
from oslo_policy import policy

from nova.policies import base


BASE_POLICY_NAME = 'os_compute_api:os-server-password'


server_password_policies = [
    policy.DocumentedRuleDefault(
        BASE_POLICY_NAME,
        base.RULE_ADMIN_OR_OWNER,
        "Show and clear the encrypted administrative password of a server",
        [
            {
                'method': 'GET',
                'path': '/servers/{server_id}/os-server-password'
            },
            {
                'method': 'DELETE',
                'path': '/servers/{server_id}/os-server-password'
            }
        ]),
]


def list_rules():
    return server_password_policies


from oslo_policy import policy

from nova.policies import base


BASE_POLICY_NAME = 'os_compute_api:os-server-password'


server_password_policies = [
    policy.DocumentedRuleDefault(
        name=BASE_POLICY_NAME,
        check_str=base.RULE_ADMIN_OR_OWNER,
        description="Show and clear the encrypted administrative "
        "password of a server",
        operations=[
            {
                'method': 'GET',
                'path': '/servers/{server_id}/os-server-password'
            },
            {
                'method': 'DELETE',
                'path': '/servers/{server_id}/os-server-password'
            }
        ],
        scope_types=['system', 'project']),
]


def list_rules():
    return server_password_policies

Introduce scope_types in server password policy
Introduce scope_types in server password policy

oslo.policy introduced the scope_type feature which can
control the access level at system-level and project-level.
 - https://docs.openstack.org/oslo.policy/latest/user/usage.html#setting-scope
 - http://specs.openstack.org/openstack/keystone-specs/specs/keystone/queens/system-scope.html

Appropriate scope_type for nova case:
- https://specs.openstack.org/openstack/nova-specs/specs/ussuri/approved/policy-defaults-refresh.html#scope

This commit introduce scope_type for server password API policies
as ['system', 'project'].

Also adds the test case with scope_type enabled and verify we
pass and fail the policy check with expected context.

Partial implement blueprint policy-defaults-refresh

Change-Id: I8f5e66810c68a871e57a5362a931545bccded608

  
  from oslo_policy import policy
  
  from nova.policies import base
  
  
  BASE_POLICY_NAME = 'os_compute_api:os-server-password'
  
  
  server_password_policies = [
      policy.DocumentedRuleDefault(
-         BASE_POLICY_NAME,
+         name=BASE_POLICY_NAME,
-         base.RULE_ADMIN_OR_OWNER,
+         check_str=base.RULE_ADMIN_OR_OWNER,
-         "Show and clear the encrypted administrative password of a server",
+         description="Show and clear the encrypted administrative "
-         [
+         "password of a server",
+         operations=[
              {
                  'method': 'GET',
                  'path': '/servers/{server_id}/os-server-password'
              },
              {
                  'method': 'DELETE',
                  'path': '/servers/{server_id}/os-server-password'
              }
-         ]),
+         ],
+         scope_types=['system', 'project']),
  ]
  
  
  def list_rules():
      return server_password_policies
  
Introduce scope_types in server password policy
## Code Before:

from oslo_policy import policy

from nova.policies import base


BASE_POLICY_NAME = 'os_compute_api:os-server-password'


server_password_policies = [
    policy.DocumentedRuleDefault(
        BASE_POLICY_NAME,
        base.RULE_ADMIN_OR_OWNER,
        "Show and clear the encrypted administrative password of a server",
        [
            {
                'method': 'GET',
                'path': '/servers/{server_id}/os-server-password'
            },
            {
                'method': 'DELETE',
                'path': '/servers/{server_id}/os-server-password'
            }
        ]),
]


def list_rules():
    return server_password_policies

## Instruction:
Introduce scope_types in server password policy
## Code After:

from oslo_policy import policy

from nova.policies import base


BASE_POLICY_NAME = 'os_compute_api:os-server-password'


server_password_policies = [
    policy.DocumentedRuleDefault(
        name=BASE_POLICY_NAME,
        check_str=base.RULE_ADMIN_OR_OWNER,
        description="Show and clear the encrypted administrative "
        "password of a server",
        operations=[
            {
                'method': 'GET',
                'path': '/servers/{server_id}/os-server-password'
            },
            {
                'method': 'DELETE',
                'path': '/servers/{server_id}/os-server-password'
            }
        ],
        scope_types=['system', 'project']),
]


def list_rules():
    return server_password_policies
