glance.api.v2.policy module¶
-
class
glance.api.v2.policy.
APIPolicyBase
(context, target=None, enforcer=None)[source]¶ Bases:
object
-
check
(name, *args)[source]¶ Perform a soft check of a named policy.
This is used when you need to check if a policy is allowed for the given resource, without needing to catch an exception. If the policy check requires args, those are accepted here as well.
- Parameters
name – Policy name to check
- Returns
bool indicating if the policy is allowed.
-
-
class
glance.api.v2.policy.
ImageAPIPolicy
(context, image, enforcer=None)[source]¶ Bases:
glance.api.v2.policy.APIPolicyBase
-
check
(name, *args)[source]¶ Perform a soft check of a named policy.
This is used when you need to check if a policy is allowed for the given resource, without needing to catch an exception. If the policy check requires args, those are accepted here as well.
- Parameters
name – Policy name to check
- Returns
bool indicating if the policy is allowed.
-
property
is_created
¶ Signal whether the image actually exists or not.
False if the image is only being proposed by a create operation, True if it has already been created.
-
-
class
glance.api.v2.policy.
MetadefAPIPolicy
(context, md_resource=None, target=None, enforcer=None)[source]¶ Bases:
glance.api.v2.policy.APIPolicyBase
-
check
(name, *args)[source]¶ Perform a soft check of a named policy.
This is used when you need to check if a policy is allowed for the given resource, without needing to catch an exception. If the policy check requires args, those are accepted here as well.
- Parameters
name – Policy name to check
- Returns
bool indicating if the policy is allowed.
-
-
glance.api.v2.policy.
check_admin_or_same_owner
(context, properties)[source]¶ Check that legacy behavior on create with owner is preserved.
Legacy behavior requires a static check that owner is not inconsistent with the context, unless the caller is an admin. Enforce that here, if needed.
- Parameters
context – A RequestContext
properties – The properties being used to create the image, which may contain an owner
- Raises
exception.Forbidden if the context is not an admin and owner is set to something other than the context’s project
-
glance.api.v2.policy.
check_is_image_mutable
(context, image)[source]¶ Replicate the DB-layer admin-or-owner check for the API.
Much of the API code depends on hard-coded admin-or-owner enforcement in the DB or authorization layer, as the policy layer is largely a no-op by default. During blueprint policy-refactor, we are trying to remove as much of that as possible, but in certain places we need to do that (if secure_rbac is not enabled). This transitional helper provides a way to do that enforcement where necessary.
- Parameters
context – A RequestContext
image – An ImageProxy
- Raises
exception.Forbidden if the context is not the owner or an admin