
from oslo_policy import policy

from neutron.conf.policies import base


rules = [
    policy.DocumentedRuleDefault(
        'get_service_provider',
        base.RULE_ANY,
        'Get service providers',
        [
            {
                'method': 'GET',
                'path': '/service-providers',
            },
        ]
    ),
]


def list_rules():
    return rules


from oslo_log import versionutils
from oslo_policy import policy

from neutron.conf.policies import base


DEPRECATION_REASON = (
    "The Service Providers API now supports system scope and default roles.")

rules = [
    policy.DocumentedRuleDefault(
        name='get_service_provider',
        check_str=base.SYSTEM_OR_PROJECT_READER,
        description='Get service providers',
        operations=[
            {
                'method': 'GET',
                'path': '/service-providers',
            },
        ],
        scope_types=['system', 'project'],
        deprecated_rule=policy.DeprecatedRule(
            name='get_service_provider',
            check_str=base.RULE_ANY),
        deprecated_reason=DEPRECATION_REASON,
        deprecated_since=versionutils.deprecated.WALLABY
    ),
]


def list_rules():
    return rules

Implement secure RBAC for service providers API
Implement secure RBAC for service providers API

This commit updates the policies for service providers API
to understand scope checking and account for a read-only role.

This is part of a broader series of changes across OpenStack to
provide a consistent RBAC experience and improve security.

Partially-Implements blueprint: secure-rbac-roles

Change-Id: I76af24a5153f1bc38b630da42de07f0f7b40cc41

  
+ from oslo_log import versionutils
  from oslo_policy import policy
  
  from neutron.conf.policies import base
  
  
+ DEPRECATION_REASON = (
+     "The Service Providers API now supports system scope and default roles.")
+ 
  rules = [
      policy.DocumentedRuleDefault(
-         'get_service_provider',
+         name='get_service_provider',
-         base.RULE_ANY,
+         check_str=base.SYSTEM_OR_PROJECT_READER,
-         'Get service providers',
+         description='Get service providers',
-         [
+         operations=[
              {
                  'method': 'GET',
                  'path': '/service-providers',
              },
-         ]
+         ],
+         scope_types=['system', 'project'],
+         deprecated_rule=policy.DeprecatedRule(
+             name='get_service_provider',
+             check_str=base.RULE_ANY),
+         deprecated_reason=DEPRECATION_REASON,
+         deprecated_since=versionutils.deprecated.WALLABY
      ),
  ]
  
  
  def list_rules():
      return rules
  
Implement secure RBAC for service providers API
## Code Before:

from oslo_policy import policy

from neutron.conf.policies import base


rules = [
    policy.DocumentedRuleDefault(
        'get_service_provider',
        base.RULE_ANY,
        'Get service providers',
        [
            {
                'method': 'GET',
                'path': '/service-providers',
            },
        ]
    ),
]


def list_rules():
    return rules

## Instruction:
Implement secure RBAC for service providers API
## Code After:

from oslo_log import versionutils
from oslo_policy import policy

from neutron.conf.policies import base


DEPRECATION_REASON = (
    "The Service Providers API now supports system scope and default roles.")

rules = [
    policy.DocumentedRuleDefault(
        name='get_service_provider',
        check_str=base.SYSTEM_OR_PROJECT_READER,
        description='Get service providers',
        operations=[
            {
                'method': 'GET',
                'path': '/service-providers',
            },
        ],
        scope_types=['system', 'project'],
        deprecated_rule=policy.DeprecatedRule(
            name='get_service_provider',
            check_str=base.RULE_ANY),
        deprecated_reason=DEPRECATION_REASON,
        deprecated_since=versionutils.deprecated.WALLABY
    ),
]


def list_rules():
    return rules
