.filter(id__in=slice_ids)
+ return qs
+
class NetworkSlice(PlCoreBase):
# This object exists solely so we can implement the permission check when
# adding slices to networks. It adds no additional fields to the relation.
@@ -70,6 +86,22 @@
def __unicode__(self): return u'%s-%s' % (self.network.name, self.slice.name)
+ def can_update(self, user):
+ return self.slice.can_update(user)
+
+ def save_by_user(self, user, *args, **kwds):
+ if self.slice.can_update(user):
+ super(NetworkSlice, self).save(*args, **kwds)
+
+ @staticmethod
+ def select_by_user(user):
+ if user.is_admin:
+ qs = NetworkSlice.objects.all()
+ else:
+ slice_ids = [s.id for s in Slice.select_by_user(user)]
+ qs = NetworkSlice.objects.filter(id__in=slice_ids)
+ return qs
+
class NetworkSliver(PlCoreBase):
network = models.ForeignKey(Network)
sliver = models.ForeignKey(Sliver)
@@ -93,6 +125,22 @@
def __unicode__(self): return u'%s-%s' % (self.network.name, self.sliver.instance_name)
+ def can_update(self, user):
+ return self.sliver.can_update(user)
+
+ def save_by_user(self, user, *args, **kwds):
+ if self.sliver.can_update(user):
+ super(NetworkSliver, self).save(*args, **kwds)
+
+ @staticmethod
+ def select_by_user(user):
+ if user.is_admin:
+ qs = NetworkSliver.objects.all()
+ else:
+ sliver_ids = [s.id for s in NetworkSliver.select_by_user(user)]
+ qs = NetworkSliver.objects.filter(id__in=sliver_ids)
+ return qs
+
class Router(PlCoreBase):
name = models.CharField(max_length=32)
owner = models.ForeignKey(Slice, related_name="routers")
diff --git a/planetstack/core/models/plcorebase.py b/planetstack/core/models/plcorebase.py
index 590e240..9838d7f 100644
--- a/planetstack/core/models/plcorebase.py
+++ b/planetstack/core/models/plcorebase.py
@@ -38,6 +38,13 @@
def get_field_diff(self, field_name):
return self.diff.get(field_name, None)
+ def can_update(self, user):
+ if user.is_readonly:
+ return False
+ if user.is_admin:
+ return True
+ return False
+
def delete(self, *args, **kwds):
# so we have something to give the observer
pk = self.pk
@@ -59,6 +66,10 @@
self.__initial = self._dict
+ def save_by_user(self, user, *args, **kwds):
+ if self.can_update(user):
+ self.save(*args, **kwds)
+
@property
def _dict(self):
return model_to_dict(self, fields=[field.name for field in
diff --git a/planetstack/core/models/reservation.py b/planetstack/core/models/reservation.py
index e445228..e89b4c8 100644
--- a/planetstack/core/models/reservation.py
+++ b/planetstack/core/models/reservation.py
@@ -19,6 +19,22 @@
def endTime(self):
return self.startTime + datetime.timedelta(hours=self.duration)
+ def can_update(self, user):
+ return self.slice.can_update(user)
+
+ def save_by_user(self, user, *args, **kwds):
+ if self.can_update(user):
+ super(Reservation, self).save(*args, **kwds)
+
+ @staticmethod
+ def select_by_user(user):
+ if user.is_admin:
+ qs = Reservation.objects.all()
+ else:
+ slice_ids = [s.id for s in Slice.select_by_user(user)]
+ qs = Reservation.objects.filter(id__in=slice_ids)
+ return qs
+
class ReservedResource(PlCoreBase):
sliver = models.ForeignKey(Sliver, related_name="reservedResourrces")
resource = models.ForeignKey(ServiceResource, related_name="reservedResources")
@@ -30,6 +46,20 @@
def __unicode__(self): return u'%d %s on %s' % (self.quantity, self.resource, self.sliver)
+ def can_update(self, user):
+ return self.sliver.slice.can_update(user)
+ def save_by_user(self, user, *args, **kwds):
+ if self.can_update(user):
+ super(ReservedResource, self).save(*args, **kwds)
+
+ @staticmethod
+ def select_by_user(user):
+ if user.is_admin:
+ qs = ReservedResource.objects.all()
+ else:
+ sliver_ids = [s.id for s in Sliver.select_by_user(user)]
+ qs = ReservedResource.objects.filter(id__in=sliver_ids)
+ return qs
diff --git a/planetstack/core/models/serviceclass.py b/planetstack/core/models/serviceclass.py
index ce3eaee..3b6ee82 100644
--- a/planetstack/core/models/serviceclass.py
+++ b/planetstack/core/models/serviceclass.py
@@ -27,4 +27,6 @@
except ServiceClass.DoesNotExist:
return None
-
+ def save_by_user(self, user, *args, **kwds):
+ if self.can_update(user):
+ super(ServiceClass, self).save(*args, **kwds)
diff --git a/planetstack/core/models/site.py b/planetstack/core/models/site.py
index 65d965b..8e77404 100644
--- a/planetstack/core/models/site.py
+++ b/planetstack/core/models/site.py
@@ -27,6 +27,30 @@
def __unicode__(self): return u'%s' % (self.name)
+ def can_update(self, user):
+ if user.is_admin:
+ return True
+ site_privs = SitePrivilege.objects.filter(user=user, site=self)
+ for site_priv in site_privs:
+ if site_priv.role.role_type == 'pi':
+ return True
+ return False
+
+ def save_by_user(self, user, *args, **kwds):
+ if self.can_update(user):
+ super(Site, self).save(*args, **kwds)
+
+ @staticmethod
+ def select_by_user(user):
+ if user.is_admin:
+ qs = Site.objects.all()
+ else:
+ site_ids = [sp.site.id for sp in SitePrivilege.objects.filter(user=user)]
+ site_ids.append(user.site.id)
+ qs = Site.objects.filter(id__in=site_ids)
+ return qs
+
+
class SiteRole(PlCoreBase):
ROLE_CHOICES = (('admin','Admin'),('pi','PI'),('tech','Tech'),('billing','Billing'))
@@ -48,6 +72,28 @@
def delete(self, *args, **kwds):
super(SitePrivilege, self).delete(*args, **kwds)
+ def can_update(self, user):
+ if user.is_admin:
+ return True
+ site_privs = SitePrivilege.objects.filter(user=user, site=self)
+ for site_priv in site_privs:
+ if site_priv.role.role_type == 'pi':
+ return True
+ return False
+
+ def save_by_user(self, user, *args, **kwds):
+ if self.can_update(user):
+ super(SitePrivilege, self).save(*args, **kwds)
+
+ @staticmethod
+ def select_by_user(user):
+ if user.is_admin:
+ qs = SitePrivilege.objects.all()
+ else:
+ sp_ids = [sp.id for sp in SitePrivilege.objects.filter(user=user)]
+ qs = SitePrivilege.objects.filter(id__in=sp_ids)
+ return qs
+
class Deployment(PlCoreBase):
name = models.CharField(max_length=200, unique=True, help_text="Name of the Deployment")
#sites = models.ManyToManyField('Site', through='SiteDeployments', blank=True)
@@ -70,6 +116,30 @@
def __unicode__(self): return u'%s %s %s' % (self.deployment, self.user, self.role)
+ def can_update(self, user):
+ if user.is_readonly:
+ return False
+ if user.is_admin:
+ return True
+ dprivs = DeploymentPrivilege.objects.filter(user=user)
+ for dpriv in dprivs:
+ if dpriv.role.role_type == 'admin':
+ return True
+ return False
+
+ def save_by_user(self, user, *args, **kwds):
+ if self.can_update(user):
+ super(DeploymentPrivilege, self).save(*args, **kwds)
+
+ @staticmethod
+ def select_by_user(user):
+ if user.is_admin:
+ qs = DeploymentPrivilege.objects.all()
+ else:
+ dpriv_ids = [dp.id for dp in DeploymentPrivilege.objects.filter(user=user)]
+ qs = DeploymentPrivilege.objects.filter(id__in=dpriv_ids)
+ return qs
+
class SiteDeployments(PlCoreBase):
site = models.ForeignKey(Site)
deployment = models.ForeignKey(Deployment)
diff --git a/planetstack/core/models/slice.py b/planetstack/core/models/slice.py
index 1fa342a..533165f 100644
--- a/planetstack/core/models/slice.py
+++ b/planetstack/core/models/slice.py
@@ -42,6 +42,31 @@
self.creator = self.caller
super(Slice, self).save(*args, **kwds)
+ def can_update(self, user):
+ if user.is_readonly:
+ return False
+ if user.is_admin:
+ return True
+ slice_privs = SlicePrivilege.objects.filter(user=user, slice=self)
+ for slice_priv in slice_privs:
+ if slice_priv.role.role_type == 'admin':
+ return True
+ return False
+
+ def save_by_user(self, user, *args, **kwds):
+ if self.can_update(user):
+ super(Slice, self).save(*args, **kwds)
+
+
+ @staticmethod
+ def select_by_user(user):
+ if user.is_admin:
+ qs = Slice.objects.all()
+ else:
+ slice_ids = [sp.slice.id for sp in SlicePrivilege.objects.filter(user=user)]
+ qs = Slice.objects.filter(id__in=slice_ids)
+ return qs
+
class SliceRole(PlCoreBase):
ROLE_CHOICES = (('admin','Admin'),('default','Default'))
@@ -55,3 +80,25 @@
role = models.ForeignKey('SliceRole')
def __unicode__(self): return u'%s %s %s' % (self.slice, self.user, self.role)
+
+ def can_update(self, user):
+ if user.is_admin:
+ return True
+ slice_privs = SlicePrivilege.objects.filter(user=user, slice=self)
+ for slice_priv in slice_privs:
+ if slice_priv.role.role_type == 'admin':
+ return True
+ return False
+
+ def save_by_user(self, user, *args, **kwds):
+ if self.can_update(user):
+ super(SlicePrivilege, self).save(*args, **kwds)
+
+ @staticmethod
+ def select_by_user(user):
+ if user.is_admin:
+ qs = SlicePrivilege.objects.all()
+ else:
+ sp_ids = [sp.id for sp in SlicePrivilege.objects.filter(user=user)]
+ qs = SlicePrivilege.objects.filter(id__in=sp_ids)
+ return qs
diff --git a/planetstack/core/models/slicetag.py b/planetstack/core/models/slicetag.py
index 76cc669..e815721 100644
--- a/planetstack/core/models/slicetag.py
+++ b/planetstack/core/models/slicetag.py
@@ -10,5 +10,18 @@
name = models.CharField(help_text="The name of this tag", max_length=30, choices=NAME_CHOICES)
value = models.CharField(help_text="The value of this tag", max_length=1024)
+ def can_update(self, user):
+ return self.slice.can_update(user)
+ def save_by_user(self, user, *args, **kwds):
+ if self.can_update(user):
+ super(SliceTag, self).save(*args, **kwds)
+ @staticmethod
+ def select_by_user(user):
+ if user.is_admin:
+ qs = SliceTag.objects.all()
+ else:
+ st_ids = [st.id for st in SliceTag.objects.filter(user=user)]
+ qs = SliceTag.objects.filter(id__in=st_ids)
+ return qs
diff --git a/planetstack/core/models/sliver.py b/planetstack/core/models/sliver.py
index 9c00cee..1c4a134 100644
--- a/planetstack/core/models/sliver.py
+++ b/planetstack/core/models/sliver.py
@@ -43,3 +43,19 @@
if not self.creator and hasattr(self, 'caller'):
self.creator = self.caller
super(Sliver, self).save(*args, **kwds)
+
+ def can_update(self, user):
+ return self.slice.can_update(user)
+
+ def save_by_user(self, user, *args, **kwds):
+ if self.slice.can_update(user):
+ super(Sliver, self).save(*args, **kwds)
+
+ @staticmethod
+ def select_by_user(user):
+ if user.is_admin:
+ qs = Sliver.objects.all()
+ else:
+ slice_ids = [s.id for s in Slice.select_by_user(user)]
+ qs = Sliver.objects.filter(id__in=slice_ids)
+ return qs
diff --git a/planetstack/core/models/tag.py b/planetstack/core/models/tag.py
index cbe63a5..ef746da 100644
--- a/planetstack/core/models/tag.py
+++ b/planetstack/core/models/tag.py
@@ -22,3 +22,16 @@
def __unicode__(self):
return self.name
+
+ def can_update(self, user):
+ if user.is_admin:
+ return True
+ return False
+
+ def save_by_user(self, user, *args, **kwds):
+ if self.can_update(user):
+ super(Tag, self).save(*args, **kwds)
+
+ @staticmethod
+ def select_by_user(user):
+ return Tag.objects.all()
diff --git a/planetstack/core/models/user.py b/planetstack/core/models/user.py
index a3b82d8..1afb5fc 100644
--- a/planetstack/core/models/user.py
+++ b/planetstack/core/models/user.py
@@ -2,6 +2,7 @@
import datetime
from collections import defaultdict
from django.db import models
+from django.db.models import F, Q
from core.models import PlCoreBase,Site
from django.contrib.auth.models import AbstractBaseUser, BaseUserManager
from timezones.fields import TimeZoneField
@@ -130,4 +131,22 @@
if not self.id:
self.set_password(self.password)
self.username = self.email
- super(User, self).save(*args, **kwds)
+ super(User, self).save(*args, **kwds)
+
+ @staticmethod
+ def select_by_user(user):
+ if user.is_admin:
+ qs = User.objects.all()
+ else:
+ # can see all users at any site where this user has pi role
+ from core.models.site import SitePrivilege
+ site_privs = SitePrivilege.objects.filter(user=user)
+ sites = [sp.site for sp in site_privs if sp.role.role == 'pi']
+ # get site privs of users at these sites
+ site_privs = SitePrivilege.objects.filter(site__in=sites)
+ user_ids = [sp.user.id for sp in site_privs] + [user.id]
+ qs = User.objects.filter(Q(site__in=sites) | Q(id__in=user_ids))
+ return qs
+
+
+